|
Forests, trees, and domains
The AD framework that holds the objects can be viewed at a number
of levels. At the top of the structure is the forest. The forest is a
collection of every object, its attributes, and rules (attribute syntax) in the
AD. The forest, tree, and domain are the logical parts in an AD network.
The AD forest contains one or more transitive, trust-linked
trees. A tree is a collection of one or more domains and domain trees, again
linked in a transitive trust hierarchy. Domains are identified by their DNS name
structure, the namespace.
The objects held within a domain can be grouped into containers
called Organizational Units (OUs). OUs give a domain a hierarchy, ease its
administration, and can give a semblance of the structure of the AD's company in
organizational or geographical terms. OUs can contain OUs - indeed, domains are
containers in this sense - and can hold multiple nested OUs. Microsoft
recommends as few domains as possible in AD and a reliance on OUs to produce
structure and improve the implementation of policies and administration. The OU
is the common level at which to apply group policies, which are AD objects
themselves called Group Policy Objects (GPOs), although policies can also be
applied to domains or sites (see below). The OU is the level at which
administrative powers are commonly delegated, but granular delegation can be
performed on individual objects or attributes as well.
AD also supports the creation of Sites, which are physical, rather
than logical, groupings defined by one or more IP subnets. Sites distinguish
between locations connected by low-speed (e.g., WAN, VPN) and high-speed (e.g.,
LAN) connections. Sites are independent of the domain and OU structure and are
common across the entire forest. Sites are used to control network traffic
generated by replication and also to refer clients to the nearest domain
controllers. Exchange 2007 also uses the site topology for mail routing.
Policies can also be applied at the site level.
The actual division of the company's information infrastructure
into a hierarchy of one or more domains and top-level OUs is a key decision.
Common models are by business unit, by geographical location, by IT Service, or
by object type. These models are also often used in combination. OUs should be
structured primarily to facilitate administrative delegation, and secondarily,
to facilitate group policy application. Although OUs form an administrative
boundary, the only true security boundary is the forest itself and an
administrator of any domain in the forest must be trusted across all domains in
the forest.
Physically the Active Directory information is held on one or more
equal peer domain controllers (DCs), replacing the NT PDC/BDC model. Each DC has
a copy of the AD; changes on one computer being synchronized (converged) between
all the DC computers by multi-master replication. Servers joined in to AD, which
are not domain controllers, are called Member Servers. The AD database is split
into different stores or partitions. Microsoft often refers to these
partitions as 'naming contexts'. The 'Schema' partition contains the definition
of object classes and attributes within the Forest. The 'Configuration'
partition, contains information on the physical structure and configuration of
the forest (such as the site topology). The 'Domain' partition holds all objects
created in that domain. The first two partitions replicate to all domain
controllers in the Forest. The Domain partition replicates only to Domain
Controllers within its domain. A subset of objects in the domain partition are
also replicated to domain controllers that are configured as global catalogs.
Unlike earlier versions of Windows which used NetBIOS to
communicate, Active Directory is fully integrated with DNS and TCP/IP — indeed
DNS is required. To be fully functional, the DNS server must support SRV
resource records or service records.
AD replication is 'pull' rather than 'push'. The Knowledge
Consistency Checker (KCC) creates a replication topology of site links
using the defined sites to manage traffic. Intrasite replication is
frequent and automatic as a result of change notification, which triggers peers
to begin a pull replication cycle. Intersite replication intervals are less
frequent and do not use change notification by default, although this is
configurable and can be made identical to intrasite replication. A different
'cost' can be given to each link (e.g., DS3, T1, ISDN etc.) and the site link
topology will be altered accordingly by the KCC. Replication between domain
controllers may occur transitively through several site links on same-protocol
site link bridges, if the 'cost' is low, although KCC automatically costs
a direct site-to-site link lower than transitive connections. Site-to-site
replication can be configured to occur between a bridgehead server in
each site, which then replicates the changes to other DCs within the site.
In a multi-domain forest the AD database becomes partitioned. That
is, each domain maintains a list of only those objects that belong in that
domain. So, for example, a user created in Domain A would be listed only in
Domain A's domain controllers. Global catalog (GC) servers are used to provide a
global listing of all objects in the Forest. The Global catalog is held on
domain controllers configured as global catalog servers. Global Catalog servers
replicate to themselves all objects from all domains and hence, provide a global
listing of objects in the forest. However, in order to minimize replication
traffic and to keep the GC's database small, only selected attributes of each
object are replicated. This is called the partial attribute set (PAS). The PAS
can be modified by modifying the schema and marking attributes for replication
to the GC.
Replication of Active Directory uses Remote Procedure Calls (RPC
over IP [RPC/IP]). Between Sites you can also choose to use SMTP for
replication, but only for changes in the Schema or Configuration. SMTP cannot be
used for replicating the Domain partition. In other words, if a domain exists on
both sides of a WAN connection, you must use RPCs for replication.
The AD
database, the directory store, in Windows 2000 uses the JET Blue-based
Extensible Storage Engine (ESE98), limited to 16 terabytes and 1 billion objects
in each domain controller's database. Microsoft has created NTDS databases with
more than 2 billion objects. (NT4's Security Account Manager could support no
more than 40,000 objects). Called NTDS.DIT, it has two main tables: the data
table and the link table. In Windows 2003 a third main table was added for
security descriptor single instancing.
Active Directory is a necessary component for many Windows
services in an organization such as Exchange.
References:
http://en.wikipedia.org/wiki/Active_Directory
|