01-Implementing Active Directory Domain Services

Bạn đang xem bản rút gọn của tài liệu. Xem và tải ngay bản đầy đủ của tài liệu tại đây (867.27 KB, 32 trang )

(1)<div class='page_container' data-page=1>

Module 1:

Implementing Active

Domain

</div>
(2)<div class='page_container' data-page=2>

Module Overview

•

Installing Active Directory Domain Services

•

Deploying Read-Only Domain Controllers

</div>
(3)<div class='page_container' data-page=3>

Lesson 1: Installing Active Directory

Domain Services

•

Requirements for Installing AD DS

•

What Are Domain and Forest Functional Levels?

•

AD DS Installation Process

•

Advanced Options for Installing AD DS

•

Installing AD DS from Media

•

Demonstration: Verifying the AD DS installation

•

Upgrading to Windows Server 2008 AD DS

•

Installing AD DS on a Server Core Computer

</div>
(4)<div class='page_container' data-page=4>

Requirements for Installing AD DS

• Local Administrator permissions to install the first
domain controller in a forest

• Domain Administrator permissions to install
additional domain controllers in a domain

• Enterprise Administrator permissions to install
additional domains in a forest

Administrator 
permissions

• TCP/IP must be configured, including DNS
client settings

• DNS Server that supports dynamic updates must
be available or will be configured on the domain
controller

Network

configuration

• A computer running Windows Server 2008

• Minimum disk space of 250 MB and a partition
formatted with NTFS file system

Server

</div>
(5)<div class='page_container' data-page=5>

What Are Domain and Forest Functional Levels?

Functional levels:

• Determine the AD DS features available in a domain or forest

• Restrict which Windows Server operating systems can be
 run on domain controllers in the domain or forest

Supported Domain Controller 
Operating Systems
Windows 2000
Windows 2000 
native 
Windows
Server 2003
Windows Server
2003 
Windows Server
2008
Windows Server 
2008

Forests

Domain

• Windows Server 2008

• Windows Server 2003

• Windows 2000

• Windows Server 2008

• Windows Server 2003

• Windows Server 2008

</div>
(6)<div class='page_container' data-page=6>

AD DS Installation Process

Install the Active Directory Domain Services role 
 using the Server Manager

1

Choose the deployment configuration

3

Select the additional domain controller features

4

Run the Active Directory Domain Services 
 Installation Wizard

2

Select the location for the database, log files, and 
 SYSVOl folder

5

Configure the Directory Services Restore 
 Mode Administrator Password

6

</div>
(7)<div class='page_container' data-page=7>

Advanced Options for Installing AD DS

Use the advanced mode options to:

• Create a new domain tree

• Use backup media as the source for AD DS information

To access the advanced mode installation options,

choose the Advanced Mode option in the installation wizard or run 
DCPromo /adv

To access the advanced mode installation options,

choose the Advanced Mode option in the installation wizard or run 
DCPromo /adv

• Select the source domain controller for the installation

• Modify the default domain NetBIOS name

</div>
(8)<div class='page_container' data-page=8>

Installing AD DS from Media

Use Ntdsutil.exe to create the installation media

Ntdsutil.exe can create the following types of installation media:

• Full (or writable) domain controller

• Full (or writable) domain controller without SYSVOL data

• Read-only domain controller without SYSVOL data

</div>
(9)<div class='page_container' data-page=9>

Demonstration: Verifying the AD DS Installation

</div>
(10)<div class='page_container' data-page=10>

Upgrading to Windows Server 2008 AD DS

Before installing

adprep /forestprep

Windows 2000 
Windows 2003
adprep
/domainprep /gpprep
Windows Server
2000 
adprep /domainprep
Windows Server 
2003

Command

Current

Version

• Windows Server 2008
domain controllers

To prepare previous versions of Active Directory for a Windows 
Server 2008 domain controller installation:

adprep /rodcprep

Windows Server 
2003

</div>
(11)<div class='page_container' data-page=11>

Installing AD DS on a Server Core Computer

To install AD DS on a Server Core computer, perform an

unattended installation using an answer file

Use following syntax with the Dcpromo command:

Dcpromo /answer[:filename]

Where filename is the name of your answer

Use following syntax with the Dcpromo command:

Dcpromo /answer[:filename]

</div>
(12)<div class='page_container' data-page=12>

Discussion: Common Configuration for AD DS

•

What additional steps would you take in your environment

after installing the first Windows Server 2008 domain

controller?

•

How would these tasks change after you have deployed

additional domain controllers in your domain?

</div>
(13)<div class='page_container' data-page=13>

Lesson 2: Deploying Read-Only

Domain Controllers

•

What Is a Read-Only Domain Controller?

•

Read-Only Domain Controller Features

•

Preparing to Install the RODC

•

Installing the RODC

•

Delegating the RODC Installation

•

What Are Password Replication Policies?

</div>
(14)<div class='page_container' data-page=14>

What Is a Read-Only Domain Controller?

RODCs host read-only partitions of the

Active Directory database, only accept
replicated changes to Active Directory,
and never initiate replication

RODCs host read-only partitions of the
Active Directory database, only accept
replicated changes to Active Directory,
and never initiate replication

RODCs:

• Cannot hold operation master roles or be configured as

replication bridgehead servers

• Can be deployed on servers running Windows Server 2008

Server core for additional security

RODCs provide:

• Additional security for branch office with

limited physical security

• Additional security if applications must run on a

domain controller

</div>
(15)<div class='page_container' data-page=15>

Read-Only Domain Controller Features

RODCs provide:

• Unidirectional replication

• Credential caching

• Administrative role separation

• Read-only DNS

</div>
(16)<div class='page_container' data-page=16>

Preparing to Install the RODC

Before installing an RODC:

• Ensure that the domain and forest is at a Windows Server 
 2003 functional level

• Ensure a writeable domain controller running 
 Windows Server 2008 is available to replicate 
 the domain partition

• Run ADPrep /rodcprep to enable the RODC to replicate 
 DNS partitions

</div>
(17)<div class='page_container' data-page=17>

Installing the RODC

Choose the option to install an additional domain controller 
 in an existing domain

1

Choose advanced mode installation if you want to 
 configure the password replication policy

3

Select the option to install an RODC in the Active Directory 
 Domain Services Installation wizard

2

To install an RODC on a Server Core installation, use an 
 unattended installation file with the

</div>
(18)<div class='page_container' data-page=18>

Delegating the RODC Installation

To delegate the installation of a RODC:

• Pre-create the RODC computer account in the 
 Domain Controllers container

• Assign a user or group with permission to install the RODC

</div>
(19)<div class='page_container' data-page=19>

What Are Password Replication Policies?

• The password replication policy determines how the

RODC performs credential caching for authenticated user

• By default, the RODC does not cache any user credentials 
 or computer credentials

• No credentials cached

• Enable credential caching on an RODC for specified accounts 
Options for configuring password replication policies:

</div>
(20)<div class='page_container' data-page=20>

Demonstration: Configuring Administrator Role

Separation and Password Replication Policies

In this demonstration, you will see how to:

•

Configure administrator role separation

•

Configure the RODC password replication groups

•

Track which users log on to a RODC

</div>
(21)<div class='page_container' data-page=21>

Lesson 3: Configuring AD DS Domain

Controller Roles

•

What Are Global Catalog Servers?

•

Modifying the Global Catalog

•

Demonstration: Configuring Global Catalog Servers

•

What Are Operations Master Roles?

•

Demonstration: Managing Operation Master Roles

</div>
(22)<div class='page_container' data-page=22></div>
(23)<div class='page_container' data-page=23>

Modifying the Global Catalog

firstName
lastName

email address
accountExpires
distinguishedName
firstName
lastName
email address
accountExpires
distinguishedName
Common 
Attributes
Common 
Attributes
Global Catalog 
Server
Global Catalog 
Server
Create 
additional
attributes
Create 
additional
attributes

Add only the additional attributes that you 
query or refer to frequently

</div>
(24)<div class='page_container' data-page=24>

Demonstration: Configuring Global

Catalog Servers

In this demonstration, you will see how to:

•

Configure global catalog servers using Active Directory

Sites and Services

•

Configure a domain controller on Server Core as a global

catalog server

</div>
(25)<div class='page_container' data-page=25>

What Are Operations Master Roles?

Role Description

Schema Master • One per forest

• Performs all updates to the Active Directory schema
Domain

Naming Master

• One per forest

• Manages adding and removing all domains and
directory partitions

RID Master

• One per domain

• Allocates blocks of RIDs to each domain controller in
the domain

PDC Emulator

• One per domain

• Minimizes replication latency for password changes

• Synchronizes time on all domain controllers in the domain
Infrastructure

Master

• One per domain

</div>
(26)<div class='page_container' data-page=26>

Demonstration: Managing Operations

Master Roles

In this demonstration, you will see how to:

•

Determine which server holds an operations master role

•

Move an operations master role

</div>
(27)<div class='page_container' data-page=27>

How Windows Time Service Works

Time synchronization is important because:

• Kerberos authentication includes a time stamp

• Replication between domain controllers is time stamped
 Windows Time service (W32Time)

provides network clock

synchronization for domain

controllers and client computers

Domain controllers
Domain controllers
PDC Emulator
PDC Emulator
Client 
computers
Client 
computers
 In a Windows Server 2008 forest,

</div>
(28)<div class='page_container' data-page=28>

Lab: Implementing Read-Only

Domain Controllers

•

Exercise 1: Evaluating Forest and Server Readiness for

Installing an RODC

•

Exercise 2: Installing and Configuring an RODC

•

Exercise 3: Configuring AD DS Domain Controller Roles

Logon information

Virtual machine

6425A-NYC-DC1,

NYC-SVR1,

6425A-NYC-DC2

User name

Administrator

Password

Pa$$w0rd

</div>
(29)<div class='page_container' data-page=29>

Lab Review

•

Why did Axel’s account not have permission to create any

objects in AD DS?

•

What were the two connection objects that were created

from NYC-DC1 to TOR-DC1? Why was no connection

object created from TOR-DC1 to NYC-DC1?

•

Could you have assigned the Domain Naming Master role

to TOR-DC1?

</div>
(30)<div class='page_container' data-page=30>

Module Review and Takeaways

•

Review questions

</div>
(31)<div class='page_container' data-page=31>

Beta Feedback Tool

•

Beta feedback tool helps:

 Collect student roster information, module feedback, and

course evaluations.

 Identify and sort the changes that students request, thereby

facilitating a quick team triage.

 Save data to a database in SQL Server that you can later

query.

</div>
(32)<div class='page_container' data-page=32>

Beta Feedback

•

Overall flow of module:

 Which topics did you think flowed smoothly, from topic to

topic?

 Was something taught out of order?

•

Pacing:

 Were you able to keep up? Are there any places where the

pace felt too slow?

 Were you able to process what the instructor said before

moving on to next topic?

 Did you have ample time to reflect on what you learned? Did

you have time to formulate and ask questions?

•

Learner activities:

 Which demos helped you learn the most? Why do you think

that is?

 Did the lab help you synthesize the content in the module?

Did it help you to understand how you can use this
knowledge in your work environment?

 Were there any discussion questions or reflection questions

</div>

01-Implementing Active Directory Domain Services

Module 1:

Implementing Active

Directory

Domain

Module Overview

Installing Active Directory Domain Services

Deploying Read-Only Domain Controllers

Lesson 1: Installing Active Directory

Domain Services

Requirements for Installing AD DS

What Are Domain and Forest Functional Levels?

AD DS Installation Process

Advanced Options for Installing AD DS

Installing AD DS from Media

Demonstration: Verifying the AD DS installation

Upgrading to Windows Server 2008 AD DS

Installing AD DS on a Server Core Computer

Requirements for Installing AD DS

What Are Domain and Forest Functional Levels?

<b>Forests</b>

AD DS Installation Process

<b>1</b>

<b>1</b>

<b>3</b>

<b>3</b>

<b>4</b>

<b>4</b>

<b>2</b>

<b>2</b>

<b>5</b>

<b>5</b>

<b>6</b>

Advanced Options for Installing AD DS

Installing AD DS from Media

Demonstration: Verifying the AD DS Installation

Upgrading to Windows Server 2008 AD DS

<b>Before installing</b>

<b>Command</b>

<b>Current </b>

<b>Version</b>

Installing AD DS on a Server Core Computer

<b>To install AD DS on a Server Core computer, perform an </b>

<b>unattended installation using an answer file</b>

Discussion: Common Configuration for AD DS

What additional steps would you take in your environment

after installing the first Windows Server 2008 domain

controller?

How would these tasks change after you have deployed

additional domain controllers in your domain?

Lesson 2: Deploying Read-Only

Domain Controllers

What Is a Read-Only Domain Controller?

Read-Only Domain Controller Features

Preparing to Install the RODC

Installing the RODC

Delegating the RODC Installation

What Are Password Replication Policies?

What Is a Read-Only Domain Controller?

Read-Only Domain Controller Features

Preparing to Install the RODC

Installing the RODC

<b>1</b>

<b>1</b>

<b>3</b>

<b>3</b>

<b>2</b>

<b>2</b>

Delegating the RODC Installation

What Are Password Replication Policies?

Demonstration: Configuring Administrator Role

Separation and Password Replication Policies

In this demonstration, you will see how to:

Configure administrator role separation

Configure the RODC password replication groups

Track which users log on to a RODC

Lesson 3: Configuring AD DS Domain

Controller Roles

What Are Global Catalog Servers?

Modifying the Global Catalog