Our Win 2 K Ad Domain Name example essay topic

Instructions Answer the following questions: 1. Can a non Microsoft Windows DNS service be used for the successful implementation of Active Directory Services? If so distinguish between the minimum and recommended requirements of the DNS service for an Active Directory implementation. There are some key differences between Windows DNS Services servers and non-Windows DNS server appliances in the areas of AD integration and security. For example, some non-Windows DNS server appliances lack complete AD integration features.

Conversely, Windows DNS Service servers don't support encrypted zone transfer and update features like some non-Windows DNS server appliances do. (ref: DNS server appliances) One cant use any DNS service. Active Directory requires that the DNS support dynamic updates via RFC 2136; Windows 2000 has the advantage of being the only one that does it out of the box Those environments that already have Internet domains and DNS servers on their networks have two options. Either replace their existing DNS servers with Windows 2000 boxes or create a new internal domain to host the AD. For example, if your company is called Widget Co, and all your internal servers are TCP / IP hosts on widget co. com, you either need to create a sub-domain called ad. widget co. com or you need to create something like widget co. net, as one of my associates had to do at a large Manhattan-based international law firm.

It's possible to make Unix DNS servers like BIND (Berkeley Internet Name Daemon) support Windows 2000 dynamic DNS, but it's a little tricky. Microsoft Tech Net's white paper on Windows 2000 DNS provides information on getting your non-MS DNS to comply with RFC 2136. Chances are you " ll need to upgrade your Unix server to the latest version of BIND, version 8.2, to make it work. Creating an entirely new domain may be less of a headache. (ref: How Microsoft went wrong with Active Directory) When Microsoft started to talk about AD and AD's DNS integration, the company said AD would operate with any DNS implementation that is compatible with the standards for dynamic DNS.

DNS is a key piece of the AD model. As the development of AD progressed, Microsoft downplayed the support for non-Win 2 K DNS servers. At press time, Microsoft claimed that Win 2 K will be compatible with UNIX's Berkeley Internet Name Domain (BIND) 8.2, but to fully utilize AD's features, you will need to use Win 2 K's DNS. UNIX advocates believe that NT isn't stable enough to provide the 24 X 7 service that DNS services require and that the Microsoft DNS implementations aren't sufficiently compatible with the open-source UNIX standards. Win 2 K and NT advocates believe that Win 2 K is reliable enough for the 24 X 7 service that DNS servers need (in multiple-server installations) and that Win 2 K's DNS implementation is easier to manage and maintain than a UNIX-based DNS.

Win 2 K's position is straightforward: If you want to fully utilize every AD function (e. g., deployment, installation automation), you have to use Win 2 K's DNS services. The trick will be to find a way to let Win 2 K's DNS provide services to Win 2 K and let the UNIX-based DNS retain control over the non-Win 2 K network components. Win 2 K businesses that don't host their DNS services are in more of a bind (no pun intended). DNS server maintenance isn't a trivial matter, and businesses that don't have the expertise in house will need to develop or hire knowledgeable personnel-neither option is cheap. Businesses will also need to add at least two DNS servers (i. e., primary and secondary) to the Win 2 K network. The hardware for these DNS servers is an additional expense, and the Win 2 K hardware requirements are significant.

However, implementing Win 2 K without AD is fairly pointless. A business needs to resolve the domain name and DNS services concerns before it can truly begin to implement Win 2 K. Given the traditional IT approach to an OS roll out, in which the focus is on the OS, you might not have discussed these core concerns. Now might be the time to take a step back from your test configurations and deployment planning to make sure that you " re also addressing the business and infrastructure concerns of a Win 2 K roll out. (ref: Preparing for active directory) Scenario 2 In this scenario, you need to decide how to integrate your existing DNS structure with Win 2 K. Win 2 K implements a DNS-style naming structure based on Lightweight Directory Access Protocol (LDAP) proposals. For example, if our Win 2 K AD domain name is sales. microsoft. com, an LDAP name can represent it as DC = sales, DC = microsoft, DC = com, O = Internet, where DC stands for a domain component and O stands for an organization. I'd recommend that your Win 2 K architects be well versed in several areas, including AD, Active Directory Service Interfaces (ADSI), LDAP, dynamic DNS, and TCP / IP. In a mixed environment, you might have to decide whether to use a contiguous or disjointed name space for your Win 2 K DNS hierarchy.

In a contiguous name space, the child domains always contain the name of the parent domain in their names. For example, sales. microsoft. com is a contiguous name space where the sales domain is a child of microsoft. com. In a disjointed name space, the child domain doesn't contain the name of the parent domain as part of its domain name. For example, . com could be a child domain of microsoft. com, but it doesn't contain the parent name in its name. Whether you use a contiguous or disjointed name space determines how LDAP search operations execute. One advantage of a contiguous name space is that a domain controller will create referrals to the child domains.

In a disjointed name space, the LDAP searches terminate because the domain controllers don't create any referrals. If you must implement a disjointed DNS name space, there are some workarounds that require a more in-depth knowledge of AD, Schema, and LDAP. To integrate DNS servers with non-Microsoft DNS servers (e. g., UNIX BIND servers), you should consider using only non-Microsoft servers that support dynamic updates and SRV records. BIND 8.1. 2 or later servers support both dynamic updates and SRV records. Dynamic update isn't a requirement, but support for SRV record is a must.

Microsoft recommends that you use BIND 8.2. 1 or later, which supports dynamic updates, SRV records and, unlike BIND 8.1. 2, incremental zone transfers. (For more information, refer to my columns Dynamic DNS Updates in Windows 2000 and Migrating to Windows 2000.) Microsoft recommends that you configure Win 2 K's DNS server as a primary DNS server and non-Microsoft servers as secondary DNS servers in a mixed environment. (ref: DNS migration Issues) You dont have to use Microsoft Windows 2000 or Windows Server 2003 DNS servers, but you must make sure that the DNS servers you use supports service location (SRV) resource records and dynamic updates.

In the event you may use a non microsoft DNS servers make sure that when you create a new site, you use a legal DNS system as your site name. (ref top 10 survival tips) During beta testing of Windows 2000, many enterprises suffered DNS server crashes due to Windows 2000 DNS interoperability problems with their Unix-based DNS servers. Unless the DNS server has been upgraded to at least BIND 8.1. 2, customers may risk crashing their BIND DNS servers if Windows 2000 severs or clients are deployed". Berkeley Internet Name Domain - BIND 8.1. 1 DNS Server implementation supports both SRV RRs and Dynamic Update, but it dumps core [crashes] when Windows 2000-based clients send certain update changes to it. [BIND] 8.1.

2 is the first BIND version that works reliably" - Source: Windows 2000 DNS White Paper, p. 5 Contrary to Microsoft's misleading marketing claims, DNS is integrated with NDS on the Net Ware 5 platform. Although DNS integration is not required for successful NDS deployments, customers can choose to leverage DNS naming with NDS, regardless of the platform supporting DNS. This freedom gives Net Ware customers the flexibility to architect their system using best of breed technologies. Microsoft strongly recommends using their DNS server. Customers who are considering Active Directory but wish to integrate into existing BIND DNS systems must carefully examine the migration costs and risks associated with the BIND update necessary for stable DNS services in a Windows 2000 environment. Microsoft understands that this is a unique problem caused by how Active Directory uses DNS".

If left un managed, the presence of stale RRs in zone data might cause some problems. The following are examples: ... (ref: . pdf) 2. Describe the five operations master roles that can be assigned to Domain Controllers. Describe the scope for each role and provide an example of how each role is used. The operations master roles are sometimes called flexible single master operations (FSMO) roles. schema masterA domain controller that holds the schema operations master role in Active Directory. The schema master performs write operations to the directory schema and replicates updates to all other domain controllers in the forest.

At any time, the schema master role can be assigned to only one domain controller in the forest. domain controller controls all updates and modifications to the schema. To update the schema of a forest, you must have access to the schema master. There can be only one schema master in the entire forest. Domain naming masterA domain controller that holds the domain naming operations master role in Active Directory. The domain naming master controls the addition or removal of domains in the forest. At any time, the domain naming master role can be assigned to only one domain controller in the forest. role co the addition or removal of domains in the forest.

There can be only one domain naming master in the entire forest. e rations master roles are sometimes called flexible single master operations (FSMO) roles. RID master The RID master RID masterA domain controller that holds the RID operations master role in Active Directory. The RID master is assigned to allocate unique sequences of relative IDs to each domain controller in its domain. As the domain controllers use the IDs allocated, they contact the RID master and are allocated additional sequences as needed.

At any time, the RID master role can be assigned to only one domain controller in each domain. allocates sequences of relative IDs (RIDs) relative IDs (RIDs) The part of a security ID (SID) that uniquely identifies an account or group within a domain. to each of the various domain controllers in its domain. At any time, there can be only one domain controller acting as the RID master in each domain in the forest. Whenever a domain controller creates a user, group, or computer object, it assigns the object a unique security ID (SID) security ID (SID) A data structure of variable length that identifies user, group, and computer accounts. Every account on a network is issued a unique SID when the account is first created.

Internal processes in Windows refer to an account's SID rather than the account's user or group name... The SID consists of a domain SID, which is the same for all SIDs created in the domain, and a RID, which is unique for each SID created in the domain. To move an object between domains (using Move tree. eye), you must initiate the move on the domain controller acting as the RID master of the domain that currently contains the object. PDC emulator master If the domain contains computers operating without Windows 2000 or Windows XP Professional client software or if it contains Windows NT backup domain controllers (BDCs), the PDC emulator master PDC emulator masterA domain controller that holds the PDC emulator operations master role in Active Directory.

The PDC emulator services network clients that do not have Active Directory client software installed, and it replicates directory changes to any Windows NT backup domain controllers (BDCs) in the domain. The PDC emulator handles password authentication requests involving passwords that have recently changed and not yet been replicated throughout the domain. At any time, the PDC emulator master role can be assigned to only one domain controller in each domain. acts as a Windows NT primary domain controller. It processes password changes from clients and replicates updates to the BDCs. At any time, there can be only one domain controller acting as the PDC emulator master in each domain in the forest. By default, the PDC emulator master is also responsible for synchronizing the time on all domain controllers throughout the domain.

The PDC emulator of a domain gets its clock set to the clock on an arbitrary domain controller in the parent domain. The PDC emulator in the parent domain should be configured to synchronize with an external time source. You can synchronize the time on the PDC emulator with an external server by executing the 'net time' command with the following syntax: net time Server Name /: TimeSourceThe end result is that the time of all computers running Windows Server 2003 or Windows 2000 in the entire forest are within seconds of each other. The PDC emulator receives preferential replication of password changes performed by other domain controllers in the domain. If a password was recently changed, that change takes time to replicate to every domain controller in the domain. If a logon authentication fails at another domain controller due to a bad password, that domain controller will forward the authentication request to the PDC emulator before rejecting the log on attempt.

The domain controller configured with the PDC emulator role supports two authentication protocols: o the Kerberos V 5 protocol o the NTLM protocol Infrastructure master At any time, there can be only one domain controller acting as the infrastructure master infrastructure masterA domain controller that holds the infrastructure operations master role in Active Directory. The infrastructure master updates the group-to-user reference whenever group memberships change and replicates these changes across the domain. At any time, the infrastructure master role can be assigned to only one domain controller in each domain. in each domain. The infrastructure master is responsible for updating references from objects in its domain to objects in other domains. The infrastructure master compares its data with that of a global catalog. Global catalogs receive regular updates for objects in all domains through replication, so the global catalog data will always be up to date.

If the infrastructure master finds data that is out of date, it requests the updated data from a global catalog. The infrastructure master then replicates that updated data to the other domain controllers in the domain. Important Unless there is only one domain controller in the domain, the infrastructure master role should not be assigned to the domain controller that is hosting the global catalog. If the infrastructure master and global catalog are on the same domain controller, the infrastructure master will not function. The infrastructure master will never find data that is out of date, so it will never replicate any changes to the other domain controllers in the domain.

In the case where all of the domain controllers in a domain are also hosting the global catalog, all of the domain controllers will have the current data and it does not matter which domain controller holds the infrastructure master role. The infrastructure master is also responsible for updating the group-to-user references whenever the members of groups are renamed or changed. When you rename or move a member of a group (and that member resides in a different domain from the group), the group may temporarily appear not to contain that member. The infrastructure master of the group's domain is responsible for updating the group so it knows the new name or location of the member. This prevents the loss of group memberships associated with a user account when the user account is renamed or moved.

The infrastructure master distributes the update via multi master replication. There is no compromise to security during the time between the member rename and the group update. Only an administrator looking at that particular group membership would notice the temporary inconsistency. For information about transferring operations master roles, see Transferring operations master roles.

For information about what to do when an operations master fails, see Responding to operations master failures. (ref: default) 3. Active Directory Domain Modes. Under what conditions would you select a domain to operate in Native Mode? During Active Directory installation During Active Directory installation, Windows prompts for whether the environment will use Windows NT computers in addition to Windows 2000 computers.

If the network uses both Windows NT and Windows 2000 computers, Active Directory is installed in Mixed Mode. If the network uses only Windows 2000 computers, Active Directory is installed in Native Mode. If you do not answer the question, Active Directory defaults to Mixed Mode. (ref: Ghost compatibility) a. What precautions need to be made before switching to Native Mode? b. What are the benefits of running a domain in Native Mode? 4.

Native Mode. Requires all the domain controllers in a domain to run Windows 2000 Server. In native mode, you can take advantages of new features such as Universal groups, nested group membership, and inter-domain user move. (A Universal group is a collection of user accounts that can contain members from any Active Directory domain in the forest, and permissions can be assigned to a universal group to resources on any member computer in the forest.

Universal groups are available only in native mode. ). (ref: Step by step guide) Native mode: Full deployment of AD with all domain controllers running Windows 2000. Pros: All AD features are available. Cons: Requires upgrade of all domain controllers. Once you flip the switch, fallback to mixed-mode operation or support for Windows NT domain controllers isn't possible (ref: making active directory easier) c. Can a Windows NT Client operate in a Windows 2000 Domain running in Native Mode? When a domain is first installed, it is in mixed mode.

The mode of operation can be changed from mixed mode to native, but this is not reversible. In native mode, Windows NT 4.0 Domain Controllers cannot participate in the domain. (ref: Step by step guide) Changing the Domain Mode Windows 2000 domains operate in one of two modes: Mixed Mode. Allows domain controllers running both Windows 2000 and earlier versions of Windows NT (R) Server to co-exist in the domain. In mixed mode, the domain features from previous versions of Windows NT Server are still enabled, while some Windows 2000 features are disabled. You can change to native mode after making sure all domain controllers in your domain are running Windows 2000 Server. 4.

Your organisation contains four geographic locations connected via slow links. Currently all locations belong to the one Domain with a number of domain controllers all located at one site. Users are complaining of slow authentication and access to AD information. Describe 2 different options you could consider to improve the performance of the Domain. Recommend one of the options providing reasons for your choice.