Brian Desmond - Active Directory

Copyright 2008 O'Reilly Media, Inc.

OReilly books may be purchased for educational, business, or sales promotional use. Online editions are also available for most titles (.

Nutshell Handbook, the Nutshell Handbook logo, and the OReilly logo are registered trademarks of OReilly Media, Inc. Active Directory , the image of domestic cats, and related trade dress are trademarks of OReilly Media, Inc.

Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and OReilly Media, Inc. was aware of a trademark claim, the designations have been printed in caps or initial caps.

While every precaution has been taken in the preparation of this book, the publisher and authors assume no responsibility for errors or omissions, or for damages resulting from the use of the information contained herein.

Active Directory is a common repository for information about objects that reside on the network, such as users, groups, computers, printers, applications, and files. The default Active Directory schema supports numerous attributes for each object class that can be used to store a variety of information. Access Control Lists (ACLs) are also stored with each object, which allows you to maintain permissions for who can access and manage the object. Having a single source for this information makes it more accessible and easier to manage; however, to accomplish this requires a significant amount of knowledge on such topics as LDAP, Kerberos, DNS, multimaster replication, group policies, and data partitioning, to name a few. This book will be your guide through this maze of technologies, showing you how to deploy a scalable and reliable Active Directory infrastructure.

Windows 2000 Active Directory has proven itself to be very solid in terms of features and reliability, but after several years of real-world deployments, there was much room for improvement. When Microsoft released Windows Server 2003, they focused on security, manageability, and scalability enhancements. Windows Server 2003 R2 takes this evolution further and combines Windows Server 2003 Service Pack 1 with some feature packs, which makes Windows Server even more secure, manageable, and scalable and also adds considerable new functionality, such as a stand-alone LDAP server service and increased Unix system integration functions right in the box.

Windows Server 2008 introduces some highly sought-after features to Active Directory. At the top of the list for many administrators will be such features as read-only domain controllers, support for Server Core, and fine-grained password policies. The list of new features and major enhancements is lengthy, and we have taken the time to cover them all in this book.

This book is a major update to the very successful third edition. All of the existing chapters have been brought up to date with Windows Server 2008 changes, as well as updates in concepts and approaches to managing Active Directory and script updates. There are eight new chapters (Chapters that cover significant Windows Server 2008 Active Directory changes.

This book describes Active Directory in depth, but not in the traditional way of going through the graphical user interface screen by screen. Instead, the book sets out to tell administrators how to design, manage, and maintain a small, medium, or enterprise Active Directory infrastructure. To this end, the book is split up into three parts.

Part I introduces in general terms much of how Active Directory works, giving you a thorough grounding in its concepts. Some of the topics include Active Directory replication, the schema, application partitions, group policies, interaction with DNS, domain controllers, and password policies.

In Part II, we describe in copious detail the issues around properly designing the directory infrastructure. Topics include in-depth looks at designing the namespace, creating a site topology, designing group policies, auditing, permissions, backup and recovery, Active Directory Lightweight Directory Services, upgrading Active Directory, and Microsoft Exchange.

Part III is all about managing Active Directory via automation with Active Directory Service Interface (ADSI), ActiveX Data Objects (ADO), Windows Management Instrumentation (WMI), PowerShell, and .NET. This section covers how to create and manipulate users, groups, printers, and other objects that you may need in your everyday management of Active Directory. It also describes in depth how you can utilize the strengths of WMI, Windows PowerShell, and the .NET namespace System.DirectoryServices to manage Active Directory programmatically via those interfaces .

If youre looking for in-depth coverage of how to use the MMC snap-ins or Resource Kit tools, look elsewhere. However, if you want a book that lays bare the design and management of an enterprise or departmental Active Directory, you need not look any further.