What types of naming convention active directory uses?

Hello Friends, 

Here are the information about naming convention active directory uses.

What types of naming convention active directory uses?

Active Directory supports several types of names for the different formats that can accessActive Directory. 

These names include:

■ Relative Distinguished Names 

The relative distinguished name (RDN) of an object identifies an object uniquely, but only within its parent container. Thus the name uniquely identifies the object relative to the other objects within the same container. In the example

CN=wjglenn,CN=Users,DC=contoso,DC=com,

the relative distinguished name of the object is CN=wjglenn. The relative distinguished name of the parent organizational unit is Users. For most objects, the relative distinguished name of an object is the same as that object’s Common Name attribute. Active Directory creates the relative distinguished name automatically, based on information provided when the object is created. Active Directory does not allow two objects with the same relative distinguished name to exist in the same parent container.

The notations used in the relative distinguished name (and in the distinguished name discussed in the next section) use special notations called LDAP attribute tags to identify each part of the name. The three attribute tags used include: 

■ DC The Domain Component (DC) tag identifies part of the DNS name of the domain, such as COM or ORG. 

■ OU The Organizational Unit (OU) tag identifies an organizational unit container. 

■ CN The Common Name (CN) tag identifies the common name configured for an Active Directory object. 

■ Distinguished Names

Each object in the directory has a distinguished name (DN) that is globally unique and identifies not only the object itself, but also where the object resides in the overall object hierarchy. You can think of the distinguished name as the relative distinguished name of an object concatenated with the relative distinguished names of all parent containers that make up the path to the object.

An example of a typical distinguished name would be:

CN=wjglenn,CN=Users,DC=contoso,DC=com.

This distinguished name would indicate that the user object wjglenn is in the Users container, which in turn is located in the contoso.com domain. If the wjglenn object is moved to another container, its DN will change to reflect its new position in the hierarchy. Distinguished names are guaranteed to be unique in the forest, similar to the way that a fully qualified domain name uniquely identifies an object’s placement in a DNS hierarchy. You cannot have two objects with the same distinguished name. 

■ User Principal Names

The user principal name that is generated for each object is in the form username@ domain_name. Users can log on with their user principal name, and an administrator can define suffixes for user principal names if desired. User principal names should be unique, but Active Directory does not enforce this requirement. It’s best, however, to formulate a naming convention that avoids duplicate user principal names. 

■ Canonical Names

An object’s canonical name is used in much the same way as the distinguished name— it just uses a different syntax. The same distinguished name presented in the preceding section would have the canonical name:

contoso.com/Users/wjglenn.

As you can see, there are two primary differences in the syntax of distinguished names and canonical names. The first difference is that the canonical name presents the root of the path first and works downward toward the object name. The second difference is that the canonical name does not use the LDAP attribute tags (e.g., CN and DC).

 What is multimaster replication?

Active Directory follows the multimaster replication which every replica of the Active Directory partition held on every domain is considered an equal master. Updates can be made to objects on any domain controller, and those updates are then replicated to other domain controllers.

 Thank you for visiting this blog.

Replication in Active directory

Hello Friends,

 Here are the information about Replication..

Explain Replication in Active directory?

Windows Server 2003 uses a replication model called multimaster replication, in which all replicas of the Active Directory database are considered equal masters. You can make changes to the database on any domain controller and the changes will be replicated to other domain controllers in the domain.

Domain controllers in the same site replicate on the basis of notification. When changes are made on a domain controller, it notifies its replication partners (the other domain controllers in the site); the partners then request the changes and replication occurs. Because of the high-speed, low-cost connections assumed within a site, replication occurs as needed rather than according to a schedule.

You should create additional sites when you need to control how replication traffic occurs over slower WAN links. For example, suppose you have a number of domain controllers on your main LAN and a few domain controllers on a LAN at a branch location. Those two LANs are connected to one another with a slow (256K) WAN link. You would want replication traffic to occur as needed between the domain controllers on each LAN, but you would want to control traffic across the WAN link to prevent it from affecting higher priority network traffic. To address this situation, you would set up two sites— one site that contained all the domain controllers on the main LAN and one site that contained all the domain controllers on the remote LAN. 

What are the different types of replication?

Single site (called intrasite replication)

Replication between sites (called intersite replication). 

■ Intrasite Replication Intrasite replication sends replication traffic in an uncompressed format. This is because of the assumption that all domain controllers within the site are connected by high-bandwidth links. Not only is the traffic uncompressed, but replication occurs according to a change notification mechanism. This means that if changes are made in the domain, those changes are quickly replicated to the other domain controllers. 

■ Intersite Replication Intersite replication sends all data compressed. This shows an appreciation for the fact that the traffic will probably be going across slower WAN links (as opposed to the LAN connectivity intrasite replication assumes), but it increases the server load because compression/decompression is added to the processing requirements. In addition to the compression, the replication can be scheduled for times that are more appropriate to your

organization. For example, you may decide to allow replication only during slower times of the day. Of course, this delay in replication (based on the schedule) can cause inconsistency between servers in different sites. 

What is LDAP?

LDAP, Lightweight Directory Access Protocol, is an Internet protocol that email and other programs use to look up information from a server.

An LDAP-aware directory service (such as Active Directory) indexes all the attributes of all the objects stored in the directory and publishes them. LDAP-aware clients can query the server in a wide variety of ways.

Thank you  for Visiting this blog.

What is a site? user of site.

Information about sites.

What is a site?

A Windows Server 2003 site is a group of domain controllers that exist on one or more IP subnets (see Lesson 3 for more on this) and are connected by a fast, reliable network connection. Fast means connections of at least 1Mbps. In other words, a site usually follows the boundaries of a local area network (LAN). If different LANs on the network are connected by a wide area network (WAN), you’ll likely create one site for each LAN. 

What is the use of site?

Sites are primarily used to control replication traffic. Domain controllers within a site are pretty much free to replicate changes to the Active Directory database whenever changes are made. Domain controllers in different sites compress the replication traffic and operate based on a defined schedule, both of which are intended to cut down on network traffic.

More specifically, sites are used to control the following: 

■ Workstation logon traffic

■ Replication traffic

■ Distributed File System (DFS)

Distributed File System (DFS) is a server component that provides a unified naming convention for folders and files stored on different servers on a network. DFS lets you create a single logical hierarchy for folders and files that is consistent on a network, regardless of where on the network those items are actually stored. Files represented in the DFS might be stored in multiple locations on the network, so it makes sense that Active Directory should be able to direct users to the closest physical location of the data they need. To this end, DFS uses site information to direct a client to the server that is hosting the requested data within the site. If DFS does not find a copy of the data within the same site as the client, DFS uses the site information in Active Directory to determine which file server that has DFS shared data is closest to the client. 

■ File Replication Service (FRS)

Every domain controller has a built-in collection of folders named SYSVOL (for System Volume). The SYSVOL folders provide a default Active Directory location for files that must be replicated throughout a domain. You can use SYSVOL to replicate Group Policy Objects, startup and shutdown scripts, and logon and logoff scripts. A Windows Server 2003 service named File Replication Service (FRS) is responsible for replicating files in the SYSVOL folders between domain controllers. FRS uses site boundaries to govern the replication of items in the SYSVOL folders. 

What are the objects a site contains?

Sites contain only two types of objects. The first type is the domain controllers contained in the site. The second type of object is the site links configured to connect the site to other sites.

What is a Site link?

Within a site, replication happens automatically. For replication to occur between sites, you must establish a link between the sites. There are two components to this link: the actual physical connection between the sites (usually a WAN link) and a site link object. The site link object is created within Active Directory and determines the protocol used for transferring replication traffic (Internet Protocol [IP] or Simple Mail Transfer Protocol [SMTP]). The site link object also governs when replication is scheduled to occur.

Thank you for visiting this blog.

. What is trust relationship and how many types of trust relationship is there in exchange 2003?

Hello Friends,

What is trust relationship and how many types of trust relationship is there in exchange 2003?

Since domains represent security boundaries, special mechanisms called trust relationships allow objects in one domain (called the trusted domain) to access resources in another domain (called the trusting domain). 

Windows Server 2003 supports six types of trust relationships: 

■ Parent and child trusts

■ Tree-root trusts

■ External trusts

■ Shortcut trusts

■ Realm trusts

■ Forest trusts

What does the logical component of the Active Directory structure include?

Hello Friends,

Here are the information about AD logical component, trees,domain, forest etc

What does the logical component of the Active Directory structure include?

■ Objects:-Resources are stored in the Active Directory as objects.

Sub category: object class

An object is really just a collection of attributes. A user object, for example, is made up of attributes such as name, password, phone number, group membership, and so on. The attributes that make up an object are defined by an object class. The user class, for example, specifies the attributes that make up the user object.

The Active Directory Schema:-

The classes and the attributes that they define are collectively referred to as the Active Directory Schema—in database terms, a schema is the structure of the tables and fields and how they are related to one another. You can think of the Active Directory Schema as a collection of data (object classes) that defines how the real data of the directory (the attributes of an object) is organized and stored 

■ Domains

The basic organizational structure of the Windows Server 2003 networking model is the domain. A domain represents an administrative boundary. The computers, users, and other objects within a domain share a common security database. 

■ Trees

Multiple domains are organized into a hierarchical structure called a tree. Actually, even if you have only one domain in your organization, you still have a tree. The first domain you create in a tree is called the root domain. The next domain that you add becomes a child domain of that root. This expandability of domains makes it possible to have many domains in a tree. Figure 1-1 shows an example of a tree. Microsoft.com was the first domain created in Active Directory in this example and is therefore the root domain. 

 

Figure 1-1 A tree is a hierarchical organization of multiple domains.

All domains in a tree share a common schema and a contiguous namespace. In the example shown in Figure 1-1, all of the domains in the tree under the microsoft.com root domain share the namespace microsoft.com. Using a single tree is fine if your organization is confined within a single DNS namespace. However, for organizations that use multiple DNS namespaces, your model must be able to expand outside the boundaries of a single tree. This is where the forest comes in. 

■ Forest

A forest is a group of one or more domain trees that do not form a contiguous namespace but may share a common schema and global catalog. There is always at least one forest on a network, and it is created when the first Active Directory–enabled computer (domain controller) on a network is installed.

This first domain in a forest, called the forest root domain, is special because it holds the schema and controls domain naming for the entire forest. It cannot be removed from the forest without removing the entire forest itself. Also, no other domain can ever be created above the forest root domain in the forest domain hierarchy.

Figure 1-2 shows an example of a forest with two trees. Each tree in the forest has its own namespace. In the figure, microsoft.com is one tree and contoso.com is a second tree. Both are in a forest named microsoft.com (after the first domain created)

Figure 1-2 Trees in a forest share the same schema, but not the same namespace.

A forest is the outermost boundary of Active Directory; the directory cannot be larger than the forest. However, you can create multiple forests and then create trust relationships between specific domains in those forests; this would let you grant access to resources and accounts that are outside of a particular forest.

■Organizational Units

Organizational Units (OUs) provide a way to create administrative boundaries within a domain. Primarily, this allows you to delegate administrative tasks within the domain.

OUs serve as containers into which the resources of a domain can be placed. You can then assign administrative permissions on the OU itself. Typically, the structure of OUs follows an organization’s business or functional structure. For example, a relatively small organization with a single domain might create separate OUs for departments within the organization. 

Q2. What does the physical structure of active directory contain?

Physical structures include domain controllers and sites. 

Q3.What is nesting?

The creation of an OU inside another OU.

IMP: - once you go beyond about 12 OUs deep in a nesting structure, you start running into significant performance issues.

Thank you!