What are different types of groups?

Hello Friends,

Here are very useful information about Group and their types and use etc.

What are different types of groups? 

■ Security groups Security groups are used to group domain users into a single administrative unit. Security groups can be assigned permissions and can also be used as e-mail distribution lists. Users placed into a group inherit the permissions assigned to the group for as long as they remain members of that group. Windows itself uses only security groups. 

■ Distribution groups These are used for nonsecurity purposes by applications other than Windows. One of the primary uses is within an e-mail

As with user accounts, there are both local and domain-level groups. Local groups are stored in a local computer’s security database and are intended to control resource access on that computer. Domain groups are stored in Active Directory and let you gather users and control resource access in a domain and on domain controllers. 

What is a group scope and what are the different types of group scopes?

Group scopes determine where in the Active Directory forest a group is accessible and what objects can be placed into the group. Windows Server 2003 includes three group scopes: global, domain local, and universal. 

■ Global groups are used to gather users that have similar permissions requirements. Global groups have the following characteristics:

1. Global groups can contain user and computer accounts only from the domain in which the global group is created.

2. When the domain functional level is set to Windows 2000 native or Windows Server 2003 (i.e., the domain contains only Windows 2000 or 2003 servers), global groups can also contain other global groups from the local domain.

3. Global groups can be assigned permissions or be added to local groups in any domain in a forest. 

■ Domain local groups exist on domain controllers and are used to control access to resources located on domain controllers in the local domain (for member servers and workstations, you use local groups on those systems instead). Domain local groups share the following characteristics:

1. Domain local groups can contain users and global groups from any domain in a forest no matter what functional level is enabled.

2. When the domain functional level is set to Windows 2000 native or Windows Server 2003, domain local groups can also contain other domain local groups and universal groups. 

■ Universal groups are normally used to assign permissions to related resources in multiple domains. Universal groups share the following characteristics: 

1. Universal groups are available only when the forest functional level is set to Windows 2000 native or Windows Server 2003.

2. Universal groups exist outside the boundaries of any particular domain and are managed by Global Catalog servers.

3. Universal groups are used to assign permissions to related resources in multiple domains.

4. Universal groups can contain users, global groups, and other universal groups from any domain in a forest.

5. You can grant permissions for a universal group to any resource in any domain. 

What is group nesting?

Placing of one group in another is called as group nesting

For example, suppose you had juniorlevel administrators in four different geographic locations, as shown in Figure 4-10. You could create a separate group for each location (named something like Dallas Junior

Admins). Then, you could create a single group named Junior Admins and make each of the location-based groups a member of the main group. This approach would allow you to set permissions on a single group and have those permissions flow down to the members, yet still be able to subdivide the junior administrators by location.

 How many characters does a group name contain?

64

 Thank you for visiting this blog.

What types of naming convention active directory uses?

Hello Friends, 

Here are the information about naming convention active directory uses.

What types of naming convention active directory uses?

Active Directory supports several types of names for the different formats that can accessActive Directory. 

These names include:

■ Relative Distinguished Names 

The relative distinguished name (RDN) of an object identifies an object uniquely, but only within its parent container. Thus the name uniquely identifies the object relative to the other objects within the same container. In the example

CN=wjglenn,CN=Users,DC=contoso,DC=com,

the relative distinguished name of the object is CN=wjglenn. The relative distinguished name of the parent organizational unit is Users. For most objects, the relative distinguished name of an object is the same as that object’s Common Name attribute. Active Directory creates the relative distinguished name automatically, based on information provided when the object is created. Active Directory does not allow two objects with the same relative distinguished name to exist in the same parent container.

The notations used in the relative distinguished name (and in the distinguished name discussed in the next section) use special notations called LDAP attribute tags to identify each part of the name. The three attribute tags used include: 

■ DC The Domain Component (DC) tag identifies part of the DNS name of the domain, such as COM or ORG. 

■ OU The Organizational Unit (OU) tag identifies an organizational unit container. 

■ CN The Common Name (CN) tag identifies the common name configured for an Active Directory object. 

■ Distinguished Names

Each object in the directory has a distinguished name (DN) that is globally unique and identifies not only the object itself, but also where the object resides in the overall object hierarchy. You can think of the distinguished name as the relative distinguished name of an object concatenated with the relative distinguished names of all parent containers that make up the path to the object.

An example of a typical distinguished name would be:

CN=wjglenn,CN=Users,DC=contoso,DC=com.

This distinguished name would indicate that the user object wjglenn is in the Users container, which in turn is located in the contoso.com domain. If the wjglenn object is moved to another container, its DN will change to reflect its new position in the hierarchy. Distinguished names are guaranteed to be unique in the forest, similar to the way that a fully qualified domain name uniquely identifies an object’s placement in a DNS hierarchy. You cannot have two objects with the same distinguished name. 

■ User Principal Names

The user principal name that is generated for each object is in the form username@ domain_name. Users can log on with their user principal name, and an administrator can define suffixes for user principal names if desired. User principal names should be unique, but Active Directory does not enforce this requirement. It’s best, however, to formulate a naming convention that avoids duplicate user principal names. 

■ Canonical Names

An object’s canonical name is used in much the same way as the distinguished name— it just uses a different syntax. The same distinguished name presented in the preceding section would have the canonical name:

contoso.com/Users/wjglenn.

As you can see, there are two primary differences in the syntax of distinguished names and canonical names. The first difference is that the canonical name presents the root of the path first and works downward toward the object name. The second difference is that the canonical name does not use the LDAP attribute tags (e.g., CN and DC).

 What is multimaster replication?

Active Directory follows the multimaster replication which every replica of the Active Directory partition held on every domain is considered an equal master. Updates can be made to objects on any domain controller, and those updates are then replicated to other domain controllers.

 Thank you for visiting this blog.

Replication in Active directory

Hello Friends,

 Here are the information about Replication..

Explain Replication in Active directory?

Windows Server 2003 uses a replication model called multimaster replication, in which all replicas of the Active Directory database are considered equal masters. You can make changes to the database on any domain controller and the changes will be replicated to other domain controllers in the domain.

Domain controllers in the same site replicate on the basis of notification. When changes are made on a domain controller, it notifies its replication partners (the other domain controllers in the site); the partners then request the changes and replication occurs. Because of the high-speed, low-cost connections assumed within a site, replication occurs as needed rather than according to a schedule.

You should create additional sites when you need to control how replication traffic occurs over slower WAN links. For example, suppose you have a number of domain controllers on your main LAN and a few domain controllers on a LAN at a branch location. Those two LANs are connected to one another with a slow (256K) WAN link. You would want replication traffic to occur as needed between the domain controllers on each LAN, but you would want to control traffic across the WAN link to prevent it from affecting higher priority network traffic. To address this situation, you would set up two sites— one site that contained all the domain controllers on the main LAN and one site that contained all the domain controllers on the remote LAN. 

What are the different types of replication?

Single site (called intrasite replication)

Replication between sites (called intersite replication). 

■ Intrasite Replication Intrasite replication sends replication traffic in an uncompressed format. This is because of the assumption that all domain controllers within the site are connected by high-bandwidth links. Not only is the traffic uncompressed, but replication occurs according to a change notification mechanism. This means that if changes are made in the domain, those changes are quickly replicated to the other domain controllers. 

■ Intersite Replication Intersite replication sends all data compressed. This shows an appreciation for the fact that the traffic will probably be going across slower WAN links (as opposed to the LAN connectivity intrasite replication assumes), but it increases the server load because compression/decompression is added to the processing requirements. In addition to the compression, the replication can be scheduled for times that are more appropriate to your

organization. For example, you may decide to allow replication only during slower times of the day. Of course, this delay in replication (based on the schedule) can cause inconsistency between servers in different sites. 

What is LDAP?

LDAP, Lightweight Directory Access Protocol, is an Internet protocol that email and other programs use to look up information from a server.

An LDAP-aware directory service (such as Active Directory) indexes all the attributes of all the objects stored in the directory and publishes them. LDAP-aware clients can query the server in a wide variety of ways.

Thank you  for Visiting this blog.

What is a site? user of site.

Information about sites.

What is a site?

A Windows Server 2003 site is a group of domain controllers that exist on one or more IP subnets (see Lesson 3 for more on this) and are connected by a fast, reliable network connection. Fast means connections of at least 1Mbps. In other words, a site usually follows the boundaries of a local area network (LAN). If different LANs on the network are connected by a wide area network (WAN), you’ll likely create one site for each LAN. 

What is the use of site?

Sites are primarily used to control replication traffic. Domain controllers within a site are pretty much free to replicate changes to the Active Directory database whenever changes are made. Domain controllers in different sites compress the replication traffic and operate based on a defined schedule, both of which are intended to cut down on network traffic.

More specifically, sites are used to control the following: 

■ Workstation logon traffic

■ Replication traffic

■ Distributed File System (DFS)

Distributed File System (DFS) is a server component that provides a unified naming convention for folders and files stored on different servers on a network. DFS lets you create a single logical hierarchy for folders and files that is consistent on a network, regardless of where on the network those items are actually stored. Files represented in the DFS might be stored in multiple locations on the network, so it makes sense that Active Directory should be able to direct users to the closest physical location of the data they need. To this end, DFS uses site information to direct a client to the server that is hosting the requested data within the site. If DFS does not find a copy of the data within the same site as the client, DFS uses the site information in Active Directory to determine which file server that has DFS shared data is closest to the client. 

■ File Replication Service (FRS)

Every domain controller has a built-in collection of folders named SYSVOL (for System Volume). The SYSVOL folders provide a default Active Directory location for files that must be replicated throughout a domain. You can use SYSVOL to replicate Group Policy Objects, startup and shutdown scripts, and logon and logoff scripts. A Windows Server 2003 service named File Replication Service (FRS) is responsible for replicating files in the SYSVOL folders between domain controllers. FRS uses site boundaries to govern the replication of items in the SYSVOL folders. 

What are the objects a site contains?

Sites contain only two types of objects. The first type is the domain controllers contained in the site. The second type of object is the site links configured to connect the site to other sites.

What is a Site link?

Within a site, replication happens automatically. For replication to occur between sites, you must establish a link between the sites. There are two components to this link: the actual physical connection between the sites (usually a WAN link) and a site link object. The site link object is created within Active Directory and determines the protocol used for transferring replication traffic (Internet Protocol [IP] or Simple Mail Transfer Protocol [SMTP]). The site link object also governs when replication is scheduled to occur.

Thank you for visiting this blog.

. What is trust relationship and how many types of trust relationship is there in exchange 2003?

Hello Friends,

What is trust relationship and how many types of trust relationship is there in exchange 2003?

Since domains represent security boundaries, special mechanisms called trust relationships allow objects in one domain (called the trusted domain) to access resources in another domain (called the trusting domain). 

Windows Server 2003 supports six types of trust relationships: 

■ Parent and child trusts

■ Tree-root trusts

■ External trusts

■ Shortcut trusts

■ Realm trusts

■ Forest trusts