IW3 - Active Directory: Introduction,

AD structure, FSMO

Ing. Jan Pluskal

UIFS
Brno University of Technology, Czech Republic
ipluskal@fit.vutbr.cz
What is Active Directory?

• Active Directory (AD) is a directory service that

Microsoft developed for Windows domain networks and
is included in most Windows Server operating systems
as a set of processes and services.
• An AD domain controller authenticates and authorizes
all users and computers in a Windows domain type
network—assigning and enforcing security policies for
all computers and installing or updating software.
• Active Directory makes use of Lightweight Directory
Access Protocol (LDAP) versions 2 and 3, Microsoft's
version of Kerberos, and DNS.

IW3 ActiveDirectory Brno, 2014 2 of x

 History

• Roots like everything other in computer networks in RFCs -

RFC 1823 (on the LDAP API, August 1995),[4] RFC 2307,
RFC 3062, and RFC 4533
• Microsoft previewed Active Directory in 1999, released it
first with Windows 2000 Server edition
• Revised and extended functionality and improve
administration in Windows Server 2003
• Additional improvements came with Windows Server 2003
R2, Windows Server 2008, and Windows Server 2008 R2
• With the release of the last Windows Server 2012 and
Windows Server 2012 R2, Microsoft renamed the domain
controller role as Active Directory Domain Services (AD DS)

IW3 ActiveDirectory Brno, 2014 3 of x

 What's New in Active Directory Domain Services

• AD DS improvements in Windows Server 2012 include:

• Virtualization that just works
• Virtualization-safe technologies and the rapid deployment of
virtual domain controllers through cloning.
• Simplified deployment and upgrade preparation
• The upgrade and preparation processes (dcpromo and adprep)
have been replaced with a new streamlined domain controller
promotion wizard that is integrated with Server Manager and
built on Windows PowerShell.
• Simplified management
• Active Directory Administrative Center (ADAC) now allows you to
perform graphical tasks that automatically generate the
equivalent Windows PowerShell commands.
• AD DS Platform Changes
• Updates to the AD DS platform include improved allocation and
scale of RIDs

IW3 ActiveDirectory Brno, 2014 4 / 32

 Logical structure vs Physical structure

• Organizational units • Active Directory sites

• Domains (physical subnets)
• Trees • Domain controllers
• Forests

• http://computer-network.wifi- • http://prakash-
lifestyle.com/active-directory-2003 nimmala.blogspot.cz/2012/04/active-directory-
concepts-part2.html
IW3 ActiveDirectory Brno, 2014 5 of x
 Physical structure

• The physical structure of Active Directory helps to

manage the communication between servers with
respect to the directory.
• The two physical elements of Active Directory are
domain controllers and sites.

IW3 ActiveDirectory Brno, 2014 6 of x

 Domain Controllers

• Domain controllers are Windows XXXX Server-based

systems that store the Active Directory database.
• Every Windows XXXX domain controller has a writable
copy of the directory (except RODC)
• Domain controllers in the same domain contain replicas
of the directory that must be synchronized periodically

IW3 ActiveDirectory Brno, 2014 7 of x

 Site

• Groups of IP subnets that are connected at high speed.

• Generally considered to be subnets that are connected at
LAN speeds (say 10 Mb) or higher.
• The purpose is to control network traffic relating to
replication, as well as to help ensure that users
connect to local resources.
• The replication inside the site (intra-site ) is almost
instantaneous (15 seconds) on the contrary, inter-site
replication is scheduled by default in 180 minutes
intervals.
• Inter-site replication can also be scheduled to specific
windows to ensure that the replication traffic does not
interfere with normal data transfers.

IW3 ActiveDirectory Brno, 2014 8 of x

 Logical structure

• Active Directory instance consists of a database and

corresponding executable code responsible for
servicing requests and maintaining the database.
• The executable part, known as Directory System Agent,
is a collection of Windows services and processes that
run on Windows 2000 and later.
• Objects in Active Directory databases can be accessed
via LDAP protocol, ADSI (a component object model
interface), messaging API and Security Accounts
Manager services.

IW3 ActiveDirectory Brno, 2014 9 of x

 Objects

• An Active Directory structure is an arrangement of

information about objects. The objects fall into two
broad categories: resources (e.g., printers) and
security principals (user or computer accounts and
groups).
• Security principals are assigned unique security identifiers (SIDs).
• Each object represents a single entity—whether a user, a computer, a
printer, or a group—and its attributes.
• An object is uniquely identified by its name and has a set of attributes—
the characteristics and information that the object represents— defined
by a schema, which also determines the kinds of objects that can be
stored in Active Directory.
• The schema object lets administrators extend or modify the schema
when necessary.

IW3 ActiveDirectory Brno, 2014 10 of x

 Domain

• A logical group of users and computers that share

the characteristics of centralized security and
administration.
• A boundary for security – this means that an
administrator of a domain is an administrator for only
that domain, and no others, by default
• A boundary for replication – all domain controllers
that are part of the same domain must replicate with
one another
• Domains in the same forest automatically have trust
relationships configured.

IW3 ActiveDirectory Brno, 2014 11 of x

 Tree

• A collection of Active Directory domains that

share a contiguous namespace
• In this configuration, domains fall into a parent-child
relationship, which the child domain taking on the
name of the parent.

IW3 ActiveDirectory Brno, 2014 12 of x

 Forest (a set of trees)

• The largest unit in Active Directory and is a collection

of trees that share a common Schema - the
definition of objects that can be created.
• All trees are connected by transitive two-way trust
relationships, thus allowing users in any tree access to
resources in another for which they have been given
appropriate permissions and rights.
• By default the first domain created in a forest is
referred to as the root domain.

IW3 ActiveDirectory Brno, 2014 13 of x

 AD Forest

•http://static.businessinsider.com/image/51dfec8469bedd5e19000017-1200/image.jpg

IW3 ActiveDirectory Brno, 2014 14 / 32

 Organizational Unit (OU)

• A container object that helps to organize objects for

the purpose of administration or group policy
application.
• An OU exists within a domain and can only contain
objects from that domain.
• OU can be nested, which allows for more flexibility in
terms of administration.
• Different methods for designing OU structures exists
• Geographical
• For a delegation of administrative authority
• …

IW3 ActiveDirectory Brno, 2014 15 of x

 Global Catalog

• Listings of every object that exists within an Active

Directory forest
• By default, a domain controller only contains
information about objects in that domain
• A Global Catalog server is a domain controller that
contains information about every object (though not
every attribute for each) stored in the entire forest.
• Facilitates and speeds up the search for information in
Active Directory.
• By default only the first domain controller created in a
forest has a copy of the global catalog.

IW3 ActiveDirectory Brno, 2014 16 of x

 Active Directory Domain Service Diagram

•http://www.conceptdraw.com/How-To-Guide/active-directory-diagram

IW3 ActiveDirectory Brno, 2014 17

 Active Directory – lab1

• Instalace AD + připojení klienta do domény

• nastartujte w2012-base a pomoci server manageru nainstalujte AD DS
services
• připojte do domény w8-base
• vytvořte organizační jednotku, uživatele a skupinu
• v konzoli AD Users and Computers zobrazte „Advenced Features“,
prozkoumejte detailní nastavení uživatele
• ptejte se lektora na to co, jste zapomněli 

IW3 ActiveDirectory Brno, 2014 18 of x

 Active Directory – lab2

• Prozkoumání vylepšení v Active Directory

Administrative Center
• Vytvořte objekt uživatele, skupiny a novou organizační
jednotku
• Uživatel Homer (Administrators), Bart
• Skupina Simpsons
• OU Brno
• Povolte Active Directory Recycle Bin
• Vyzkoušejte smazání a odstranění uživatele a OU

IW3 ActiveDirectory Brno, 2014 19 of x

 Active Directory – lab3

• Management AD objektů v PowerShell

• Prohlédněte si exitující uživatele a skupiny
• Get-Command *-AD*
• Get-ADUser, Get-ADGroup, Get-ADOrganizationalUnit
• Vytvořte objekt uživatele, skupiny a novou organizační
jednotku
• Uživatel Superman (Domain Administrators), Spiderman
• Skupina Superheroes
• OU Hollywood
• New-ADUser, New-ADGroup, New-ADOrganizationalUnit
• Postup obdobný jako ad_introduction_lab.pdf
Exercise 4, popř. IW2-exercices-03.pdf

IW3 ActiveDirectory Brno, 2014 20 of x

 Active Directory – lab4

• Vzdálená instalace záložního řadiče

• nastartujte z w2012-base2
• naaplikujte snapshot na r2 base, tak aby se „zresetoval“ do původního stavu (lektor
poradí jak)
• připojte w2012-base2 do domény vytvoření v Lab1
• nakonfigurujte base server na použití dns serveru na ad
• vzdáleně přes w2012-base
• nainstalujte další řadič domény na base server
• zkontrolujte zda se w2012-base2 přidal do domény jako DC
Postup obdobný jako ad_introduction_lab.pdf
Exercise 1

IW3 ActiveDirectory Brno, 2014 21 of x

 Active Directory – lab5
• Vzdálené nasazení Read-Only Domain Controller
• Zapnětě virtuální stroj w2012 XXX
• Z w2012-base
• Použijte PowerShell k instalaci AD DS na daný stroj Install-
WindowsFeature
• Povyšte stroj do role RODC obdobně jako …
• Delegace lokálního administrátora na uživatele Homer
Invoke-Command –ComputerName Server2 –ScriptBlock {Import-Module
ADDSDeployment;Install-ADDSDomainController –NoGlobalCatalog:$False
–CreateDNSDelegation:$False –Credential (Get-Credential)
–CriticalReplicationOnly:$False –DatabasePath “C:\Windows\NTDS” –DomainName
“Contoso.com” –InstallDNS:$True –LogPath “C:\Windows\NTDS”
–NoRebootOnCompletion:$False –SiteName “Default-First-Site-Name” –SysVolPath
“C:\Windows\SysVol” }
• otestujte delegaci lokálního administrátora
• zkontrolujte přidání nového RODC do AD
• otestujte možnost nastavení cachování hesel
• na base serveru (pdc) „odstraňtě“ přes users and computers konzoli účet serveru
ad (rodc) a sledujte chování (možnost resetu hesla uživatelům co byli
cacheovaní)
IW3 ActiveDirectory Brno, 2014 22 of x
 Flexible Single Master Operation Roles (FSMO)

• Active Directory has five special roles which are vital

for the smooth running of AD as a multimaster system.
• Some functions of AD require there is an authoritative
master to which all Domain Controllers can refer to.
• If you de-commission a DC and DCPROMO fails to run
correctly or have a catastrophic failure of a DC you will
need to know about these roles to recover or transfer
them to another DC.

IW3 ActiveDirectory Brno, 2014 23 of x

 Flexible Single Master Operation Roles (FSMO)

Forest Wide Roles: Domain Wide Roles:

• Schema Master • Relative ID (RID)
• Domain Naming Master
• PDC Emulator
• Infrastructure Master

IW3 ActiveDirectory Brno, 2014 24 of x

Schema Master

• Used to introduce manual and programmatic schema

updates
• includes those updates that are added by Windows
ADPREP /FORESTPREP
• by Microsoft Exchange
• by other applications that use Active Directory Domain
Services (AD DS)
• Must be online when schema updates are performed.

IW3 ActiveDirectory Brno, 2014 25

 AD object schema

•http://aheil.files.wordpress.com/2005/06/drink.png
IW3 ActiveDirectory Brno, 2014 26 / 32
 Domain Naming Master

• Used to add and to remove domains and application

partitions to and from the forest.
• Must be online when domains and application
partitions in a forest are added or removed.

IW3 ActiveDirectory Brno, 2014 27 of x

 Primary Domain Controller (PDC emulator)

• Receives password updates when passwords are

changed for the computer and for user accounts that
are on replica domain controllers.
• Consulted by replica domain controllers that service
authentication requests that have mismatched
passwords.
• Default target domain controller for Group Policy
updates.
• Target domain controller for legacy applications that
perform writable operations and for some admin tools.
• Must be online and accessible 24 hours a day, seven
days a week.

IW3 ActiveDirectory Brno, 2014 28 of x

 Relative ID (RID) Master

• Allocates active and standby RID pools to replica

domain controllers in the same domain.
• Must be online for newly promoted domain controllers
to obtain a local RID pool that is required to advertise
or when existing domain controllers have to update
their current or standby RID pool allocation.

IW3 ActiveDirectory Brno, 2014 29 of x

 Infrastructure Master

• Scope: Domain, Application partition

• Updates cross-domain references and phantoms from
the global catalog.
• A separate infrastructure master is created for each
application partition including the default forest-wide
and domain-wide application partitions created by
Windows Server 2003 and later domain controllers.

IW3 ActiveDirectory Brno, 2014 30 of x

 FSMO availability and placement

• The Active Directory Installation Wizard performs the initial

placement of roles on domain controllers. This placement is
frequently correct for directories that have just a few
domain controllers.
• It's easier to keep track of FSMO roles if you host them on
fewer computers.
• If a role has to be moved to a different domain controller,
and the current role holder is online and available, you
should transfer (not seize) the role to the new domain
controller.
• Place the schema master on the PDC of the forest root
domain.
• Place the domain naming master on the forest root PDC.

IW3 ActiveDirectory Brno, 2014 31 of x

 Transfer vs Seize

• Recommendation – always transfer if possible

• Transfer – both machines has to be online at the
same time
• Seize – if targeted server has malfunctioned or
disappeared, general rule - after seizing a role never
return the DC back (except PDC, infrastructure)
• Tools
• GUI administrative tools
• ntdsutil /roles
• Netdom query fsmo

IW3 ActiveDirectory Brno, 2014 32 of x

 Active Directory – lab6

• Vyzkoušejte přesun jednotlivých FSMO mezi řadiči

domény pomocí
• GUI administrativních nástrojů
• Příkazové řádky ntdsutil
• PowerShell Move-
ADDirectoryServerOperationMasterRole

IW3 ActiveDirectory Brno, 2014 33 of x

 Recap

• What is the Active Directory physical and logical

structure?

• What are Flexible Single Master Operation Roles

(FSMO)?
• What they are used for?
• What is the preferred and safest way transfer/seize?

IW3 ActiveDirectory Brno, 2014 34 / 32

 Sources

• http://en.wikipedia.org/wiki/Active_Directory
• http://technet.microsoft.com/en-
us/library/cc181267.aspx
• http://support.microsoft.com/kb/223346/en-us
• http://www.ucs.cam.ac.uk/support/windows-
support/winsuptech/activedir/fsmoroles

IW3 ActiveDirectory Brno, 2014 35 of x

 Thank you for attention!
Any questions?!

IW3 ActiveDirectory Brno, 2014 36