Module 2: Active Directory Domain Services (AD DS)

Container

A container is an object that provides an organizational framework for use in AD DS. Containers cannot have GPOs linked to them.

Logical Components - Definition

AD DS logical components are structures that you use to implement an Active Directory design that is appropriate for an organization. The following table describes the types of logical structures that an Active Directory database contain.

Web Application Proxy

Allows applications to be published to the internet

Multi-Factor Access Control

Allows claims using different factors

Workplace Join

Allows consumer devices to participate in the domain

Multi-Factor Authentication

Allows you to specify the use of the multiple factors for authentication

Organizational unit (OU)

An organizational unit is a container object that provides a framework for delegating administrative rights and for linking Group Policy Objects (GPOs).

Physical Components

Domain Controller Data Store Global Catalog Server Read-only Domain Controller

Logical Components

Partition Schema Domain Domain Tree Forest Site OU Container

Data Store

There is a data store on each domain controller; it holds the AD DS database. The AD DS database uses Microsoft Jet database technology, and stores the directory information in the Ntds.dit file and associated log files. Those files are stored in the C:\Windows\NTDS folder by default. (Ntds.dit)

Domain Controller

This contains a copy of the AD DS database. For most operations, each domain controller can process changes and replicate the changes to all the other domain controllers in the domain.

Forest

This is a collection of domains that share a common AD DS.

Site

This is a collection of users, groups, and computers that are defined by their physical location. You can use sites to plan administrative tasks such as replication of changes to the AD DS database.

Global catalog server

This is a domain controller that hosts the global catalog, which is a partial, read-only copy of all the objects in the forest. A global catalog speeds up searches for objects that might be stored on domain controllers in a different domain in the forest.

Domain

This is a logical, administrative container for users and computers.

Partition

This is a section of the AD DS database. Although the database is one file named Ndts.dit, you view it, manage it, and replicate it as if it consists of distinct sections or instances. These are called partitions, which are also called naming contexts.

Read-only domain controller (RODC)

This is a special read-only installation of AD DS. RODCs are often used in branch offices where security and IT support are less advanced than in the main corporate centers.

Schema

This is the set of definitions of the object types and attributes that you use to create objects in AD DS.

service resource (SRV) records

specify information about available services, and are recorded in DNS for all domain controllers.