{"id":464,"date":"2017-03-28T10:01:09","date_gmt":"2017-03-28T10:01:09","guid":{"rendered":"http:\/\/imalogic.com\/blog\/?p=464"},"modified":"2017-06-29T06:30:06","modified_gmt":"2017-06-29T06:30:06","slug":"active-directory-overview","status":"publish","type":"post","link":"https:\/\/imalogic.com\/blog\/2017\/03\/28\/active-directory-overview\/","title":{"rendered":"Active Directory Overview"},"content":{"rendered":"

<\/p>\n

Introduction<\/h3>\n
Keeping track of everything on your network is a time-consuming task. Even on small networks, users tend to have difficulty finding network file and printer shares. Without some kind of network directory, medium and large networks are\u00a0<\/span><\/span><\/span>impossible<\/span><\/span><\/span><\/em>\u00a0to manage, and users will often have a difficult time finding resources on the network.<\/span><\/span><\/span><\/p>\n
A directory, in the most generic sense, is a comprehensive listing of objects. A phone book is a type of directory that stores information about people, businesses, and government organizations. Phone books typically record names, addresses, and phone numbers. Active Directory is similar to a phone book in several ways, and it is far more flexible. Active Directory will store information about organizations, sites, systems, users, shares, and just about any other network object that you can imagine. Not all objects are as similar to each other as those stored in the phone book, so Active Directory includes the ability to record different types of information about different objects. <\/span><\/span><\/span><\/p>\n

$\"\"$ <\/a><\/h3>\n
Active Directory stores information about network components. It allows clients to find objects within its\u00a0<\/span><\/span><\/span>namespace<\/span><\/span><\/span><\/em>. The term namespace (also known as\u00a0<\/span><\/span><\/span>console tree<\/span><\/span><\/span><\/em>) refers to the area in which a network component can be located. For example, the table of contents of this book forms a namespace in which chapters can be resolved to page numbers. <\/span><\/span><\/span><\/p>\n
DNS is a namespace that resolves host names to IP addresses. Telephone books provide a namespace for resolving names to telephone numbers. Active Directory provides a namespace for resolving the names of network objects to the objects themselves. Active Directory can resolve a wide range of objects, including users, systems, and services on a network.<\/span><\/span><\/span><\/p>\n
Everything that Active Directory tracks is considered an\u00a0<\/span><\/span><\/span>object<\/span><\/span><\/span><\/em>. <\/span><\/span><\/span><\/p>\n
\n
An <\/span><\/span><\/span>object<\/b><\/span><\/span><\/span> is any user, system, resource, or service tracked within Active Directory. The generic term\u00a0<\/span><\/span><\/span>object<\/span><\/span><\/span><\/em>\u00a0is used because Active Directory is capable of tracking a variety of items, and many objects can share common\u00a0<\/span><\/span><\/span>attributes<\/span><\/span><\/span><\/em>.*<\/span><\/span><\/span><\/li>\n
Attributes<\/b><\/span><\/span><\/span> describe objects in Active Directory. For example, all User objects share attributes to store a user name, full name, and description. Systems are also objects, but they have a separate set of attributes that include a host name, an IP address, and a location.<\/span><\/span><\/span><\/li>\n<\/ul>\n
\n
The set of attributes available for any particular object type is called <\/span><\/span><\/span>a<\/span><\/span><\/span>\u00a0<\/b><\/span><\/span><\/span>schema<\/b><\/span><\/span><\/span><\/em>. The schema makes object classes different from each other. Schema information is actually stored within Active Directory, which allows administrators to add attributes to object classes and have them distributed across the network to all corners of the domain, without restarting any domain controllers.<\/span><\/span><\/span><\/li>\n<\/ul>\n
\n
A\u00a0<\/span><\/span><\/span>container<\/b><\/span><\/span><\/span><\/em>\u00a0<\/span><\/span><\/span><\/em>is a special type of object used to organize Active Directory. It does not represent anything physical, like a user or a system. Instead, it is used to group other objects. Container objects can be nested within other containers.<\/span><\/span><\/span><\/li>\n<\/ul>\n
Each object in an Active Directory has a\u00a0<\/span><\/span><\/span>name<\/span><\/span><\/span><\/em>. These are not the names that you are accustomed to, like \u201cDavid\u201d or \u201cEric.\u201d They are LDAP\u00a0<\/span><\/span><\/span>distinguished names<\/span><\/span><\/span><\/em>. LDAP distinguished names are complicated, but they allow any object within a directory to be identified uniquely regardless of its type. My distinguished name on the Microsoft network is \u201c\/O=Internet\/DC=COM\/DC=Microsoft\/ DC=MSPress\/CN=Users\/CN=David Lovera\u201d\u2026but you can call me David.<\/span><\/span><\/span><\/p>\n
The term\u00a0<\/span><\/span><\/span>tree<\/b><\/span><\/span><\/span><\/em>\u00a0is used to describe a set of objects within Active Directory. When containers and objects are combined hierarchically, they tend to form branches\u2014hence the term. A related term is\u00a0<\/span><\/span><\/span>contiguous subtree<\/span><\/span><\/span><\/em>, which refers to an unbroken branch of the tree.<\/span><\/span><\/span><\/p>\n
Continuing the tree metaphor, the term\u00a0<\/span><\/span><\/span>forest<\/span><\/span><\/span><\/em>\u00a0describes trees that are not part of the same namespace but that share a common schema, configuration, and global catalog. Trees in a forest all trust each other, so objects in these trees are available to all users if the security allows it. Organizations that are divided into multiple domains should group the trees into a single forest.<\/span><\/span><\/span><\/p>\n
A\u00a0<\/span><\/span><\/span>site<\/span><\/span><\/span><\/em>\u00a0is a geographical location, as defined within Active Directory. Sites correspond to logical IP subnets, and as such, they can be used by applications to locate the closest server on a network. Using site information from Active Directory can profoundly reduce the traffic on wide area networks.<\/span><\/span><\/span><\/p>\n
<\/a> Security<\/h3>\n
Active Directory plays an important role in the future of Windows networking. Administrators must be able to protect their directory from attackers and users, while delegating tasks to other administrators where necessary. This is all possible using the Active Directory security model, which associates an access control list (ACL) with each container, object, and object attribute within the directory.<\/span><\/span><\/span><\/p>\n
This high level of control allows an administrator to grant individual users and groups varying levels of permissions for objects and their properties. Administrators can even add attributes to objects and hide those attributes from certain groups of users. For example, the administrator could set the ACLs such that only managers can view the home phone numbers of other users. Nonmanagers would not even know that the attribute existed. <\/span><\/span><\/span><\/p>\n
<\/a> Use of DNS (Domain Name System)<\/h3>\n
Domain Name System, or DNS, is necessary to any Internet-connected organization. DNS provides name resolution between common names, such as mspress.microsoft.com, and the raw IP addresses that network layer components use to communicate. Active Directory makes extensive use of DNS technology and relies on DNS to locate objects within Active Directory. This is a substantial change from previous Windows operating systems that require NetBIOS names to be resolved to IP addresses, and to rely on WINS or another NetBIOS name resolution technique.<\/span><\/span><\/span><\/p>\n
<\/a> Global Catalog<\/h3>\n
Active Directory provides a\u00a0<\/span><\/span><\/span>global catalog\u00a0<\/span><\/span><\/span><\/em>(GC). No, this does not mean that you can find any piece of information on the planet\u2014but it is still very significant. Active Directory provides a single source to locate any object within an organization\u2019s network.<\/span><\/span><\/span><\/p>\n
<\/a> Replication<\/h3>\n
Administrators who implement Active Directory will quickly discover that their network relies heavily on its services. This reliance means that Active Directory must be available on multiple servers\u2014so that if a single server fails, clients can contact a server with duplicate services and information.\u00a0<\/span><\/span><\/span><\/p>\n
One of the most complex parts of making redundant servers work properly is replicating the information and ensuring that all servers have the most up-to-date content. Active Directory uses\u00a0multimaster replication,<\/em>\u00a0which is another way of stating that updates can occur on any Active Directory server. Each server keeps track of which updates it has received from which servers, and can intelligently request only necessary updates in case of a failure. <\/span><\/span><\/span><\/p>\n
<\/a> Schema: Attributes and Object Classes<\/h3>\n
As I defined the term earlier, a schema is a set of attributes used to describe a particular object class in Active Directory. Different types of information need to be tracked for different object classes, and that\u2019s why the schema is so important. For example, the Users object class needs attributes for a first name, last name, phone number, e-mail address, and mailing address. The Printer object class must have many different attributes\u2014users will want to know how fast a printer is and whether it can duplex or print in color.\u00a0<\/span><\/span><\/span><\/p>\n
<\/a> Objects<\/h3>\n
Many people are initially confused by the relationship between object classes, attributes, and the objects themselves. Objects are created based on an object class. Attributes describe an object class. When an object is created, it inherits all the attributes of its object class. Here\u2019s where it gets tricky:\u00a0<\/span><\/span><\/span>object classes and attributes are also objects in Active Directory.\u00a0<\/span><\/span><\/span><\/em>Fortunately, most user interfaces hide this fact.<\/span><\/span><\/span><\/p>\n
<\/a>Lightweight Directory Access Protocol (LDAP)<\/h3>\n
Active Directory reflects Microsoft\u2019s trend toward relying on standard protocols. The Lightweight Directory Access Protocol (LDAP) is a product of the IETF (Internet Engineering Task Force). It defines how clients and servers exchange information about a directory. LDAP version 2 and version 3 are used by Windows 2000 Server\u2019s Active Directory.<\/span><\/span><\/span><\/p>\n
Distinguished Names<\/h3>\n
It is very important to understand the structure of distinguished names, as you will be referring to them often in the course of your job. My distinguished name is \/O=Internet\/DC=COM\/DC=Microsoft\/ DC=MSPress\/CN=Users\/CN=David Lovera.<\/span><\/span><\/span><\/p>\n
<\/a>ADSI (Active Directory Service Interface)<\/h3>\n
ADSI (Active Directory Service Interface) allows applications to interact with any directory service without being forced to know the internal details of the underlying protocols. Administrators can write programs and scripts that make use of ADSI to read or write to legacy Windows NT 4.0 directories, NetWare NDS directories, NetWare 3 binderies, and LDAP directories such as Active Directory. Developers can even create applications that make use of directories at the customer\u2019s site, without previous knowledge of the type of directory being used.<\/span><\/span><\/span><\/p>\n
For example, the following Microsoft Visual Basic code uses ADSI to display a list of users in the debug window:<\/span><\/span><\/span><\/p>\n
Set ou = GetObject(\"LDAP:\/\/dcserver\/OU=Sales,<\/span><\/span>\r\nDC=ArcadiaBay,DC=COM\")<\/span><\/span>\r\nFor Each obj In ou<\/span><\/span>\r\n Debug.Print obj.Name<\/span><\/span>\r\nNext<\/span><\/span><\/pre>\n
As you can see, gathering a list of users is much simpler than in previous Windows operating systems. ADSI makes use of the Component Object Model (COM), so almost any Windows development environment can immediately make use of the interface. Developers will be interested to know that they can access Active Directory through the LDAP C API and through MAPI, though ADSI is the preferred interface.<\/span><\/span><\/span><\/p>\n
e.g\u00a0: using ADSI in C++<\/span><\/span><\/span><\/p>\n
HRESULT hr;<\/span><\/span><\/span><\/span><\/span>\r\nIADs *pUser; <\/span><\/span><\/span>\r\n \r\n\/\/ Bind to user object.<\/span><\/span><\/span>\r\nhr = ADsGetObject(L<\/span><\/span>\"LDAP:\/\/CN=Jeff Smith,CN=Users,DC=fabrikam,DC=com\"<\/span><\/span><\/span>, IID_IADs, (<\/span><\/span>void<\/span><\/span><\/span>**)&pUser);<\/span><\/span><\/span>\r\n\r\nif<\/span>(SUCCEEDED(hr)) <\/span><\/span><\/span>\r\n{<\/span><\/span><\/span>\r\n BSTR bstrName;<\/span><\/span><\/span>\r\n\r\n \/\/ Get property.<\/span><\/span><\/span><\/span>\r\n hr = pUser->get_Name(&bstrName);<\/span><\/span><\/span>\r\n if<\/span><\/span><\/span>(SUCCEEDED(hr)) <\/span><\/span><\/span>\r\n {<\/span><\/span><\/span>\r\n wprintf(bstrName);<\/span><\/span><\/span>\r\n \r\n SysFreeString(bstrName);<\/span><\/span><\/span>\r\n }<\/span><\/span><\/span>\r\n\r\n pUser->Release();<\/span><\/span><\/span>\r\n}<\/span><\/span><\/span><\/pre>\n
\u00a0<\/p>\n<\/body>","protected":false},"excerpt":{"rendered":"
Introduction Keeping track of everything on your network is a time-consuming task. Even on small networks, users tend to have<\/p>\n","protected":false},"author":1,"featured_media":465,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[7],"tags":[73,24,74,34,75],"class_list":["post-464","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-coding","tag-active","tag-c","tag-directory","tag-microsoft","tag-windows"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/imalogic.com\/blog\/wp-content\/uploads\/2017\/06\/microsoft-active-directory_102642.png?fit=200%2C200&ssl=1","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p8J21V-7u","jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/imalogic.com\/blog\/wp-json\/wp\/v2\/posts\/464","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/imalogic.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/imalogic.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/imalogic.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/imalogic.com\/blog\/wp-json\/wp\/v2\/comments?post=464"}],"version-history":[{"count":1,"href":"https:\/\/imalogic.com\/blog\/wp-json\/wp\/v2\/posts\/464\/revisions"}],"predecessor-version":[{"id":469,"href":"https:\/\/imalogic.com\/blog\/wp-json\/wp\/v2\/posts\/464\/revisions\/469"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/imalogic.com\/blog\/wp-json\/wp\/v2\/media\/465"}],"wp:attachment":[{"href":"https:\/\/imalogic.com\/blog\/wp-json\/wp\/v2\/media?parent=464"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/imalogic.com\/blog\/wp-json\/wp\/v2\/categories?post=464"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/imalogic.com\/blog\/wp-json\/wp\/v2\/tags?post=464"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

Distinguished Names<\/h3>\nIt is very important to understand the structure of distinguished names, as you will be referring to them often in the course of your job. My distinguished name is \/O=Internet\/DC=COM\/DC=Microsoft\/ DC=MSPress\/CN=Users\/CN=David Lovera.<\/span><\/span><\/span><\/p>\n

Distinguished Names<\/h3>\n
It is very important to understand the structure of distinguished names, as you will be referring to them often in the course of your job. My distinguished name is \/O=Internet\/DC=COM\/DC=Microsoft\/ DC=MSPress\/CN=Users\/CN=David Lovera.<\/span><\/span><\/span><\/p>\n