Active Directory Services – Part 02

During the COVID-19 pandemic, lots of businesses have started to collaborate with each other. Sometimes these businesses have had to share resources among them. For example, one company may want to access an Active Directory integrated web application of another company. In such a scenario, how can we grant access to the application with minimal effect? An Active Directory trust allows you to connect two different Active Directory domains/forests together and allows users to share resources among them. In this chapter, we will look into Active Directory trusts in detail.

In an Active Directory environment, each and every domain controller holds sensitive information about identities. Therefore, the security of domain controllers is crucial. With Windows Server 2008, Microsoft introduced read-only domain controllers (RODCs), which are ideal for sites where we can't guarantee physical security. In this chapter, we will learn about...

Active Directory trusts

I bought a new bicycle for my daughter on her last birthday. It's almost summer here in the UK and the weather is getting better. So, on a sunny Sunday evening, we wanted to go to Richmond Park so she could ride her new bike.

She asked if her friend Georgina could join us. I agreed and we all went to the park. Georgina liked my daughter's new bike very much. My daughter went ahead and asked her if she wanted to ride it. Once Georgina agreed, my daughter let her ride it. Georgina is her friend and she has known her for years. She trusts her and she was happy to share the bike with her. In the same way, modern businesses collaborate with each other more than ever. The rapid digital transformation of businesses due to the pandemic has opened up new areas of opportunities. As part of the collaboration process, sometimes it is required to share resources between organizations. This can be in the form of access to an application, access to data shares...

RODCs

RODC is a great role introduced with Windows Server 2008. RODCs can be used in locations where we cannot guarantee physical security and regular maintenance. Throughout this chapter, we have discussed possible scenarios where we have required a domain controller in a remote site. When considering a domain controller in a remote site, the link between sites is not the only thing we need to consider. A domain controller, by default, will be aware of any changes in the Active Directory structure. Once an update triggers, it updates its own copy of the Active Directory database. This ntds.dit file contains everything about the Active Directory infrastructure, including the data about the user objects. If this file falls into the wrong hands, they could retrieve data related to identities and compromise the identity infrastructure.

When considering information security, physical security is also important. That's why data centers have all sorts of security standards. So...

Active Directory database maintenance

Active Directory maintains a multi-master database to store schema information, configuration information, and domain information. Normally, when we say database, the first thing that comes to our mind is software such as Microsoft SQL, MySQL, or Oracle. But here, it's quite different. Active Directory databases use the Extensible Storage Engine (ESE), which is an Indexed and Sequential Access Method (ISAM) technology.

Here, a single system works as the client and server. It uses record-oriented database architecture, which provides extremely fast access to records. The ESE indexes the data in the database file, which can grow up to 16 terabytes and hold over 2 billion records. Typically, the ESE is used for applications that require fast and structured data storage. The ESE is used for many other Microsoft applications, including Microsoft Exchange, DHCP, and FRS.

As the database creation process is part of the domain controller...

Active Directory Backup and Recovery

Active Directory domain controllers are the main components responsible for the organization's identity infrastructure. Failure of the domain controllers or the services will impact the entire identity infrastructure. Therefore, as with any other critical system of a business, the Active Directory server's high availability is crucial. There are two types of disasters related to Active Directory domain controllers that can occur.

The first type of disaster is when there is a complete system crash due to faulty hardware. Apart from the Active Directory backup, maintaining multiple domain controllers helps organizations to recover from such situations. If it's not the flexible single master operation (FSMO) role holder, we can forcefully remove the crashed domain controller's related records and introduce a new domain controller. If it's the FSMO role holder, we can seize the FSMO roles and make them available from any...

Summary

We started this chapter by looking into Active Directory trusts, which enable collaboration between organizations. Then, we moved on to RODCs and looked into their features and deployment scenarios. Later, we looked into Active Directory database maintenance, which included different tools and techniques used to optimize Active Directory database performance. Last but not least, we looked at Active Directory recovery options.

In the next chapter, we are going to look into another important Active Directory role service: AD CS.