You're reading from Mastering Active Directory, Third Edition - Third Edition

Product typeBook

Published inNov 2021

PublisherPackt

ISBN-139781801070393

Edition3rd Edition

Tools

Active Directory Domain Services

Concepts

Networking

Author (1)

Dishan Francis

Designing an Active Directory Infrastructure

The Active Directory (AD) role installation process has been made easy in the last few versions of Windows Server operating systems. Even if you don't have advanced knowledge of AD, with a few clicks, you can install an Active Directory Domain Services (AD DS) role on a server. But there is a lot more to think about before you install your first domain controller in an IT infrastructure. First, we need to evaluate our business requirements. We need to evaluate our security/compliance requirements, and then we can decide what AD features/services to enable and where to place them in the infrastructure. We need to get the fundamentals of the design correct before the implementation phase.

In this chapter, we are going to learn how to design an On-prem and Hybrid identity Infrastructure properly. In the design phase, we will be looking at information gathering techniques, risk mitigation, capacity planning, component placement, and...

What makes a good system?

Fish-keeping is an interesting hobby and when I was a kid I really enjoyed it. I had a to identify issues few fish tanks with different varieties of fish. Me and my dad used to make the fish tanks at home. Before creating a tank, first, we'd decide what size of tank we needed. The type and the thickness of the glass depended on the capacity of the tank. Then we needed the correct glue to assemble the tank.

When assembling, the main goal was to make it waterproof. However, even though we used the correct materials and equipment, it wasn't always waterproof on the first attempt. If there was a leak, we needed to go back and fix it. Once the tank was completely waterproof, we would think about creating a roof, lighting, and decorating inside the tank.

When we are designing a system, it is much like waterproofing a fish tank or a boat. We may not succeed on the first attempt. We need to leave room for faults. We may have to revisit the same...

Gathering business requirements

Before we start to figure out how many forests, domains, and domain controllers to create, we need to gather some data to help us make an accurate design that agrees with the core business requirements.

Understanding the organizational structure correctly is vital to designing any access management system. An organizational chart is a good place to start with. It will give you an idea of to whom you need to talk to collect the relevant data that will help your design.

For example, if you need to know what your software development department requires from the directory services, the best person to talk to will be the technical lead or architect of the team. They will be able to give you the exact answer you are looking for. If you ask the same question to the managing director, the answer may not be that accurate. So, before you seek the answers to your questions, you need to find the correct source.

When we gather business requirements...

Designing the forest structure

The Active Directory design starts with designing the forest structure. The Active Directory forest is the security boundary for the identity infrastructure. When you deploy the first domain controller in your infrastructure, it creates a forest as well. Every Active Directory infrastructure has at least one forest.

There are two types of forest implementations:

Single forest
Multiple forests

The type of the forest is decided based on many things, such as the size of the company, legal requirements, operation requirements, mergers and acquisitions, resource isolation, and so on.

Single forest

A single forest deployment is the default deployment mode. Most business models fit into the single forest model. The complexity and cost of implementation are low in this model. One of the main things you need to consider in this mode is replication. Domains are used to partition the directory and manage the replication. But...

Creating the forest structure

Once the forest mode has been decided on, the next step is to create the forest structure. In order to do that, we need to decide whether we are going to achieve autonomy or isolation.

Autonomy

Autonomy gives you independent control over resources. An Active Directory environment that is focused on autonomy will help administrators manage the resources independently, but there will be more privileged administrators who can manage the resources and privileges of other administrators.

There are two types of autonomy:

Service autonomy: This will provide privileges to an individual or a group of administrators to control the service level of AD DS fully or partially. For example, it will allow administrators to add or remove domain controllers, modify the Active Directory schema, and modify DNS without the forest owner.
Data autonomy: This will provide privileges to an individual or a group of administrators to control data stored...

Selecting forest design models

Once the forest model and the number of forests have been decided, the next step is to select forest design models. There are three forest design models: organizational, resource, and restricted.

The organizational forest model

In an organizational forest model, resources, data, and identities will stay in separate forests and will be managed independently. This model can be used to provide service autonomy, service isolation, or data isolation:

Figure 3.1: Organizational forest model example

In the preceding example, Rebeladmin Corp. and My training are two companies under the same mother company. Due to the operation requirements, it needs service isolation. In order to do that, engineers have created two separate forests. Each company has its own IT department and manages resources and identities independently. If resources need to be shared between two forests, that can be done via a cross-forest trust.

The resource forest...

Designing the domain structure

Every AD DS forest has at least one domain. When you set up your first domain forest, it will also become the default domain. There are a few reasons why you will need to consider having multiple domains in a forest:

Smaller administrative boundaries: Active Directory is capable of managing nearly 2 billion objects. Having a large directory creates administrative nightmares. Imagine managing a large herd of sheep. As the herd grows, shepherds need to put in more and more effort to manage it. Predators will also take advantage of it, and, sometimes, shepherds may not notice missing sheep as they are too busy managing the herd. Instead of managing a large number of sheep together, isn't it easier if each shepherd manages smaller herds? Domains will help set smaller administrative boundaries and smaller management targets. This will help manage organization resources efficiently.
Replication: Every domain in the Active Directory forest...

Deciding on the domain and forest functional levels

Once the domain and forest designs are ready, the next step is to decide on the forest and domain functional levels. The forest and domain functional levels define the AD DS features that can be used in the identity infrastructure. You cannot have AD DS 2022 features if your organization level is running on the Windows Server 2012 domain and forest functional levels. When you add the domain controller to the existing forest or domain, it will automatically match the existing forest and domain functional level.

There are a couple of things you need to consider when you're deciding on the forest and domain functional levels:

Existing domain controllers: It is always good to run the latest and greatest functional levels, but it isn't always practical. The lowest domain controller version in the domain decides the maximum forest and domain function you can have without an upgrade. As an example, in your domain...

Designing the OU structure

In Active Directory, there are different types of objects, such as user accounts, groups, and devices. It is important to manage them effectively. OUs can group objects that have similar administrative and security requirements within the domain. Organizational units are also used to delegate the administration of objects and apply group policies.

OU design changes are less complex compared to domain and forest level structure changes. When you move objects from one OU to another, they will inherit the security settings and group policies that are applied to the destination OU. Moving an object will not move any settings it has at the source OU level.

The domain administrators can delegate permission to users to become OU administrators. OU administrators can manage objects and manage policies within the OU. They can also create child OUs and delegate permissions to another user/users to manage child OU objects. OU administrators will not have control...

Designing the physical topology of Active Directory

Designing a hybrid identity

There are many reasons why organizations look to extend their On-prem AD to Azure AD. Let's look into some of those reasons:

Cloud application (SaaS) adoption: Organizations use different types of applications for their operations (On-prem). Most standalone applications are easy to manage and maintain, but some applications have complexities. Some applications require lots of resources. SAP applications are a great example. SAP applications depend on a few components such as database servers, application servers, and front-end servers. If any of these components fail, the whole application fails too. Therefore, you need to plan for high availability on top of that. Now, more and more vendors are taking away this burden from customers and offer cloud versions of applications instead of On-prem ones. By doing this, organizations don't have to worry about scalability, availability, and maintenance. The application will be available for...

Identifying business needs

If I go to the Auto Trader website and just search for a car, I'll receive more than 400,000 results. It would be impossible to go through all of those to find the car I have in mind. But if I, say, want a BMW 4 series, automatic, 2020 build, it is very easy to find the one I need. As long as we express our requirements correctly and as long as the supplier captures them correctly, we will get the solution we are looking for.

Business needs in organizations come in different forms. They can be in the form of operation improvements, strategy changes, or compliance/security requirements. In order to provide the appropriate solution, we need to know the ins and outs of the requirement. This is the most challenging phase of the design process for engineers. This always starts with some sort of communication between engineers and the business owner, director, manager, or department head. Some of them may not be technical enough to explain what exactly...

Summary

Design, implementation, and maintenance are key stages of any successful service deployment. In this chapter, we learned how to design the Active Directory infrastructure according to industry standards and best practices. The Active Directory infrastructure has two types of components: logical and physical. In this chapter, we learned about the design and placement of both types. As part of the design exercise, we also learned how to gather business data, how to identify risks, and how to do sizing.

We also looked into the design process of a hybrid identity. Here, we learned why a hybrid identity is important and what we need to consider during the design phase. We also learned how we can gather the required information from businesses using questionnaires.

In the next chapter, we are going to look into the DNS, which is the naming system for infrastructures.

The rest of the chapter is locked

You have been reading a chapter from

Mastering Active Directory, Third Edition - Third Edition

Published in: Nov 2021Publisher: PacktISBN-13: 9781801070393

A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.

undefined

Unlock this book and the full library FREE for 7 days

Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of

Start free trial

Renews at $15.99/month. Cancel anytime

Author (1)

Dishan Francis

Dishan Francis is an IT professional with over 15 years of experience. He was a six-time Microsoft MVP in enterprise mobility before he joined Microsoft UK as a security consultant. He has maintained the RebelAdmin technology blog over the years, with lots of useful articles that focus on on-premises Active Directory services and Azure Active Directory. He has also written for other Microsoft-managed blogs such as canitpro and ITopsTalk. When it comes to managing innovative identity infrastructure solutions to improve system stability, efficiency, and security, his level of knowledge and experience places him among the very best in the field.
Read more about Dishan Francis

Personalised recommendations for you

Based on your interests and search pattern

Designing and Implementing Microsoft Azure Networking Solutions

Designing and Implementing Microsoft Azure Networking Solutions Exam Ref AZ-700 is an all-encompassing guide to the AZ-700 exam and contains all the information you need to succeed in the world of virtual networking with Azure. With this book, you will be fully prepared for the exam and the world of cloud networking.

BookAug 2023524 pages

Microsoft 365 Security, Compliance, and Identity Administration

The Microsoft 365 Security, Compliance, and Identity Administration is a comprehensive guide that helps you employ Microsoft 365's robust suite of features and empowers you to optimize your administrative tasks.

BookAug 2023630 pages

Zero Trust Overview and Playbook Introduction

Get started on Zero Trust with this step-by-step playbook and learn everything you need to know for a successful Zero Trust journey with tailored guidance for every role, covering strategy, operations, architecture, implementation, and measuring success. This book will become an indispensable reference for everyone in your organization.

BookOct 2023240 pages

The Self-Taught Cloud Computing Engineer

This self-study book helps you master multiple clouds, including AWS, Azure, and GCP, and serves as a roadmap to becoming a certified cloud computing expert. The book will guide you to develop a professional cloud career by helping you build a broad cloud knowledge base, developing hands-on cloud computing skills, and getting cloud certified.

BookSep 2023472 pages

Technology Operating Models for Cloud and Edge

This book will help you build and create ownership of a technology operating model, as well as connect your leadership with engineering and operations, keeping your internal and external customers in mind. It provides practical tips on why, where, and how to make the cloud and edge platform paradigm sing for you, your team, and your organization.

BookAug 2023228 pages

Azure Architecture Explained

Azure is the preferred platform to build mission-critical and secure apps. This book provides comprehensive coverage of essential Azure products, services, and solutions vital for every solution architect's success. Elevate your knowledge and master the critical components of Azure to excel in your role with Azure Architecture Explained.

BookSep 2023446 pages

Pentesting Active Directory and Windows-based Infrastructure

This practical guide helps you explore the pentesting of Microsoft infrastructure in detail, and enhances your offensive skillset by showing you the different ways to perform security assessment. This book will help blue teamers and IT engineers get up to speed with possible security issues they may encounter in their Windows environments.

BookNov 2023360 pages

Practical Ansible

In Practical Ansible, you'll work with the latest release of Ansible and learn to solve complex issues quickly with the help of task-oriented scenarios. You'll start by installing and configuring Ansible to automate monotonous and repetitive IT tasks and get to grips with concepts such as playbooks, inventories, plugins, collections, and network modules.

BookSep 2023420 pages

Windows 11 for Enterprise Administrators

Microsoft’s launch of Windows 11 is a step toward satisfying the enterprise administrator’s needs for better management and enhanced user experience customization. This book provides the enterprise administrator with the knowledge needed to fully utilize the advanced feature set of Windows 11 Enterprise.

BookOct 2023286 pages

The Linux DevOps Handbook

This book is for software and IT professionals seeking knowledge on Linux systems and DevOps practices. This book will provide you with guidance and tools to learn and gain proficiency in managing Linux-based infrastructures and knowledge of DevOps.

BookNov 2023428 pages2

Dos	Don'ts
Run domain controllers in different virtualized clusters in different data centers in order to avoid a single point of failure.	Don't save the Active Directory database and log files on virtual IDE disks. For durability, save them on a VHD that's attached to a virtual SCSI controller.
Virtual hard disks (VHDs) security is important as copied VHDs can map to a computer and read the data inside it. If someone unauthorized gains access to `ntds.dit`, it will expose the identities. We can use encryption services to do server-side disk encryption with customer-managed keys.
Disable time synchronization between...