Active Directory Field Guide 1st Edition Laura E. Hunter 2024 scribd download
Active Directory Field Guide 1st Edition Laura E. Hunter 2024 scribd download
com
https://ebookname.com/product/active-directory-field-
guide-1st-edition-laura-e-hunter/
OR CLICK BUTTON
DOWNLOAD EBOOK
https://ebookname.com/product/active-directory-cookbook-3rd-edition-
laura-e-hunter/
ebookname.com
https://ebookname.com/product/configuring-symantec-antivirus-
corporate-edition-laura-e-hunter/
ebookname.com
https://ebookname.com/product/firewall-policies-and-vpn-
configurations-1st-edition-laura-e-hunter/
ebookname.com
https://ebookname.com/product/nucleosomes-histones-chromatin-
part-b-1st-edition-carl-wu-and-c-david-allis-eds/
ebookname.com
Public and Community Health Nursing Practice A Population
Based Approach 1st Edition Demetrius J. Porche
https://ebookname.com/product/public-and-community-health-nursing-
practice-a-population-based-approach-1st-edition-demetrius-j-porche/
ebookname.com
https://ebookname.com/product/wild-about-reptiles-crafts-for-kids-
kathy-ross/
ebookname.com
https://ebookname.com/product/ios-4-programming-cookbook-solutions-
examples-for-iphone-ipad-and-ipod-touch-apps-1st-edition-vandad-
nahavandipoor/
ebookname.com
https://ebookname.com/product/statistics-the-art-and-science-of-
learning-from-data-3rd-edition-edition-alan-agresti/
ebookname.com
The Writings of Henry Barrow 1590 1591 Elizabethan Non
Conformist Texts 1st Edition Henry Barrow
https://ebookname.com/product/the-writings-of-henry-
barrow-1590-1591-elizabethan-non-conformist-texts-1st-edition-henry-
barrow/
ebookname.com
Active Directory
Field Guide
Laura E. Hunter
Active Directory Field Guide
Copyright © 2005 by Laura E. Hunter
All rights reserved. No part of this work may be reproduced or transmitted in any form
or by any means, electronic or mechanical, including photocopying, recording, or by
any information storage or retrieval system, without the prior written permission of
the copyright owner and the publisher.
ISBN (pbk): 1-59059-492-4
Printed and bound in the United States of America 9 8 7 6 5 4 3 2 1
Trademarked names may appear in this book. Rather than use a trademark symbol
with every occurrence of a trademarked name, we use the names only in an editorial
fashion and to the benefit of the trademark owner, with no intention of infringement
of the trademark.
Lead Editor: Jim Sumser
Technical Reviewer: Alexander N. Nepomnjashiy
Editorial Board: Steve Anglin, Dan Appleman, Ewan Buckingham, Gary Cornell,
Tony Davis, Jason Gilmore, Jonathan Hassell, Chris Mills, Dominic Shakeshaft,
Jim Sumser
Assistant Publisher: Grace Wong
Project Manager: Beckie Stones
Copy Manager: Nicole LeClerc
Copy Editor: Ami Knox
Production Manager: Kari Brooks-Copony
Production Editor: Ellie Fountain
Compositor: Diana Van Winkle
Proofreader: Linda Marousek
Indexer: Kevin Broccoli
Artist: Diana Van Winkle
Cover Designer: Kurt Krames
Manufacturing Manager: Tom Debolski
Distributed to the book trade in the United States by Springer-Verlag New York, Inc.,
233 Spring Street, 6th Floor, New York, NY 10013, and outside the United States by
Springer-Verlag GmbH & Co. KG, Tiergartenstr. 17, 69112 Heidelberg, Germany.
In the United States: phone 1-800-SPRINGER, fax 201-348-4505, e-mail
[email protected], or visit http://www.springer-ny.com. Outside the
United States: fax +49 6221 345229, e-mail [email protected], or visit
http://www.springer.de.
For information on translations, please contact Apress directly at 2560 Ninth Street,
Suite 219, Berkeley, CA 94710. Phone 510-549-5930, fax 510-549-5939, e-mail
[email protected], or visit http://www.apress.com.
The information in this book is distributed on an “as is” basis, without warranty.
Although every precaution has been taken in the preparation of this work, neither the
author(s) nor Apress shall have any liability to any person or entity with respect to any
loss or damage caused or alleged to be caused directly or indirectly by the information
contained in this work.
For Mom, Dad, and Bryan
Contents at a Glance
INDEX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319
v
Contents
vii
viii ■ CONTENTS
■INDEX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319
About the Author
xi
About the Technical Reviewer
xiii
Acknowledgments
A project of this scope is never the work of just one individual, and I would
like to thank the following people who have been indispensable in nurturing
this book through to its final form:
• Everyone at Apress who took the time to make me feel like such a wel-
come addition to the family: Gary Cornell, Jim Sumser, Beckie Stones,
Tina Nielsen, Ellie Fountain, Ami Knox, Julie Miller, Glenn Munlawin,
and Jonathan Hassell, along with Alexzander Nepomnjashiy for his
outstanding insights as a technical reviewer.
• The wonderful people at Microsoft whom I’ve engaged with as a part of
the MVP program and otherwise: Emily Freet, John Buscher, Eddy Malik,
Christopher Corbett, Joseph Davies, Sean O’Driscoll, Susan Leiter, Can-
dice Pedersen, Jan Shanahan, Mark Mortimore, and Steve Riley.
• Members of the Microsoft MVP community who have impacted me
both professionally and personally: Steve Friedl, Susan Bradley, Joe
Richards, Don Wells, Jeremy Moskowitz, Mark Minasi, Mitch Ruebush,
Roger Abell, Thomas Lee, Charles Clarke, Roger Seielstad, Tony Murray,
Dèjì Akómöláfé, Robbie Allen, and Ron Chamberlin.
• And last but certainly not least, my family: Carol, Charles, John and Paula
Hunter, Stephanie Adams, Wayne Collins, Joey Huff, and Bryan Hopkins.
xv
Introduction
• Readers who have little or no Active Directory experience and who are
ready to make the transition from Windows NT 4.0
• Readers who have gained some Active Directory exposure either on the
job or through an AD tutorial, and who are seeking to expand their AD
administration repertoire
This book does not assume that you have any grounding in VBScript,
JScript, or any other language commonly used for administrative scripting,
though a little background knowledge does no harm. You’ll find several
examples of these types of scripts throughout the book, as well as a scripting
primer at the end of the final chapter.
xvii
xviii ■ INTRODUCTION
of resources, both print and online, that you can reference for more informa-
tion on a particular topic.
Here’s a summary of the contents of this book:
—Laura E. Hunter
CHAPTER 1
I ’m going to start things off literally at the beginning, by looking at the tasks
involved in installing Active Directory (AD). If you need to build a brand new
network from the ground up, you’ll find helpful advice on the Active Direc-
tory design process, as well as actual walk-throughs of the Active Directory
Installation Wizard and ways to automate the installation process. Even if
you’re working with a network that’s already been installed, you might still
find some useful nuggets here as we talk about the overall structure of Active
Directory forests, domain trees, and domains, and how to configure Global
Catalog servers and Flexible Single Master Operations role holders.
In this chapter, you’ll learn how to
OU OU
OU OU OU OU
Domain A Domain B
Forest
What it really boils down to is this: do you have groups and resources
that need to be isolated from the remainder of your network, or will it be
sufficient to simply delegate authority to different groups without needing
to draw such a distinct “line” in the administrative “sand”? You may have
different parts of your organization that require absolute isolation of their
data and resources from the rest of your network: this is often the case when
you’re dealing with extremely high-security installations, like government
organizations and companies dealing in sensitive research, or if you are deal-
ing with legal or regulatory stipulations that require you to fully separate out
different portions of your network. Conversely, your company may consist of
a number of different departments that need to operate independently from
one another, but are willing to be a part of a single shared infrastructure to
decrease costs and administrative overhead.
■Note Determining the number of forests you need can be a business or “political”
decision as much as it is a technical one. While you may not see the need for a particular
area of your company to have their own forest, management may see things differently.
It’s your job as an Active Directory consultant or administrator to point out the technical
ramifications of deploying multiple forests.
6 CHAPTER 1 ■ INSTALLING ACTIVE DIRECTORY
• company.com
• east.company.com
• mktg.east.company.com
• west.company.com
• ad.west.company.com
• airplanes.com
• finance.airplanes.com
• dev.airplanes.com
• research.airplanes.com
• sst.research.airplanes.com
In this case, you have a single Active Directory forest that contains two
domain trees: the company.com domain tree and the airplanes.com domain
tree. Even though the two domain trees don’t share a namespace, they can
still belong to the same forest. This will allow them to share the same schema,
Global Catalogs, and directory configuration. (The argument against multiple
domain trees is that, because the two domain trees are part of the same forest,
they do not have the same level of isolation that multiple forests would create.)
So when you’re planning your Active Directory network, be sure that you’re not
deploying multiple forests in a situation where multiple domain trees would
be more appropriate.
group resources based on the organization of your company, so that users and
objects in the department that requires isolation are all grouped into a single
forest. You can use trust relationships between forests if you have users in one
forest that need access to another one, so that administrators in each forest can
grant access to their forest resources to users in other forests. In Windows 2000,
you’ll need to set up one-way trust relationships between each forest that
requires trust access; Windows Server 2003 allows for two-way transitive trust
relationships between forests. So let’s say that you’re administering a network
that contains extremely sensitive Research & Development data that only a
small percentage of employees should have access to. You can create the com-
pany.corp forest for day-to-day access to file and print resources, and then a
company.dev forest that contains the sensitive R&D information. You can then
create a one-way trust relationship between the two forests, so that a researcher
with a user account in the company.corp forest will be able to access resources
in the company.dev forest using a single user account, without allowing users in
company.corp unnecessary access to information in the R&D forest.
For even better security, you can create a separate forest that doesn’t
have any trust relationships with the remainder of your network. For users
to access resources in this restricted forest, they will need to have an account
that was explicitly created for them within it. You can see where this can cre-
ate administrative headaches, since your users will now have two separate
usernames to juggle (with passwords that aren’t synchronized and may have
different complexity requirements and expiration settings); however, in
extremely high-security environments, this type of protection is sometimes
necessary. In our previous example, a researcher would require two user
accounts: [email protected] to access the company’s commonly accessi-
ble resources, and [email protected] to get into the R&D domain.
In case I haven’t fully made the point yet, managing and maintaining
multiple forests will create a great deal of administrative complexity for your
organization. All in all, there are two specific scenarios in which multiple
forests are a good idea; in all other cases, you should try to make a single for-
est model work. The two scenarios that are appropriate for a multiple forest
model are as follows:
• You need to create a small number of domains that have limited trust
relationships with each other, but are otherwise completely
autonomous.
• You are working with two existing organizations that already have their
own Active Directory forests in place.
8 CHAPTER 1 ■ INSTALLING ACTIVE DIRECTORY
Shortcut trusts require a bit more explanation, since they’re more a mat-
ter of efficiency than security. They’re used to shorten the amount of time
that it takes a user in one domain to access resources in a separate, trusted
domain. By default, trust relationships are verified along a trust path. Take as
an example a forest with two domain trees, as shown in Figure 1-2. If a group
of users in the sst.research.airplanes.com domain needs to access a file share
that’s located in the mktg.east.company.com domain, Active Directory will
verify each trust relationship from sst.research.airplanes.com all the way up
to the root of the domain tree. Then AD will verify the trust relationship
between the two domain tree roots: airplanes.com and company.com. After
that, the trust relationship will get verified down the company.com domain
tree to mktg.east.company.com.
airplanes.com company.com
■Note The lines in bold in Figure 1-2 indicate the default trust path.
If the users in question only need to access the domain in the other tree
once in a while, or if every domain is linked using high-speed connections,
the time it takes AD to go up and down the trust path will be negligible. But if
10 CHAPTER 1 ■ INSTALLING ACTIVE DIRECTORY
■Note You can also use sites within a single domain to control replication traffic, which
we’ll discuss in the “Creating the Physical Design” section later in the chapter.
B. Mechanische Fruchtabtreibungsmittel.
Zu den mechanischen
Fruchtabtreibungsmitteln müssen auch noch Blutentziehungen.
starke Blutentziehungen gerechnet werden, von denen insbesondere
der Aderlass verhältnissmässig häufig, seltener das Setzen von
Blutegeln in Anwendung gezogen wird.
Es kann nicht geleugnet werden, dass eine hochgradige, namentlich eine
plötzlich erzeugte Anämie den Abortus möglicherweise zu bewirken im Stande sein
wird, einestheils indem durch die Verminderung der Blutmenge der Mutter die
Respiration der Frucht leidet, andererseits weil eine plötzliche Anämie der
Nervencentren thatsächlich Uteruscontractionen hervorzurufen vermag, wie die
Versuche von O s e r und S c h l e s i n g e r , sowie unsere eigenen gezeigt haben.
Trotzdem wird es wohl nur ganz selten geschehen, dass durch Aderlässe etc. der
Anstoss zur Fehlgeburt gegeben wird, da bei diesen die Blutentleerung kaum je so
weit getrieben wird, dass dadurch entweder Lebensgefahr für die Frucht bedingt
oder eine Reizung der Centra der Uterusbewegung gesetzt wird, wie auch trotz der
Häufigkeit, in welcher Blutentziehungen zu Fruchtabtreibungszwecken in
Anwendung gezogen wurden, unseres Wissens kein Fall bekannt ist, in welchem
nur durch diese der Abortus hervorgerufen worden wäre. Im Gegentheil sah
M o r i c e a u bei zwei Individuen die Entbindung normal verlaufen, obgleich das eine
48mal, das andere 90mal sich während der Schwangerschaft zur Ader gelassen
hatte (G a l l a r d , pag. 23).
Nichtsdestoweniger sind diese Vorgänge von grosser forensischer Bedeutung,
weil der Befund von frischen Aderlasswunden oder Blutegelstichen häufig den
Verdacht bestärkt, dass die Betreffende Fruchtabtreibungsversuche unternommen
habe, besonders dann, wenn solche Befunde sich an Stellen ergeben, wo, wie z. B.
an den Füssen oder an den Genitalien, aus therapeutischen Zwecken selten oder
gar nicht Aderlässe oder Blutegel gesetzt werden.
Durch den elektrischen Strom, namentlich den
constanten, können Contractionen des Uterus Elektricität.
hervorgerufen werden und wurde derselbe bereits
wiederholt zur Einleitung der ärztlich indicirten Frühgeburt mit Erfolg angewendet,
so insbesondere von B a y e r (Zeitschr. für Geburtsh. und Gyn. XII und Prager med.
Wochenschr. 1889, Nr. 48). Die Kathode wurde in den Cervix eingeführt, die Anode
auf den Bauch oder die Kreuzbeingegend applicirt. Nach B a y e r ist dieses in den
meisten Fällen ein sicheres und absolut ungefährliches Mittel zur Einleitung der
künstlichen Frühgeburt, womit allerdings die Erfahrungen anderer Beobachter
(F r ä n k e l , B u m m , F l e i s c h m a n n , B r ü h l ) nicht ganz übereinstimmen. In Amerika
soll das Mittel zur Fruchtabtreibung nicht gar selten benützt werden. R o s e n s t i r n
(Virchow’s Jahresb. 1881, II, 562) erzählt von einer Dame, an welcher die
Operation in einem „elektrischen Bade“ geschah, wo ihr ein Strom von 60
Daniell’schen Elementen 10 Minuten lang vom Kreuzbein nach dem Introitus
vaginae durchgeleitet wurde. Der Abortus erfolgte am anderen Tage.