Active Directory. Designing, Deploying, and Running Active Directory. 5th Edition - Helion

ebook

Autor: Brian Desmond, Joe Richards, Robbie Allen
ISBN: 978-14-493-6986-6
stron: 738, Format: ebook
Data wydania: 2013-04-11
Księgarnia: Helion

Cena książki: 186,15 zł (poprzednio: 216,45 zł)
Oszczędzasz: 14% (-30,30 zł)

Osoby, które kupiły tę książkę, wybierały także »

Organize your network resources by learning how to design, manage, and maintain Active Directory. Updated to cover Windows Server 2012, the fifth edition of this bestselling book gives you a thorough grounding in Microsoft’s network directory service by explaining concepts in an easy-to-understand, narrative style.

You’ll negotiate a maze of technologies for deploying a scalable and reliable AD infrastructure, with new chapters on management tools, searching the AD database, authentication and security protocols, and Active Directory Federation Services (ADFS). This book provides real-world scenarios that let you apply what you’ve learned—ideal whether you’re a network administrator for a small business or a multinational enterprise.

Upgrade Active Directory to Windows Server 2012
Learn the fundamentals, including how AD stores objects
Use the AD Administrative Center and other management tools
Learn to administer AD with Windows PowerShell
Search and gather AD data, using the LDAP query syntax
Understand how Group Policy functions
Design a new Active Directory forest
Examine the Kerberos security protocol
Get a detailed look at the AD replication process

Osoby które kupowały "Active Directory. Designing, Deploying, and Running Active Directory. 5th Edition", wybierały także:

Windows Media Center. Domowe centrum rozrywki 66,67 zł, (8,00 zł -88%)
Ruby on Rails. Ćwiczenia 18,75 zł, (3,00 zł -84%)
Przywództwo w świecie VUCA. Jak być skutecznym liderem w niepewnym środowisku 58,64 zł, (12,90 zł -78%)
Scrum. O zwinnym zarządzaniu projektami. Wydanie II rozszerzone 58,64 zł, (12,90 zł -78%)
Od hierarchii do turkusu, czyli jak zarządzać w XXI wieku 58,64 zł, (12,90 zł -78%)

Spis treści

Active Directory. Designing, Deploying, and Running Active Directory. 5th Edition eBook -- spis treści

Active Directory
Preface
- 1. Intended Audience
- 2. Contents of the Book
- 3. Conventions Used in This Book
- Using Code Examples
- Safari Books Online
- How to Contact Us
- 4. Acknowledgments
  - For the Fourth and Fifth Editions (Brian)
  - For the Third Edition (Joe)
  - For the Second Edition (Robbie)
  - For the First Edition (Alistair)
- Content Updates
  - May 15, 2013
1. A Brief Introduction
- 1.1. Evolution of the Microsoft NOS
  - A Brief History of Directories
- 1.2. Summary
2. Active Directory Fundamentals
- 2.1. How Objects Are Stored and Identified
  - Uniquely Identifying Objects
    - Distinguished names
    - Examples
- 2.2. Building Blocks
  - Domains and Domain Trees
  - Forests
  - Organizational Units
  - The Global Catalog
  - Flexible Single Master Operator (FSMO) Roles
  - Time Synchronization in Active Directory
  - Domain and Forest Functional Levels
    - Windows 2000 domain mode
  - Groups
    - Group membership across domain boundaries
    - Converting groups
- 2.3. Summary
3. Active Directory Management Tools
- 3.1. Management Tools
  - Active Directory Administrative Center
    - PowerShell History
    - Global Search
    - Multiple-domain support
    - Extensibility
  - Active Directory Users and Computers
    - Advanced Features
    - Saved Queries
    - Controlling drag-and-drop moves
    - Taskpads
  - ADSI Edit
  - LDP
- 3.2. Customizing the Active Directory Administrative Snap-ins
  - Display Specifiers
  - Property Pages
  - Context Menus
  - Icons
  - Display Names
  - Object Creation Wizard
- 3.3. Active Directory PowerShell Module
- 3.4. Best Practices Analyzer
- 3.5. Active Directory-Based Machine Activation
- 3.6. Summary
4. Naming Contexts and Application Partitions
- 4.1. Domain Naming Context
- 4.2. Configuration Naming Context
- 4.3. Schema Naming Context
- 4.4. Application Partitions
  - Storing Dynamic Data
- 4.5. Summary
5. Active Directory Schema
- 5.1. Structure of the Schema
  - X.500 and the OID Namespace
- 5.2. Attributes (attributeSchema Objects)
  - Dissecting an Example Active Directory Attribute
- 5.3. Attribute Properties
  - Attribute Syntax
  - systemFlags
    - Constructed attributes
    - Category 1 objects
  - schemaFlagsEx
  - searchFlags
    - Indexed attributes
    - Ambiguous name resolution
    - Preserving attributes in a tombstone
    - The subtree index
    - The tuple index
    - Confidentiality
    - Attribute change auditing
    - The filtered attribute set
  - Property Sets and attributeSecurityGUID
  - Linked Attributes
  - MAPI IDs
- 5.4. Classes (classSchema Objects)
  - Object Class Category and Inheritance
  - Dissecting an Example Active Directory Class
    - How inheritance affects mustContain, mayContain, possSuperiors, and auxiliaryClass
    - Viewing the user class with the Active Directory Schema snap-in
  - Dynamically Linked Auxiliary Classes
- 5.5. Summary
6. Site Topology and Active Directory Replication
- 6.1. Site Topology
  - Site and Replication Management Tools
  - Subnets
    - Managing subnets
    - Troubleshooting subnet data problems
  - Sites
    - Managing sites
  - Site Links
    - Managing site links
  - Site Link Bridges
  - Connection Objects
  - Knowledge Consistency Checker
- 6.2. How Replication Works
  - A Background to Metadata
    - Update sequence numbers (USNs) and highestCommittedUSN
    - Originating updates versus replicated updates
    - DSA GUIDs and invocation IDs
    - High-watermark vector (direct up-to-dateness vector)
    - Up-to-dateness vector
    - Recap
  - How an Objects Metadata Is Modified During Replication
    - Step 1: Initial creation of a user on Server A
    - Step 2: Replication of the originating write to DC B
    - Step 3: Password change for the user on DC B
    - Step 4: Password-change replication to DC A
  - The Replication of a Naming Context Between Two Servers
    - Step 1: Replication with a partner is initiated
    - Step 2: The partner works out what updates to send
    - Step 3: The partner sends the updates to the initiating server
    - Step 4: The initiating server processes the updates
    - Step 5: The initiating server checks whether it is up to date
    - Recap
  - How Replication Conflicts Are Reconciled
    - Conflict due to identical attribute change
    - Conflict due to a move or creation of an object under a now-deleted parent
    - Conflict due to creation of objects with names that conflict
    - Replicating the conflict resolution
- 6.3. Common Replication Problems
  - Lingering Objects
  - USN Rollback
- 6.4. Summary
7. Searching Active Directory
- 7.1. The Directory Information Tree
  - Database Structure
    - Hidden table
    - Data table
    - Link table
    - Security descriptor table
- 7.2. Searching the Database
  - Filter Operators
  - Connecting Filter Components
  - Search Bases
  - Modifying Behavior with LDAP Controls
- 7.3. Attribute Data Types
  - Dates and Times
  - Bit Masks
  - The In-Chain Matching Rule
- 7.4. Optimizing Searches
  - Efficient Searching
    - Using the stats control
  - objectClass Versus objectCategory
- 7.5. Summary
8. Active Directory and DNS
- 8.1. DNS Fundamentals
  - Zones
  - Resource Records
  - Client Lookup Process
  - Dynamic DNS
  - Global Names Zones
- 8.2. DNSSEC
  - How Does DNSSEC Work?
    - Resource records
    - Lookup process
  - Configuring DNSSEC for Active Directory DNS
- 8.3. DC Locator
- 8.4. Resource Records Used by Active Directory
  - Overriding SRV Record Registration
- 8.5. Delegation Options
  - Not Delegating the AD DNS Zones
    - Political factors
    - Initial setup and configuration
    - Support and maintenance
    - Integration issues
  - Delegating the AD DNS Zones
    - Political factors
    - Initial setup and configuration
    - Support and maintenance
    - Integration issues
- 8.6. Active Directory-Integrated DNS
  - Replication Impact
  - Background Zone Loading
- 8.7. Using Application Partitions for DNS
- 8.8. Aging and Scavenging
  - Configuring Scavenging
    - Setting zone-specific options
    - Enabling scavenging on the DNS server
- 8.9. Managing DNS with Windows PowerShell
- 8.10. Summary
9. Domain Controllers
- 9.1. Building Domain Controllers
  - Deploying with Server Manager
  - Using DCPromo on Earlier Versions of Windows
  - Automating the DC Build Process
- 9.2. Virtualization
  - When to Virtualize
  - Impact of Virtualization
    - USN rollback
    - RID pool reuse
    - System clock changes
  - Virtualization Safe Restore
  - Cloning Domain Controllers
    - The DC cloning process
    - Cloning a domain controller
- 9.3. Read-Only Domain Controllers
  - Prerequisites
  - Password Replication Policies
    - Managing the password replication policy
    - Managing the loss of an RODC
  - The Client Logon Process
    - Populating the password cache
  - RODCs and Write Requests
    - User password changes
    - Computer account password changes
    - The lastLogonTimeStampAttribute
    - Last-logon statistics
    - Logon success/failure information
    - NetLogon secure channel updates
    - Replication connection objects
    - DNS updates
  - The W32Time Service
  - Application Compatibility
  - RODC Placement Considerations
  - Administrator Role Separation
  - Promoting an RODC
    - Prestaging RODC domain controller accounts
- 9.4. Summary
10. Authentication and Security Protocols
- 10.1. Kerberos
  - User Logon
  - Service Access
    - Service principal names
    - Service tickets
  - Application Access
  - Logon and Service Access Summary
  - Delegation and Protocol Transition
    - Delegation
    - Protocol Transition
- 10.2. Authentication Mechanism Assurance
- 10.3. Managed Service Accounts
  - Preparing for Group Managed Service Accounts
  - Using Group Managed Service Accounts
- 10.4. Summary
11. Group Policy Primer
- 11.1. Capabilities of Group Policy Objects
  - Group Policy Storage
    - ADM or ADMX files
    - How GPOs are stored in Active Directory
    - Group Policy replication
- 11.2. How Group Policies Work
  - GPOs and Active Directory
  - Prioritizing the Application of Multiple Policies
  - Standard GPO Inheritance Rules in Organizational Units
  - Blocking Inheritance and Overriding the Block in Organizational Unit GPOs
    - Summary
  - When Policies Apply
    - Group Policy Refresh Frequency
  - Combating Slowdown Due to Group Policy
    - Limiting the number of GPOs that apply
    - Limiting cross-domain linking
    - Limiting use of site policies
    - Use simple queries in WMI filters
  - Security Filtering and Group Policy Objects
  - Loopback Merge Mode and Loopback Replace Mode
  - Summarizing Group Policy Application
  - WMI Filtering
  - Group Policy
- 11.3. Managing Group Policies
  - Using the Group Policy Management Console
  - Using the Group Policy Management Editor
  - Group Policy Preferences
    - Deploying group policy preferences
    - Item-Level Targeting
  - Running Scripts with Group Policy
  - Group Policy Modeling
  - Delegation and Change Control
    - The importance of change-control procedures
    - Designing the delegation of GPO administration
  - Using Starter GPOs
  - Group Policy Backup and Restore
  - Scripting Group Policy
- 11.4. Troubleshooting Group Policy
  - Group Policy Infrastructure Status
  - Group Policy Results Wizard
  - Forcing Group Policy Updates
  - Enabling Extra Logging
    - Group Policy Logging in Windows 2000, Windows XP, and Windows Server 2003
    - Group Policy Logging in Windows Vista/Windows Server 2008 and Newer
  - Group Policy Diagnostic Best Practices Analyzer
  - Third-Party Troubleshooting Tools
- 11.5. Summary
12. Fine-Grained Password Policies
- 12.1. Understanding Password Settings Objects
- 12.2. Scenarios for Fine-Grained Password Policies
  - Defining Password Settings Objects
    - Defining PSO precedence
- 12.3. Creating Password Settings Objects
  - PSO Quick Start
  - Building a PSO from Scratch
    - Creating a PSO with the Active Directory Administrative Center
    - Creating a PSO with PSOMgr
- 12.4. Managing Password Settings Objects
  - Strategies for Controlling PSO Application
    - Applying PSOs to groups
    - Applying PSOs to users
    - Mixing group application and user application
  - Managing PSO Application
    - Applying a PSO with ADAC
    - Applying a PSO with ADSI Edit
    - Applying a PSO with ADUC
    - Applying a PSO with PSOMgr
    - Viewing the effective PSO
- 12.5. Delegating Management of PSOs
- 12.6. Summary
13. Designing the Active Directory Structure
- 13.1. The Complexities of a Design
- 13.2. Where to Start
- 13.3. Overview of the Design Process
- 13.4. Domain Namespace Design
  - Objectives
    - Represent the structure of your business
  - Step 1: Decide on the Number of Domains
    - Isolated replication
    - Unique domain policy
    - Final notes
  - Step 2: Design and Name the Tree Structure
    - Choose the forest root domain
    - Design the namespace naming scheme
    - Create additional trees
    - Create additional forests
    - Arrange the subdomain hierarchy
- 13.5. Design of the Internal Domain Structure
  - Step 3: Design the Hierarchy of Organizational Units
    - Recreating the business model
    - Delegating full administration
    - Delegating other rights
  - Step 4: Design the Workstation and Server Naming Conventions
  - Step 5: Plan for Users and Groups
    - Naming and placing users
    - Naming and placing groups
- 13.6. Other Design Considerations
- 13.7. Design Examples
  - Tailspin Toys
    - Step 1: Decide on the number of domains
    - Step 2: Design and name the tree structure
    - Step 3: Design the hierarchy of organizational units
    - Step 4: Design the workstation and server naming conventions
    - Step 5: Plan for users and groups
  - Contoso College
    - Step 1: Decide on the number of domains
    - Step 2: Design and name the tree structure
    - Step 3: Design the hierarchy of organizational units
    - Step 4: Design the workstation and server naming conventions
    - Step 5: Plan for users and groups
  - Fabrikam
    - Step 1: Decide on number of domains
    - Step 2: Design and name the tree structure
    - Step 3: Design the hierarchy of organizational units
    - Step 4: Design the workstation and server naming conventions
    - Step 5: Plan for users and groups
- 13.8. Recognizing Nirvanas Problems
- 13.9. Summary
14. Creating a Site Topology
- 14.1. Intrasite and Intersite Topologies
  - The KCC
  - Automatic Intrasite Topology Generation by the KCC
    - Two servers
    - Three servers
    - Four servers
    - Eight servers
    - Now what?
  - Site Links: The Basic Building Blocks of Intersite Topologies
    - Cost
    - Schedule
    - Transport
    - When the ISTG becomes involved
  - Site Link Bridges: The Second Building Blocks of Intersite Topologies
- 14.2. Designing Sites and Links for Replication
  - Step 1: Gather Background Data for Your Network
  - Step 2: Plan the Domain Controller Locations
    - Where to put domain controllers
    - How many domain controllers to have
    - Placing a domain controller in more than one site
  - Step 3: Design the Sites
  - Step 4: Create Site Links
  - Step 5: Create Site Link Bridges
- 14.3. Design Examples
  - Tailspin Toys
    - Step 1: Gather background data for your network
    - Step 2: Plan the domain controller locations
    - Step 3: Design the sites
    - Step 4: Create site links
  - Contoso College
    - Step 1: Gather background data for your network
    - Step 2: Plan the domain controller locations
    - Step 3: Design the sites
    - Step 4: Create site links
  - Fabrikam
    - Step 1: Gather background data for your network
    - Step 2: Plan the domain controller locations
    - Step 3: Design the sites
    - Step 4: Create site links
- 14.4. Additional Resources
- 14.5. Summary
15. Planning for Group Policy
- 15.1. Using GPOs to Help Design the Organizational Unit Structure
  - Identifying Areas of Policy
  - Guidelines for Designing GPOs
- 15.2. Design Examples
  - Tailspin Toys
  - Contoso College
  - Fabrikam
- 15.3. Summary
16. Active Directory Security: Permissions and Auditing
- 16.1. Permission Basics
  - Permission ACEs
  - Property Sets, Validated Writes, and Extended Rights
  - Inherited Versus Explicit Permissions
  - Default Security Descriptors
  - Permission Lockdown
  - The Confidentiality Bit
  - Protecting Objects from Accidental Deletion
- 16.2. Using the GUI to Examine Permissions
  - Reverting to the Default Permissions
  - Viewing the Effective Permissions for a User or Group
  - Using the Delegation of Control Wizard
- 16.3. Using the GUI to Examine Auditing
- 16.4. Designing Permissions Schemes
  - The Five Golden Rules of Permissions Design
    - Rule 1: Apply permissions to groups whenever possible
    - Rule 2: Design group permissions so that you have minimal duplication
    - Rule 3: Manage advanced permissions only when absolutely necessary
    - Rule 4: Allow inheritance; do not protect sections of the domain tree from inheritance
    - Rule 5: Keep a log of changes
  - How to Plan Permissions
  - Bringing Order out of Chaos
- 16.5. Designing Auditing Schemes
  - Implementing Auditing
  - Tracking Last Interactive Logon Information
- 16.6. Real-World Active Directory Delegation Examples
  - Hiding Specific Personal Details for All Users in an Organizational Unit from a Group
  - Allowing Only a Specific Group of Users to Access a New Published Resource
  - Restricting Everyone but HR from Viewing National/Regional ID Numbers with the Confidential Bit
- 16.7. The AdminSDHolder Process
- 16.8. Dynamic Access Control
  - Configuring Active Directory for DAC
    - Configuring claim types
    - Configuring central access policies
    - Kerberos policies
  - Using DAC on the File Server
    - Compound expressions with groups
    - Using claims in your ACLs
    - Auditing
- 16.9. Summary
17. Designing and Implementing Schema Extensions
- 17.1. Nominating Responsible People in Your Organization
- 17.2. Thinking of Changing the Schema
  - Designing the Data
  - To Change or Not to Change
  - The Global Picture
- 17.3. Creating Schema Extensions
  - Running the AD Schema Management MMC Snap-in for the First Time
  - The Schema Cache
  - The Schema Master FSMO
  - Using LDIF to Extend the Schema
  - Checks the System Makes When You Modify the Schema
  - Making Classes and Attributes Defunct
  - Mitigating a Schema Conflict
- 17.4. Summary
18. Backup, Recovery, and Maintenance
- 18.1. Backing Up Active Directory
  - Using the NT Backup Utility
  - Using Windows Server Backup
- 18.2. Restoring a Domain Controller
  - Restore from Replication
    - Manually removing a domain controller from Active Directory
  - Restore from Backup
  - Install from Media
    - Creating and using IFM media on Windows Server 2003
    - Creating and using IFM media on Windows Server 2008 and newer
- 18.3. Restoring Active Directory
  - Nonauthoritative Restore
    - Restoring with NT Backup
    - Restoring with Windows Server Backup
  - Partial Authoritative Restore
  - Complete Authoritative Restore
- 18.4. Working with Snapshots
- 18.5. Active Directory Recycle Bin
  - Deleted Object Lifecycle
  - Enabling the Recycle Bin
  - Undeleting Objects
    - Using ADAC
    - Using PowerShell
- 18.6. FSMO Recovery
- 18.7. Restartable Directory Service
- 18.8. DIT Maintenance
  - Checking the Integrity of the DIT
  - Reclaiming Space
  - Changing the DS Restore Mode Admin Password
- 18.9. Summary
19. Upgrading Active Directory
- 19.1. Active Directory Versions
  - Windows Server 2003
    - New features
    - Differences in functionality
  - Windows Server 2008
    - New features
    - Differences in functionality
  - Windows Server 2008 R2
    - New features
    - Differences in functionality
  - Windows Server 2012
    - New features
    - Differences in functionality
- 19.2. Functional Levels
  - Raising the Functional Level
  - Functional Level Rollback
- 19.3. Beginning the Upgrade
- 19.4. Known Issues
- 19.5. Summary
20. Active Directory Lightweight Directory Services
- 20.1. Common Uses for AD LDS
- 20.2. AD LDS Terms
- 20.3. Differences Between AD and AD LDS
  - Standalone Application Service
  - Configurable LDAP Ports
  - No SRV Records
  - No Global Catalog
  - Top-Level Application Partition Object Classes
  - Group and User Scope
  - FSMOs
  - Schema
  - Service Account
  - Configuration/Schema Partition Names
  - Default Directory Security
  - User Principal Names
  - Authentication
  - Users in the Configuration Partition
  - New and Updated Tools
- 20.4. AD LDS Installation
  - Installing the Server Role
  - Installing a New AD LDS Instance
  - Installing an AD LDS Replica
  - Enabling the Recycle Bin
- 20.5. Tools
  - ADAM Install
  - ADAM Sync
  - ADAM Uninstall
  - AD Schema Analyzer
  - AD Schema MMC Snap-in
  - ADSI Edit
  - dsdbutil
  - dsmgmt
  - ldifde
  - LDP
  - repadmin
- 20.6. The AD LDS Schema
  - Default Security Descriptors
  - Bindable Objects and Bindable Proxy Objects
- 20.7. Using AD LDS
  - Creating Application Partitions
  - Creating Containers
  - Creating Users
  - Creating User Proxies
    - Special considerations
  - Renaming Users
  - Creating Groups
  - Adding Members to Groups
  - Removing Members from Groups
  - Deleting Objects
  - Deleting Application Partitions
  - Controlling Access to Objects and Attributes
- 20.8. Summary
21. Active Directory Federation Services
- 21.1. Introduction to Federated Identity
  - How It Works
  - SAML
  - WS-Federation
- 21.2. Understanding ADFS Components
  - The Configuration Database
  - Federation Servers
  - Federation Server Proxies
  - ADFS Topologies
    - Single federation server
    - Single federation server and federation proxy
    - Load-balanced ADFS servers
    - Geographically redundant ADFS servers
- 21.3. Deploying ADFS
  - Federation Servers
    - Certificates
    - Configuring ADFS
    - Service configuration
  - Federation Server Proxies
- 21.4. Relying Party Trusts
- 21.5. Claims Rules and the Claims Pipeline
  - The Pipeline
  - Creating and Sending Claims Through the Pipeline
- 21.6. Customizing ADFS
  - Forms-Based Logon Pages
  - Attribute Stores
- 21.7. Troubleshooting ADFS
  - Event Logs
  - Fiddler
- 21.8. Summary
A. Programming the Directory with the .NET Framework
- A.1. Choosing a .NET Programming Language
- A.2. Choosing a Development Tool
  - .NET IDE Options
  - .NET Development Without an IDE
- A.3. .NET Framework Versions
  - Which .NET Framework Comes with Which OS?
  - Directory Programming Features by .NET Framework Release
  - Assemblies Versus Namespaces
  - Summary of Namespaces, Assemblies, and Framework Versions
- A.4. Directory Services Programming Landscape
  - System.DirectoryServices Overview
    - Other nice things in System.DirectoryServices
    - System.DirectoryServices summary
  - System.DirectoryServices.ActiveDirectory Overview
    - Why use System.DirectoryServices.ActiveDirectory?
    - System.DirectoryServices.ActiveDirectory summary
  - System.DirectoryServices.Protocols Overview
    - Why use System.DirectoryServices.Protocols?
    - System.DirectoryServices.Protocols summary
  - System.DirectoryServices.AccountManagement Overview
    - Why use System.DirectoryServices.AccountManagement?
    - System.DirectoryServices.AccountManagement summary
- A.5. .NET Directory Services Programming by Example
  - Connecting to the Directory
  - Searching the Directory
  - Basics of Modifying the Directory
    - Basic add example
    - Basic remove examples
    - Moving and renaming objects
    - Modifying existing objects
  - Managing Users
    - Managing users with System.DirectoryServices.AccountManagement
  - Overriding SSL Server Certificate Verification with SDS.P
- A.6. Summary
Index
About the Authors
Colophon
Copyright