1. Module 1: Introduction to Designing a Directory Services Infrastructure

2. Overview Role of Active Directory in an Enterprise Conducting an Organizational Analysis Architectural Elements of Active Directory

3. This module provides the basic context and terminology for the course. It starts by describing how Microsoft® Windows® 2000 Active Directory™ directory service works in an enterprise network environment. Prior to designing the Active Directory structure, the architect must first identify the administrative and business goals of an organization. General guidelines for identifying business needs are provided, and a framework for making good design choices is discussed. Finally, an overview of the architectural elements of Active Directory is presented.

4. At the end of this module, you will be able to: Describe Active Directory in Windows 2000. Explain the importance of determining business needs prior to designing an Active Directory infrastructure. Describe the architectural elements used in the design of the Active Directory infrastructure.

5. Role of Active Directory in an Enterprise Domains and OUs Form Hierarchical Structures Multiple Domains Can Form Trees Forests Domain Tree Forest Objects OU OU OU Domain Domain Domain

6. Active Directory in Windows 2000 is a network directory service. Administrators use Active Directory to define, arrange, and manage objects, such as user data, printers, and servers, so that they are available to users and applications throughout the organization. Objects in Active Directory are logically organized into a hierarchical structure.

7. The objects that create the overall structural hierarchy in Active Directory are: Domains. This is the core unit of Active Directory. A domain is a container of objects that share security requirements, replication processes, and administration. Active Directory uses a multi-master replication model in which all domain controllers are equal. Organizational units (OUs). An OU is a container object that is used to organize objects within a domain into logical administrative groups. Within a domain, OUs form a hierarchical structure based on the organization's administrative model.

8. Multiple domains within a single Active Directory can create additional structure in the form of: Trees. A tree is a hierarchical arrangement of one or more domains with a single root name. Domains within a tree share a common root domain name and share information through automatic trust relationships. Forests. A forest is a collection of one or more trees. Multiple trees within a forest do not share a common root domain name, but share information through automatic trust relationships. Multiple forests can share information only through explicit trusts.

9.  Conducting an Organizational Analysis Identifying Organizational Needs Making Design Choices Planning Guidelines

10. Enterprise architects must design the Active Directory directory service to meet the business needs of the customer. The first step in meeting this goal is performing an organizational analysis to determine the business as well as the information technology (IT) needs of the customer.

11. In this lesson you will learn about the following topics: Identifying organizational needs Making design choices Planning guidelines

12. Identifying Organizational Needs Determine the Goals of the Organization Analyze the Administrative Model Anticipate Growth and Reorganization Document the Gathered Information

13. Identifying organizational needs consists of the following steps:

14. Determine Goals of the Organization. As an architect, you must identify and then prioritize the business needs of an organization. Once you have identified the goals, you must translate them into a design for the Active Directory structure that meets those goals. In the design, you must ensure that Active Directory meets the business needs of the organization, instead of basing the goals of the organization on the Active Directory structure.

15. Analyze the Administrative Model. The Active Directory directory service is designed to support the storage and easy retrieval of information. The design must support the administrative model. The administrators of an organization support the enterprise. Therefore, you need to design Active Directory to support administrator needs. These needs may be different from the business practices of the organization. Identify and analyze the current administrative model, and determine if any improvements can be made.

16. Anticipate Growth and Reorganization. An Active Directory structure has an anticipated life span of three to five years. When designing the Active Directory structure, you must anticipate future growth and reorganization, and then design Active Directory so it can easily accommodate growth.

17. Document the Gathered Information. After your initial organizational analysis, document your findings. Documentation will guide you through the design process and clarify any conflicts that may occur as you design Active Directory.

18. Making Design Choices Decision Points Implications Risks and Costs Tradeoffs

19. When making design choices, identify the following factors that will influence design:

20. Decision Points. You should filter information you received from your organizational analysis. Organizations can often provide too little or too much information about their business needs. Careful examination of your information will help you incorporate only the most pertinent information into the design of the Active Directory structure.

21. Implications. Be aware of the implications of making a particular design decision, and possible alternatives to the decision. There are often several ways to achieve an intended outcome in the design of the Active Directory structure. Knowing the implications of each possible option will help guide your design choices.

22. Risks and Costs. Identifying risks before beginning the design process gives you an opportunity to mitigate or decrease possible problems. For example, if there are limited resources for testing, then implementation of a design can be scheduled for off-peak hours to mitigate any unforeseen results of the implementation.

23. Tradeoffs. Every organization will have individuals or departments with different goals for the project. Not all goals may be achievable due to schedule and resource constraints. By prioritizing goals and identifying positive and negative characteristics of each goal, you can make effective tradeoff decisions

24. Planning Guidelines Remember Business Needs Maintain a Clear Vision Make Solid Tradeoff Decisions Create a Simple Design Test the Design

25.  Remember Business Needs When designing an Active Directory structure, ensure that the business needs, rather than the technology, determine the design. Only allow technology to influence your design if the technology can provide a more efficient means of doing business.

26.  Maintain a Clear Vision As your design progresses, maintain a clear vision of your overall structure.

27.  Make Solid Tradeoff Decisions Carefully consider tradeoff decisions when faced with design options.

28.  Create a Simple Design The best strategy is to create the simplest design possible.

29.  Test the Design Finally, ensure that the design is adequately tested before releasing the design to the team responsible for implementing Active Directory.

30.  Architectural Elements of Active Directory Designing a Naming Strategy Designing for Delegation of Administrative Authority Designing Schema Modifications Designing for Group Policy Designing an Active Directory Domain Designing Multiple Domains Designing a Site Topology

31. An enterprise architect combines the various architectural components of Active Directory to design a directory services infrastructure that meets the business needs of the organization. To use these components effectively, you must understand the capabilities of each component and the design elements within Active Directory that each component influences.

32. In this lesson you will learn about the following topics: Designing a naming strategy Designing for delegation of administrative authority Designing schema modifications Designing for group policy Designing an active directory domain Designing multiple domains Designing a site topology

33. Designing a Naming Strategy Active Directory Uses DNS as Naming Service Internet Presence a Determining Factor in Selecting Domain Names Domain Name System (DNS) (DNS) nwtraders.msft

34. Active Directory follows the Domain Name System (DNS) standard as a basis for naming domains. Active Directory also uses DNS as the domain locator service. You can use DNS for name resolution of the organization's internal resources, such as its intranet, and external resources, such as the Internet. An organization's current and planned presence on the Internet will help determine Active Directory naming strategies. Carefully selecting an inclusive DNS name for the root domain is crucial, because a carefully selected name may make it easier for users to access the network over the Internet. The root domain name will also be included in any child domains created from the root domain. DNS Basics

35. Designing for Delegation of Administrative Authority Relieves Burden of Centralized Management Separates Administrative Authority from Rest of Network Domain nwtraders.msft na.nwtraders.msft asia.nwtraders.msft MfgMfg researchresearch HRHR recruitingrecruitingtrainingtraining

36. Delegating administrative authority in Active Directory allows network administrators to grant administrative control of objects in Active Directory to trusted users. Delegating authority reduces the workload of a centralized administrator, and also separates the delegated authority from other areas of the network.

37. You can create a hierarchical structure of domains and OUs that reflects the administrative model of an organization. You can also delegate authority to individual users and computers. By structuring the Active Directory hierarchy and then managing the permissions on the objects and properties in Active Directory, you can precisely specify the accounts that can access information in Active Directory and the level of permissions that they can have. This precise specification allows network administrators to delegate specific authority over portions of Active Directory to groups of users, without making its information vulnerable to unauthorized access.

38. Designing Schema Modifications Schema Defines Objects and Attributes in Active Directory Changing the Schema Can Affect the Entire Network Create a Schema Modification Policy to Manage Changes Schema

39. The Active Directory schema contains the definitions of all objects, such as computers, users, and printers, that are stored in Active Directory. The definitions contained within the schema define the classes of objects Active Directory may contain, and the types of attributes each object may or must have. Schema modification includes adding or changing object class or attribute definitions. Changing the schema has implications that can affect the entire network. Schema modifications are rare, but an organization may have business needs that can only be met by schema modification. You will need to create a schema modification policy to manage the modification process.

40. Group Policy Objects Apply Configurations to Sites, Domains, and OUs Group Policy Is Inherited In Active Directory Hierarchy Designing for Group Policy Site GPO Domain OUOU

41. Group Policy is used to manage software configurations and regulate security on computers and users in Active Directory. A Group Policy object (GPO) is used to apply Group Policy to users and computers in Active Directory at the site, domain, and OU level. You can design Active Directory to support the application of Group Policy through delegation and by the creation of lower-level OUs to contain users and computers subject to particular GPOs. Group Policy is also inherited through the site, domain, and OU structure. By carefully designing the Active Directory infrastructure, you can apply GPOs to intended users and computers in upper-level domains or OUs so that the GPOs will be inherited to lower-level domains and OUs.

42. Designing an Active Directory Domain Create OUs to Support Delegation and Group Policy Create OU Structure to Reflect Administrative Model Carefully Name the First Domain OU OUOU OU OUOU First Domain nwtraders.msft

43. The ongoing administrative tasks of an organization can be simplified by initially planning how to organize objects in a domain. A well-designed OU structure comprised of upper- and lower-level OUs will allow administrators to delegate authority and apply Group Policy. The first domain created in Active Directory is the root domain of the entire forest. The first domain is also referred to as the forest root. The forest root contains the configuration and schema information for the forest. Naming the first domain is an important design step, since the first domain cannot be renamed.

44. Administered Separately But May Share Resources More Complex To Manage Designing Multiple Domains nwtraders.msft us.nwtraders.msft europe.nwtraders.msft Child Domain Root

45. Domains, trees, and forests are bordered units within Microsoft Windows 2000 Active Directory directory service. These units can share resources but can also be administered separately. Most business needs can be met by a single domain structure. A single domain is simpler to manage, and it is simple to delegate administrative authority. However, a business may want to use multiple domains within Active Directory. You will need to evaluate the need for a multiple- domain structure and the implications of increasing the complexity of the Active Directory structure before making this decision. Domains can be arranged into multiple-domain trees, multiple-tree forests, and multiple forests. The business drivers that require a multiple-domain design will also affect the type of design you create.

46. Designing a Site Topology Sites Define Physical Structure of Active Directory Use Sites to Control Network Traffic Flow nwtraders.msft Redmond Site Charlotte Site

47. Active Directory uses sites to define the physical structure of the network. A site is a collection of well- connected machines, based on Internet Protocol (IP) subnets. A site definition is stored as a site object in Active Directory. Collectively, all sites form a site topology. Because sites represent the physical structure of your network, they do not need to map to the logical structure of the Active Directory.

48. You can use sites to control workstation logon traffic, replication traffic, Distributed file system (Dfs) topology, and File Replication service (FRS). Excessive network traffic can occur between remote locations due to frequent exchange of large amounts of data and directory information. Designing an appropriate site topology helps you better organize the Windows 2000 network in your organization and optimize the exchange of data and directory information.

49. Review Role of Active Directory in an Enterprise Conducting an Organizational Analysis Architectural Elements of Active Directory