© Copyright Nanda Ganesan1 CHAPTER NT Domains

© Copyright Nanda Ganesan2 Chapter Objectives Give an overall picture of the NT networking architecture Explain the concept of domain Describe the different domain models Examine the role of the main constituents, namely the users, in the domain Discuss various types of user accounts –Group, built-in etc

© Copyright Nanda Ganesan3 Chapter Modules Windows NT Network Architecture An Overview of Domains Domain Models An Overview of Group and User Accounts Built-in User and Group Accounts

4 MODULE Windows NT Network Architecture

© Copyright Nanda Ganesan5 Module Objectives Microsoft network architectures The workgroup The domain A servers role in a domain A typical domain Domain architecture with fault tolerance Domain architecture with multiple server types

© Copyright Nanda Ganesan6 MS Network Architectures Workgroup based architecture Domain based architecture Active Directory

© Copyright Nanda Ganesan7 Workgroup Peer-to-Peer architecture Each workstation maintains its own Security Account Manager (SAM) database Examples: –Windows 95 –Windows for Workgroup Usage –Low cost peer-to-peer applications Mostly share-level control

© Copyright Nanda Ganesan8 Domain Client-Server architecture Contains at least one server and workstations Security Account Manager(SAM) database –Maintained on a server designated to be a domain controller Share-level as well as user-level controls are possible

© Copyright Nanda Ganesan9 The Role of a Server in a Domain Primary Domain Controller (PDC) Backup Domain Controller (BDC) Stand-alone Server

© Copyright Nanda Ganesan10 A Typical Domain PDCClient Server

© Copyright Nanda Ganesan11 A Domain Architecture with Fault Tolerance PDCBDC Client SAM Copy of SAM

© Copyright Nanda Ganesan12 Domain Architecture with All Three Types of Servers PDCBDC ServerClient Stand-alone

© Copyright Nanda Ganesan13 END OF MODULE

14 MODULE An Overview of Domains

© Copyright Nanda Ganesan15 Module Objectives Domain defined A simple domain Multiple domains Trust: The binding between domains A simple example of trust

© Copyright Nanda Ganesan16 Domain Defined Grouping of users Grouping of resources Definition of Access Rights and Access Controls

© Copyright Nanda Ganesan17 A Simple Domain Domain Users/ Administrators Resources

© Copyright Nanda Ganesan18 Large Network Multiple Domains Domain A Domain B Domain C

© Copyright Nanda Ganesan19 Trust: The Binding Between Domains The binding factor of multiple domains Domains can trust one another A user from a trusted domain can enter a trusting domain without authentication

© Copyright Nanda Ganesan20 Trust: A Simple Example Domain ADomain B Trust Domain B trusts domain A. Users entering Domain A can enter Domain B without further validation.

© Copyright Nanda Ganesan21 END OF MODULE

22 MODULE Domain Models

© Copyright Nanda Ganesan23 Module Objectives Major NT domain models A single domain model Constituents of a domain Users and resources Need for multiple domains Master domain model Multiple master domain model The complete trust model

© Copyright Nanda Ganesan24 NT Domain Models Single Domain Master Domain Multiple-Master Domain Complete Trust

© Copyright Nanda Ganesan25 A Simple Example of a Single Domain PDCClient Server Domain A Administrator User

© Copyright Nanda Ganesan26 Basic Constituents of a Domain Users Resources

© Copyright Nanda Ganesan27 Users and Resources Users and administrators can be of different types –Administrators, server operators, domain users etc. Resources can be of different types –Workstations, printers, modems etc.

© Copyright Nanda Ganesan28 Need for Multiple Domains Single Domain –Manageable number of users –Facilitates simple and centralized management Move to Multiple Domain –Slow response due to a large number of users in a single domain –If multiple domains are desired due to modular organizational structure

© Copyright Nanda Ganesan29 Master Domain Model Domain A (Master) Domain B (Trusting) Domain C (Trusting)

© Copyright Nanda Ganesan30 Master Domain Characteristics Centralized control of security Flexibility to manage locally Browsing load is distributed among the domains Master domain limitation may require expansion to the next model –Limited to 26,000 users for instance

© Copyright Nanda Ganesan31 Multiple Master Domain Model Domain A (Master) Domain B (Master) Domain D (Trusting) Domain C (Trusting)

© Copyright Nanda Ganesan32 Multiple Master Domain Characteristics The same advantages as the Master Domain model –Centralized security –Flexibility to manage the resources locally –etc. Advantage of being able to expand to cover a larger Enterprise Disadvantage of becoming complicated with too many domains and trust relationships

© Copyright Nanda Ganesan33 The Complete Trust Model Domain A (Master) Domain B (Master) Domain D (Trusting) Domain C (Trusting)

© Copyright Nanda Ganesan34 The Complete Trust Model Characteristics Flexible operation –Reduces the load on any one or more master domain No centralized control on security –Hence, this model is not the model of choice by the IS departments

© Copyright Nanda Ganesan35 END OF MODULE

36 MODULE An Overview of Group and User Accounts

© Copyright Nanda Ganesan37 Module Objectives User participation in domains User rights and access to resources Restrictions on usage of resources Types of user accounts and groups Global groups Local groups Global user accounts Local user accounts

© Copyright Nanda Ganesan38 User Participation in Domains A user account basically specifies a user’s access rights to the resources Accounts can be individual user accounts or group accounts The scope can be global or local in the case of user accounts

© Copyright Nanda Ganesan39 User Rights and Access to Resources Account Resource User Resource

© Copyright Nanda Ganesan40 Restrictions User Resource Restriction on user account.Restriction on resource.

© Copyright Nanda Ganesan41 Types of User Accounts and Groups Groups –Global –Local User Accounts –Global –Local

© Copyright Nanda Ganesan42 Global Groups Constitute user accounts created in any one domain –It cannot contain users from any other groups or domains Users in a Global Group can be assigned privileges in the following: –Domain of creation –Trusting domain

© Copyright Nanda Ganesan43 Global Group Privileges Domain A Domain B Trust Privileges Global Group

© Copyright Nanda Ganesan44 Local Groups Can be assigned privileges only in the domain in which they were created May contain both local users and global groups One of the purposes is to manage access to local resources locally

© Copyright Nanda Ganesan45 Global User Accounts User accounts that can be used in domains other than those in which they were created –Through trust relationships In multi-domain models Global User accounts are desirable

© Copyright Nanda Ganesan46 Local User Accounts Originate largely in a non-NT network environment –Novell NetWare Confined to the domain in which they are created with the exception of inclusion in global and local groups Enables accounts created in NetWare, IBM LAN Server etc. to participate in Windows NT networking

© Copyright Nanda Ganesan47 END OF MODULE

48 MODULE Built-in User and Group Accounts

© Copyright Nanda Ganesan49 Module Objectives An overview of built-in groups An overview of built-in users Domain administrator Account operator User Domain user Assignment of user account

© Copyright Nanda Ganesan50 Built-in Groups Administrator Domain Administrator Backup Operator Server Operator Account Operator Print Operator Power Users

© Copyright Nanda Ganesan51 Built-in Users Cont. Users Domain Users Guests Domain Guests Replicator

© Copyright Nanda Ganesan52 Domain Administrator Entrusted with all the administrative functions Access to nearly all the resources and user accounts Automatically included in all the trusting domains

© Copyright Nanda Ganesan53 Account Operator Create, delete and modify most user accounts Exception in controlling user accounts –Administrators and operators of different types such as server operators etc. User rights cannot be assigned by account operators

© Copyright Nanda Ganesan54 User Most users fall into this category They access resources on the domain

© Copyright Nanda Ganesan55 Domain User Constitute all user accounts in a domain They can be included in other domains in a multi-domain network

© Copyright Nanda Ganesan56 Assignment of User Accounts Each account has its own set of pre- defined privileges In most cases, a user may be conveniently assigned to a built-in account type Additional modifications may be carried out as needed

© Copyright Nanda Ganesan57 END OF MODULE END OF CHAPTER