{"id":237,"date":"2005-09-14T06:40:00","date_gmt":"2005-09-14T06:40:00","guid":{"rendered":"http:\/\/markwilson.me.uk\/blog\/2005\/09\/10000-feet-view-of-microsoft-active.htm"},"modified":"2007-07-09T09:44:47","modified_gmt":"2007-07-09T08:44:47","slug":"10000-feet-view-of-microsoft-active","status":"publish","type":"post","link":"https:\/\/www.markwilson.co.uk\/blog\/2005\/09\/10000-feet-view-of-microsoft-active.htm","title":{"rendered":"10,000 feet view of Microsoft Active Directory"},"content":{"rendered":"

Non-technical colleagues, and friends who work with Microsoft products but outside of a corporate environment often ask me “what is Active Directory<\/a>” (AD). As I’ve blogged a few 10,000 feet views of Microsoft technologies, I thought I’d produce one for AD.<\/p>\n

At the Microsoft Technical Roadshow event last May, Paul Brombley (a messaging technology specialist for Microsoft UK) gave a presentation on Exchange and the Active Directory which included an “AD 101”. As I thought it was an excellent overview I haven’t re-invented the wheel and the following is taken from my notes from that presentation, with a few items added from my own experience.<\/p>\n

Active Directory is basically a distributed database. It is hierarchical, with a permissions model, includes a common set of objects and is integrated with Windows Security as the primary means of authentication (and hence authorisation).<\/p>\n

AD makes use of DNS as a name service. AD cannot be implemented without DNS although it does not require a Microsoft DNS service – in fact, any DNS server supporting SRV records (RFC 2782) and dynamic DNS updates (RFC 2136) can be used to support Active Directory<\/a> although there are advantages to using the Windows DNS Server (e.g. AD-integrated DNS zones).<\/p>\n

This reliance on DNS is apparent when the logical structure of AD is examined. As for Windows NT, domains can be linked using trust relationships. The main differences with AD are that instead of using NetBIOS names, DNS is the naming service for AD domain (with NetBIOS and WINS only supported for legacy purposes) and that default trusts are two-way transitive Kerberos trusts.<\/p>\n

Each AD server is called a domain controller (DC) and all DCs can authenticate users.<\/p>\n

Each domain must have at least one DC. One or more domains sharing a common schema are referred to as a forest. If these domains also have a contiguous namespace then they are called a tree, and each forest may contain multiple trees; however the first domain in the forest is always the forest root domain. These concepts are illustrated in the Windows 2000 Advanced Server help documentation: understanding domain trees and forests<\/a>.<\/p>\n

DCs replicate data using a multiple master model (although there are five roles known as operations masters, or FSMOs, which dictate the master server for certain operations at domain or forest level – for more information, see Daniel Petri’s description of the FSMO roles<\/a>).<\/p>\n

There are four naming contexts (NCs) which make up AD:<\/p>\n