25. DECUS Symposium
16.04.2002
Windows.NET Beta 3
Active Directory New Features
Wolfgang Werner
Compaq
Decus Bonn 2002
Agenda
ƒ Install Replica from Media
ƒ Domain Controller Rename
ƒ Domain Rename
ƒ Universal Group Membership Caching
ƒ Linked Value Replication
ƒ Forest Trusts
ƒ Application Directory Partitions
ƒ Defunct Schema Objects
ƒ InetOrgPerson
http://www.decus.de
1
25. DECUS Symposium
16.04.2002
Install Replica from Media
ƒ Problem: Installing a Domain Controller at a site
with slow network connection
ƒ Windows 2000 replicates a complete copy of the
Active Directory database and possibly the
Global Catalog over the network 1
Install Replica from Media
ƒ Windows.NET Server allows loading the Active
Directory database from a backup of an existing
Domain Controller or Global Catalog server
– Backup the system state of an existing DC
– Restore system state on an alternate location on
target server
http://www.decus.de
2
25. DECUS Symposium
16.04.2002
Install Replica from Media
ƒ Run DCPROMO in Advanced Mode
– DCPROMO /ADV
Install Replica from Media
ƒ Network connectivity still required for up-to-date
information
– Changes in the AD databases and SYSVOL
folder updates are replicated over the network
ƒ Restrictions
– The backup cannot be older than the tombstone
lifetime (default 60 days)
– Application directory partitions will not be restored
http://www.decus.de
3
25. DECUS Symposium
16.04.2002
Agenda
ƒ Install Replica from Media
ƒ Domain Controller Rename
ƒ Domain Rename
ƒ Universal Group Membership Caching
ƒ Linked Value Replication
ƒ Forest Trusts
ƒ Application Directory Partitions
ƒ Defunct Schema Objects
ƒ InetOrgPerson
Domain Controller Rename
ƒ Windows 2000 a domain controller (DC) can't be
renamed
ƒ In Windows.NET DCs can be renamed without
being demoted first
ƒ New name is automatically updated to DNS and
Active Directory
http://www.decus.de
4
25. DECUS Symposium
16.04.2002
Domain Controller Rename
ƒ No Explorer like features
ƒ Procedure:
– Add a new name
– Wait for the new name to propagate through the
network
– Remove the old name
Domain Controller Rename
ƒ Add new name
– NETDOM COMPUTERNAME oldname
/ADD:newname
ƒ Wait for replication of
– DNS host (A) records
ƒ servicePrincipalName attribute to all DCs in the
domain and all Global Catalog servers in the
forest
http://www.decus.de
5
25. DECUS Symposium
16.04.2002
Domain Controller Rename
ƒ Update computer account in AD
– NETDOM COMPUTERNAME oldname
/MAKEPRIMARY:newname
ƒ Reboot
ƒ Wait for the replication of the DNS Locator
resource records
– Defined in system32\config\netlogon.dns
Domain Controller Rename
ƒ Remove old name
– NETDOM COMPUTEENAME newname
/REMOVE:oldname
– Removes old DNS host (A) records
– Removes the old name in Active Directory
ƒ Change "Computer Name" in System Control
Panel
http://www.decus.de
6
25. DECUS Symposium
16.04.2002
Domain Controller Rename
ƒ Moving DCs between domains was planned but
will not be implemented
ƒ Certification Authorities can not be renamed
ƒ DNS and Active Directory replication latency may
cause a temporary inavailability
Agenda
ƒ Install Replica from Media
ƒ Domain Controller Rename
ƒ Domain Rename
ƒ Universal Group Membership Caching
ƒ Linked Value Replication
ƒ Forest Trusts
ƒ Application Directory Partitions
ƒ Defunct Schema Objects
ƒ InetOrgPerson
http://www.decus.de
7
25. DECUS Symposium
16.04.2002
R
enaming D
omains
Renaming
Domains
ƒ Change the DNS and NetBIOS names
– of the forest-root domain
– any tree-root domains
– any parent and child domains
ƒ Restructure a domain's position within a forest
R
enaming D
omains
Renaming
Domains
ƒ No Pruning and Grafting capabilities
ƒ Windows.Net Help and Support:
"A domain rename will affect every domain controller in
your forest and is a thorough multi-step process that
requires a detailed understanding of the operation"
ƒ Resources from
http://www.microsoft.com/windows2000/downloads/tools/
domainrename/default.asp
– Understanding How Domain Rename Works (28 pages)
– Step-by-Step Guide to Implementing Domain Rename (69
pages)
– rendom.exe utility
http://www.decus.de
8
25. DECUS Symposium
16.04.2002
R
enaming D
omains
Renaming
Domains
ƒ Identity of the forest root domain cannot be changed
ƒ If Exchange 2000 is deployed in the same forest domain
rename is blocked
ƒ Each domain controller in the forest will be out-of-service
briefly
ƒ All Domain Controllers in the forest that where
unreachable during the operation or finished in the Error
state must be demoted
ƒ Any external trust relationships must be re-established
ƒ ...
Agenda
ƒ Install Replica from Media
ƒ Domain Controller Rename
ƒ Domain Rename
ƒ Universal Group Membership Caching
ƒ Linked Value Replication
ƒ Forest Trusts
ƒ Application Directory Partitions
ƒ Defunct Schema Objects
ƒ InetOrgPerson
http://www.decus.de
9
25. DECUS Symposium
16.04.2002
Universal G
roup M
embership C
aching
Group
Membership
Caching
ƒ In Windows 2000 a Global Catalog Server is
required for logging on to a domain
– To determine the users membership in universal
groups
– If no local GC is available a server in the remote
site will be used
ƒ Recommendation: at least one GC per site
– Adds replication traffic
Universal G
roup M
embership C
aching
Group
Membership
Caching
ƒ If no Global Catalog is available:
– If the user is an administrator logon succeeds
– If only a Domain Controller is available the user
fails to log on to the workstation
– If no Domain Controller is available, the user is
logged on with cached credentials
http://www.decus.de
10
25. DECUS Symposium
16.04.2002
Universal G
roup M
embership C
aching
Group
Membership
Caching
ƒ Workaround in Windows 2000:
HKLM\System\CCS\Control\Lsa\
IgnoreGCFailures 1
ƒ Q241789 How to Disable Requirement that a
Global Catalog Server Be Available to Validate
User Logons
ƒ Potential security vulnerability if universal groups
are also used
Universal G
roup M
embership C
aching
Group
Membership
Caching
ƒ Windows.NET adds the ability to cache the
Universal Memberships of the users
ƒ Enabling this caching process is done on a Siteby-Site basis
ƒ To enable GC-less logon modify AD Sites NTDS
Site Settings object
http://www.decus.de
11
25. DECUS Symposium
16.04.2002
Universal G
roup M
embership C
aching
Group
Membership
Caching
ƒ The DC will use the cached information even if a
GC is available
ƒ Cache is updated in eight-hour intervals (default)
– This caching mechanism may allow stale data
ƒ Cached data expires from lack of use
– No logon in 180 days (default)
Universal G
roup M
embership C
aching
Group
Membership
Caching
ƒ To adjust the default refresh interval
HKLM\System\CCS\Services\NTDS\Parameters\
Cached Membership Refresh Interval
DWORD in minutes
ƒ To adjust the default expiration time period
HKLM\System\CCS\Services\NTDS\Parameters\
Cached Membership Site Stickiness
DWORD in minutes
http://www.decus.de
12
25. DECUS Symposium
16.04.2002
Universal G
roup M
embership C
aching
Group
Membership
Caching
ƒ msDS-Cached-Membership single valued
attribute added to the user object
– Stores the SIDs of the Universal Groups to which
the user belongs
– To populate the attribute the DC must contact a
GC when a user first logs on
– Not replicated between Domain Controllers
Universal G
roup M
embership C
aching
Group
Membership
Caching
ƒ No GUI to control an update of the cached
msDS-Cached-Membership attributes
ƒ Use ADSI
set objRoot = GetObject("LDAP://RootDSE")
objRoot.Put "UpdateCachedMemberships", 1
objRoot.SetInfo
http://www.decus.de
13
25. DECUS Symposium
16.04.2002
Universal G
roup M
embership C
aching
Group
Membership
Caching
ƒ To diagnose Group membership caching
HKLM\SYSTEM\CCS\Services\NTDS\
Diagnostics\20 Group Caching
5 (full diagnostic)
ƒ Information is written to the Directory Service
Event Log
Agenda
ƒ Install Replica from Media
ƒ Domain Controller Rename
ƒ Domain Rename
ƒ Universal Group Membership Caching
ƒ Linked Value Replication
ƒ Forest Trusts
ƒ Application Directory Partitions
ƒ Defunct Schema Objects
ƒ InetOrgPerson
http://www.decus.de
14
25. DECUS Symposium
16.04.2002
Linked Value Replication
ƒ Novell's Claims against Active Directory
(December 1999):
DID YOU KNOW that Microsoft recommends against
distributed group management? MS recommends that all
group membership should be done from a single
machine.
WHY? If two administrators manage an AD group
(add/delete a user to/from the group) before the group
COMPLETELY synchronizes to ALL AD domain
controllers, changes will be lost.
Linked Value Replication
ƒ In Windows 2000 group membership is stored as
a single multi-valued attribute
ƒ If the group membership is modified the complete
membership attribute is replicated
– Even adding or removing a single member
ƒ If membership is modified on two different DCs
simultaneously changes might be lost
ƒ Windows 2000 workaround: use only one
Domain Controller to change group membership
http://www.decus.de
15
25. DECUS Symposium
16.04.2002
Linked Value Replication
ƒ Windows.NET removes this issue
– A linked-value is a pointer to other objects in the
directory
– A multi-value linked-value attribute is a list of
pointers to other objects in the directory
– Replication metadata is is stored in every single
value of that list
– Now this single value can be replicated
Linked Value Replication
ƒ Novell's Claims against Active Directory
(December 1999):
DID YOU KNOW that Microsoft recommends no more
than 5000 users in an Active Directory group?
WHY? Because group membership is sent out as a
single attribute value. So, if you add the 5000th user to a
group of 4999 members, instead of sending just the new
user, the entire group (all 5000 users) is sent to ALL
domain controllers.
http://www.decus.de
16
25. DECUS Symposium
16.04.2002
Linked Value Replication
ƒ 5000 members is not a hard limit
ƒ The attribute becomes too large to be replicated
in a single transaction
ƒ Windows 2000 workaround: using smaller groups
to compose larger groups
ƒ Windows .NET removes the issue by only
replicating updates to the group membership
Agenda
ƒ Install Replica from Media
ƒ Domain Controller Rename
ƒ Domain Rename
ƒ Universal Group Membership Caching
ƒ Linked Value Replication
ƒ Forest Trusts
ƒ Application Directory Partitions
ƒ Defunct Schema Objects
ƒ InetOrgPerson
http://www.decus.de
17
25. DECUS Symposium
16.04.2002
Forest T
rusts
Trusts
ƒ Windows 2000 Kerberos authentication is only
forest wide
ƒ To create trusts between forests NTLM trusts
between every domain in each forest must be
created
Forest T
rusts
Trusts
ƒ In Windows.NET Transitive Kerberos trust
between two forests' root domains can be
created
– Authorization and authentication occur
transparently between the linked forests
ƒ Forest trusts are targeted for companies
– Undergoing mergers or acquisitions
– Seeking a solution to administrative autonomy
ƒ Cross-forest trust can be 1-way or 2-way
http://www.decus.de
18
25. DECUS Symposium
16.04.2002
Forest T
rusts
Trusts
ƒ Two-way
– All users in both forests are able to access all resources
anywhere in either forest
ƒ One-way: incoming
– Only users in the first forest are able to access resources
anywhere in the second forest
– Users in the second forest will not be able to access any
resources in the first forest
ƒ One-way: outgoing
– Only users in the second forest are able to access
resources anywhere in the first forest
– Users in the first forest will not be able to access any
resources in the second forest.
Forest T
rusts
Trusts
ƒ To define trust relationships use the new Trust
Wizard
http://www.decus.de
19
25. DECUS Symposium
16.04.2002
Forest T
rusts
Trusts
ƒ Forest trusts can only be created between two
forests
ƒ Relationship is not transitive between forests
ƒ Exchange Server still see two different
organizations
ƒ No way to unify forests into one forest
– Still two Global Catalogs
– Still two Schemas
Agenda
ƒ Install Replica from Media
ƒ Domain Controller Rename
ƒ Domain Rename
ƒ Universal Group Membership Caching
ƒ Linked Value Replication
ƒ Forest Trusts
ƒ Application Directory Partitions
ƒ Defunct Schema Objects
ƒ InetOrgPerson
http://www.decus.de
20
25. DECUS Symposium
16.04.2002
Application Directory Partitions
ƒ A naming context (also called a directory partition)
– Stores application-specific data in the Active Directory
– Used for redundancy, availability, or fault tolerance
ƒ Windows 2000: only three choices of replication scope
– Not replicated
– Domain-wide (domain naming context)
– Forest-wide (configuration naming context)
Application Directory Partitions
ƒ In Windows 2000 data may go to places where it is not
used
– All application data replicated to every DC in the
domain
– Every object in Active Directory is put into the GC
ƒ Inappropriate to store volatile data in DS
– Gets replicated widely
– Data may not be up to date on various domain
controllers
– May cause lot of replication traffic
http://www.decus.de
21
25. DECUS Symposium
16.04.2002
Application Directory Partitions
ƒ In Windows.NET additional naming contexts can be
created
– Used for Active Directory enabled application to store and
replicate data
– Usually created by the applications that will use them
– Contain any hierarchy of objects, except security principals
– Replicated only to specific domain controllers in a forest
– Objects not replicated to GC
Application Directory Partitions
ƒ Naming
– Part of the forest namespace
– Like domain directory partition
– Same DNS and LDAP naming conventions
ƒ DNS: adp1.microsoft.com
ƒ DN: dc=adp1,dc=microsoft,dc=com
http://www.decus.de
22
25. DECUS Symposium
16.04.2002
Application Directory Partitions
ƒ Three possible placements within the forest
namespace:
–
–
–
–
A child of a domain directory partition.
A child of an application directory partition.
A new tree in the forest.
Domain directory partitions cannot be children of
an application directory partition
Application Directory Partitions
ƒ Ntdsutil can be used to perform various
operations
– For testing and troubleshooting purposes only
– Applications will provide the utilities
ƒ DCPROMO demote will not remove replicas or
delete application directory partitions
http://www.decus.de
23
25. DECUS Symposium
16.04.2002
Application Directory Partitions
ƒ The Knowledge Consistency Checker (KCC)
automatically generates and maintains the
replication topology for all application directory
partitions
ƒ Replicas follow the same intersite replication
schedule as the domain directory partition.
Application Directory Partitions
ƒ Example: Active Directory integrated DNS
ƒ Ability to replicate zones
– Among a given set of DNS servers of different domains
ƒ dnscmd.exe (/CreateDirectoryPartition
/EnlistDirectoryPartition /UnEnlistDirectoryPartition)
– All DNS servers in the forest
ƒ Default DNS application partition DomainDnsZones
ƒ dnsmgmt.msc or dnscmd.exe
– All DNS servers in the forest
ƒ Default DNS application partition ForestDnsZones
ƒ dnsmgmt.msc or dnscmd.exe
http://www.decus.de
24
25. DECUS Symposium
16.04.2002
Application Directory Partitions
ƒ Example: List partitions with ntdsutil.exe
Agenda
ƒ Install Replica from Media
ƒ Domain Controller Rename
ƒ Domain Rename
ƒ Universal Group Membership Caching
ƒ Linked Value Replication
ƒ Forest Trusts
ƒ Application Directory Partitions
ƒ Defunct Schema Objects
ƒ InetOrgPerson
http://www.decus.de
25
25. DECUS Symposium
16.04.2002
Defunct Schema Objects
ƒ The directory schema describes the kinds of
objects that can reside in a directory
– Allowable parent object types for an object
– Mandatory and optional attributes for an object
– Syntax for an attribute
ƒ Schema objects: classes and attributes 1
Defunct Schema Objects
ƒ Schema additions are permanent 1
– No way back
– In both Windows 2000 and Windows.NET
ƒ In Windows.NET schema objects
– Can be disabled (marked "defunct")
– Can be redefined
– Can be reactivated
http://www.decus.de
26
25. DECUS Symposium
16.04.2002
Defunct Schema Objects
ƒ Redefining Schema Objects
– The object identifier and the ldapDisplayName can be
reused
ƒ Example:
– Active Directory does not permit you to change the syntax
of an attribute after it has been defined in the schema
– Deactivate the attribute and create a new attribute that
reuses the same object identifier and LDAP display name
as the old attribute, but with the desired attribute syntax
Defunct Schema Objects
ƒ To deactivated Schema objects set the isDefunct
property to "True"
– Programmatically With the Active Directory
Schema snap-in
ƒ Only objects that have been added to the base
schema can de deactivated or redefined
http://www.decus.de
27
25. DECUS Symposium
16.04.2002
Defunct Schema Objects
ƒ To reactivated Schema objects set the isDefunct
property to "False"
ƒ Any instances become valid, normal objects
again
ƒ There must be no collisions with active Schema
objects (ldapDisplayName, schemaIdGuid,...)
Agenda
ƒ Install Replica from Media
ƒ Domain Controller Rename
ƒ Domain Rename
ƒ Universal Group Membership Caching
ƒ Linked Value Replication
ƒ Forest Trusts
ƒ Application Directory Partitions
ƒ Defunct Schema Objects
ƒ InetOrgPerson
http://www.decus.de
28
25. DECUS Symposium
16.04.2002
inetOrgPerson
ƒ Novell's Claims against Active Directory
(December 1999):
DID YOU KNOW that Windows2000 does not conform to
LDAP standards? This means that many off the shelf
LDAP applications (Netscape, Oblix, Netegrity, etc)
cannot run against Active Directory? It seems that
Windows2000 doesn’t derive users from InetOrgPerson,
which is the LDAP standard. Therefore, most LDAP
applications won’t recognize Active Directory users.
inetOrgPerson
ƒ Windows 2000 Active Directory
– The user account object is implement as the
'user' class1
ƒ Other LDAP implementations
– The user account object is implement as the
inetOrgPerson class (RFC 2798) 2
– Do not recognize AD users
ƒ In Windows.NET Active Directory:
– new inetOrgPerson class compatible with the
user class 3
http://www.decus.de
29
25. DECUS Symposium
16.04.2002
inetOrgPerson
ƒ In Windows.NET inheritance chain
top (abstract)
-> person (abstract)
-> organizationalPerson (abstract)
-> user (structural)
-> inetOrgPerson (structural)
ƒ RFC 2798 inheritance chain:
top (abstract)
-> person (structural)
-> organizationalPerson (structural)
-> inetOrgPerson (structural)
inetOrgPerson
ƒ Exchange 2000 schema extension
– secretary:
1.2.840.113556.1.2.444
– labeledURI: 1.2.840.113556.1.2.593
ƒ inetOrgPerson RFC 2798
– secretary:
0.9.2342.19200300.100.1.21
– labeledURI: 1.3.6.1.4.1.250.1.57
ƒ Solution: Change lDAPDisplayName
– secretary -> msExchangeAssistantName
– labeledURI -> msExchlabeledURI
http://www.decus.de
30
25. DECUS Symposium
16.04.2002
inetOrgPerson
ƒ inetOrgPerson and user objects are different
entities
ƒ Up to now there is NO Exchange 2000 support
for inetOrgPerson objects
http://www.decus.de
31