INF211x Windows Server 2016: Infrastructure - Forest Design Models

You can apply one of the following three forest design models in your Active Directory environment: Organizational forest model, Resource forest model, and Restricted access forest model. It is likely that you will need to use a combination of these models to meet the needs of all the different groups in your organization.

Organizational forest model

This is the most common type of forest. User accounts and resources are contained in the forest and managed independently. If users need to access resources in other forests (or the reverse), trust relationships can be established.

Resource forest model

In this model, a separate forest is used to manage resources. Resource forests do not contain user accounts. Forest trusts are established so that users from other forests can access the resources contained in the resource forest.

Restricted access forest model

In the restricted access forest model, a separate forest is created to contain user accounts and data that must be isolated from the rest of the organization. Restricted access forests provide data isolation in situations where the consequences of compromising project data are severe. Users from other forests cannot be granted access to the restricted data because no trust exists.

Enhanced Security Administrative Environment (ESAE) forests are an example of a restricted access forest model. These forests have hosts privileged accounts, privileged groups, and privileged access workstations. The ESAE forest is configured with a one-way trust relationship with a production forest. A production forest is a forest in which administrators perform an organization’s day-to-day activities. The production forest configured so that administrative tasks can only be performed by using accounts that the ESAE forest hosts.

ESAE forest have the following benefits:

• Locked-down accounts. Standard non-privileged user accounts in the ESAE forest can be configured as highly privileged in the production forest. For example, a standard user account in the ESAE forest is made a member of the Domain Admins group in a domain in the production forest.
• Selective authentication. ESAE forest design allows organizations to leverage the trust relationship’s selective authentication feature. For example, sign-ins from the ESAE forest will be restricted to specific hosts in the production forest.
• Simple way to improve security. ESAE forest design provides substantive improvement in security of existing production forests without requiring complete rebuilding of the production environment. The ESAE forest approach has a small hardware/software footprint and only affects IT Operations team users.

INF211x Windows Server 2016: Infrastructure - Forest

An AD DS forest is the highest-level container object in the AD DS hierarchy. A forest is a collection of one or more AD DS trees. Each AD DS tree will contain one or more AD DS domains. The AD DS forest is the outermost boundary for the AD DS security and administration. 

The forest root domain is unique.

The first domain that is created in the forest is called the forest root domain. The forest root domain contains a few objects that do not exist in other domains in the forest. Because these objects are always created on the first domain controller created, a forest can consist of as little as one domain with a single domain controller, or it can consist of hundreds of domains across multiple trees.

Microsoft INF200.1x, Windows Server 2012 Fundamentals: Infrastructure - Windows Subnets

What are subnets?

Subnets map network addresses to sites

Subnets identify the network addresses that map computers to AD DS sites. A subnet is a segment of a TCP/IP network to which a set of logical IP addresses are assigned. A site can consist of one or more subnets.

Keep your subnet information up to date

When you design your AD DS site configuration, it's critical that you correctly map IP subnets to sites. Similarly, if the underlying network configuration changes, make sure that you update the configuration to reflect the new site mapping. Domain controllers use the AD DS subnet information to map client computers and servers to sites. If this mapping isn't accurate, operations such as logon traffic and applying GPOs are likely to occur across WAN links, and may be disruptive.

Microsoft INF200.1x, Windows Server 2012 Fundamentals: Infrastructure - Windows Sites

   

What are sites?

Sites represent the physical network in a logical way

Sites in AD DS represent the physical structure, or topology, of your network. AD DS uses network topology information, which is stored in the directory as site, subnet, and site link objects, to build the most efficient replication topology between your domain controllers.

Initially there is only one site

When you add the Active Directory Domain Services server role to create the first domain controller in a forest, a default site (Default-First-Site-Name) is created in AD DS. As long as this site is the only site in the directory, all domain controllers and servers that you add to the forest are assigned to this site.

When should you create more sites?

Sites identify networks that have good network connectivity. By creating more sites, domain controllers and other servers that use AD DS can take advantage of this connectivity. This means sites can help with improving the efficiency of these activities.  

Sites are created due to the following reasons.

• Slow Links: A slow link separates part of the network. If two locations are connected by a slow link, you should configure each location as a separate AD DS site. A slow link typically is considered one that has a connection of less than 512 kilobits per second (Kbps). However, for AD DS design, consider a larger threshold value.
• User Locations: If a network location has a sufficient number of users for whom the inability to authenticate would be problematic, put a domain controller in the location to support authentication within the location. After you include a domain controller or other distributed service in a location that will support those users, you might want to manage Active Directory replication to the location or localize service use by configuring an Active Directory site to represent the location.
• Server Localization: You want to control service localization. By establishing AD DS sites, you can make sure that clients use domain controllers that are nearest to them for authentication, which reduces authentication latency and traffic on WAN connections. In most scenarios, each site will contain a domain controller (and often two for redundancy). However, you might configure sites to localize services other than authentication, such as DFS, BranchCache, and Exchange Server services. In this case, some sites might be configured without a domain controller present in the site.
• Replication: You want to control replication between domain controllers. There might be scenarios in which two well-connected domain controllers are allowed to communicate only at certain times of the day. Creating sites allows you to control how and when replication takes place between domain controllers.

Microsoft INF200.1x, Windows Server 2012 Fundamentals: Infrastructure - Forest and PAM

What is a forest?

The forest is at the top of the AD DS hierarchy

An AD DS forest is the highest-level container object in the AD DS hierarchy. A forest is a collection of one or more AD DS trees. Each AD DS tree will contain one or more AD DS domains. The AD DS forest is the outermost boundary for the AD DS security and administration.

The forest root domain is unique

The first domain that is created in the forest is called the forest root domain. The forest root domain contains a few objects that do not exist in other domains in the forest. Because these objects are always created on the first domain controller created, a forest can consist of as little as one domain with a single domain controller, or it can consist of hundreds of domains across multiple trees.  

What are flexible master operation (FSMO) roles?

FSMO roles are special roles within a forest and domain. There are five roles, two of which are at the forest level. We will talk more about the domain FSMO roles in the next section. But for now, let's look at the forest FSMO roles in the forest root domain.

• The schema master role. This is a special forest-wide domain controller role. There is only one schema master in any forest. The schema can be changed only by targeting the domain controller that holds the schema master.
• The domain naming master role. This is also special forest-wide domain controller role. There is only one domain naming master in any forest. New domain names can be added to the directory only by the domain naming master
  

The forest is a replication and security boundary

The forest is a security boundary

A forest is often referred to as a security boundary because it provides the most complete and secure separation of Active Directory domains.

By default, all the domains in a forest trust the other domains in the forest automatically. This makes it easy to enable access to resources such as file shares and websites for all users in a forest, regardless of the domain in which the user account is located. However, no users from outside the forest can access any resources inside the forest.

A forest is a replication boundary

A forest is also referred to as a replication boundary for the configuration and schema partitions in the AD DS database. It is also the replication boundary for the global catalog. This means that all domain controllers in the forest must share the same schema.

NOTE: Typically, an organization creates only one forest, although you can create multiple forests to isolate administrative permissions between different parts of the organization.

What is Privileged Access Management?

Privileged Access Management (PAM) for Active Directory Domain Services is a solution that is based on Microsoft Identity Manager (MIM) and Windows Server 2012 R2 and Windows Server 2016. It helps organizations restrict privileged access within an existing Active Directory environment.

How does PAM work?

PAM uses a new bastion Active Directory forest that has a trust with your existing forest. The bastion forest establishes a pristine environment that isolates the use of privileged accounts and reduces the corresponding risk of those credentials being stolen. PAM provides authentication requests as they are needed, and adds auditing, alerts, and reports of privileged access requests.
 
PAM does not require any changes to existing applications or users in the Active Directory environment. There is no need to upgrade any servers or raise the domain or forest functional levels in that environment to get started using PAM.

What are Domains and Forests? - This technical reference covers the logical and physical Active Directory structure, as well as domains and forests.

Privileged Access Management for Active Directory Domain Services - This article covers the problems that PAM solves, how PAM is set up, and how PAM works to secure privileged accounts.

Microsoft INF200.1x, Windows Server 2012 Fundamentals: Infrastructure - Nano Servers

What is Nano Server?

Nano Server is a new installation option in Windows Server 2016.

Nano Server is a remotely administered server operating system optimized for private clouds and datacenters. It is similar to Windows Server in the Server Core mode, but significantly smaller, has only limited local sign-in capability, and only supports 64-bit applications, tools, and agents. It consumes far less disk space, can be set up significantly faster, and requires far fewer updates and fewer and faster restarts than Windows Server.

Nano server is ideal for the following scenarios.

• As a compute host for Hyper-V virtual machines.
• As a storage host for Scale-Out File Server.
• As a DNS server.
• As a web server running Internet Information Services (IIS).
• As a host for applications that are developed using cloud application patterns and run in a container or virtual machine guest operating system.

What Roles and Features Can Nano Server Support?

Here are the server roles and features that you can install when you deploy Nano Server or subsequently install with Windows PowerShell.

• The Hyper-V role.
• Failover Clustering.
• Hyper-V guest drivers for hosting Nano Server as a virtual machine.
• Basic drivers for a variety of network adapters and storage controllers.
• The File Server role and other storage components.
• Windows Defender Antimalware, including a default signature file.
• Reverse forwarders for application compatibility—for example, common application frameworks, such as Ruby and Node.js.
• The DNS Server role.
• Desired State Configuration (DSC).
• IIS.
• Host support for Windows Containers.
• System Center Virtual Machine Manager agent.
• Network Performance Diagnostics Service (NPDS).
• Data Center Bridging.

 

How Do You Manage Nano Server?

Nano Server is designed to be managed entirely remotely. Although you can sign in locally to use the recovery console for very basic configuration, you must perform all other management tasks remotely.

There are many options for managing Nano Server remotely.

• Windows PowerShell
• Windows Management Instrumentation (WMI)
• Windows Remote Management
• Emergency Management Services (EMS)
• Remote Server Management Tools
• Windows PowerShell DSC
• Hyper-V Manager
• Failover Cluster Manager
• Server Manager
  Tools like Perfmon, Event Viewer, Disk Manager, and Device Manager.
   

Microsoft: INF200.1x Microsoft Windows Server 2012 Fundamentals: Infrastructure

What you will learn in this course:

• How to install Windows Server 2012 including upgrades, editions, roles, features, and server core.
• How to identify and use the physical and logical components of AD DS, such as forests, domains, and domain controllers.
• How to perform day to day system administrator tasks such as backup and restore, and implementing the Recycle Bin.
• How to create and configure user, group, and computer accounts.
• How to implement Group Policy Objects to enforce standard processes in your organization.

Course Prerequisites:

• Learners should have some general understanding of Windows Server and how it is used.
• Windows PowerShell will be the tool of choice when implementing the features in this course. Learners should have a good foundation in accessing and using simple Windows PowerShell commands. To help in this area the course includes an Appendix on Windows PowerShell Basics.

 There are many resources available for learning the skills necessary to be successful in this course. For example,Microsoft Virtual Academy.

Module 1 – Windows Server Basics
Module 2 – AD DS Logical Components
Module 3 – AD DS Physical Components
Module 4 - Administering AD DS
Module 5 - User Accounts
Module 6 - Group Accounts
Module 7 - Computer Accounts
Module 8 - Group Policy         

Where can you take this course?
Follow this link

Is this course for you?

This course is designed to help you understand Active Directory Domain Services in Windows Server 2012 and Windows Server 2012 R2.

You may already have some familiarity and real world experience with this technology. What follows are some sample

Questions that you would be expected to answer after completing this course. You can use these Questions to decide if the course content will be appropriate for you.  

• If you answer all of these Questions correctly, you may already know the course material.
• If you miss a few Questions, this course will fill in the gaps in your knowledge.
• If you struggle to answer the Questions, this course will definitely help you gain a better understanding of how to use these concepts and technologies.
• If you don't understand the Questions at all, you probably are not ready for this course. We suggest you review the recommended prerequisite knowledge and return to the course after additional self-study.

After completing the course, you should return to this topic and ensure you can easily answer the

Questions. Real world practice will be needed to master these skills, but this course will provide a step in the right direction.

1. What is an Organizational Unit (OU) and why would you create additional OUs?
2. What are the five flexible single master operations (FSMO) roles and where do they exist?
3. What is a trust relationship and which type of trust relationship is used to improve user logon times between two domains in a forest?
4. Which optional AD DS feature enables you to quickly restore objects that have been deleted?
5. What is Server Core and what are some advantages of using it?
6. Which feature can you use to define different password policies and account lockout settings in a domain?
7. Aziz has reported he is unable to sign in to the domain. The error message is, “The trust relationship between this workstation and the primary domain failed.” What is likely the problem and how should you fix it?
8. What is the global catalog and when is it used?
9. What is the global catalog and when is it used?
10. What is an AD DS site and when should you consider creating a site?
11. When should you use an authoritative restore?
12. How are Group Policy settings and a Group Policy preferences different?

 
Answers:

1. An OU is an object in a domain that you can use to store user objects, computer objects, group objects, and other AD DS objects. You typically create additional OUs when you want to delegate control to a specific group or link a Group Policy Object to the OU.
2. FSMO roles are special roles within a forest and domain. There are two FSMO roles at the forest level: Schema Master and Domain Naming Master. There are three FSMO roles at the domain level: RID Master, Infrastructure Master, and PDC Emulator.
3. Trust relationships are authentication pipelines between different domains. Shortcut trusts can be used to improve user logon times between two domains in an Active Directory forest.
4. The Active Directory Recycle Bin, an optional feature of AD DS, provides a simplified process for restoring deleted objects.
5. Server Core is the default Windows Server installation option. Server Core does not have a graphical user interface. Server Core installs fewer components so fewer updates are required. Server Core removes unneeded files so disk space and memory requirements are less. Lastly, fewer files and components means less opportunity for security threats.
6. Fine-grained password policies let you specify different password policies and account lockout policies for different groups of users. For example, executives, administrators, service accounts, or regular users.
7. Most likely the problem is a broken secure channel. You can use Active Directory Users and Computers or PowerShell to reset the computer account and rejoin the computer to the domain.
8. The global catalog is a central directory of every object in the forest. The global catalog is commonly used to provide Exchange email account information and a user’s Universal group memberships.
9. The global catalog is a central directory of every object in the forest. The global catalog is commonly used to provide Exchange email account information and a user’s Universal group memberships.
10. An AD DS site represents the physical structure, or topology, of your network. There are several reasons to consider creating additional sites such as: number of users at a location, slow links between locations, service localization, and AD DS database replication.
11. An authoritative restore is necessary when a known good copy of AD DS has been restored that contains objects that must override the existing state of other objects in the AD DS database.
12. Group policy settings and group policy preferences are different. Preferences are not enforced, can reapply automatically, and can use item-level targeting.