Active Directory

Microsoft Active Directory for Windows networks can be used to centrally manage internal company IT resources, edit rights and policies, and monitor various services. Here, we explain what the directory service is all about and how Windows AD works.

Active Directory (AD) is a directory service developed by Microsoft for Windows networks. AD plays an important role for companies with complex IT resources, user rights, and hi­er­ar­chi­cal work­groups. Basically, you can think of Active Directory as an address book of sorts, though with many more options for ad­min­is­tra­tors to manage, edit, query, and structure stored user and object data. The IT structure of an or­ga­ni­za­tion can be divided into so-called domains with the help of the directory service and can be clearly repli­cat­ed.

An Active Directory basically consists of three central com­po­nents: schema, con­fig­u­ra­tion, and domain. At the heart of this are domains, which contain all the important in­for­ma­tion about IT resources and users and map the network. Equally important for the overall structure are the database and its objects. Below, we take a look at the in­di­vid­ual com­po­nents.

As the name suggests, the AD schema serves as a template for required and permitted clas­si­fi­ca­tions as well as types of AD entries. This includes objects and their at­trib­ut­es, classes, and the syntax of at­trib­ut­es. The schema uses de­f­i­n­i­tions to determine which objects are available or can be made available on the network.

While the schema defines the possible contents, the AD con­fig­u­ra­tion maps the structure of the Active Directory and all contained objects, user roles, and shares. This includes existing domains that subdivide work­groups in the computer network. In turn, domain-specific content and in­for­ma­tion is only available via internal domain con­trollers of the re­spec­tive domain. These contain a global catalog with all important in­for­ma­tion and partial in­for­ma­tion about the schema, con­fig­u­ra­tion, and other domains in the same network. The global catalog can be used to search for and retrieve important partial in­for­ma­tion across domains.

Domains are the basis of Active Directory and are used in the hi­er­ar­chi­cal struc­tur­ing of objects, work­groups, and users managed by ad­min­is­tra­tors. Like di­rec­to­ries and sub­di­rec­to­ries, a domain contains all in­for­ma­tion about objects and at­trib­ut­es that only concern the domain. Domain-specific in­for­ma­tion can be accessed from other domains only if they are included in the global catalog. All other in­for­ma­tion is available only on the internal domain con­troller. A domain is therefore an important struc­tur­ing element, defining ad­min­is­tra­tive and network units into areas, work­groups, and de­part­ments, and hi­er­ar­chi­cal­ly struc­tur­ing au­tho­riza­tions. Domain names are assigned in the same way as with classic DNS servers.

The Active Directory database is based on the Microsoft Jet Engine, similar to a Microsoft Exchange Server. It is object-based and hi­er­ar­chi­cal. The objects represent the re­spec­tive data sets and group policies for IT resources. Their prop­er­ties are called at­trib­ut­es and their types are defined ac­cord­ing­ly. Objects are sub­di­vid­ed into “accounts” (e.g. service- and user-related accounts for employees, groups, or devices) and “resources” (e.g. shares for ap­pli­ca­tions and services).

Objects are divided into “con­tain­ers”, which contain further pre­de­fined or self-defined objects, and “non-con­tain­ers”, which don’t contain any further objects and are also called end nodes/leaf nodes.

Four central standards are used to enable uniform com­mu­ni­ca­tion between computers, ap­pli­ca­tions, services, AD di­rec­to­ries, and domains:

• LDAP (Light­weight Directory Access Protocol): protocol for unified requests to Active Directory di­rec­to­ries.
• Kerberos protocol: Protocol for cen­tral­ized, unified au­then­ti­ca­tion and access rights of users in AD servers.
• SMB (Server Message Block): Protocol for access rights like group policies or log-in scripts to files in the AD network and on servers.
• DNS (Domain Name System): System to uniformly address computer names and domains in the Active Directory.

If you only take a quick look, you won’t see the Active Directory for the trees. Although it may sound like a bad pun, it’s actually true, because the overall structure of AD is also called the forest and can contain several trees in the form of root domains and sub­do­mains of a DNS space. Con­tain­ers organized into domains are con­sid­ered the lowest unit. Joined domains map the or­ga­ni­za­tion­al structure and resources of the en­ter­prise, but can also be con­fig­ured in­de­pen­dent­ly of physical and logical en­ter­prise struc­tures. In this way, several locations can be united in one domain or different domains can be managed at one location.

In­for­ma­tion that can be accessed by all AD users is

• the schema,
• the con­fig­u­ra­tion
• and domain in­for­ma­tion in the global catalog.

Domain-specific data, on the other hand, can only be accessed via the internal domain con­trollers already mentioned. A domain usually has two con­trollers, which prevent data loss through mul­ti­mas­ter repli­ca­tion, i.e. backup con­trollers and AD copies.

The ad­van­tages of Active Directory for complex Windows networks in companies at a glance:

• Cen­tral­ized man­age­ment and con­fig­u­ra­tion of shares, rights, and policies for users, groups, services, and ap­pli­ca­tions.
• Pro­tec­tion against failures and data loss through mul­ti­mas­ter repli­ca­tion within the domain structure.
• Mapping and central con­fig­u­ra­tion of the or­ga­ni­za­tion­al structure of Windows computer networks.
• Flexible extension and scaling of domain struc­tures.
• In­for­ma­tion pro­tec­tion through hi­er­ar­chi­cal de­mar­ca­tion between areas, de­part­ments, and work­groups with different access rights.
• Com­pat­i­bil­i­ty with other directory services.
• Cost and effort reduction through cen­tral­ized ad­min­is­tra­tion.