This is a little reminder for myself. As I am not a theory type guy, I love taking notes. The purpose of this post is to mechanically write down these terms so it will stay in my memory(hopefully).

Domains and Child Domains

• The first created domain of an AD forest is the Root Domain
• The Root Domain can have it’s own domains called Child Domains
• The group containing Root Domain and Child Domains is called a tree
• When a Child Domain is created, a two-way trust is automatically created by AD. We call it a Parent-Child trust

Tree Domains

• Tree domains are domains using a different name than the Root Domain but is part of the same forest
• During the creation of a Tree Domain, a trust is automatically created with the Root Domain(tree-root trust)

Active Directory Forest

• A forest is a collection of domains(AD or others)
• A forest’s name is the same as the root domain’s DNS
• The forest is the security frontier. It contains the whole AD infrastructure.

Trust Relationships

• A Trust is a trust relationship between to domains or two AD forests
• If we want 2 forests to give each other permissions, we need to create a manual trust
• Trusts can be unidirectional or bidirectional

Active Directory Sites

• An AD site is another physical instance of a same AD domain
• If we create a new domain inside a new forest, we have a default AD site, Default-First-Site-Name
• The creation of sites allows the replication between branches

AD Replication

Replication

• AD works under the principle of “multi-master replication” which allows any modification made on a DC(except RODC) will be replicated to every other DC
• By modification I mean adding, modifying, deleting AD objects such as user accounts, groups or computers
• Every members of a replication group can answer a client’s requests
• The replication cannot go over the limits of an AD forest

Inter-site replication

In a situation where the domain is spread across several sites and that each site has more than one DC, a “bridgehead server” will automatically selected by each sites. This server will be used to relay the replication on the Site level.

Useful commands

repadmin /replsummary - replication summary
repadmin /showrepl - show the status of the DC replication
repadmin /syncall /AdeP - force replication to all DCs

AD Partitionning

AD is divided into 4 partitions which are stored inside the AD database(C:\Windows\NTDS\ by default)

• Schema Partition
• Configuration Partition
• Domain Partition
• Applications Partition

AD Schema

• The AD schema defines every objects that can be created into the directory and their attributes such as; usernames, name, surname, password, manager, etc.
• The schema is applied to the whole AD Forest
• Each time we create a new object in AD, the directory consults the schema to give a class group.
• The AD Schema will rarely change. Changes are irreversible

FSMO Roles

More on that here

Global Catalog

• The first created DC in a forest is “Global Catalog Server” by default
• The GC included an index which gathers all the basic information on the other domains in a forest
• The GC gathers information on objects in each domains of a multi-domains forest. It also manages the requests on the objects level by supplying necessary data for login
• During a user authentication the GC server is requested to verify every universal groups that the user is in. The more universal groups, slower the replication is
• At least 2 GC servers are recommended for redundancy

GC options

• To add or remove the GC option we need to go to Users and Computer management in AD
• Inside the OU/Domain Controllers(right click)
• NTDS settings

Creating new domains

• We create new domains in an existing forest by promoting a DC
• Two types of domains : Child Domain and Tree Domains

More on trusts

• A trust is useful to give resources permission between domains or between AD forests
• Thanks to trusts, a user or a group can access resources hosted on other domains(ex: shared folder)

Bidirectional vs Unidirectional

• Bidirectional : The trusts is in the two ways, Both domains trust each other. Both can access both’s resources
• Unidirecitonal : single way. A domain trusts another domain but the inverse.

Transivity

• The transivity is what allows several domains to trust each other without a direct trust
• Transivity is at the domain level and not the forest level

Implicite vs explicite

Implicite

Explicit

Steps to create a Trust

• We need to different forests let’s say osullivan.local and acme.com
• On one of the server, open DNS manager
• Right-click conditional redirections(Redirecteurs conditionnels) and select “New”
• Add the information DNS name and Root Domain DC’s IP of the forest to add

• Do the same on the other server
• On one of the servers open Domain and approbations AD
• Right-click on the domain, Properties, Approbations tab and click “New Approbation”
• Give the forest’s DNS name to add
• Choose “Forest Approbation”
• Choose Bidirecitonal

• In the Window “Way of approbation” we can create two extremities of a trust at the same time if we have the other forest’s admin credentials.
• Choose “This domain and the specified domain”
• Add credentials ex: ACME\Admin

• Choose “Authentication for every resources of the forest”. We could also target the precise server on which the approbation works, if needed
• Complete the approbation

AD Sites

• AD sites divide a domain in several geographic locations
• This division allows to manage the replication delay between DC’s
• The DC’s can be distributed between sites if needed.
• By default, every new Domains regroup all of it’s DC’s on the same site name “Default-First-Site-Name”
• Limit of 1 RODC for a site
• AD sites can is also useful to manage the replication between Exchange servers
• Site can be linked with RPC over IP as well as SMTP(not used anymore)
• The links between sites are WAN links or VPN servers.

Create AD Sites

• Open up AD Sites and services
• Select the Sites folder, right-click, new site
• Give it a name and select the default link
• Do the same for any other sites needed
• Now in the Servers folder, right-click move the server to which site you want it to be

• Now we must create a link for these sites
• Under the folder Inter-Site Transport, right-click IP select “Link to new site”
• Give it a name and add the involved sites to the right

• Right-click on the new created linked, properties
• From here we can manage the frequency of replication and the costs

Costs