Designing Windows Server 2008 Active Directory Infrastructure and Services

Preparing For Active Directory Design

Designing the Internal AD DS Infrastructure

Extending the Active Directory Design

Exploring the Contoso Ltd. Scenario

Exploring Additional Scenarios for Active Directory Designs

After completing this module, students will be able to:

Prepare for Active Directory design.

Design the internal AD DS infrastructure.

Extend the Active Directory design.

To design the infrastructure of an AD DS forest for your organization, first you must collect organizational and administrative requirements, and then you must decide which design to use. There are several possible designs, and each one requires some trade-offs. Based on the requirements of your organization, you must determine the type of AD DS forest and forest root domain. You also must plan for trusts between forests, determine whether your organization requires multiple forests, and determine which modifications, if any, you must make to the AD DS schema. In addition, you must design for the time synchronization of all computer clocks in your organization by using the Windows Time service (Win32Time).

In this module, you will learn about forest design concepts as well as about forest trusts, the AD DS schema, and the Windows Time Service.

Designing an AD DS Forest

Designing AD DS Forest Trusts

Planning for AD DS Schema Changes

Designing a Windows Time Service Deployment

Design an AD DS Forest

Create and Implement Forest Trusts

After completing this module, students will be able to:

Design an AD DS forest.

Design AD DS forest trusts.

Plan for AD DS schema changes.

Design a Windows Time service deployment.

After designing the infrastructure for the AD DS forest as described in Module 1, you need to design the AD DS domain infrastructure. To do this, you first need to decide on the AD DS domain design model and the placement and deployment of domain controllers, based on your organization's needs. After designing the AD DS domain, you then integrate the internal and external DNS namespaces with the AD DS domain by using DNS servers. If your design consists of multiple domains, you can create domain trusts to enable easy and reliable communication from one domain to another. You need to choose the right type of domain trust, based on your organization's needs.

In this module, you will learn about designing AD DS domains, DNS, and domain trusts.

Designing AD DS Domains

Designing DNS Namespaces in an AD DS Environment

Designing AD DS Domain Trusts

Designing and Implementing AD DS Domains

Designing and Implementing DNS Integration

Designing and Implementing Domain Trusts

After completing this module, students will be able to

Design AD DS domains.

Design DNS namespaces in an AD DS environment.

Design AD DS domain trusts.

You should design the site topology for the network after you design the logical structure of the AD DS infrastructure in your organization. The site topology is a logical representation of the physical network. You use the site topology to manage replication and logon network traffic, among other things. When you create the site design, include information about the location of the AD DS sites, the AD DS domain controllers within each site, and the site links and site-link bridges that support AD DS replication between sites. Windows Server 2008 uses site information for many purposes, including routing replication, client affinity, system volume (SYSVOL) replication, Distributed File System (DFS) namespaces, and service locations.

In this module, you will learn how to design a distributed directory service that supports domain controllers that are in portions of your network that are separated by expensive, slow, or unreliable links.

Designing AD DS Sites

Designing AD DS Replication

Designing and Implementing AD DS Sites

Designing and Implementing AD DS Replication

After completing this module, students will be able to:

Design AD DS sites.

Design AD DS replication.

This module explains how to design an AD DS domain controller.

Designing Domain Controllers and Domain Controller Placement

Designing RODC Deployments

Designing Domain Controllers As Virtual Machines

Designing Domain Controller Availability

Designing an AD DS Controller Deployment

Designing and Implementing an RODC Deployment

After completing this module, students will be able to:

Design domain controllers and domain controller placement.

Design read only domain controller (RODC) deployments.

Design domain controllers as virtual machines.

Design domain controller availability.

You can use an AD DS domain to simplify the administration of your IT resources by creating a manageable structure that underlies a network infrastructure based on the Windows operating system.

To design the effective administration of an AD DS domain, you need to first assess the state of the configuration and administration of the AD DS environment. To determine the best design for your AD DS domain administration, first collect information about how your organization needs to administer the various resources in your AD DS domain environment. This information provides the basis on which you can design and build the AD DS domain structures that will enable the most effective AD DS domain administrative methods for your organization, such as organizational units (OUs), AD DS groups, and user and computer account objects.

Planning the Delegation of AD DS Administration

Designing the Structure of OUs

Designing an AD DS Group Strategy

Planning to Manage User and Computer Accounts

Creating and Implementing an OU Design

Creating and Implementing an AD DS Group Design

Automating User and Group Management

After completing this module, students will be able to:

Plan the delegation of AD DS administration.

Design the structure of OUs.

Design an AD DS group strategy.

Plan to manage user and computer accounts.

The AD DS Group Policy environment is the principal vehicle for configuration management in Windows Server 2008. An effective Group Policy design means a more standardized and easy-to-manage environment in which to perform all other administrative tasks.

This module introduces the key concepts for designing Group Policy as they relate to planning, implementing. and managing Group Policy in AD DS.

Preparing for Group Policy Design

Designing Group Policy Objects

Designing Group Policy Processing

Planning for Group Policy Management

Designing and Implementing Group Policy Objects

Designing and Implementing Group Policy Application

After completing this module, students will be able to:

Prepare for Group Policy design.

Design Group Policy objects.

Design Group Policy processing.

Plan for Group Policy management.

One of the primary reasons to deploy a directory service like AD DS is to provide security for the organization’s network. Managing secure access to network resources is critical to ensuring that only authorized users can access the data and that only authorized administrators can make changes to the environment.

By ensuring that the AD DS deployment is secure, you can help ensure system stability and reliability, and you can minimize the number of successful attempts to jeopardize system security and integrity.

Preparing to Design AD DS Security

Designing AD DS Account and Password Policies

Designing AD DS Domain Controller Security

Designing AD DS Administrator Security

Designing and Implementing Security Policies for Accounts and Passwords

Designing and Implementing Administrative Security Policies

After completing this module, students will be able to:

Prepare to design AD DS security.

Design AD DS account and password policies.

Design AD DS domain controller security.

Design AD DS administrator security.

This module explains how to design a PKI deployment by using Windows Server 2008 AD CS.

Overview of PKI and AD CS

Designing a Certification Authority Deployment

Designing Certificate Templates

Designing Certificate Distribution and Revocation

Designing and Implementing a CA Hierarchy

Designing and Implementing AD CS Certificate Templates

After completing this module, students will be able to:

Describe the PKI and AD CS features and components.

Design a certification authority (CA) deployment hierarchy in AD CS.

Design certificate templates.

Design a strategy for distributing and revoking certificates.

This module explains how to design and implement a rights protection infrastructure by using AD RMS.

AD RMS Overview

Designing an AD RMS Deployment

Extending the AD RMS Deployment Outside an Organization

Designing an AD RMS Deployment

Implementing an Internal AD RMS Deployment

Verifying the AD RMS Deployment

After completing this module, students will be able to:

Describe the AD RMS components and functionality.

Design an AD RMS deployment.

Extend an AD RMS deployment outside an organization.

This module explains how to design and implement an AD LDS deployment.

AD LDS Deployment Scenarios

Designing an AD LDS Server Deployment

Designing AD LDS Replication

Integrating AD LDS with AD DS

Designing AD LDS Replication for Internal Applications

Designing AD LDS Replication for External Applications

Designing Highly Available LDAP Services for Multiple Applications

Implementing an AD LDS Solution

After completing this module, students will be able to:

Describe the AD LDS deployment scenarios.

Design an AD LDS server deployment.

Design an AD LDS replication topology.

Integrate AD LDS with AD DS.

This module explains how to design an implementation of Active Directory Federation Services (AD FS).

Overview of an AD FS Design

Designing an AD FS Deployment

Designing AD FS Claims and Applications

Configuring AD FS in the Account Partner

Configuring AD FS in the Resource Forest

Adding Resource and Account Partners

Configuring AD RMS to Work with AD FS

Configuring the AD FS Client

Verifying AD RMS and AD FS Functionality

After completing this module, students will be able to:

Describe the AD FS components and deployment scenarios.

Design an AD FS deployment.

Design AD FS claims and applications.

This module explains how to design and implement AD DS upgrades and migrations.

Choosing an AD DS Transition Strategy

Designing a Domain-Upgrade Strategy

Designing a Domain-Restructure Strategy

Designing AD DS Domain Renaming

Designing an AD DS Domain Restructure

Implementing an AD DS Domain Restructure

After completing this module, students will be able to:

Choose the best AD DS transition strategy, based on the current environment and requirements.

Design a domain-upgrade strategy.

Design a domain-restructure strategy.

Design AD DS domain renaming.