Basic Functions of Microsoft Active Directory
Active Directory is a distributed directory service included with Microsoft Windows
Server operating systems. Active Directory enables centralized, secure management
of an entire network, which might span a building, a city, or multiple locations throughout the world.
Let's analyze a basic part of Active Directory: domains. A domain is a logical collection
and a security boundary at the same time. For example, every domain has a name like "Microsoft.com".
Domains also have what we call a name space; "Microsoft.com" would be a good example. A "tree"
is one or more domains that share a common name space. So, one might have "support.microsoft.com"
Now, what happens within this tree is that is an automatic trust relationship with the
other domains within the tree and subsequently within the "forest", which is a collection
of trees that share common configuration and schema (all the objects and all the object
attributes that you can use inside your network -remember, only one schema per forest!).
This trust relationship allows the user to go beyond the domain boundaries for certain
functions if the other domain gives the permission to access it.
Active Directory is built on servers called domain controllers. These are servers that
hold a local domain database (Active Directory), where all the user and computer accounts reside.
This directory service also authenticates users and responds to queries every time members
in the domain perform a search. So when someone searches for a printer or another user, or
when one asks to connect to another server in the network, they are actually "talking" to the
domain controller and perform searches in the active directory database.
A few domain controllers have an additional role called Global Catalog which allows the
server to be the domain's actual index. The Global Catalog is the server that hosts a subset
of information from other domains in the forest - when someones searches for something that
is on another domain, it can be found it a lot faster through this server.
No Active Directory can exist without the Domain Name Servers (DNS). All network services
depend on DNS. Most people think that it only performs name resolution ("pinging" a name and
returning the IP address), but DNS does a lot more. DNS helps clients find domain controllers
and Global Catalog servers. Furthermore, DNS always gives you nearest resources first, so if
your computer asks where the domain controller is, the answer will contain all the domain controllers
sorted from the nearest to the furthest.