active directory Domain service Installation

Installation of Active Directory Domain Service
Before installation Active Directory domain service (AD DS) for the first time we need to plan
various things in-order to meet our organization requirement. Below are the list of information
which you need to plan before installing AD DS.
• Domain name for the organization (eg. Vision.com) and NetBIOS domain name (eg.
Vision)
• Domain and Forest functional level
• Installation of DNS service
• Location of NTDS Database and logs file
• Name of the server
• IP address for the DNS Server
• Administrator password and DSRM password
Now let start the procedure to install AD DS role on the server and make the server works as
domain controller for a new forest/domain.
The AD DS process is divided into 2 parts i.e.
• Installation of AD DS role
• Installation of AD using dcpromo.exe
Installation of AD DS role
Inorder to install AD DS role we require to have Windows 2008 server DVD ready with us. Now
follow the below given steps to install AD DS role
Go to Server Manager from Start – Programs – Administrative tools

In the Server Manager console select Role option



Next click on Add role to bring the Add role wizard window as shown below





Select the Active directory domain service role and then click on next button to continue to begin
the process of installing AD DS role

After completion of AD DS role installation the next step is to installation AD DS service using
dcpromo.exe
Installation of AD using dcpromo.exe
To installation all the feature of AD you need to run dcpromo.exe as we where using in earlier
version of Windows. Below are the steps to perform this action
Go to Start – Run and type dcpromo.exe to start the installation process of AD.
After running dcpromo.exe a window appear on screen as shown below to start AD DS
installation wizard. Click the Use Advance mode installation option and click Next button to
continue.
Vision Infosystems (VIS)
Page No. : 20
Next it will display information about compatibility with previous version of Windows Server
operating system. Click next to continue.
Now select Create a new domain in new forest if you are installation the first DC in a forest
and then click Next.
Vision Infosystems (VIS)
Page No. : 21
Next type the Fully Qualified Domain Name (FQDN) for the domain (i.e. vision.com)
Next type the NetBIOS domain name for the domain (i.e. VISION)
Now select the Forest function level which suits our organization requirement.
Vision Infosystems (VIS)
Page No. : 22
Next select the addition service which are require to installation before installation AD DS.
These are
DNS : You have a option to do not install DNS server if required. But in our case since we are
installation the first domain controller this option must be selected.
Global Catalog : By default the first server in the forest is GC by default.
RODC : This role is not available on the First DC.
Vision Infosystems (VIS)
Page No. : 23
Next specify the location of Active Directory database file, log files and sysvol folder.
Next you have to specify DSRM password for restoring and performing active directory database
related function.
Note : This password is different from normal administrator password.
Vision Infosystems (VIS)
Page No. : 24
Next it will show the summary of various options you have selected during the installation of AD
DS wizard.
Next the installation process begins. Wait for few minute to complete the process.
Vision Infosystems (VIS)
Page No. : 25
After completion of installation of AD DS you need to restart the server for changes to take
effect.
When AD DS is installed on a Windows 2008 server you have 3 consoles installed to manage
your active directory forest. They are as under :
• Active directory users and computer : This snap-in or console is use manage active
directory objects like uses, groups, OU, etc.
• Active directory sites and services : This snap-in or console is used to manage active
directory sites which are used for managing replication and finding resources.
• Active directory domains and trust : This snap-in or console is used to manage trust
relationship.
Also two forward lookup zones are created in DNS. They are as under
• <domain.com>
• _msdcs.<domain.com>
Exampe : if you domain name is vision.com then the two zone will be named as 1) vision.com
and 2) _msdcs.vision.com.
Vision Infosystems (VIS)
Page No. : 26
Installation of Addition Domain Controller
1) To set up an Additional Domain Controller, use the dcpromo.exe command. To use the
command, click on Start > Run > and then write dcpromo > Click OK
2) The system will now start checking if Active Directory Domain Services ( AD DS) binaries
are installed, then will start installing them. The binaries could be installed if you had run the
dcpromo command previously and then canceled the operation after the binaries were installed.
3) The Active Directory Domain Services Installation Wizard will start, either enable the
checkbox beside Use Advanced mode installation and Click Next , or keep it unselected and
click on Next.
4) The Operating System Compatibility page will be displayed, take a moment to read it and
click Next.
5) On the Choose a Deployment Configuration page, click Existing forest, click Add a domain
controller to an existing domain, and then click Next.
Vision Infosystems (VIS)
Page No. : 27
6) On the Network Credentials page, type your domain name, in our case it is vision.com
7) To set up an Additional Domain Controller, you will need an account that must be either a
member of the Enterprise Admins group or the Domain Admins group.
8) To enter the Alternate credentials, click Set. In the Windows Security dialog box, enter the
user name and password for an account that must be either a member of the Enterprise Admins
group or the Domain Admins group > then click Next.
Vision Infosystems (VIS)
Page No. : 28
9) On the Select a Domain page, select the domain of the Additional Domain Controller, and
then click Next, as I already have only one domain, then it will be selected by default.
10) On the Select a Site page, either enable the checkbox beside Use the site that corresponds to
the IP address of this computer, this will install the domain controller in the site that corresponds
to its IP address, or select a site from the list and then click Next. If you only have one domain
controller and one site, then you will have the first option grayed and the site will be selected by
default as shown in the following image
11)On the Additional Domain Controller Options page, By default, the DNS Server and Global
Catalog checkboxes are selected. You can also select your additional domain controller to be a
Read-only Domain Controller (RODC) by selecting the checkbox beside it.
Vision Infosystems (VIS)
Page No. : 29
My primary domain controller is a DNS Server is well, and this can be verified by reading the
additional information written in the below image, that there is currently 1 DNS server that is
registered as an authoritative name server for this domain. I do want my Additional DC to be a
DNS server and a Global catalog, so I will keep the checkboxes selected. Click Next
12) If you select the option to install DNS server in the previous step, then you will receive a
message that indicates a DNS delegation for the DNS server could not be created and that you
should manually create a DNS delegation to the DNS server to ensure reliable name resolution.
If you are installing an additional domain controller in either the forest root domain (or a tree
root domain) , you do not need to create the DNS delegation. In this case, you can safely ignore
the message and click Yes.
13) In the Install from Media page ( will be displayed if you have selected Use advanced mode
installation on the Welcome page, if you didn't select it, then skip to step # 15), you can choose
to either replicate data over the network from an existing domain controller, or specify the
location of installation media to be used to create the domain controller and configure AD DS. I
want to replicate data over the network, so I will choose the first option > click Next
Vision Infosystems (VIS)
Page No. : 30
14) On the Source Domain Controller page of the Active Directory Domain Services Installation
Wizard, you can select which domain controller will be used as a source for data that must be
replicated during installation, or you can have the wizard select which domain controller will be
used as the source for this data. You have two options :
Vision Infosystems (VIS)
Page No. : 31
15) Now you will have to specify the location where the domain controller database, log files
and SYSVOL are stored on the server.
16) In the Directory Services Restore Mode Administrator Password (DSRM) page, write a
password and confirm it. This password is used when the domain controller is started in
Directory Services Restore Mode, which might be because Active Directory Domain Services is
not running, or for tasks that must be performed offline.
17) Summary page will be displayed showing you all the setting that you have set . It gives you
the option to export the setting you have setup into an answer file for use to automate subsequent
Vision Infosystems (VIS)
Page No. : 32
AD DS operations, if you wish to have such file, click on the Export settings button and save the
file. Then click Next to begin AD DS installation
18) Active Directory Domain Services installation will be completed, click Finish, then click on
Restart Now to restart your server for the changes to take effect.
19) Open Active Directory Users & Computers, and then click on the Domain Controllers
Organizational Unit, and you will see your Additional Domain Controller along with your
Primary Domain Controller.
Installation of Child Domain
To create a new domain in a new forest
1. Open the Active Directory Installation Wizard.
2. On the Domain Controller Type page, click Domain controller for a new domain, and
then click Next.
3. On the Create New Domain page, click Domain in a new forest, and then click Next.
4. On the New Domain Name page, type the full DNS name for the new domain, and then
click Next.
5. On the NetBIOS Domain Name page, verify the NetBIOS name, and then click Next.

6. On the Database and Log Folders page, type the location in which you want to install
the database and log folders, or click Browse to choose a location, and then click Next.
7. On the Shared System Volume page, type the location in which you want to install the
Sysvol folder, or click Browse to choose a location, and then click Next.
8. On the DNS Registration Diagnostics page, verify if an existing DNS server will be
authoritative for this forest or, if necessary, choose to install and configure DNS on this
server by clicking Install and configure the DNS server on this computer, and set this
computer to use this DNS server as its preferred DNS server, and then click Next.
9. On the Permissions page, select one of the following:
o Permissions compatible with pre-Windows 2000 Server operating systems
o Permissions compatible only with Windows 2000 or Windows Server 2003
operating systems
10. Review the Summary page, and then click Next to begin the installation.

Active Directory Domain Service 2008 windows server

What is Directory:-
Directory is nothing but to organize all sorts of information about a network. The various type of
information stored in Directory is like Network Resources, Network Services, Network users and
groups, etc. A directory is a container, which arranges objects in systematic order according to
our requirement eg. Telephone directory, address directory, company directory, etc.
There are various types of directory available, they are as under:
Application directory : Directory maintained by e-mails software like Lotus notes and
exchanges for maintaining their users, etc
Purpose-specific Directory : A directory maintained by various services like WINS, DNS maintains its own directory for storing mapping for hostname and IP address.
Network Directory : It is a online directory that stores information about network resources, services and objects in a network. It stores all information about computers, users, printers and other available
resources in a network. Active Directory of Windows 2000 is an example of network directory
What is Directory Service In simple a directory service can be define as "The friendly telephone operator who guides or looks up people's phone numbers for your assistance.". If the directory is the actual data—the list of people and telephone numbers—the operators and the method for calling them is the directory service. In windows 2008 Active Directory is a database while the computers which
maintain this database are called as Domain Controllers.
In the field of computing there are various types of directory developed the development of
networking begins, like
Microsoft - Active Directory Service
Xerox - Grapevine
ITU - X.500
IEEE - DNS (Domain Naming Service)
Netware - NDS (Novell Directory Service)
RFC - LDAP (Light Weight Directory Access Protocol)
What is Active Directory Domain Service (AD DS)
AD DS is a new name given in Windows 2008 to ADS. AD DS is a truly network directory that
includes all the features and benefits of traditional directory service. In November 1996,
Microsoft delivered the first preview of Active Directory for developers at the Professional
Developers Conference held in Long Beach, California. Active Directory is designed to be a3
single directory for any size of network. The informational (data) model of the LDAP protocol is
a base for Active Directory. Active Directory is based on X.500 — the International Standards
Organization (ISO) special standard defining elements of a distributed directory service. This
standard proposes an object-oriented data model; therefore, it uses such terms as class, objects
and attributes In Windows 2008 Microsoft has made several enhancements in active directory. We will study about the same later in this chapter.
Active Directory Identity and Access(AD IDA)
Windows 2008 Microsoft has break-up active directory features into 5 different roles to suites
customer requirement. With this IDA feature Microsoft has provided solution for enterprise
resource management like e-mail, database, application, files, etc. All the below given roles are
collectively called ad (IDentity Access) IDA by Microsoft.
IDA concepts includes Authentication (Identity), Application support, Security(Trust), External
connectivity (Partnership) and Integrity (Data protection).

The 5 active directory roles include
Active Directory Domain Service (AD DS) : Active directory domain service was previously
called as Active directory service(ADS). AD DS provide domain management with
authentication, authorization, policy management, etc. This is same as what we have seen in
Windows 2003 active directory, but with enhancement.
Active Directory Lightweight Directory Service (AD LDS) : AD LDS is a standalone version
of active directory which is formally know as Active Directory Application Mode (ADAM).
With AD LDS directory-capable application can now take advantage of active directory service.
Application can store data in AD LDS and AD LDS helps to replication of the same to other AD
LDS.
Active Directory Certificate Service (AD CS) : With this feature you can setup Certificate
authority to provide certificate for secure communication. AD CS provides certificate which
helps for user authentication, computer authentication, web authentication, VPN, IPsec, EFS,
secure wireless network, digital signatures, etc.
Active Directory Rights Management Service (AD RMS) : AD RMS is an information
protection solution for documents and other resources. Example, you can configure to allow user
to read a document but not to print or copy its contents. AD RMS requires Domain Controller
and a MS-SQL server and client requires RMS client software.
Active Directory Federation Service (AD FS) : AD FS helps an organisation to extends
identity solution across multiple platforms (i.e. Windows and Non-Windows too). with AD FS
user authenticated in one organisation can access resources of other organsation. This feature is
called as Single sign-on (SSO).
Active Directory Domain Services Features
• Centralized database : With Active Directory Domain Service we get centralized
network directory of objects stored in active directory.
• Scalability : You can scale your network into multiple domains and trees according to
your requirement.
• Extensibility : You can extend the feature of active directory domain service by
modifying the schema of active directory.
• Manageability : With active directory you can manage your entire forest and find
resources easily and quickly

• Integration with the Domain Name System (DNS) : DNS is used with active directory
to resolves name and finding resources like GC, DC, etc.
• Enhanced Policy feature : With GPO administrator can manage network in an efficient
manner.
• Enhanced replication feature : Active directory had designed replication in such a way
that in multi-domain network model replication cannot become overhead to active
directory.
• Flexible in Operation : Operation can be made flexible with active directory by way of
using multiple protocols, schema modification, domain and trees structure.
• Security and authentication : Active directory domain service support enhanced
security and authentication protocol like Kerberos, NTLM, SSL, TLS ,etc.
• Directory-enabled applications support : With this new feature application can now
take advantage of active directory to store and replication information.
• Compatible with other Directory service : Active directory domain service is
compatible with other directory service due to support for industry standard protocol like
Kerberos, LDAP, X.500, etc.
Active Directory Domain Service Concepts
Active Directory Domain Service has several components that work together to provide a
complete directory service. They are as under :
Active Directory Domain Service Schema : Schema in nothing but a structure which define
what objects and their attributes can be stored in ADS. When a domain is setup it contains a
default schema know as DIT (Directory Information Tree). There are over 140 predefines classes
and over 840 attributes stored in DIT. SCHMMGMT.MSC is used to view the schema of ADS
Objects and Attributes : In ADS every component is called as Objects and every objects as
some Attributes. Eg. users, computer, printers are called as objects and properties related to it is
called as Attributes
Class : A Class is nothing but a container or a object containing sub objects like Forest, Tree,
Domain, O.U. etc.
Logical Structure of Active Directory In Active Directory domain service objects are grouped logically like Domains, Tress, Forest,
Org. Unit, etc. Grouping objects logically enables you to find a objects by its name rather than by
its physical location.
Domains : A domain in AD is nothing but logical grouping of objects like users, computers,
printers, O.U. A domain defines a boundary for all objects located under it. All objects under a
domain uses a common namespace.
Trees : They are logical grouping of Domains and Sub-Domains under a single hierarchy. A tree
uses common namespace for all domains under it. EG. The tree of vision.com uses same
namespace for all its child domain.
Forest : They are logical grouping of Trees having multiple namespace.
Organisation Unit : It is a sub-division of domain into multiple logical classes by administration
for easy administration and management of objects in a container.

Physical Structure
The physical components of Active Directory domain service are sites and domain controllers.
Domain Controller : DC is an object or Computer which runs Windows 2008 Server Operating
Systems and which maintains a copy of AD. In a domain we can have multiple DCs according to
our requirement.
Read-only Domain Controller (RODC) : RODC is a new concept in AD DS. A RODC is a DC
which maintains a read only copy of AD. RODC provides security for branch offices where
physical security is not possible.
Sites : A site is a collection of one or more IP subnets connected by a highly reliable and fast
link to localize as much network traffic as possible. With Active Directory domain service, sites
are not part of the namespace. When you browse the logical namespace, you see computers and
users grouped into domains and OUs, not sites. Sites contain only computer objects like Domain
Controller and connection objects used to configure replication between sites. Sites are basically
used for replication of Active Directory Domain Service database between Domain Controllers
in a site.
Global Catalog : GC is called as index file which helps to find objects in a large Active
directory domain service database. The global catalog is the central repository of information
about objects in a tree or forest. The GC stores a full copy of entire Active Directory domain
service while each Domain maintains partial copy of it. DC maintains Global Catalog database.
By default the first DC in the forest is assigned the role of Global Catalog. When a user logs on a
machine the GC searches for object match and send the object query to the specific domain.
The global catalog performs following tasks:
• It helps network logon by providing universal group membership information to a
domain controller when a logon process is initiated.
• It helps finding information about objects within the forest.
• If a global catalog is not available when a user initiates a network logon process, the user
is only able to log on to the local computer (except member of Domain Admin group)
• We can maintain multiple global catalog servers according to requirement of organization
and network traffic.
Dynamic DNS Service
Service that uses Active Directory Domain Service is the Domain Name System (DNS) service.
Active Directory relies on DNS to find or identify objects like DC, GC, etc. The DNS service is
configured to integrate with Active Directory for storing and network or computer information.

Functions of DNS
• Finding objects in active directory like Domain Controller, Global Catalog, etc. using
SRV records in DNS.
• To resolve names (i.e. Fully Qualified Domain Name) to IP address.
LDAP (Lightweight Directory Access Protocol)
LDAP is protocol that defines how AD service is designed and how objects are managed in ADs.
It defines the schema of AD. It defines how objects are organized in AD. It also defines how
objects or resources can be access from AD. All objects naming in AD is based on LDAP
protocol.
LDAP Namaing of objects
CN=Schema,CN=Configuration,DC=forest name,DC=forest root
eg : CN=Ajay Raul, CN=Users, DN=Vision, DC=com
In the above example Ajay Raul is username Full name and Vision.com is domain name
LDAP Ports
The connections via the LDAP protocol between a client and DSA use either a Transmission
Control Protocol (TCP) or User Datagram Protocol (UDP). The table below lists the protocol
sockets used in different access modes:
Function Port
LDAP 389
LDAP Secure Sockets Layer (SSL) 636
Global Catalog (GC) 3268
Global Catalog Secure Sockets Layer 3269
Directory Partitions
Each DC in a forest maintains a directory partition. Directory partition is logical grouping
objects in AD for easy indexing and searching. There are three types of partitions
Schema Partition : It defines the type of data stored in AD. This partition is shared by all DC in
a forest. When a new object is added to a network schema partition is checked to according
attributes are applied to the object. Scheme partition is replicated to all domains in the forest.

Configuration Partition : It is used to store configuration data of network, such as topology,
replication setting and other network wide resources. Configuration partition is replicated to all
domains in the forest.
Domain Partitions : This partition stores specific information about a AD domain. It contains
information about users, computers, etc objects for a specific domain only. Each domain
maintains its own domain partitions.
Active Directory Support Files
The engine used by Active Directory is based on Microsoft's Jet database technology. Jet uses a
b-tree file structure with transaction logs to ensure recoverability in the event of a system or
drive failure.
When you promote a server to a domain controller, you select where to put the Active Directory
files. The default path is in the boot partition under \Windows\NTDS. Generally, it is a good
idea to put them on a separate volume from the operating system files to improve performance.
The following list contains the Active Directory support files and their functions:
Ntds.dit : This is the main AD database. NTDS stands for NT Directory Services. The DIT
stands for Directory Information Tree. The Ntds.dit file on a particular domain controller
contains all naming contexts hosted by that domain controller, including the Configuration and
Schema naming contexts. A Global Catalog server stores the partial naming context replicas in
the Ntds.dit right along with the full Domain naming context for its domain.
Edb.log : This is a transaction log. Any changes made to objects in Active Directory are first
saved to a transaction log. During lulls in CPU activity, the database engine commits the
transactions into the main Ntds.dit database. This ensures that the database can be recovered in
the event of a system crash. Entries that have not been committed to Ntds.dit are kept in memory
to improve performance. Transaction log files used by the ESE engine are always 1MB.
Edbxxxxx.log : These are auxiliary transaction logs used to store changes if the main Edb.log
file gets full before it can be flushed to Ntds.dit. The xxxxx stands for a sequential number in
hex. When the Edb.log file fills up, an Edbtemp.log file is opened. The original Edb.log file is
renamed to Edb00001.log, and Edbtemp.log is renamed to Edb.log file, and the process starts
over again. ESENT uses circular logging. Excess log files are deleted after they have been
committed. You may see more than one Edbxxxxx.log file if a busy domain controller has many
updates pending.
Edb.chk : This is a checkpoint file. It is used by the transaction logging system to mark the point
at which updates are transferred from the log files to Ntds.dit. As transactions are committed, the
checkpoint moves forward in the Edb.chk file. If the system terminates abnormally, the pointer
tells the system how far along a given set of commits had progressed before the termination.

Temp.edb : This is a scratch pad used to store information about in-progress transactions and to
hold pages pulled out of Ntds.dit during compaction.
Schema.ini : This file is used to initialize the Ntds.dit during the initial promotion of a domain
controller. It is not used after that has been accomplished.
How big is Active Directory service
Active Directory : 100,000 users, 100,000 computers, 10,000 groups, 10,000 printers, and
10,000 volumes. The size of the resulting Ntds.dit is about 1,400 MB, or 1.4 gigabytes! This is
with minimal attributes set on the objects. If all the attributes are set and new schema is update
then the size can grow too long.
Functional Level
Windows 2008 active directory domain service includes a feature to provide support or
compatibility to all Windows Server based operating system using Domain and forest
functionality. Different levels of domain functionality and forest functionality are available
depending on your environment. In each functionality levels we get various features enabled or
disabled.
Domain functional level Domain controllers supported
Windows 2000 native
Windows 2000
Windows Server 2003 family
Windows Server 2008 family
Windows 2003
Windows 2003 server family
Windows Server 2008 family
Windows Server 2008 Windows Server 2008 family
Forest functional level Domain controllers supported
Windows 2000
Windows 2000
Windows Server 2003 family
Windows Server 2008 family
Windows Server 2003
Windows Server 2003 family
Windows Server 2008 family

Windows Server 2008 Windows Server 2008 family
New features of Active Directory Service in Windows 2008
• Read only Domain Controller (RODC)
• Restart able AD Service
• Active directory command-line tools
• Fine-grained password and audit policy
• Active Directory mining tool
• AD certificate service
• Active directory Federation Service
• Active directory Lightweight directory service.
Authentication in Windows 2008
Windows 2008 support 2 types of authentication protocol. They are Kerberos V5 and NTLM
(NT Lan Manager)
NTLM : This protocol is used for backward compatibility with operating systems like Windows
95, 98 and NT. This protocol is used is in mixed mode and is disable in native mode.
Kerberos V5 : This protocol is an Industry standard authentication protocol that provides higher
level of security and is one of the best secure and fast authentication protocol developed by MIT.
Kerberos V5 is the default protocol used in Windows 2000/2003/2008/XP/Vista for
authentication of users, computers and even trust relationship.
How Kerberos V5 works
When a user logs on to domain the user password is converted into an encrypted key. The local
computer uses this key to encrypt timestamp information and sends the same to Domain
controller. To find the domain controller client uses DNS SRV record.
The Domain Controller unencrypted the information and checks the timestamp information and
creates two Kerberos tickets. The tickets are unencrypted using the user stored password key and
sends the ticket back to the user. The two tickets are logon session key ticket which is used to
establish logon session and the other ticket is TGT (Ticket granting ticket) or user ticket which
helps user to access network resources.
Windows 2008 Server Version Comparisons

Microsoft has included a whole variety of flavors of Windows Server 2008 to meet organisation
requirements. Windows 2008 server is available in 8 different edition to suits customer and
organisation requirement. Windows Server 2008 is now available in five primary editions, and
three of these editions will also be available without Windows Server Hyper-V, bringing the total
number of editions to eight. Let us know review all the eight edition of Windows 2008 server.
Windows Server 2008 Standard is the basic sever operating system of Windows 2008 server
family. It includes all the standard features and virtualization. This edition does not includes
clustering feature.
Windows Server 2008 Enterprise is designed for enterprise level of environment for deploying
business-critical applications like mailing system, web servers, application servers, etc. It
includes features like clustering and hot-add processor capabilities.
Windows Server 2008 Datacenter is designed for enterprise or multinational level organization
for deploying business-critical applications and large-scale virtualization on small and large
servers. It includes features like clustering and dynamic hardware partitioning capabilities. It
supports 2 to 64 processors.
Windows Web Server 2008 is designed to be used specifically as a single-purpose Web server,
Windows Web Server 2008 delivers on a rock-solid foundation of Web infrastructure capabilities
in the next-generation Windows Server 2008. Integrated with the newly re-architected IIS 7.0,
ASP.NET, and the Microsoft .NET Framework, Windows Web Server 2008 enables any
organization to rapidly deploy Web pages, Web sites, Web applications, and Web services.

Windows Server 2008 for Itanium-Based Systems is designed to support 64-bit hardware and
large databases, line of business, and custom applications providing high availability and
scalability for up to 64 processors to meet the needs of demanding and mission-critical solutions.
Windows HPC Server 2008, the next generation of high-performance computing (HPC),
provides enterprise-class tools for a highly productive HPC environment. Built on Windows
Server 2008, 64-bit technology, Windows HPC Server 2008 can efficiently scale to thousands of
processing cores and includes management consoles that help you to proactively monitor and
maintain system health and stability. Job scheduling interoperability and flexibility enables
integration between Windows and Linux based HPC platforms, and supports batch and service
oriented application (SOA) workloads. Enhanced productivity, scalable performance, and ease of
use are some of the features that make Windows HPC Server 2008 best-of-breed for Windows
environments.
Upgrade Paths for windows 2008
Operating System Upgrade Options
•
Windows Server 2003 R2 Standard Edition •
Windows Server 2003 Standard Service Pack 1 (SP1) Edition with •
SWeinrvdicoew sP aScekr v2e r( S2P020)3 Standard Edition with
•
Ful instalation of Windows Server 2008 Standard •
Fwuitlhl oinust tHalylapteiorn-V o™f W teinchdnowolso gSye rver 2008 Standard •
FEunltle irnpsrtiasela tion of Windows Server 2008 •
FEunltle irnpsrtiasela wtioithn oouft WHiynpdeorw-Vs Server 2008
•
Windows Server 2003 R2 Enterprise Edition •
wWiitnhd Soewrsv icSee rPvaecr k2 010 (3S PE1n)te rprise Edition •
wWiitnhd Soewrsv icSee rPvaecr k2 020 (3S PE2n)te rprise Edition
•
FEunltle irnpsrtiasela tion of Windows Server 2008 •
FEunltle irnpsrtiasela wtioithn oouft WHiynpdeorw-Vs Server 2008 •
Ful instalation of Windows Server 2008

Operating System Upgrade Options
Datacenter •
Ful instalation of Windows Datacenter without Hyper-V Server 2008
•
Windows Server 2003 R2 Datacenter Edition •
wWiitnhd Soewrsv icSee rPvaecr k2 010 (3S PD1a)t a center Edition •
wWiitnhd Soewrsv icSee rPvaecr k2 020 (3S PD2a)t a center Edition
•
FDualtla icnesntatelar tion of Windows Server 2008
•
Windows Server 2008 Standard
•
Windows Server 2008 Enterprise
•
HWyinpdeor-wVs Server 2008 Standard without
•
Windows Server 2008 Enterprise without Hyper-V
•
Windows Server 2008 Enterprise
•
Windows Server 2008 Datacenter
•
HWyinpdeor-wVs Server 2008 Enterprise without
•
Windows Server 2008 Enterprise without Hyper-V
New Features in Windows Server 2008
This chapter covers new features in Windows Server 2008:
• RODC
• AD Restartable Service

• Quota Management
• File Service Resource Management
• Virtualization
• Fine-grained policy
• DNS and DHCP with IPv6 support
• AD RMS and AD FS
• Reliability Monitor
• Terminal Service Enhancement
• Windows Search Service
• Windows System Resource Manager
• New Windows Server Backup
• Network Access Protection
• Windows Deployment Service
• Many more

********************************************************************************

Users, Groups and Management of Policy -2008 server

Users
User is an object or security principle which has authority to perform activities on a Windows
based machine. Every user has an right to perform activities and has a user login name and
password. There are two types of users in Windows network environment i.e. Local User and
Global User.
Local Users
• Used in workgroup environment
• Created only on Non-Domain Controller
• Can log on to the same machine where his account is created
• Created using computer management
• Cannot be created on domain controller
• Local user are created on member server, windows 2000/XP professional.
Domain Global User (Active directory user)
• Used in domain environment
• Created only on domain controllers
• Can log on to any machine in a domain
• Created using Active directory users and computers snap-in or using command-line tool
Creating active directory global user from command line
Dsadd user “USERDN” –samid <samid> -upn <name@domainname> -pwd <password>
Example :
dsadd user “cn=ajay raul, cn=Users, dc=vision,dc=com” –samid ajayraul –upn
ajayraul@vision.com –pwd 123_abc
Built-in Users
There are two built-in users account i.e. Administrator and Guest. Administrator is a user who
has full access to every resources of a windows based machine. The administrator can perform a
variety of task. We cannot delete this account but we can rename it. Where as the guest account
is designed to permit limited access to network resources. For example, a client visiting your
office might want to access some network resources for limited period of time. Guest account is
disable by default. Once guest account is enabled client can logon to network using this account.
So it is recommended to disable guest account. The guest account does not require a password.
You cannot delete guest account, but can rename it.

Steps for creating domain based global user
1. Select Start – Programs - Administrative Tools - Active Directory Users and Computers
snap-in.
2. In the left pane of the Active Directory Users and Computers dialog box, click the + next
to the name of the domain in which you want to create a domain user account. Highlight
the Users folder or the OU in which you want to create a domain user account, and right
click Action New User.
3. The New Object - User dialog box appears on the screen.
Enter the first name, middle initial, and last name of the new user in the appropriate text
boxes. Windows 2000 automatically displays the full name based on the information you
entered. Enter a user logon name — this is the user name. Click Next.
4. The next New Object - User dialog box appears on your screen.

Enter the password for the new user account, and confirm the password by retyping it. There are
four check boxes that can be selected in this dialog box, none of which are selected by default:
User must change password at next logon: Select this check box if you want the user to choose
and enter a new password the first time the user logs on.
User cannot change password: Select this check box if you — the network administrator —
want to manage and assign user passwords.
Password never expires: Select this check box if you are configuring a user account for a
Windows 2000 service to use when it logs on.
Account is disabled: Select this check box if you are creating a user template.
5. In the next New Object - User dialog box, click Finish.
6. Windows 2008 creates the new user account, and displays it in the right pane of the
Active Directory Users and Computers dialog box.
Groups
Group types
Security Group : A group that can be listed in discretionary access control lists (DACLs) used
to define permissions on resources and objects. In simple security groups are group to which
rights and permission can be assigned.
Distribution Group : A group that is used solely for e-mail distribution and that is not securityenabled.
Distribution groups cannot be listed in discretionary access control lists (DACLs) used
to define permissions on resources and objects. Distribution groups can be used only with e-mail
applications (such as Microsoft Exchange) to send e-mail to collections of users. If you do not
need a group for security purposes, create a distribution group instead of a security group.
There are three group scopes: universal, global, and domain local
• Members of universal groups can include other groups and accounts from any domain in
the domain tree or forest and can be assigned permissions in any domain in the domain
tree or forest.
• Members of global groups can include other groups and accounts only from the domain
in which the group is defined and can be assigned permissions in any domain in the
forest.
• Members of domain local groups can include other groups and accounts from Windows
Server 2003, Windows 2000, or Windows NT domains and can be assigned permissions
only within a domain.

Universal scope
• When the domain functional level is set to Windows 2000 native or Windows Server
2003, members of universal groups can include accounts, global groups, and universal
groups from any domain.
• When the domain functional level is set to Windows 2000 mixed, security groups with
universal scope cannot be created
• When the domain functional level is set to Windows 2000 native or Windows Server
2003, groups can be added to other groups and assigned permissions in any domain
• Groups can be converted to domain local scope. Groups can be converted to global scope,
as long as no other universal groups exists as members.
Global scope
• When the domain functional level is set to Windows 2000 native or Windows Server
2003, members of global groups can include accounts and global groups from the same
domain.
• When the domain functional level is set to Windows 2000 mixed, members of global
groups can include accounts from the same domain.
• Groups can be added to other groups and assigned permissions in any domain.
• Groups can be converted to universal scope, as long as the group is not a member of any
other group with global scope.
Domain local scope
• When the domain functional level is set to Windows 2000 native or Windows Server
2003, members of domain local scope can include accounts, global groups, and universal
groups from any domain, as well as domain local groups from the same domain
• When the domain functional level is set to Windows 2000 native or Windows Server
2003, members of domain local groups can include accounts and global groups from any
domain.
• Groups can be added to other domain local groups and assigned permissions only in the
same domain.
• Groups can be converted to universal scope, as long as the group does not have as its
member another group with domain local scope.

Changing group scope
• Global to universal : This is only allowed if the group you want to change is not a
member of another global scope group.
• Domain local to universal : This is only allowed if the group you want to change does
not have another domain local group as a member.
• Universal to global : This is only allowed if the group you want to change does not have
another universal group as a member.
• Universal to domain local : No restrictions for this operation
Built-in Default Groups
• Administrators : Members of this group have full control of the server and can assign
user rights and access control permissions to users as necessary.
• Backup Operators : Members of this group can back up and restore files on the server,
regardless of any permissions that protect those files.
• DHCP Administrators : Members of this group have administrative access to the
Dynamic Host Configuration Protocol (DHCP) Server service.
• Guests : Members of this group will have a temporary profile created at log on, and
when the member logs off, the profile will be deleted.
• HelpServicesGroup : This group allows administrators to set rights common to all
support applications. By default, the only group member is the account associated with
Microsoft support applications, such as Remote Assistance. Do not add users to this
group.
• Network Configuration Operators : Members of this group can make changes to
TCP/IP settings and renew and release TCP/IP addresses
• Performance Monitor Users : Members of this group can monitor performance counters
on the server locally and from remote clients without being a member of the
Administrators or Performance Log Users groups.
• Power Users : Members of this group can create user accounts and then modify and
delete the accounts they have created. They can create local groups and then add or
remove users from the local groups they have created
• Print Operators : Members of this group can manage printers and print queues.
• Remote Desktop Users : Members of this group can remotely log on to a server

• Terminal Server Users :This group contains any users who are currently logged on to
the system using Terminal Server
And many more
Steps to Create Groups
To create Groups you must have administrative privileges or rights. Domain based Groups are
only created on Domain Controllers. Active Directory users and computer snap-in is a tool used
for creating Groups. Below are the steps used to create groups
1) Click on Start – Program – Administrative Tools – Active Directory Users and Computer
2) When you click on Active Directory Users and Computer snap-in a MMC Console
appears on you screen.
3) Right click on the user Icon and then select New – Groups. When you do so the group
creation window appears on screen as show below.
Here you have specified a unique group name, group type and group scope.
4) After specifying the details shown above click on OK to create a new Group.
5) Next you can add users or other groups to the new groups or you can make this group a
member of existing group.
6) To add user to this group right click on the group and then go to properties as show below

7) Then go to member tab and select the user who wants to be member of this group.
8) To make this group the member of existing group you can go to Members Of tab.
9) After doing so click on OK to finish.
Note : You can also add a user to a group by going to User properties and then to Member tab
and then add the group you want.

Managing user Policies
Windows 2008 policies are rules or setting applied to users in a domain or workgroup. These
setting are not applied to an individual user, but rather applied to all or multiple users. The
various policies setting are like
• Password policy
• Account Lockout policy
• Kerberos policy
Password Policy
This policy setting contains user password setting like passsword age, password length, password
history, etc.
Enforce Password History : This setting specifies how many password a user must use before
an old password can be reused. If you set this value to 5 passwords, it means you cannot use
same password after 5 different password. This value ranges from 0 to 24.
Maximum password age : This setting specifies for how many days the same password can be
used. The value ranges from 0 to 999 and default is 42 days.
Minimum password age : This setting specifies for how many minimum days a user must use
the same password before changing it. This value ranges from 0 to 998.
Minimum password length : This setting specifies the length of the password. The value ranges
from 0 to 14.
Passowrd must meet complexity requirement : This setting specifies that the password should
be complex combining of charaters, numbers, special charaters, etc. eg : V103_IN03
Store password using reversible encryption : This setting specifies whether password should
be stored using one-way encryption or reversible encryption. One-way encryption is more secure
the reverse encryption. This setting should only be used when you have domain with apple
computers or any application that only supports reverse encryptions.
Account Lockout Policy
This policy are use as a security parameters to secure users password and accounts. There are 3
setting available to secure user accounts. This policy tracks user account locking feature if any
invalid attempts are made.

Account Lockout Threshold : This setting specifies that when to lock a user account if how
many unsuccessful attempt is made. This value ranges from 0 to 999.
Account lockout duration : This setting specifies for how long duration the user account must
be locked. The value ranges from 0 to 99999 minutes. Administration has a right to manually
unlock a locked user account.
Reset account lockout counter : This setting specifies the number of minutes the counter must
be reset so that the user gets new attempts. This value ranges from 0 to 99999 minutes. This
value should be equal to account lockout duration.
Kerberos Policy
This policy setting applies to Kerberos V5 authentication protocol use by Windows
2000/2003/2008 operating system. This feature is used in domain environment only and
operating system that supports its like Windows 2000/XP/2003/2008/Vista/7. This feature is not
supported by Windows NT/9x,etc.
Enforce user logon restrictions
Maximum lifetime for service ticket
Maximum lifetime for user ticket
Maximum lifetime for user ticket renewal
Maximum tolerance for computer clock synchronization
Account Policy Setting for a Domain
1. Select Start.- Programs - Administrative Tools – Group Policy Management.
2. In the Group Policy Management Window Select the domain and under the domain select
group policy.
3. Next select the domain security policy and right click and select edit.
4. The GPO window now appears on the screen
5. Next select windows settings under computer configuration.
6. Under Windows seetings , click the Security Settings. Then click the Account Policies.
7. In the dialog box, highlight the type of account policies you want to set, either Password
Policy, Account Lockout Policy, or Kerberos Policy. Notice the six configurable settings
displayed in the right pane.
8. To set account policies, in the right pane, double-click the setting you want to configure.
For example, suppose you want to configure the minimum password length.

9. In this case, the Security Policy Setting dialog box would be displayed, specify the
minimum number of required characters in user passwords. Make the appropriate
configurations in the Security Policy Setting dialog box and click OK.
10. Repeat Steps 3 through 5 to set additional account policies as necessary. When you’ve
finished setting account policies, close the Domain Security Policy dialog box.
User rights
User rights are rights assigned to user to perform specific type of task on a Windows XP/Vista/7
based computer. User rights enable a user to perform various activities like load and unload
device drivers, log on locally, backup files and folders, etc. The procedure for assigning user
rights is same as assigning account setting to the user.
The various rights are as under
• Access this computer from the network
• Deny access to this computer from the network
• Deny logon as a batch job
• Deny logon as a service
• Deny logon locally
• Log on as a batch job
• Log on as a service
• Log on locally
• Act as part of the operating system
• Add workstations to domain
• Back up files and directories

• Bypass traverse checking
• Change the system time
• Create a pagefile
• Create a token object
• Create permanent shared objects
• Debug programs
• Enable computer and user accounts to be trusted for delegation
• Force shutdown from a remote system
• Generate security audits
• Increase quotas
• Increase scheduling priority
• Load and unload device drivers
• Lock pages in memory
• Manage auditing and security log
• Modify firmware environment values
• Profile single process
• Profile system performance
• Remove computer from docking station
• Replace a process level token
• Restore files and directories
• Shut down the system
• Synchronize directory service data
• Take ownership of files or other objects

AD DS Installation

Installation of Active Directory Domain Service
Before installation Active Directory domain service (AD DS) for the first time we need to plan
various things in-order to meet our organization requirement. Below are the list of information
which you need to plan before installing AD DS.
• Domain name for the organization (eg. Vision.com) and NetBIOS domain name (eg.
Vision)
• Domain and Forest functional level
• Installation of DNS service
• Location of NTDS Database and logs file
• Name of the server
• IP address for the DNS Server
• Administrator password and DSRM password
Now let start the procedure to install AD DS role on the server and make the server works as
domain controller for a new forest/domain.
The AD DS process is divided into 2 parts i.e.
• Installation of AD DS role
• Installation of AD using dcpromo.exe
Installation of AD DS role
Inorder to install AD DS role we require to have Windows 2008 server DVD ready with us. Now
follow the below given steps to install AD DS role
Go to Server Manager from Start – Programs – Administrative tools

In the Server Manager console select Role option
Next click on Add role to bring the Add role wizard window as shown below
Select the Active directory domain service role and then click on next button to continue to begin
the process of installing AD DS role

After completion of AD DS role installation the next step is to installation AD DS service using
dcpromo.exe
Installation of AD using dcpromo.exe
To installation all the feature of AD you need to run dcpromo.exe as we where using in earlier
version of Windows. Below are the steps to perform this action
Go to Start – Run and type dcpromo.exe to start the installation process of AD.
After running dcpromo.exe a window appear on screen as shown below to start AD DS
installation wizard. Click the Use Advance mode installation option and click Next button to
continue.

Next it will display information about compatibility with previous version of Windows Server
operating system. Click next to continue.
Now select Create a new domain in new forest if you are installation the first DC in a forest
and then click Next.

Next type the Fully Qualified Domain Name (FQDN) for the domain (i.e. vision.com)
Next type the NetBIOS domain name for the domain (i.e. VISION)
Now select the Forest function level which suits our organization requirement.
2
Next select the addition service which are require to installation before installation AD DS.
These are
DNS : You have a option to do not install DNS server if required. But in our case since we are
installation the first domain controller this option must be selected.
Global Catalog : By default the first server in the forest is GC by default.
RODC : This role is not available on the First DC.

Next specify the location of Active Directory database file, log files and sysvol folder.
Next you have to specify DSRM password for restoring and performing active directory database
related function.
Note : This password is different from normal administrator password.

Next it will show the summary of various options you have selected during the installation of AD
DS wizard.
Next the installation process begins. Wait for few minute to complete the process.

After completion of installation of AD DS you need to restart the server for changes to take
effect.
When AD DS is installed on a Windows 2008 server you have 3 consoles installed to manage
your active directory forest. They are as under :
• Active directory users and computer : This snap-in or console is use manage active
directory objects like uses, groups, OU, etc.
• Active directory sites and services : This snap-in or console is used to manage active
directory sites which are used for managing replication and finding resources.
• Active directory domains and trust : This snap-in or console is used to manage trust
relationship.
Also two forward lookup zones are created in DNS. They are as under
• <domain.com>
• _msdcs.<domain.com>
Exampe : if you domain name is vision.com then the two zone will be named as 1) vision.com
and 2) _msdcs.vision.com.

Installation of Addition Domain Controller
1) To set up an Additional Domain Controller, use the dcpromo.exe command. To use the
command, click on Start > Run > and then write dcpromo > Click OK
2) The system will now start checking if Active Directory Domain Services ( AD DS) binaries
are installed, then will start installing them. The binaries could be installed if you had run the
dcpromo command previously and then canceled the operation after the binaries were installed.
3) The Active Directory Domain Services Installation Wizard will start, either enable the
checkbox beside Use Advanced mode installation and Click Next , or keep it unselected and
click on Next.
4) The Operating System Compatibility page will be displayed, take a moment to read it and
click Next.
5) On the Choose a Deployment Configuration page, click Existing forest, click Add a domain
controller to an existing domain, and then click Next.

6) On the Network Credentials page, type your domain name, in our case it is vision.com
7) To set up an Additional Domain Controller, you will need an account that must be either a
member of the Enterprise Admins group or the Domain Admins group.
8) To enter the Alternate credentials, click Set. In the Windows Security dialog box, enter the
user name and password for an account that must be either a member of the Enterprise Admins
group or the Domain Admins group > then click Next.

9) On the Select a Domain page, select the domain of the Additional Domain Controller, and
then click Next, as I already have only one domain, then it will be selected by default.
10) On the Select a Site page, either enable the checkbox beside Use the site that corresponds to
the IP address of this computer, this will install the domain controller in the site that corresponds
to its IP address, or select a site from the list and then click Next. If you only have one domain
controller and one site, then you will have the first option grayed and the site will be selected by
default as shown in the following image
11)On the Additional Domain Controller Options page, By default, the DNS Server and Global
Catalog checkboxes are selected. You can also select your additional domain controller to be a
Read-only Domain Controller (RODC) by selecting the checkbox beside it.

My primary domain controller is a DNS Server is well, and this can be verified by reading the
additional information written in the below image, that there is currently 1 DNS server that is
registered as an authoritative name server for this domain. I do want my Additional DC to be a
DNS server and a Global catalog, so I will keep the checkboxes selected. Click Next
12) If you select the option to install DNS server in the previous step, then you will receive a
message that indicates a DNS delegation for the DNS server could not be created and that you
should manually create a DNS delegation to the DNS server to ensure reliable name resolution.
If you are installing an additional domain controller in either the forest root domain (or a tree
root domain) , you do not need to create the DNS delegation. In this case, you can safely ignore
the message and click Yes.
13) In the Install from Media page ( will be displayed if you have selected Use advanced mode
installation on the Welcome page, if you didn't select it, then skip to step # 15), you can choose
to either replicate data over the network from an existing domain controller, or specify the
location of installation media to be used to create the domain controller and configure AD DS. I
want to replicate data over the network, so I will choose the first option > click Next

14) On the Source Domain Controller page of the Active Directory Domain Services Installation
Wizard, you can select which domain controller will be used as a source for data that must be
replicated during installation, or you can have the wizard select which domain controller will be
used as the source for this data. You have two options :

15) Now you will have to specify the location where the domain controller database, log files
and SYSVOL are stored on the server.
16) In the Directory Services Restore Mode Administrator Password (DSRM) page, write a
password and confirm it. This password is used when the domain controller is started in
Directory Services Restore Mode, which might be because Active Directory Domain Services is
not running, or for tasks that must be performed offline.
17) Summary page will be displayed showing you all the setting that you have set . It gives you
the option to export the setting you have setup into an answer file for use to automate subsequent

AD DS operations, if you wish to have such file, click on the Export settings button and save the
file. Then click Next to begin AD DS installation
18) Active Directory Domain Services installation will be completed, click Finish, then click on
Restart Now to restart your server for the changes to take effect.
19) Open Active Directory Users & Computers, and then click on the Domain Controllers
Organizational Unit, and you will see your Additional Domain Controller along with your
Primary Domain Controller.
Installation of Child Domain
To create a new domain in a new forest
1. Open the Active Directory Installation Wizard.
2. On the Domain Controller Type page, click Domain controller for a new domain, and
then click Next.
3. On the Create New Domain page, click Domain in a new forest, and then click Next.
4. On the New Domain Name page, type the full DNS name for the new domain, and then
click Next.
5. On the NetBIOS Domain Name page, verify the NetBIOS name, and then click Next.

6. On the Database and Log Folders page, type the location in which you want to install
the database and log folders, or click Browse to choose a location, and then click Next.
7. On the Shared System Volume page, type the location in which you want to install the
Sysvol folder, or click Browse to choose a location, and then click Next.
8. On the DNS Registration Diagnostics page, verify if an existing DNS server will be
authoritative for this forest or, if necessary, choose to install and configure DNS on this
server by clicking Install and configure the DNS server on this computer, and set this
computer to use this DNS server as its preferred DNS server, and then click Next.
9. On the Permissions page, select one of the following:
o Permissions compatible with pre-Windows 2000 Server operating systems
o Permissions compatible only with Windows 2000 or Windows Server 2003
operating systems
10. Review the Summary page, and then click Next to begin the installation.

Active Directory Domain Service (ADDS)

What is Directory
Directory is nothing but to organize all sorts of information about a network. The various type of
information stored in Directory is like Network Resources, Network Services, Network users and
groups, etc. A directory is a container, which arranges objects in systematic order according to
our requirement eg. Telephone directory, address directory, company directory, etc.
There are various types of directory available, they are as under:
Application directory : Directory maintained by e-mails software like Lotus notes and
exchanges for maintaining their users, etc
Purpose-specific Directory : A directory maintained by various services like WINS, DNS maintains its
own directory for storing mapping for hostname and IP address.
Network Directory : It is a online directory that stores information about network resources, services and
objects in a network. It stores all information about computers, users, printers and other available
resources in a network. Active Directory of Windows 2000 is an example of network directory
What is Directory Service
In simple a directory service can be define as "The friendly telephone operator who guides or
looks up people's phone numbers for your assistance.". If the directory is the actual data—
the list of people and telephone numbers—the operators and the method for calling them is the
directory service. In windows 2008 Active Directory is a database while the computers which
maintain this database are called as Domain Controllers.
In the field of computing there are various types of directory developed the development of
networking begins, like
Microsoft - Active Directory Service
Xerox - Grapevine
ITU - X.500
IEEE - DNS (Domain Naming Service)
Netware - NDS (Novell Directory Service)
RFC - LDAP (Light Weight Directory Access Protocol)
What is Active Directory Domain Service (AD DS)
AD DS is a new name given in Windows 2008 to ADS. AD DS is a truly network directory that
includes all the features and benefits of traditional directory service. In November 1996,
Microsoft delivered the first preview of Active Directory for developers at the Professional
Developers Conference held in Long Beach, California. Active Directory is designed to be a


single directory for any size of network. The informational (data) model of the LDAP protocol is
a base for Active Directory. Active Directory is based on X.500 — the International Standards
Organization (ISO) special standard defining elements of a distributed directory service. This
standard proposes an object-oriented data model; therefore, it uses such terms as class, objects
and attributes
In Windows 2008 Microsoft has made several enhancements in active directory. We will study
about the same later in this chapter.
Active Directory Identity and Access(AD IDA)
Windows 2008 Microsoft has break-up active directory features into 5 different roles to suites
customer requirement. With this IDA feature Microsoft has provided solution for enterprise
resource management like e-mail, database, application, files, etc. All the below given roles are
collectively called ad (IDentity Access) IDA by Microsoft.
IDA concepts includes Authentication (Identity), Application support, Security(Trust), External
connectivity (Partnership) and Integrity (Data protection).

The 5 active directory roles include
Active Directory Domain Service (AD DS) : Active directory domain service was previously
called as Active directory service(ADS). AD DS provide domain management with
authentication, authorization, policy management, etc. This is same as what we have seen in
Windows 2003 active directory, but with enhancement.
Active Directory Lightweight Directory Service (AD LDS) : AD LDS is a standalone version
of active directory which is formally know as Active Directory Application Mode (ADAM).
With AD LDS directory-capable application can now take advantage of active directory service.
Application can store data in AD LDS and AD LDS helps to replication of the same to other AD
LDS.
Active Directory Certificate Service (AD CS) : With this feature you can setup Certificate
authority to provide certificate for secure communication. AD CS provides certificate which
helps for user authentication, computer authentication, web authentication, VPN, IPsec, EFS,
secure wireless network, digital signatures, etc.
Active Directory Rights Management Service (AD RMS) : AD RMS is an information
protection solution for documents and other resources. Example, you can configure to allow user
to read a document but not to print or copy its contents. AD RMS requires Domain Controller
and a MS-SQL server and client requires RMS client software.
Active Directory Federation Service (AD FS) : AD FS helps an organisation to extends
identity solution across multiple platforms (i.e. Windows and Non-Windows too). with AD FS
user authenticated in one organisation can access resources of other organsation. This feature is
called as Single sign-on (SSO).
Active Directory Domain Services Features
• Centralized database : With Active Directory Domain Service we get centralized
network directory of objects stored in active directory.
• Scalability : You can scale your network into multiple domains and trees according to
your requirement.
• Extensibility : You can extend the feature of active directory domain service by
modifying the schema of active directory.
• Manageability : With active directory you can manage your entire forest and find
resources easily and quickly

• Integration with the Domain Name System (DNS) : DNS is used with active directory
to resolves name and finding resources like GC, DC, etc.
• Enhanced Policy feature : With GPO administrator can manage network in an efficient
manner.
• Enhanced replication feature : Active directory had designed replication in such a way
that in multi-domain network model replication cannot become overhead to active
directory.
• Flexible in Operation : Operation can be made flexible with active directory by way of
using multiple protocols, schema modification, domain and trees structure.
• Security and authentication : Active directory domain service support enhanced
security and authentication protocol like Kerberos, NTLM, SSL, TLS ,etc.
• Directory-enabled applications support : With this new feature application can now
take advantage of active directory to store and replication information.
• Compatible with other Directory service : Active directory domain service is
compatible with other directory service due to support for industry standard protocol like
Kerberos, LDAP, X.500, etc.
Active Directory Domain Service Concepts
Active Directory Domain Service has several components that work together to provide a
complete directory service. They are as under :
Active Directory Domain Service Schema : Schema in nothing but a structure which define
what objects and their attributes can be stored in ADS. When a domain is setup it contains a
default schema know as DIT (Directory Information Tree). There are over 140 predefines classes
and over 840 attributes stored in DIT. SCHMMGMT.MSC is used to view the schema of ADS
Objects and Attributes : In ADS every component is called as Objects and every objects as
some Attributes. Eg. users, computer, printers are called as objects and properties related to it is
called as Attributes
Class : A Class is nothing but a container or a object containing sub objects like Forest, Tree,
Domain, O.U. etc.
Logical Structure of Active Directory
In Active Directory domain service objects are grouped logically like Domains, Tress, Forest,
Org. Unit, etc. Grouping objects logically enables you to find a objects by its name rather than by
its physical location.

Domains : A domain in AD is nothing but logical grouping of objects like users, computers,
printers, O.U. A domain defines a boundary for all objects located under it. All objects under a
domain uses a common namespace.
Trees : They are logical grouping of Domains and Sub-Domains under a single hierarchy. A tree
uses common namespace for all domains under it. EG. The tree of vision.com uses same
namespace for all its child domain.
Forest : They are logical grouping of Trees having multiple namespace.
Organisation Unit : It is a sub-division of domain into multiple logical classes by administration
for easy administration and management of objects in a container.

Physical Structure
The physical components of Active Directory domain service are sites and domain controllers.
Domain Controller : DC is an object or Computer which runs Windows 2008 Server Operating
Systems and which maintains a copy of AD. In a domain we can have multiple DCs according to
our requirement.
Read-only Domain Controller (RODC) : RODC is a new concept in AD DS. A RODC is a DC
which maintains a read only copy of AD. RODC provides security for branch offices where
physical security is not possible.
Sites : A site is a collection of one or more IP subnets connected by a highly reliable and fast
link to localize as much network traffic as possible. With Active Directory domain service, sites
are not part of the namespace. When you browse the logical namespace, you see computers and
users grouped into domains and OUs, not sites. Sites contain only computer objects like Domain
Controller and connection objects used to configure replication between sites. Sites are basically
used for replication of Active Directory Domain Service database between Domain Controllers
in a site.
Global Catalog : GC is called as index file which helps to find objects in a large Active
directory domain service database. The global catalog is the central repository of information
about objects in a tree or forest. The GC stores a full copy of entire Active Directory domain
service while each Domain maintains partial copy of it. DC maintains Global Catalog database.
By default the first DC in the forest is assigned the role of Global Catalog. When a user logs on a
machine the GC searches for object match and send the object query to the specific domain.
The global catalog performs following tasks:
• It helps network logon by providing universal group membership information to a
domain controller when a logon process is initiated.
• It helps finding information about objects within the forest.
• If a global catalog is not available when a user initiates a network logon process, the user
is only able to log on to the local computer (except member of Domain Admin group)
• We can maintain multiple global catalog servers according to requirement of organization
and network traffic.
Dynamic DNS Service
Service that uses Active Directory Domain Service is the Domain Name System (DNS) service.
Active Directory relies on DNS to find or identify objects like DC, GC, etc. The DNS service is
configured to integrate with Active Directory for storing and network or computer information.

Functions of DNS
• Finding objects in active directory like Domain Controller, Global Catalog, etc. using
SRV records in DNS.
• To resolve names (i.e. Fully Qualified Domain Name) to IP address.
LDAP (Lightweight Directory Access Protocol)
LDAP is protocol that defines how AD service is designed and how objects are managed in ADs.
It defines the schema of AD. It defines how objects are organized in AD. It also defines how
objects or resources can be access from AD. All objects naming in AD is based on LDAP
protocol.
LDAP Namaing of objects
CN=Schema,CN=Configuration,DC=forest name,DC=forest root
eg : CN=Ajay Raul, CN=Users, DN=MSI, DC=com
In the above example Ajay Raul is username Full name and MSI.com is domain name
LDAP Ports
The connections via the LDAP protocol between a client and DSA use either a Transmission
Control Protocol (TCP) or User Datagram Protocol (UDP). The table below lists the protocol
sockets used in different access modes:
Function Port
LDAP 389
LDAP Secure Sockets Layer (SSL) 636
Global Catalog (GC) 3268
Global Catalog Secure Sockets Layer 3269
Directory Partitions
Each DC in a forest maintains a directory partition. Directory partition is logical grouping
objects in AD for easy indexing and searching. There are three types of partitions
Schema Partition : It defines the type of data stored in AD. This partition is shared by all DC in
a forest. When a new object is added to a network schema partition is checked to according
attributes are applied to the object. Scheme partition is replicated to all domains in the forest.

Configuration Partition : It is used to store configuration data of network, such as topology,
replication setting and other network wide resources. Configuration partition is replicated to all
domains in the forest.
Domain Partitions : This partition stores specific information about a AD domain. It contains
information about users, computers, etc objects for a specific domain only. Each domain
maintains its own domain partitions.
Active Directory Support Files
The engine used by Active Directory is based on Microsoft's Jet database technology. Jet uses a
b-tree file structure with transaction logs to ensure recoverability in the event of a system or
drive failure.
When you promote a server to a domain controller, you select where to put the Active Directory
files. The default path is in the boot partition under \Windows\NTDS. Generally, it is a good
idea to put them on a separate volume from the operating system files to improve performance.
The following list contains the Active Directory support files and their functions:
Ntds.dit : This is the main AD database. NTDS stands for NT Directory Services. The DIT
stands for Directory Information Tree. The Ntds.dit file on a particular domain controller
contains all naming contexts hosted by that domain controller, including the Configuration and
Schema naming contexts. A Global Catalog server stores the partial naming context replicas in
the Ntds.dit right along with the full Domain naming context for its domain.
Edb.log : This is a transaction log. Any changes made to objects in Active Directory are first
saved to a transaction log. During lulls in CPU activity, the database engine commits the
transactions into the main Ntds.dit database. This ensures that the database can be recovered in
the event of a system crash. Entries that have not been committed to Ntds.dit are kept in memory
to improve performance. Transaction log files used by the ESE engine are always 1MB.
Edbxxxxx.log : These are auxiliary transaction logs used to store changes if the main Edb.log
file gets full before it can be flushed to Ntds.dit. The xxxxx stands for a sequential number in
hex. When the Edb.log file fills up, an Edbtemp.log file is opened. The original Edb.log file is
renamed to Edb00001.log, and Edbtemp.log is renamed to Edb.log file, and the process starts
over again. ESENT uses circular logging. Excess log files are deleted after they have been
committed. You may see more than one Edbxxxxx.log file if a busy domain controller has many
updates pending.
Edb.chk : This is a checkpoint file. It is used by the transaction logging system to mark the point
at which updates are transferred from the log files to Ntds.dit. As transactions are committed, the
checkpoint moves forward in the Edb.chk file. If the system terminates abnormally, the pointer
tells the system how far along a given set of commits had progressed before the termination.

Temp.edb : This is a scratch pad used to store information about in-progress transactions and to
hold pages pulled out of Ntds.dit during compaction.
Schema.ini : This file is used to initialize the Ntds.dit during the initial promotion of a domain
controller. It is not used after that has been accomplished.
How big is Active Directory service
Active Directory : 100,000 users, 100,000 computers, 10,000 groups, 10,000 printers, and
10,000 volumes. The size of the resulting Ntds.dit is about 1,400 MB, or 1.4 gigabytes! This is
with minimal attributes set on the objects. If all the attributes are set and new schema is update
then the size can grow too long.
Functional Level
Windows 2008 active directory domain service includes a feature to provide support or
compatibility to all Windows Server based operating system using Domain and forest
functionality. Different levels of domain functionality and forest functionality are available
depending on your environment. In each functionality levels we get various features enabled or
disabled.
Domain functional level Domain controllers supported
Windows 2000 native
Windows 2000
Windows Server 2003 family
Windows Server 2008 family
Windows 2003
Windows 2003 server family
Windows Server 2008 family
Windows Server 2008 Windows Server 2008 family
Forest functional level Domain controllers supported
Windows 2000
Windows 2000
Windows Server 2003 family
Windows Server 2008 family
Windows Server 2003
Windows Server 2003 family
Windows Server 2008 family
Windows Server 2008 Windows Server 2008 family
New features of Active Directory Service in Windows 2008
• Read only Domain Controller (RODC)
• Restart able AD Service
• Active directory command-line tools
• Fine-grained password and audit policy
• Active Directory mining tool
• AD certificate service
• Active directory Federation Service
• Active directory Lightweight directory service.
Authentication in Windows 2008
Windows 2008 support 2 types of authentication protocol. They are Kerberos V5 and NTLM
(NT Lan Manager)
NTLM : This protocol is used for backward compatibility with operating systems like Windows
95, 98 and NT. This protocol is used is in mixed mode and is disable in native mode.
Kerberos V5 : This protocol is an Industry standard authentication protocol that provides higher
level of security and is one of the best secure and fast authentication protocol developed by MIT.
Kerberos V5 is the default protocol used in Windows 2000/2003/2008/XP/Vista for
authentication of users, computers and even trust relationship.
How Kerberos V5 works
When a user logs on to domain the user password is converted into an encrypted key. The local
computer uses this key to encrypt timestamp information and sends the same to Domain
controller. To find the domain controller client uses DNS SRV record.
The Domain Controller unencrypted the information and checks the timestamp information and
creates two Kerberos tickets. The tickets are unencrypted using the user stored password key and
sends the ticket back to the user. The two tickets are logon session key ticket which is used to
establish logon session and the other ticket is TGT (Ticket granting ticket) or user ticket which
helps user to access network resources.
Windows 2008 Server Version Comparisons

Microsoft has included a whole variety of flavors of Windows Server 2008 to meet organisation
requirements. Windows 2008 server is available in 8 different edition to suits customer and
organisation requirement. Windows Server 2008 is now available in five primary editions, and
three of these editions will also be available without Windows Server Hyper-V, bringing the total
number of editions to eight. Let us know review all the eight edition of Windows 2008 server.
Windows Server 2008 Standard is the basic sever operating system of Windows 2008 server
family. It includes all the standard features and virtualization. This edition does not includes
clustering feature.
Windows Server 2008 Enterprise is designed for enterprise level of environment for deploying
business-critical applications like mailing system, web servers, application servers, etc. It
includes features like clustering and hot-add processor capabilities.
Windows Server 2008 Datacenter is designed for enterprise or multinational level organization
for deploying business-critical applications and large-scale virtualization on small and large
servers. It includes features like clustering and dynamic hardware partitioning capabilities. It
supports 2 to 64 processors.
Windows Web Server 2008 is designed to be used specifically as a single-purpose Web server,
Windows Web Server 2008 delivers on a rock-solid foundation of Web infrastructure capabilities
in the next-generation Windows Server 2008. Integrated with the newly re-architected IIS 7.0,
ASP.NET, and the Microsoft .NET Framework, Windows Web Server 2008 enables any
organization to rapidly deploy Web pages, Web sites, Web applications, and Web services.

Windows Server 2008 for Itanium-Based Systems is designed to support 64-bit hardware and
large databases, line of business, and custom applications providing high availability and
scalability for up to 64 processors to meet the needs of demanding and mission-critical solutions.
Windows HPC Server 2008, the next generation of high-performance computing (HPC),
provides enterprise-class tools for a highly productive HPC environment. Built on Windows
Server 2008, 64-bit technology, Windows HPC Server 2008 can efficiently scale to thousands of
processing cores and includes management consoles that help you to proactively monitor and
maintain system health and stability. Job scheduling interoperability and flexibility enables
integration between Windows and Linux based HPC platforms, and supports batch and service
oriented application (SOA) workloads. Enhanced productivity, scalable performance, and ease of
use are some of the features that make Windows HPC Server 2008 best-of-breed for Windows
environments.
Upgrade Paths for windows 2008
Operating System Upgrade Options
•
Windows Server 2003 R2 Standard Edition •
Windows Server 2003 Standard Service Pack 1 (SP1) Edition with •
SWeinrvdicoew sP aScekr v2e r( S2P020)3 Standard Edition with
•
Ful instalation of Windows Server 2008 Standard •
Fwuitlhl oinust tHalylapteiorn-V o™f W teinchdnowolso gSye rver 2008 Standard •
FEunltle irnpsrtiasela tion of Windows Server 2008 •
FEunltle irnpsrtiasela wtioithn oouft WHiynpdeorw-Vs Server 2008
•
Windows Server 2003 R2 Enterprise Edition •
wWiitnhd Soewrsv icSee rPvaecr k2 010 (3S PE1n)te rprise Edition •
wWiitnhd Soewrsv icSee rPvaecr k2 020 (3S PE2n)te rprise Edition
•
FEunltle irnpsrtiasela tion of Windows Server 2008 •
FEunltle irnpsrtiasela wtioithn oouft WHiynpdeorw-Vs Server 2008 •
Ful instalation of Windows Server 2008

Operating System Upgrade Options
Datacenter •
Ful instalation of Windows Datacenter without Hyper-V Server 2008
•
Windows Server 2003 R2 Datacenter Edition •
wWiitnhd Soewrsv icSee rPvaecr k2 010 (3S PD1a)t a center Edition •
wWiitnhd Soewrsv icSee rPvaecr k2 020 (3S PD2a)t a center Edition
•
FDualtla icnesntatelar tion of Windows Server 2008
•
Windows Server 2008 Standard
•
Windows Server 2008 Enterprise
•
HWyinpdeor-wVs Server 2008 Standard without
•
Windows Server 2008 Enterprise without Hyper-V
•
Windows Server 2008 Enterprise
•
Windows Server 2008 Datacenter
•
HWyinpdeor-wVs Server 2008 Enterprise without
•
Windows Server 2008 Enterprise without Hyper-V
New Features in Windows Server 2008
This chapter covers new features in Windows Server 2008:
• RODC
• AD Restartable Service

• Quota Management
• File Service Resource Management
• Virtualization
• Fine-grained policy
• DNS and DHCP with IPv6 support
• AD RMS and AD FS
• Reliability Monitor
• Terminal Service Enhancement
• Windows Search Service
• Windows System Resource Manager
• New Windows Server Backup
• Network Access Protection
• Windows Deployment Service
• Many more