Review on Active Directory Aim Enable users to find network resources easily Central and easy administration of users and resources in a domain Improve security by controlling access on resources and restrictions placed on user and computer configuration Structure Hierarchical structure Forest Tree Necessary components Domain controller(s) as central repository of the domain and provides access control DNS server for locating resources Other computers: servers and workstations added to domain by domain administrator Protocols used Kerberos for network authentication Lightweight Directory Access Protocol (LDAP) to provide directory service (to get information about objects) Information obtained from LDAP Entry in AD dn: cn=John Doe,dc=example,dc=com cn: John Doe givenName: John sn: Doe telephoneNumber: telephoneNumber: mail: manager: cn=Barbara Doe,dc=example,dc=com objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top Search information in AD Group Policy Rules to define settings of either users and computers Hundreds of settings can be defined Each setting has 3 possible states: Not configured Disabled Enabled Group Policy Apply to Property of Group Policy Policy setting inherited by child containers A container can have multiple policies being applied Which policy setting comes into effect depends on it precedence of the policy Group Policy Management Tool Download from Microsoft for easy management of group policy Log on Procedure Authentication User at log on Computer at machine start Issue of Access Token AD gathers all group policy applied to the user and computer and returns a list of SID to users computer The LSA uses the SIDs to form an access token Content of Access Token To show identity and privilege Name SID of user Groups SID of groups user belongs Logon SID (valid for a certain duration) Request for use of network resources Authenticate the users request by comparing the Access Token to the Security Descriptor of an object Content of Security Descriptor SID of owner SID of group (seldom used in Windows) DACL SID, Rights Deny on top System ACL Update of Access Token Every 30 minutes or as set in the group policy Samples of Group Policy A package called Common Scenario provided by Microsoft Lightly managed Mobile Multi-user App station Task station Kiosk