GID, SID and Distinguished Names

• For every AD object a globally unique identifier (GID) is generated and will be saved in objectGUID attribute.
• For every object at a domain level a unique Security identifier (SID) will be generated and will be saved in objectSID attribute. When the user moves to different domain , GID will be same but a new SID will be allocated
• Distinguished name are very similar to the way postal address works. In AD distinguished names are used to uniquely identify an object & to do that it relies on the following names
  • organizationName (O) or organizationUnitNmae (OU): This name represents the organization
  • domainComponent(DC): This is the naming attribute for the domain and the DNS. IF the dns domain name is avengers.com, then we will have the following domain components
    • DC=avengers,DC=com
  • commonName (CN): This refers to object & containers in the directory
• Following is example of the child domain

Active Directory Server Roles

• There are five main Active Directory Server Roles
• Installation of these service can be done by a Powershell Cmdlet

Install-WindowsFeature AD-DomainServices

Active Directory Domain Services (AD DS)

• This service can manage an organization’s resources such as users, computers,printers etc
• AD Forest is an identity infrastructure security boundary. Forest can multiple domain controllers.
• OU will be used to arrange objects in Active Directory

Active Directory Federation Services (AD FS)

• This service allows us to share identities b/w trusted identity infrastructures using a Claim based authentication
• Major Usecases:
  • Estabilish trust relationship across identities
  • Single Sign On (SSO)

Active Directory Lightweight Directory Services (AD LDS)

• Some applications requires a directory-enable environment to operate & it might not require fully-blown AD. In these kind of cases AD LDS helps us to enable data storage & retrieval for directory-enable applications.

Active Directory Rights Managment Services (AD RMS)

• AD RMS helps enterprises to protect sensitive data from unauthorized access

Active Directory Certificate Services (AD CS)

• This role helps enterprises to build public key infrastructure (PKI) in an easy & cost effective way.

Adding a Computer to Active Directory Domain

• Steps:
  • Create one windows server in AWS Cloud
  • Configure DNS
  • Join the windows server to ad-domain
• Outcomes:
  • How to add systems to domain controller
  • How systems authenticate using domain controller
• Active Directory Authentication Process

Next Steps

• Understanding User & Group Management
• Understanding Group Policies
• Understanding Operations Master Roles