MultiCloud Classroom notes 13/Mar/2025

Active Directories

• LDAP is the protocol which is used for storing users, computers and groups of the organizations
• OpenLDAP and active directory are the applications which implement this protocol.
• Active Directory is widely used for Storing user information

Active Directory Domain Controller

An Active Directory Domain Controller (AD DC) is a server that plays a crucial role in managing network and identity security within a Windows Active Directory environment. Here’s an overview of its functions and significance:

Key Functions of an Active Directory Domain Controller

1. Authentication and Authorization:
2. Role: Acts as a gatekeeper for user authentication and authorization, ensuring that only authorized users can access network resources.
3. Mechanism: Uses protocols like Kerberos for authentication and stores user credentials securely.
4. Directory Service Management:
5. Role: Maintains a copy of the Active Directory database, which stores information about users, groups, computers, and other network resources.
6. Mechanism: Participates in replication with other domain controllers to ensure consistency across the domain.
7. Group Policy Enforcement:
8. Role: Applies security policies and settings defined by administrators to ensure compliance and security across the domain.
9. Mechanism: Uses Group Policy Objects (GPOs) to enforce settings on domain-joined devices.
10. DNS and Time Services:
11. Role: Often serves as a DNS server to resolve hostnames and provides time synchronization services to ensure all devices have consistent time settings.
12. Mechanism: Uses Windows DNS and the Windows Time service.

Types of Domain Controllers

1. Standard Domain Controller:
2. Role: Provides basic authentication and authorization services.
3. Description: Every AD domain must have at least one standard domain controller.
4. Read-Only Domain Controller (RODC):
5. Role: Used in remote or insecure locations to provide read-only access to the directory.
6. Description: Enhances security by not storing sensitive data locally.
7. Operations Master (FSMO Roles):
8. Roles: Schema Master, Domain Naming Master, PDC Emulator, RID Master, and Infrastructure Master.
9. Description: These roles are assigned to specific domain controllers to manage critical operations within the domain.

Importance of Domain Controllers

• Security: Domain controllers are critical for network security as they manage access and enforce policies.
• Reliability: Deploying multiple domain controllers ensures high availability and redundancy.
• Management: They simplify user and resource management by providing a centralized identity management system.

In summary, an Active Directory Domain Controller is essential for managing access, enforcing security policies, and maintaining consistency across a Windows network. Its role is pivotal in ensuring that only authorized users can access network resources while maintaining the integrity of the directory service.

Citations:
[1] https://www.solarwinds.com/resources/it-glossary/domain-controller
[2] https://www.quest.com/learn/what-is-a-domain-controller.aspx
[3] https://en.wikipedia.org/wiki/Domain_controller
[4] https://www.techtarget.com/searchwindowsserver/definition/domain-controller
[5] https://instasafe.com/blog/domain-controller-vs-active-directory/
[6] https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/get-started/virtual-dc/active-directory-domain-services-overview
[7] https://jumpcloud.com/blog/domain-controller-vs-active-directory
[8] https://jumpcloud.com/blog/what-is-a-domain-controller

• Domain controller respond to ldap queries
• Organizations will be using ADFS to provide SSO (Single Sign On)

Allowing users from AD into cloud

• Generally cloud offer Active Directory Services
• Sync users from on-prem AD to cloud

AWS

• AWS Direcory Services help creating Active Directory on the AWS cloud, Here they give an option to connect to existing active directory
• Use ADFS as Identity Provider using SAML into IAM

Azure

• Microsoft Entra Tenant is already compatible with AD and can be used (Office 365)
• Entra connect sync’s users from AD DC into Entra ID

Handling Multiple Accounts

• Companies don’t deal with single cloud account
  • AWS Organizatons Central governance and management across AWS accounts.
  • Azure Management Groups