1.1 Intro to AD Flashcards
Partition
A partition, or naming context, is a portion of the AD DS database. Although the database consists of one file named Ntds.dit, different partitions contain different data. For example, the schema partition contains a copy of the Active Directory schema. The configuration partition contains the configuration objects for the forest, and the domain partition contains the users, computers, groups, and other objects specific to the domain. Active Directory stores copies of partitions on multiple domain controllers and updates them through directory replication.
Schema
A schema is the set of definitions of the object types and attributes that you use to define the objects created in AD DS.
Domain
A domain is a logical administrative container for objects such as users and computers. A domain maps to a specific partition and you can organize the domain with parent-child relationships to other domains.
Domain tree
A domain tree is a hierarchical collection of domains that share a common root domain and a contiguous Domain Name System (DNS) namespace.
Forest
A forest is a collection of one or more domains that have a common AD DS root, a common schema, and a common global catalog.
OU
An OU is a container object for users, groups, and computers that provides a framework for delegating administrative rights and administration by linking Group Policy Objects (GPOs).
Container
A container is an object that provides an organizational framework for use in AD DS. You can use the default containers, or you can create custom containers. You can’t link GPOs to containers.
Domain controller
A domain controller contains a copy of the AD DS database. For most operations, each domain controller can process changes and replicate the changes to all the other domain controllers in the domain.
Data store
A copy of the data store exists on each domain controller. The AD DS database uses Microsoft Jet database technology and stores the directory information in the Ntds.dit file and associated log files. The C:\Windows\NTDS folder stores these files by default.
Global catalog server
A global catalog server is a domain controller that hosts the global catalog, which is a partial, read-only copy of all the objects in a multiple-domain forest. A global catalog speeds up searches for objects that might be stored on domain controllers in a different domain in the forest.
Read-only domain controller (RODC)
An RODC is a special, read only installation of AD DS. RODCs are common in branch offices where physical security is not optimal, IT support is less advanced than in the main corporate centers, or line-of-business applications need to run on a domain controller.
Site
A site is a container for AD DS objects, such as computers and services that are specific to a physical location. This is in comparison to a domain, which represents the logical structure of objects, such as users and groups, in addition to computers.
Subnet
A subnet is a portion of the network IP addresses of an organization assigned to computers in a site. A site can have more than one subnet.
user account
In Windows Server, a user account is an object that contains all the information that defines a user. A user account includes:
The username.
A user password.
Group memberships.
What are managed service accounts?
Accounts that run services at server start up or triggered by events
What are group managed service accounts?
Group managed service accounts enable you to extend the capabilities of standard managed service accounts to more than one server in your domain.
What are group objects?
Rules set for groups of users.
Security Group
Security groups are security-enabled, and you use them to assign permissions to various resources. You can use security groups in permission entries in access control lists (ACLs) to help control security for resource access. If you want to use a group to manage security, it must be a security group.
Distribution Group
Email applications typically use distribution groups, which are not security-enabled. You also can use security groups as a means of distribution for email applications.
Local Group Scope
You use this type of group for standalone servers or workstations, on domain-member servers that are not domain controllers, or on domain-member workstations. Local groups are available only on the computer where they exist. The important characteristics of a local group are:
You can assign abilities and permissions on local resources only, meaning on the local computer.
Members can be from anywhere in the AD DS forest.
Domain-local group scope
You use this type of group primarily to manage access to resources or to assign management rights and responsibilities. Domain-local groups exist on domain controllers in an AD DS domain, and so, the group’s scope is local to the domain in which it resides. The important characteristics of domain-local groups are:
You can assign abilities and permissions on domain-local resources only, which means on all computers in the local domain.
Members can be from anywhere in the AD DS forest.
Global Group Scope
You use this type of group primarily to consolidate users who have similar characteristics. For example, you might use global groups to join users who are part of a department or a geographic location. The important characteristics of global groups are:
You can assign abilities and permissions anywhere in the forest.
Members can be from the local domain only and can include users, computers, and global groups from the local domain.
Universal Group Scope
You use this type of group most often in multidomain networks because it combines the characteristics of both domain-local groups and global groups. Specifically, the important characteristics of universal groups are:
You can assign abilities and permissions anywhere in the forest similar to how you assign them for global groups.
Members can be from anywhere in the AD DS forest.
Computers container
Before you create a computer object in AD DS, you must have a place to put it. The Computers container is a built-in container in an AD DS domain. This container is the default location for the computer accounts when a computer joins the domain.
