Click here to get back home

Active Directory Questions.

 HomeNewsGroups | Search | About
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Active Directory Questions. Varadarajam 11-24-2006
Posted by Varadarajam on November 24, 2006, 12:09 am
Please log in for more thread options
Hi

I have some queries in Active Directory. kidnly clarify my doubts.

1. What is the necessity of Child Domain Controller other than ADC? Why do
we need to go for Child Domain Concept with out ADC? What is the main
purpose of going for Child Domain. Please Give clear Description.

2. Can i create the user with the same name in Parent Domain and Child
Domain? Any conflicts can be happend? Is it recommended to create the same
user in a single tree.

3. Child Domain user can logon from the parent domain ? or Parent Domain
user can login from the Child Domain.

4. How RID service will work? If RID service is down Main DC can i create a
user in ADC or in DC.. (ADC is also read write copy of ADDS right..)..Is it
possible or not.. If its not whyy.. While creating any object in ADC it will
contact to DC before creating..(That means replication takes at that time
immediately while creating any object in any dc in a domain)

5. Global catalog is enabled in one DC in a domain. I have another ADC also
in that domain. If my Global Catalog server is down i made my ADC as a Global
Catalog server.. My question is from where that ADC gets the data of Global
Catalog..(When we enabled Global Catalog in that server automatically it
creates the data or it has to get from other Domain Controllers in that
domain). What is exact use of GC.

6. Difference between Authoratative Restore and Non Authoratative Restore..
When we will go for those restore methods?

7. What is the exact background process takes palce when a user logging into
the domain?

Eagerly waiting for the answers for my above questions. Thanks in Advance.

Varadarajam.P.V.


Posted by Joe Richards [MVP] on November 26, 2006, 6:32 pm
Please log in for more thread options
Doubts or questions? What are you doubting if you have doubts? Or am I
doing your homework for you?

I would highly recommend picking up my book which listed in the signature.


1. There are various reasons, you want a different password security
policy or you want to group regional or divisional users together are
the primary ones.

2. Yes. It isn't recommended though but not because of AD, AD is fine
with it. It can cause user confusion and have impact on things like
Exchange because the default mailNickname is the sAMAccountName which
would likely be the same if you name users the same and mailNickname
should be unique in the org.

3. Child users cannot be authenticated by parent DCs but can be
authenticated by child DCs on parent members. I.E. A child domain user
can go up to a parent domain workstation and logon with their child
domain ID assuming a child DC can be reached. And vice versa.

4. For some reason people all of a sudden keep saying ADC. You have
domain controllers period, some have additional special roles, but they
are still ALL DCs. The RID master DC hands out RID pools to all DCs in a
domain. If the RID Master DC goes down there is no immediate issue for
creating objects as the RID Pools should last for a bit. The main issues
for a RID Master going down would be related to other functions that
target a RID master such as a cross-forest object move.

5. The GC hold a partial set of attributes for all objects in the
directory and is used for finding objects. From where your newly
promoted GC got its info you would need to look at the replication
connections. Assuming you have at least on DC from every domain
available, a GC can be built, it doesn't need to talk to another GC.

6. Authoritative marks the objects as the most recent so will not be
overwritten with other changes. Non-authoritative puts the object back
in place as it was backed up and then any changes since are replicated
into it.

7. Depends on the auth type.

joe



--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm


Varadarajam wrote:
> Hi
>
> I have some queries in Active Directory. kidnly clarify my doubts.
>
> 1. What is the necessity of Child Domain Controller other than ADC? Why do
> we need to go for Child Domain Concept with out ADC? What is the main
> purpose of going for Child Domain. Please Give clear Description.
>
> 2. Can i create the user with the same name in Parent Domain and Child
> Domain? Any conflicts can be happend? Is it recommended to create the same
> user in a single tree.
>
> 3. Child Domain user can logon from the parent domain ? or Parent Domain
> user can login from the Child Domain.
>
> 4. How RID service will work? If RID service is down Main DC can i create a
> user in ADC or in DC.. (ADC is also read write copy of ADDS right..)..Is it
> possible or not.. If its not whyy.. While creating any object in ADC it will
> contact to DC before creating..(That means replication takes at that time
> immediately while creating any object in any dc in a domain)
>
> 5. Global catalog is enabled in one DC in a domain. I have another ADC also
> in that domain. If my Global Catalog server is down i made my ADC as a Global
> Catalog server.. My question is from where that ADC gets the data of Global
> Catalog..(When we enabled Global Catalog in that server automatically it
> creates the data or it has to get from other Domain Controllers in that
> domain). What is exact use of GC.
>
> 6. Difference between Authoratative Restore and Non Authoratative Restore..
> When we will go for those restore methods?
>
> 7. What is the exact background process takes palce when a user logging into
> the domain?
>
> Eagerly waiting for the answers for my above questions. Thanks in Advance.
>
> Varadarajam.P.V.
>

Posted by Varadarajam on November 27, 2006, 1:25 am
Please log in for more thread options
Hi Joe

Thanks a lot for your very good answers to my questions.

Definitely i will read your book.

Thanks and Regards

Varadarajam.P.V.



"Joe Richards [MVP]" wrote:

> Doubts or questions? What are you doubting if you have doubts? Or am I
> doing your homework for you?
>
> I would highly recommend picking up my book which listed in the signature.
>
>
> 1. There are various reasons, you want a different password security
> policy or you want to group regional or divisional users together are
> the primary ones.
>
> 2. Yes. It isn't recommended though but not because of AD, AD is fine
> with it. It can cause user confusion and have impact on things like
> Exchange because the default mailNickname is the sAMAccountName which
> would likely be the same if you name users the same and mailNickname
> should be unique in the org.
>
> 3. Child users cannot be authenticated by parent DCs but can be
> authenticated by child DCs on parent members. I.E. A child domain user
> can go up to a parent domain workstation and logon with their child
> domain ID assuming a child DC can be reached. And vice versa.
>
> 4. For some reason people all of a sudden keep saying ADC. You have
> domain controllers period, some have additional special roles, but they
> are still ALL DCs. The RID master DC hands out RID pools to all DCs in a
> domain. If the RID Master DC goes down there is no immediate issue for
> creating objects as the RID Pools should last for a bit. The main issues
> for a RID Master going down would be related to other functions that
> target a RID master such as a cross-forest object move.
>
> 5. The GC hold a partial set of attributes for all objects in the
> directory and is used for finding objects. From where your newly
> promoted GC got its info you would need to look at the replication
> connections. Assuming you have at least on DC from every domain
> available, a GC can be built, it doesn't need to talk to another GC.
>
> 6. Authoritative marks the objects as the most recent so will not be
> overwritten with other changes. Non-authoritative puts the object back
> in place as it was backed up and then any changes since are replicated
> into it.
>
> 7. Depends on the auth type.
>
> joe
>
>
>
> --
> Joe Richards Microsoft MVP Windows Server Directory Services
> Author of O'Reilly Active Directory Third Edition
> www.joeware.net
>
>
> ---O'Reilly Active Directory Third Edition now available---
>
> http://www.joeware.net/win/ad3e.htm
>
>
> Varadarajam wrote:
> > Hi
> >
> > I have some queries in Active Directory. kidnly clarify my doubts.
> >
> > 1. What is the necessity of Child Domain Controller other than ADC? Why do
> > we need to go for Child Domain Concept with out ADC? What is the main
> > purpose of going for Child Domain. Please Give clear Description.
> >
> > 2. Can i create the user with the same name in Parent Domain and Child
> > Domain? Any conflicts can be happend? Is it recommended to create the same
> > user in a single tree.
> >
> > 3. Child Domain user can logon from the parent domain ? or Parent Domain
> > user can login from the Child Domain.
> >
> > 4. How RID service will work? If RID service is down Main DC can i create a
> > user in ADC or in DC.. (ADC is also read write copy of ADDS right..)..Is it
> > possible or not.. If its not whyy.. While creating any object in ADC it will
> > contact to DC before creating..(That means replication takes at that time
> > immediately while creating any object in any dc in a domain)
> >
> > 5. Global catalog is enabled in one DC in a domain. I have another ADC also
> > in that domain. If my Global Catalog server is down i made my ADC as a
Global
> > Catalog server.. My question is from where that ADC gets the data of Global
> > Catalog..(When we enabled Global Catalog in that server automatically it
> > creates the data or it has to get from other Domain Controllers in that
> > domain). What is exact use of GC.
> >
> > 6. Difference between Authoratative Restore and Non Authoratative Restore..
> > When we will go for those restore methods?
> >
> > 7. What is the exact background process takes palce when a user logging into
> > the domain?
> >
> > Eagerly waiting for the answers for my above questions. Thanks in Advance.
> >
> > Varadarajam.P.V.
> >
>

Similar ThreadsPosted
auditing active directory not working properly directory serviceaccess October 21, 2005, 7:47 pm
Linking PKI directory accounts with Active Directory? February 11, 2007, 5:29 am
Active Directory December 28, 2005, 7:00 am
eap-tls without active directory November 23, 2006, 10:52 am
Active Directory May 1, 2008, 11:11 am
Active Directory Server August 12, 2005, 3:49 pm
Published Certificates in Active Directory February 9, 2006, 6:53 pm
Active Directory Schema Permissions October 17, 2006, 4:59 pm
Group Policy without Active Directory February 27, 2007, 3:31 pm
SAMR Interface Calls and Active Directory March 29, 2006, 8:16 am

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap