Difference between revisions of "AD DS"

Revision as of 14:26, 9 June 2017

Single forest single domain is preferred, 2,150,000,000 objects per domain, FQDN less than 64 characters
PDC act as the time root in forest (w32tm /config /computer:BJDC01.alphabook.com.cn /manualpeerlist:time.windows.com /syncfromflags:manual /update)
Implement multiple/backup domain controllers (all GCs), implement multiple sites as needed (site, subnet,site link(180 minutes default, 15 minutes minimum), bridge all site links(default))
Enable Active Directory Recycle Bin
Enable Protect object from accidental deletion (User, OU, etc)
Fill user account more properties (City, Country, Phone, Job Title, Department, Manager...)
Grant permission per group, not a single user
Delegate IT helpdesk group unlock user account permission
Delegate IT helpdesk group join computer into domain permission

https://github.com/shenhuitao2000/PowerShell/blob/master/Setup%20First%20Domain%20Controller
w32tm /config /computer:BJDC01.alphabook.com.cn /manualpeerlist:time.windows.com /syncfromflags:manual /update
BPA

Schema master / Forest level
- To make change Schema in forest (such as Exchange, Lync, SCCM)
Domain naming master / Forest level
- To add/remove domain in forest
PDC / Domain level
- Time root in forest (PDC->DCs->Computers)
- Group policy central management
- Handle password change specially (the change will sync to PDC immediately)
- Handle user account lock specially
RID pool master / Domain level
- Assign RIDs to DCs (500/time)
Infrastucture master / Domain level
- Objects reference in different domains

@@ Line 12: / Line 12: @@
 == Setup the first Domain Controller ==
 * https://github.com/shenhuitao2000/PowerShell/blob/master/Setup%20First%20Domain%20Controller
+* w32tm /config /computer:BJDC01.alphabook.com.cn /manualpeerlist:time.windows.com /syncfromflags:manual /update
+* BPA
 == FSMO (Flexible single master operation) ==