Difference between revisions of "AD DS"
From AlphaBook
(→Active Directory Domain Service Design) |
(→Active Directory Domain Service Design) |
||
| Line 7: | Line 7: | ||
* Enable [[Active Directory Recycle Bin]] | * Enable [[Active Directory Recycle Bin]] | ||
* Enable [[Protect object from accidental deletion]] (User, OU, etc) | * Enable [[Protect object from accidental deletion]] (User, OU, etc) | ||
| − | * Fill | + | * Fill more AD account properties (City, Country, Phone, Job Title, Department, Manager...) [[Create AD user with PowerShell]] |
* Grant permission per group, not a single user | * Grant permission per group, not a single user | ||
* [https://support.microsoft.com/en-us/help/279723/how-to-grant-help-desk-personnel-the-specific-right-to-unlock-locked-user-accounts Delegate IT helpdesk group unlock user account permission] | * [https://support.microsoft.com/en-us/help/279723/how-to-grant-help-desk-personnel-the-specific-right-to-unlock-locked-user-accounts Delegate IT helpdesk group unlock user account permission] | ||
Revision as of 15:20, 19 July 2017
Contents
Active Directory Domain Service Design
- Single forest single domain is preferred, 2,150,000,000 objects per domain, FQDN less than 64 characters
- Selecting the Forest Root Domain https://technet.microsoft.com/en-us/library/cc726016(v=ws.10).aspx
- PDC act as the time root in forest
- Implement multiple/backup domain controllers (all GCs)
- Implement multiple sites as needed (site, subnet,site link(180 minutes default, 15 minutes minimum), bridge all site links(default))
- Enable Active Directory Recycle Bin
- Enable Protect object from accidental deletion (User, OU, etc)
- Fill more AD account properties (City, Country, Phone, Job Title, Department, Manager...) Create AD user with PowerShell
- Grant permission per group, not a single user
- Delegate IT helpdesk group unlock user account permission
- Delegate IT helpdesk group join computer into domain permission
Setup the first Domain Controller
- https://github.com/shenhuitao2000/PowerShell/blob/master/Setup%20First%20Domain%20Controller
- w32tm /config /computer:BJDC01.alphabook.com.cn /manualpeerlist:time.windows.com /syncfromflags:manual /update
- BPA (Best Practices Analyzer)
FSMO (Flexible single master operation)
5 FSMO roles
- Schema master / Forest level
- To make change Schema in forest (such as Exchange, Lync, SCCM)
- Domain naming master / Forest level
- To add/remove domain in forest
- PDC / Domain level
- Time root in forest (PDC->DCs->Computers)
- Group policy central management
- Handle password change specially (the change will sync to PDC immediately)
- Handle user account lock specially
- RID pool master / Domain level
- Assign RIDs to DCs (500/time)
- Infrastucture master / Domain level
- Objects reference in different domains
To check the FSMO servers
- netdom query fsmo
To transfer / seize to FSMO roles
- Ntdsutil
- Roles
- Connections
- ?
- Connect to server BJDC01
- Quit
- Transfer schema master
- Transfer domain naming master
- Transfer PDC
- Transfer RID master
- Transfer infrastructure master
