Difference between revisions of "AD DS"

Revision as of 13:33, 20 July 2017

Single forest single domain is preferred, 2,150,000,000 objects per domain, FQDN less than 64 characters
Selecting the Forest Root Domain (corp.alphabook.cn) https://technet.microsoft.com/en-us/library/cc726016(v=ws.10).aspx
PDC acts as a key role (time root in forest, etc)
Implement multiple/backup domain controllers (all GCs)
Implement multiple sites as needed (site, subnet,site link(180 minutes default, 15 minutes minimum), bridge all site links(default))
Enable Active Directory Recycle Bin
Enable Protect object from accidental deletion (User, OU, etc)
Fill more AD account properties (City, Country, Phone, Job Title, Department, Manager...) Create AD user with PowerShell
Grant permission per group, not a single user
Account Lockout Policy
Delegate IT helpdesk group join computer into domain permission

https://github.com/shenhuitao2000/PowerShell/blob/master/Setup%20First%20Domain%20Controller
w32tm /config /computer:BJDC01.corp.alphabook.cn /manualpeerlist:time.windows.com /syncfromflags:manual /update
BPA (Best Practices Analyzer)

Schema master / Forest level
- To make change Schema in forest (such as implement Exchange, Lync, SCCM)
Domain naming master / Forest level
- To add/remove domain in forest
PDC / Domain level
- Time root in forest (PDC->DCs->Computers)
- Group policy central management
- Handle password change specially (the change will sync to PDC immediately)
- Handle user account lock specially
RID pool master / Domain level
- Assign RIDs to DCs (500/time)
Infrastucture master / Domain level
- Objects reference in different domains

@@ Line 20: / Line 20: @@
 === 5 FSMO roles ===
 * Schema master / Forest level
-** To make change Schema in forest (such as Exchange, Lync, SCCM)
+** To make change Schema in forest (such as implement Exchange, Lync, SCCM)
 * Domain naming master / Forest level
 ** To add/remove domain in forest