Some Rumblings in designing active directory and Exchange

There are many high-level documents e in regards to designing AD and the exchange available on the Microsoft side as well as individual blogs. Based on experience of the administrator it is possible to read and implement the best practices for stability and business continuity. I wanted to underline some of the basic implementation for AD and exchange design.

Active Directory

We start with AD, because the base for any application is the AD (active directory), As an Active Directory Domain Services administrator, we all must understand the healthy AD requires healthy DNS and Exchange comes on top of this picture. Therefore, knowing, understanding, and implementing the basic and the best practices always lead to stability in many environments.

Separation of roles and responsibilities (Business needs to decide this)

First step is to define the roles such as below

• Domain administrators
  
• Enterprise administrators
  
• Help desk
  
• Network security
  
• Exchange administrators
  
• Define name convention
  
• Separation admin accounts from regular account
  
• YY-oz, or zz-oz ( admin), or anything can do this type of separation
  
• Oz ( regular account), $_Exchange ( service account), TE-john ( Temp Employee)
  

AD (Active directory) OU structure needs to be re-design either using geographically dispersed design or the function base AD design or mix.

Having two sub OU's under a primary OU, will allow the GPO;s to apply either PC's and the user account or both such as having OU called HR ( Human Resource)

OU	Sub OU	HR computers and users will be place in below, sub OU's. The logical name convention will be implemented as well ( or any other standards)
HR ( human Resource)
	Computers
	Users

 

Of course having simple name convention for account and other objects (PC) is very important especially a large environment (follow some type of standards)

• Giving more rights to anyone more than what they need is to me the most common mistake many organizations do, the cause of this is due to poor planning and lock of knowledge in my opinion.
  
• Monitoring active directory database replication is mission critical almost for any environment
  
• Policies are good as long as they are being forced, if no one is going to make sure, if they are being used or not, many things will not get done correctly.
  
• SOP ( Standard operations) needs to be build for the business
  
• SOP included installing a server, step by step and installing applications for the business
  
• SOP also clearly defied what RAID level needs to be used for given type of installation
  
• For instance installing domain controllers best practices as follows
  

C Drive ( 64 Bit windows 2003 SP2) 8 Gig memory	OS & Logs	RAID 1 + 0
D Drive ( NTDS)	SysVol & .DIT database RAID 1 + 0
H Drive CD-Room

 

For exchange installation, the vendor best practices when working with SAN backend for the disk configuration. The OS installation should be basic RAID 1 + 0 for redundancy. If it is all possible, install Exchange binaries on a separate disk spindles with correct RAID configuration. The rule is any type of RAID configuration provides the fastest read & write will satisfy the best results. Do understand and implement the basic mechanic behind the applications such as Exchange and what type of operations they perform the most. This will dictate the level of RAID configuration when it comes to designing Exchange for given environment.

• Logs
  
• Databases
  
• Exchange binaries
  
• Develop strategies for the backup
  
• Leave spare mail store (Enterprise edition) if it possible so that you will never have to perform ESEUTIL. Move mailboxes around to delete the databases contain white space. Taking Exchange offline for defragmentation is pointless and involved more affords.
  

  
   

Also monitoring your investment is very important; the large enterprise networks will need to monitor AD and exchange database and related services. Small environment network administrator will include this into their daily task

 

Oz Ozugurlu

MVP (Exchange)

MCITP (EMA), MCITP (SA)

MCSE 2003, M+, S+, MCDST

Security+, Project +, Server +

Blog: http://www.smtp25.blogspot.com

AD BASIC UNDERSTANDING EXAM -1

As I have promised, I am posting basic AD (Active directory) questions. The questions below are homework to my Saturday MCSE class. Hopefully when everyone in the class become MCSE 2003, they will all go for Exchange 2007 class which will start shortly after MCSE (-:, this was commercial by the way.

The answers to below questions will be pretty short, if you discover yourself you are thinking or trying to explain below concept more than couple minutes or one or two sentences, I would say you need AD steroid which I think it is the webcast ""Active directory inside out" by Michael Murphy. After learning AD, I strongly recommend to all my students to learn about Exchange 2007.

AD QUESTIONS

1. What is active directory?
   
2. What is a Domain
   
3. What is inside the active directory database? Describe the content
   
4. Domain is not security boundaries as it was in AD NT 4.0 anymore why?
   
5. What is a Domain Controller?
   
6. What is a standalone server
   
7. What is an Object
   
8. What does DNS stand for? And what port DNS utilize and what is the usage of DNS in Active directory?
   
9. What do you understand from active directory integrated DNS?
   
10. What is an attribute?
    
11. What is schema
    
12. What is organizational Unit (OU)
    
13. What are three primary functions of OU's
    
14. What id forest?
    
15. What is GC (Global Catalog server) define it.
    
16. What is tree?
    
17. If my company DNS name space is father.org and I want I to have two child domains, what would be DNS name space for below names?
    

    -Brother
    

    -Sister
    

Oz Ozugurlu

MVP (Exchange)

MCITP (EMA), MCITP (SA)

MCSE 2003, M+, S+, MCDST

Security+, Project +, Server +

Blog: http://www.smtp25.blogspot.com

Active Directory 2008

Active directory for no question is the most important constituent in Microsoft networking. Most people will not even realize all the other applications runs on top of the AD and its .DIT database. Recent AD cleanup work I have done for a large client made me start seeing, AD in a different perspective. Exchange is only one of these applications, which depends heavily or will die without Active directory. Active directory will need healthy DNS in order to function properly or else, it will suffer from many diseases such as not being able to locate the resources client needs or the replication. Below some of good information, I decided to summarize.

Therefore, the equation goes this way

• Exchange=AD=DNS (=, needs)
  

The interaction with AD Database for most of the administrator starts with daily operational tasks. This includes creating users, groups and similar task. The fact to matter is every time these type of task is being performed the administrator touches or modifies the .DIT database by using ADUC ( active directory users and computers snaps in)

.DIT database is partitioned database and there are 3 partitions constitute the .DIT database.

• Domain
  
• Configuration
  
• Schema
  

AD DS (Active directory, domain services) database is stored by default in the

• %Systemroot%/NTDS/NTDS.dit ( Directory information tree)
  

Below are the components of the .DIT database

	Interfaces=LDAP,MAPI
	NTDSa.dll
	DSA
	DATABASE LAYER
	ESE (Esent.dll)

Lightweight Directory Access Protocol (LDAP)

LDAP v3 is the most common interface used by directory clients to locate information in the directory store. LDAP v3 is backward compatible with LDAP v2. Clients can use port 389 (the standard LDAP port), port 636 (LDAP secured by SSL), port 3268 (for global catalog lookups), and port 3269 (Global catalog LDAP secured by SSL) to access the LDAP interface. Clients can also use UDP Port 389 for both LDAP and Netlogon (this interface is used to locate domain controllers).

Messaging API (MAPI)

MAPI is used by messaging clients such as Outlook to access the Microsoft Exchange Server data stored in the data store. Exchange Server 2000 and later use the AD DS data store to store all recipient information, and the MAPI interface enables messaging clients to access the Global Address List (GAL). MAPI uses RPC communication.

The DSA

DSA runs as Ntdsai.dll on each domain controller) provides the data store access interfaces. In addition, the DSA enforces directory semantics, maintains the schema, guarantees object identity, and enforces data types on attributes. When clients or other domain controllers need to access the directory store, they used one of the supported interfaces to connect (bind) to the DSA and then search for, read, and write to AD DS objects and their attributes.

The database layer resides in Ntdsai.dll

It provides an internal interface between the DSA and the directory database. The DSA cannot directly connect to the database; applications go through the database layer. The database layer also provides an object view of the directory database, making the data accessible to the DSA as a set of hierarchical containers.

The database layer is also responsible for the creation, retrieval, and deletion of individual records (objects), attributes within records, and values within attributes.

The Extensible Storage Engine (ESE)

A Windows component is used by AD DS, as well as by several other Windows components, as an interface to the database. The ESE is responsible for indexing the data in the database file and for transferring the data in and out of the database. It also maintains the rows and columns that comprise the database. Its purpose is to enable applications to store and retrieve data. The ESE also implements the transactional process for committing changes to the database.

The data store stores directory information in a single database file. In addition, the data store also uses transaction log files, to which it temporarily writes uncommitted changes, as well as committed transactions prior to committing them to the database.

Domain

• Domain is boundary of replication
  

• Domain is boundary of DNS name space.
  
• Domain is boundary of administration.
  
• Domain is also boundary of authentication
  

Domain Controller:

• Authentication server is domain controller.
  

DNS

• Domain name service/System
  
• We use DNS the reference object and locate the services offers by a domain,
  
• In addition, DNS is required to locate computer, services and any other information is available in the active directory.
  

Global Catalog server

• Global Catalog server is a central repository. The global catalog server has a partial, read-only replica of all other domain directory partitions in the forest .All domains in the Tree share common global catalog server.GC contains references to all objects in active directory regardless, which domain the (objects) are created. That is why global catalog server is very important
  
• Without a global catalog, search requests received by a domain controller for an object in a different domain would result in that domain controller referring the query to a domain controller in the object domain
  
• Global catalog queries are identical to any other LDAP query against a Windows Server 2008 domain controller. The only difference is that the global catalog query uses TCP port 3268 rather than TCP port 389, which is the standard LDAP port. If a domain controller that is also a global catalog server receives a query on port 389, it will not search the global catalog for objects in other domains.
  

User Logons

Global catalog servers are also used when processing user logons.

• Every time a user logs on to a domain, a global catalog server is contacted.
  
• This is because nonglobal catalog domain controllers do not contain any information about universal group membership.
  
• Universal groups can contain user and group accounts from any domain in a particular forest.
  
• Since universal group membership is forest-wide, group membership can only be resolved by a domain controller that has forest-wide directory information
  

In order for an accurate security token to be generated for the user-seeking authentication, the global catalog must be contacted to determine the user's universal group membership.

Windows Server 2008 supports a feature known as universal group membership caching that makes it possible to log on to a Windows Server 2008 network without contacting a global catalog. Universal group membership can be cached on nonglobal catalog domain controllers after a user has logged on to that domain controller.

After this information is obtained from a global catalog, it is cached on the domain controller for the site indefinitely and is periodically updated (by default every 8 hours). Enabling this feature results in faster logon times for users in remote sites, as the authenticating domain controllers do not have to access a global catalog

Tree

Hierarchy of domains forming contiguous name space that maps to the DNS infrastructure. What defines three is contiguous name space.

• Father.com
  
• Son.Father.com
  
• Sister.Father.com
  

There are not many differences in AD 2003 versus AD 2008. There are several improvements in AD 2008, but having a good solid base on AD 2003 will cover almost 85 percent of the knowledge in my opinion. The recent book I am reading "Windows serer 2008 Active Directory Resource Kit" Microsoft Press book does have great information in this regard. If you would want to get AD 2008 book this one is highly recommended.

Oz Ozugurlu

MVP (Exchange)

MCITP (EMA), MCITP (SA)

MCSE 2003, M+, S+, MCDST

Security+, Project +, Server +

Blog: http://www.smtp25.blogspot.com

WHY Exchange Admin must secure the Logs with his life

I am reading this great Technet article in regards to architecture Exchange databases and decided to post some of it as it is in my blog and give the reference link to it.

The Key points are as follows

Information store work hand in hand with following components

• MAPI
  
• Information Store
  
• Database engine
  
• Operating System disk I/O
  

The Database engine

• The Exchange database engine caches the disk in memory by swapping 4 KB chunks of data
  
• These called pages, and they work in and out of memory
  
• It updates the pages in memory and takes care of writing new or updated pages back to the disk.
  
• This makes the system more efficient because writing to memory is FASTER
  

When users make requests
(Let's say using outlook)

• The database engine starts loading the requests into memory and marks the pages as "dirty" (a dirty page is a page in memory that has been written with data).
  
• Now we know who is actually corrupting exchange databases, all it is users fault isn't it (- :
  
• These dirty pages are then later written to the information store databases on disk.
  

The information on disk is never completely up-to-date

• Although caching data in memory is the fastest and most efficient way to process data, it means that while Exchange is running, the information on disk is never completely up-to-date.
  
• since many changes in memory haven't made it onto disk yet, the database and memory are out of sync
  

Because these operations are done in a transaction, Exchange will perform none or all of these operations. As a result, it doesn't matter which order Exchange performs the operations. The message can be deleted safely from "Inbox" first because the system knows that the delete will only be committed if the message is also inserted into "Important." Thanks to transactions, even if the system crashes, it is guaranteed that Exchange will never lose an e-mail message while moving it. What's more, Exchange will never end up with two copies of an e-mail message that was moved

• The user sends a message.
  
• MAPI calls the information store to tell it that the user is sending the message.
  
• The information store starts a transaction in the database engine and makes the corresponding changes to the data.
  
• The database engine records the transaction in memory by dirtying a new page in memory.
  
• At about the same time, the database engine secures the transaction in the transaction log file and creates a log record. When the database engine reaches the end of a transaction log file, it rolls over and creates a new log file in sequence.
  
• The database engine writes the dirty page to the database file on disk.
  
• The checkpoint file gets updated
  

Read more

--oz

Oz Ozugurlu

MVP (Exchange)

MCITP (EMA), MCITP (SA)

MCSE 2003, M+, S+, MCDST

Security+, Project +, Server +

Blog: http://www.smtp25.blogspot.com