Chapter 34. Organizing Active Directory

Whether you are implementing a new Active Directory environment or updating your existing environment, there's a lot to think about when it comes to design. Every Active Directory design is built from the same basic building blocks. These basic building blocks include the following:

  • Domains A domain is a logical grouping of objects that allows central management and control over replication of those objects. Every organization has at least one domain, which is implemented when Active Directory is installed on the first domain controller.

  • Domain Trees A domain tree is a single domain in a unique namespace or a group of domains that share the same namespace. The domain at the top of a domain tree is referred to as the root domain. Two-way transitive trusts join parent and child domains in the same domain tree.

  • Forests A forest is a single domain tree or a group of domain trees that are grouped together to share resources. The first domain created in a new forest is referred to as the forest root domain. Domain trees in a forest have two-way transitive trusts between their root domains.

Many organizations have only one domain and while I'll discuss reasons why you might want to have additional domains, domain trees, and forests in this chapter, you might also want to add structure to a domain. The building block you use to add structure to a domain is the organizational unit (OU), which I'll discuss in depth in this chapter.

Creating an Active Directory Implementation or Update Plan

Creating or modifying an existing domain and forest plan is the single most important design decision you will make when implementing Active Directory. As such, this isn't a decision you should make alone. When you design Active Directory for an organization of any size, you should get the organization's management involved in the high-level design process.

Involvement doesn't mean letting other groups decide on all aspects of the design. There are many complex components that all have to fit together, and the actual implementation of Active Directory should be the responsibility of the IT group. Involvement means getting feedback from and working with the business managers of other groups to ensure that the high-level design meets their business requirements.

In addition, you will almost certainly need to get approval of the high-level design goals with regard to security, access, usability, and manageability. Plan for this as you are developing the initial implementation plan. Your plan should start with the highest-level objects and work toward the lowest-level objects. This means that you must do the following:

  1. Develop a forest plan

  2. Develop a domain plan that supports the forest plan

  3. Develop an organizational unit plan that supports the domain and forest plan

The sections that follow discuss how to develop the necessary plans. Once you have completed the planning and the plans are approved, you can implement the plan.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset