Catalog server

Transcription

Welcome to the next free video in this free Active Directory free course for the 70-640 exam. In this video I will look at the global catalog server. As we know from the previous videos, each domain in an Active Directory forest has its own copy of the Active Directory database. This is stored in the ntds.dit file and changes are replicated to each domain controller in the domain. This works quiet well when you want to access resources that are only in the one domain, but what happens when you attempt to access a resource in a different part of the forest. If the resource you are trying to access is in the same forest Windows will automatically use your username and password to access the remote resource. Assuming that you have permission to the resource you will be given access. The problem occurs when you want to access a resource in the forest and you don’t know where it is. A domain only knows about resources that are in the domain itself. The domain does not have information about resources that exist outside that domain. To allow users to find resources in the forest Windows allows a domain controller to function as a global catalog server. A global catalog server acts as an index for the forest. Just like an index in a library, a global catalog server helps users find information. Any domain controller can be made a global catalog server it is just a matter of ticking a tick box. Objects in Active Directory have a number of attributes that are assigned to them. The global catalog contains information about all the objects in the Active Directory forest. This is not a full record of each object but rather a subset of each objects data. In other words, only certain attributes are replicated to the global catalog server. The information replicated is enough to find objects in the forest. Just like an index in the library contains key information like the title of each book and the authors, the global catalog server contains key information about every object in the forest. Having Global catalog servers or GC’s means users in different domains can run queries on the GC’s to find any object in the forest. Since users in different domains can access resources in different domains in the forest there are also groups that work across the forest. These groups can contain users from any domain in the forest. The global catalog server is responsible for keeping information about these groups that include users from different domains. Any domain controller can be a global catalog server. In each domain you need to have at least one global catalog server. If you have a large enough domain you should also have additional global catalog servers for redundancy reasons. Losing your only global catalog server in your domain can cause problems. As long as you have one global catalog server you can always make more domain controllers global catalog servers. To make things as simple as possible there is nothing stopping you from making all your domain controllers into global catalog servers. In fact, Windows Server 2008 by default will make a new domain controller into a global catalog server when it is promoted. The disadvantage to having more global catalog servers is that they require more disk space and more bandwidth. Now days with disk space and network bandwidth becoming a lot cheaper and more available, making all domain controllers into global catalog servers is not such a big concern as it once was. For these reasons, this is why Microsoft makes all domain controllers global catalog servers by default. You can always switch this off when you promote the server or later on if you decide to. I will now change to my windows server to show you how to change a domain controller to a global catalog server or change it back if it is no longer required. First of all I will open server manager from administrative tools under the start menu. From here expand down through roles to Active Directory domain services. This contains some of the admin tools for Active Directory. The tool I am interested in is Active Directory users and computers. You could also run this tool by itself from the start menu. If I now expand down to domain controllers, this will show all the domain controllers in this domain. To change a domain controller into or remove the global catalog component open the properties for its computer account. From the properties tab select the button NTDS settings. In the NTDS settings you have a tick box global catalog. To remove the global catalog simply un-tick the tick box. To make the domain controller into a global catalog server simply tick the tick box. Once you tick or un-tick the tick box Windows will do the rest. Making a domain controller into a global catalog server or removing the global catalog as you can see is a simple task. The harder questions arises which domain controllers should be made into global catalog servers. If you have the bandwidth and hard disk space you can simply make all domain controllers into global catalog servers. This is the easiest solution. One question you may also want to ask yourself is where do these domain controllers need to be placed. Domain controllers authenticate users but they don’t have to be near the users. For example, if you had a small office of only a few users it would not be worth the money to deploy a domain controller to that location. If the link between the small office and head office was unreliable you may deploy a domain controller at the location to ensure users can always logon to the network. The next decision is would you want to make that domain controller a global catalog server as well. Let’s have a look at some of the reasons why you would deploy global catalog servers in certain locations. Global catalogs are used when a user first logs on. You would think a normal domain controller would have all the information to log a user on but this is not correct. Domain controllers do not contain forest wide information. The most notably missing information is universal groups. Groups and universal groups are covered in more detail later in the course so I will only go into a lot of detail about them in this video. Universal groups are groups that can include users from different domains in the forest. For this reason, a regular domain controller simply does not have this information. Even if you have a single domain and a single forest you could still put a user in a universal group and thus you always need a global catalog server. To illustrate this better, consider what happens when you first logon to a domain. When you first logon to a domain Windows creates a security token for you. This token contains everything that you have access to. In order to create this token, well Windows needs to know everything you have access to. The security token is created when you first logon and only when you first log on. From a computing prospective it is time consuming to generate this token and this is why it is only done once. This is also why if you change group member ship for a user this change does not take effect until that user logs off and logs back on again. The global catalog server is required to determine which universal groups the user is a member of. Windows can cache credentials so if the global catalog server can’t be contact the user may be able to still logon using the cached credentials. It is best to always have a global catalog available on the network to ensure users don’t have any problems logging in. The second reason you need global catalog servers is that global catalogs servers are required when a user logs in using a Universal Principal Name or UPN. A UPN is simply a username in the form of user name @ domain name. The UPN is unique across the forest however this does not mean the UPN has to be the same as the domain name. For example, you could have a domain called ITFreeTraining and a domain called high cost training. Due to high cost training failure in the market palace the employees there were moved to TTFreeTraining however their user accounts stayed in the high costing training domain. This was done because the cooperate change happened quickly but it will take time for the IT department to move the users from the High Cost Training domain and move them to the IT Free Training Domain. These kinds of things can happen often in business. People move for area to area, company are purchased and sold and businesses restructured. The IT department needs to be able to response quickly to the business need changes. The quick changes may mean a user’s UPN does not match the domain they are in. Because of this you need to global catalog server to work out where the person is users account is located in the forest. The next reason you need a Global catalog server is that they are used to locate directory information regardless of where the user is in the forest. If you did not have a global catalog server you would need to know exactly which domain this information is located in and forest wide services could not exist. If you want to search for all large format color printers in the forest for example, you could not do so without a global catalog server. The next recommendation with global catalog server placement is that you place a global catalog server at each one of your sites that is separated by a wide area network. In some cases you many have a high speed link between the user and the server however it may be blocked by a firewall. If you can’t open these ports between the client and the server you may need to place a global catalog server local to the client. This can also apply if the link between the client and the global catalog server is unreliable. If this occurs you should make a domain controller on the local network a global catalog server or deploy a new domain controller to that network. The next reason for global catalog server placement is that some software requires a global catalog in order to run. Microsoft exchange is an excellent example of this. If you have software like Exchange you need a global catalog server available for it to run. On large networks you should consider having more than one global catalog server’s available on the local network for the user. This gives you redundancy in case one of the servers is not available but it also spreads the load between the servers. In busy environments load balancing between global catalog servers will help with keep response times low. Now that I have looked at all the reasons that you would want to use a global catalog server, let’s look at why you would not want to use global catalog servers. A global catalog sever contains a partial replicate of every object in the forest and thus does put more load on the server answering queries. A global catalog server must answer GC related queries as well as authenticate users. A global catalog server also requires additional network traffic and hard disk space for forest wide changes. In a small forest with not that many users this won’t be that noticeable, but in a large forest with high volume of users and thus a high amount of changes this can make a difference. Having said this, carefully planning is important in global catalog placement. If possible I would personally make all domain controllers global catalog servers as this is the simplest and easily configuration to support assuming the network can support it. In the next video I will look at operation master roles. These are unique roles at the forest and domain level. Like global catalog servers, these operation master roles do take some planning to place them correctly. Once again, thanks for watching are always free videos.