Windows Domains

• Windows Domain is a group of users and computers under the administration of a given business.
• The main idea behind a domain is to centralize the administration of common components of Windows computer network in a single repository called Active Directory (AD).
• The server that runs the Active Directory services is known as Domain Controller (DC).

Advantages of having a configured windows domain:

1. Centralized Identity Management: All users across the network can be configured from Active Directory with minimum effort.
2. Managing Security Policies: We can configure security policies directly from Active Directory and apply them to users and computers across the network as needed.

Active Directory

• The core of any Windows domain is Active Directory Domain service (AD DS).

• This service acts as a catalogue that holds the information of all the objects that exists on our network.

• For example- We have users, group, machines, printers, shares and many others.

  Users

  • They are the most common object types in AD.
  • They are knows as security principals.
  • They can be authenticated by the domain and assigned privileges over resources like files and printers.
  • They can be used to represent 2 types of entities:
    • People: Generally represent persons in an organization that need to access the network, like employees.
    • Services: Users can be defined to be used by services such as IIS or MSSQL.

  Machines

  • For every computer that joins the AD domain, a machine object is created.
  • They are also considered “security principals” and assigned an account just as any regular user.
  • Machine accounts themselves are local administrators on the assigned computer.
    • Machine Account passwords are automatically rotated out and are generally comprised of 120 random characters.
  • For identifying machine accounts- they follow a specific naming scheme. The machine account name is the computer’s name followed by a dollar sign.
  • For example- A machine named DC01 will have a machine account name DC01$.

  Security Groups

  • They are also considered security principals.
  • They can have both users and machines as members.
  • They can include other groups as well.
  • Some of the most important groups in a domain are:
    • Domain Admins: Users of this group have administrative privileges over the entire domain. By default, they can administer any computer on the domain, including the DCs.
    • Server Operators: Users in this group can administer Domain Controllers. They cannot change any administrative group memberships.
    • Backup Operators: Users in this group are allowed to access any file, ignoring their permissions. They are used to perform backups of data on computers.
    • Account Operators: Users in this group can create or modify other accounts in the domain.
    • Domain Users: Includes all existing user accounts in the domain.
    • Domain Computers: Includes all existing computers in the domain.
    • Domain Controllers: Includes all existing DCs in the domain.

Active Directory Users and Computers

• We need to login in DC and run “Active Directory Users and Computers” to configure user, groups or machines in AD.

• Objects in AD are organized in Organizational Units (OUs).

• OUs are mainly used to define set of users with similar policing requirements.

• For example- The people in the Sales department of an organization are likely to have a different set of policies applied than the people in IT.

• A user can only be a part of a single OU at a time.