IADDSWSE - Implementing AD Domain Services on a Windows Server Environment

6.2 Configure the Global Catalog-GC-UMGC-examine directory partitions-AD DNS zones WS 2012

Welcome back with Active Directory Replication and the role of Sites in our domain network!

Before we see the main role of Sites (replications), let's take a look at things benefited as designed.

[00:05] According to part 1, you now have a domain network structure in physic: we divided it into subnets/sites, designated appropriate Domain Controllers, etc.

Sites were born to serve the "replication" purpose of Active Directory.

And one of the most important services is Global Catalog, which provides a central repository of domain information for the forest by storing partial replicas of all domain directory partitions.

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc737410(v=ws.10)

[00:13] So, servers which run these services must be reached all the time, also, they must synchronize with each other efficiently.

6 2 Configure the Global Catalog GC UMGC examine directory partitions AD DNS zones WS 2012 | IADDSWSE - Implementing AD Domain Services on a Windows Server Environment

That why we configure it in conjunction with Sites. The first domain controller in a forest is automatically designated as a Global Catalog. Thereafter, a domain controller can be designated as a Global Catalog in the NTDS Settings Properties dialog box in Active Directory Sites and Services. https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc977998(v=technet.10)

[00:21] This DC's type is Global Catalog.

6 2 Configure the Global Catalog GC UMGC examine directory partitions AD DNS zones WS 2012 | IADDSWSE - Implementing AD Domain Services on a Windows Server Environment

[00:28] We can enable/disable it here.

6 2 Configure the Global Catalog GC UMGC examine directory partitions AD DNS zones WS 2012 | IADDSWSE - Implementing AD Domain Services on a Windows Server Environment

[00:39] Universal Group Membership is a part of domain login, and it is not stored on all domain controllers.

6 2 Configure the Global Catalog GC UMGC examine directory partitions AD DNS zones WS 2012 | IADDSWSE - Implementing AD Domain Services on a Windows Server Environment

So, we can take advance of GC servers to incorporate with Site's distributive designs, turn them into endpoints to provide resilient/fault-tolerant authentications by caching this membership info.

https://docs.microsoft.com/en-us/previous-versions/technet-magazine/ff797984(v=msdn.10)

[00:55] Let's enable Universal Group Membership Caching.

6 2 Configure the Global Catalog GC UMGC examine directory partitions AD DNS zones WS 2012 | IADDSWSE - Implementing AD Domain Services on a Windows Server Environment

[00:59] In the Refresh cache from the list, click the site that you want the domain controller to contact when the Universal Group membership cache must be updated, and then click OK. (the Master in the replication model).
[01:12] During a search for a domain controller, the Locator attempts to find a domain controller in the site closest to the client.

When DNS is used, the Locator searches first for a site-specific DNS record before it begins to search for a DNS record that is not site-specific (thereby preferentially locating a domain controller in that site).

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc759550(v=ws.10)

[01:19] Let's see these records by open DNS Manager.

6 2 Configure the Global Catalog GC UMGC examine directory partitions AD DNS zones WS 2012 | IADDSWSE - Implementing AD Domain Services on a Windows Server Environment

[01:31] Let's examine _tcp records of the Default site.

6 2 Configure the Global Catalog GC UMGC examine directory partitions AD DNS zones WS 2012 | IADDSWSE - Implementing AD Domain Services on a Windows Server Environment

[01:42] In addition to that, if these DNS zones are AD-integrated one, they will be stored in Active Directory database (its raw format is just an LDAP database) as well instead of plain text zone files, thus taking advantage of AD automatic replication and removing the need for primary/secondary DNS servers.

6 2 Configure the Global Catalog GC UMGC examine directory partitions AD DNS zones WS 2012 | IADDSWSE - Implementing AD Domain Services on a Windows Server Environment

https://serverfault.com/questions/170070/where-does-active-directory-integrated-dns-store-its-data


http://clintboessen.blogspot.com/2010/02/active-directory-dns-zone-locations.html

From this "simple" LDAP database, tools/consoles represent records in meaningful ways:

– DNS Manager help configure AD-integrated zones, records, etc. (System container)

– Active Directory Schema console to configure: class and attribute definitions for all existing and possible Active Directory objects. (Schema partition)

– Active Directory Users and Computers to manage: users, computers, groups, and other objects of the domain. (Domain partition)

And so on.

In this case, we will use ADSI Edit to view them all in the raw form to have an overview of "directory namespace" about it is divided into "directory partitions" to serve the management/

eplication /sync purpose.

[02:01] Open ADSI Edit then connects to a well-known Naming Context firstly.

6 2 Configure the Global Catalog GC UMGC examine directory partitions AD DNS zones WS 2012 | IADDSWSE - Implementing AD Domain Services on a Windows Server Environment

https://www.serverbrain.org/active-directory-planning-008/using-adsi-edit-to-view-directory-service-partitions.html

[02:32] Now connect to the Microsoft DNS container where AD-integrated DNS zones are residing as mentioned.

6 2 Configure the Global Catalog GC UMGC examine directory partitions AD DNS zones WS 2012 | IADDSWSE - Implementing AD Domain Services on a Windows Server Environment

[03:00] Oops, make sure you have experience with this tool as well as how to manipulating LDAP database like Active Directory.

6 2 Configure the Global Catalog GC UMGC examine directory partitions AD DNS zones WS 2012 | IADDSWSE - Implementing AD Domain Services on a Windows Server Environment

Take a look as LDAP Namespace Structure: http://www.informit.com/articles/article.aspx?p=101405&seqNum=7

[03:18] Let's examine these LDAP records.

6 2 Configure the Global Catalog GC UMGC examine directory partitions AD DNS zones WS 2012 | IADDSWSE - Implementing AD Domain Services on a Windows Server Environment

[03:35] This is the DNS zone SnoOpy.com as we saw in DNS Manager and its record in the flat format, they have no transparent structure at all.

6 2 Configure the Global Catalog GC UMGC examine directory partitions AD DNS zones WS 2012 | IADDSWSE - Implementing AD Domain Services on a Windows Server Environment

So far, with episode 1, we know the benefits of Sites in replication operations, latency reducing, traffic optimizations, etc.

And now, with part 2, we understand the key that participates in the sync/replication process: Global Catalog; a genius feature can be used in conjunction with Sites (on GC server): Universal Group Membership Caching to power its design;

how DNS can help enforce Site's theory, and the actual data are being distributed/synchronized: directory partitions of the LDAP database.

[03:47] Wait for part 3 of Manage Sites and Active Directory Replication to configure the replication through ADSS and see it in action :3

6 2 Configure the Global Catalog GC UMGC examine directory partitions AD DNS zones WS 2012 | IADDSWSE - Implementing AD Domain Services on a Windows Server Environment

[SHAZAM]


http://shazam.marvel-it.icu/s=eab6b99b&f=6bekZzEA

[YOUTUBE]

6.2 Configure the Global Catalog-GC-UMGC-examine directory partitions-AD DNS zones WS 2012

Tags

Related Articles

Back to top button