Active Directory (AD) is vital for anyone preparing for the SC-900 Microsoft Security, Compliance, and Identity Fundamentals exam. This component is a cornerstone of Microsoft’s identity and access management services, which aims to ensure secure and controlled access to resources in an enterprise network.
What is Active Directory?
Active Directory is a Microsoft technology used to manage computers and other devices on a network. It is a directory service for Windows domain networks and is included in most Windows Server operating systems. In essence, AD is like a database that helps keep track of all the different components in a system such as users, groups, computers, and other objects.
Active Directory provides a variety of functions including:
- Authentication: Confirming the identity of users and devices before granting access to resources.
- Authorization: Assigning access rights and permissions to users and devices, then enforce these access controls.
- Directory Services: Providing a central repository for storing and managing information about network resources.
- Hierarchical Organization Structure: Allows for organization and structuring of users, resources, and services based on business needs.
Active Directory Components
Active Directory has several essential components that work together to facilitate its functions. These include:
- Domain: This is a logical group of network objects (computers, users, devices) that share the same AD database. A domain has its security policies and security relationships with other domains.
- Tree: A hierarchical arrangement of domains in Active Directory. A tree is a collection of one or more domains and domain trees in a contiguous namespace, linked in a transitive trust hierarchy.
- Forest: This is the topmost level in an AD structure. A forest can contain multiple trees, which need not have a contiguous namespace. A forest shares a single schema, configuration, and global catalog.
- Organizational Unit (OU): OUs are containers within a domain where resources can be organized and managed.
- Schema: The AD schema determines the objects and the type of data that can be stored in the directory.
Active Directory Structure
| Level | Description |
| Forest | Top-level container in an Active Directory structure that hosts one or more domain tree structures |
| Trees | Contiguous namespace that hosts one or more domains. |
| Domains | Logical group of network objects that share the same AD database |
| OU | Substructure within a domain used for detailed management and administration of objects. |
| Objects | Individual items such as users, groups, computers stored in Active Directory. |
Working of Active Directory
When a user attempts to access a resource, Active Directory performs its work behind the scenes to ensure security:
- The user’s login credentials are authenticated.
- If authentication is successful, Active Directory then checks the user’s authorizations (what they can or cannot do based on their credentials).
- The related permissions to the user or resource are carried out, and the user can access the resource within the limitations set by those permissions.
Active Directory and Microsoft SC-900 Exam
Understanding the workings of AD is crucial for the SC-900 Exam. This fundamental knowledge is part of understanding Microsoft’s approach to security, compliance, and identity, which is a main focus of the exam. Specifically, you will need to understand how to manage identity and access in Azure AD, and how to secure your identity with Azure AD.
Conclusion
In conclusion, Active Directory forms an integral part of Microsoft’s security, compliance, and identity function. It plays a critical role in user and resource management, providing both authentication and authorization services. Understanding Active Directory will put you on the right track for success with your SC-900 Microsoft Security, Compliance, and Identity Fundamentals exam.
Practice Test
True/False: Active Directory (AD) is a Microsoft product that consists of several services to handle network management.
- True
- False
Answer: True
Explanation: Active Directory is Microsoft’s solution for centralized management of resources on a network. It streamlines administration and offers more robust security controls.
Single Select: Which of the following is not a component of Active Directory?
- a) Domain Services (AD DS)
- b) Certificate Services (AD CS)
- c) DNS Server
- d) DHCP Server
Answer: d) DHCP Server
Explanation: While DHCP is an essential service in a network, it is not part of Active Directory. The other options are all components of AD.
True/False: Active Directory does not support Lightweight Directory Access Protocol (LDAP).
- True
- False
Answer: False
Explanation: Active Directory does support LDAP. LDAP is a protocol used to access and manage directory information.
Single Select: In Active Directory, what does OUs stand for?
- a) Organizational Units
- b) Operational Units
- c) Organizational Users
- d) Operational Users
Answer: a) Organizational Units
Explanation: In Active Directory, OUs stands for Organizational Units. They provide a method for organizing objects within a domain.
Multiple Select: Which of the following is a primary function of Active Directory?
- a) Authorization
- b) Authentication
- c) Auditing
- d) Emailing
Answer: a) Authorization, b) Authentication, c) Auditing
Explanation: Active Directory supports authorization, authentication, and auditing. Emailing is not a primary function of Active Directory.
True/False: Active Directory allows administrators to manage policies and procedures for security and distributing software.
- True
- False
Answer: True
Explanation: Active Directory is critical for managing security policies and auditing access in a network.
Single Select: What is the primary database for storing and managing directory information in Active Directory?
- a) DNS
- b) DHCP
- c) NTDS.DIT
- d) FSMO
Answer: c) NTDS.DIT
Explanation: NTDS.DIT is the primary database file in Active Directory for storing and managing directory information.
True/False: Active Directory does not provide any support for third-party identity providers.
- True
- False
Answer: False
Explanation: Active Directory provides tools to integrate with third-party identity providers.
Single Select: In Active Directory, what is a “forest”?
- a) It is the highest level of logical grouping of resources.
- b) It is a collection of domain controllers.
- c) It is a group of objects within a domain.
- d) It is a directory service daemon process.
Answer: a) It is the highest level of logical grouping of resources.
Explanation: A forest in Active Directory is the highest level of logical grouping of resources, encompassing multiple domains.
Multiple Select: Which of the following are features of Active Directory?
- a) Centralized resource administration
- b) Local user account management
- c) Group policy administration
- d) Decentralized resource administration
Answer: a) Centralized resource administration, c) Group policy administration
Explanation: Active Directory enables centralized resource administration and group policy administration. It is not intended for local user account management or decentralized resource administration.
Interview Questions
What is Active Directory in Microsoft?
Active Directory (AD) is a directory service developed by Microsoft for Windows domain networks. It provides a variety of services, including LDAP directory services, Kerberos-based authentication, DNS-based naming and other network services.
Name the major components of Active Directory?
The major components of Active Directory are Domain Services (AD DS), Lightweight Directory Services (AD LDS), Certificate Services (AD CS), Federation Services (AD FS), and Rights Management Services (AD RMS).
What is Active Directory Domain Services?
Active Directory Domain Services (AD DS) is the foremost service in Active Directory. It stores directory data and manages communication between users and domains, including user logon processes, authentication, and directory searches.
What is the purpose of Organizational Units in Active Directory?
Organizational Units (OUs) are used in Active Directory to group together objects, such as users, groups, and computers, for administrative purposes. This enables certain permissions or policies to be applied to the group, rather than individually.
What is a forest in Active Directory?
A forest in Active Directory is the top-level container in an AD environment that contains domains, users, computers, and group policies. It represents the security boundary within which users, computers, groups, and other objects are accessible.
What’s the role of Group Policy in Active Directory?
Group Policy in Active Directory allows administrators to implement specific configurations for users and computers. It provides the centralized management and configuration of operating systems, applications, and users’ settings in an Active Directory environment.
What is the Global Catalog in Active Directory?
The Global Catalog is a distributed data repository in Active Directory. It contains a searchable, partial representation of every object in every domain in a forest. It helps find information from anywhere in the forest without needing to know the domain of the object.
Define Active Directory Rights Management Services (AD RMS).
AD RMS is an information protection technology in the Microsoft Windows environment. It uses encryption and a form of selective functionality denial to limit access to documents, such as email messages and word documents, to specific users.
Explain Active Directory Federation Services (AD FS).
AD FS is a Single Sign-On solution created by Microsoft. It allows users to authenticate to multiple applications using a single login. It provides users with seamless access to systems and applications across organizational boundaries.
What is the function of a Domain Controller in Active Directory?
A Domain Controller is a server that is running AD DS. It is responsible for authenticating and authorizing all users and computers within a network domain, assigning and enforcing security policies for all computers, and installing or updating software on domain computers.
What does Lightweight Directory Services do in Active Directory?
Active Directory Lightweight Directory Services (AD LDS) is a Lightweight Directory Access Protocol (LDAP) directory service that provides flexible support for directory-enabled applications, without the dependencies required for AD DS. It provides a data storage and retrieval service for directory-enabled applications.
What is an Active Directory trust?
An Active Directory trust is a secure channel for authentication and authorization between two Active Directory domains or forests. Trust relationships allow users in one domain to be authenticated by a domain controller in the other domain.
What are the different types of trusts in Active Directory?
The different types of trusts in Active Directory include: Two-way trust, One-way trust, Transitive trust, Non-transitive trust, Explicit trust, and Implicit trust.
How does Kerberos work in Active Directory?
Kerberos is an authentication protocol that uses ‘tickets’ to allow nodes to prove their identity over a non-secure network. In Active Directory, when a user logs on with a username and password, the Domain Controller verifies the password and issues a Kerberos “ticket”, which is used to authenticate the user to the network resources.
What are the replication components in Active Directory?
The replication components in Active Directory include: Replication agents that manage replication topology and data transfer. The directory system agent (DSA) manages requests and data. The database layer is a Jet database where the actual AD data is stored.
extutorials.com