book

Mastering Active Directory - Third Edition

by Dishan Francis

November 2021

Beginner

780 pages

19h 29m

English

Packt Publishing

Read now

Unlock full access

Who this book is forWhat this book coversTo get the most out of this bookGet in touch
Modern access managementWhat is an Identity? The future of Identity and Access Management (IAM)The Rise of CybercrimeZero trust security Password-less authentication Digital IDHybrid Identity and Active Directory Domain ServicesBenefits of using Active DirectoryCentralized data repositoryThe replication of dataHigh availabilitySecurityAuditing capabilitiesSingle sign-on (SSO)Schema modificationQuerying and indexingUnderstanding Active Directory componentsLogical componentsForestsDomainsDomain treesOrganizational unitsPhysical componentsDomain controllersThe global catalog serverActive Directory sitesUnderstanding Active Directory objectsGlobally unique identifiers and security identifiersDistinguished namesActive Directory server rolesSummary
The features of AD DS 2022The deprecation of Windows Server 2003's forest and domain functional levelsThe deprecation of the File Replication servicePrivileged Access Management (PAM)The evolution of cyber crimeRecent cyber-attacksA typical AD attackWhat does PAM have to do with AD DS 2022?What is the logic behind PAM?Time-based group membershipsWindows Hello for BusinessTime sync improvementsPowerShell 7Summary
What makes a good system?New business requirementsCorrecting legacy design mistakesGathering business requirementsDefining security boundariesIdentifying the physical computer network structureDesigning the forest structureSingle forestMultiple forestsCreating the forest structureAutonomyIsolationSelecting forest design modelsThe organizational forest modelThe resource forest modelThe restricted access forest modelDesigning the domain structureSingle domain Regional domain The branch/site domainThe number of domainsDeciding on domain namesThe forest root domainDeciding on the domain and forest functional levelsDesigning the OU structureDesigning the physical topology of Active DirectoryPhysical or virtual domain controllersDomain controller placementGlobal catalog server placementDesigning a hybrid identityCloud approachIdentifying business needsSynchronizationShared responsibilityCostSummary
What is DNS?Hierarchical naming structuresTop-Level Domain managers (TLD managers)How DNS worksDNS infrastructure designIntegrate AD DS with existing DNS infrastructure Disjoint naming spaceDeploying AD-integrated new DNS infrastructure DNS essentialsDNS recordsStart of authority recordA and AAAA recordsNS recordsMail exchanger recordsCanonical name recordsPointer recordsSRV recordsZonesPrimary zoneSecondary zoneStub zonesReverse lookup zonesConditional forwardersDNS policiesSecure DNS client over HTTPS (DoH)DNS server operation modesZone transfersDNS delegationDNS service providersSummary
FSMO rolesSchema operations masterDomain-naming operations masterPDC emulator operations masterRID operations master roleInfrastructure operations masterFSMO role placementActive Directory's logical and physical topologyConnectivityThe number of domain controllersCapacityBest practices Moving FSMO rolesSeizing FSMO rolesSummary
AD DS installation prerequisitesHardware requirementsVirtualized environment requirementsBest practices for installing a domain controller in Microsoft AzureAdditional requirementsAD DS installation methodsAD DS deployment scenariosSetting up a new forest root domainAD DS installation checklist for the first domain controllerDesign topologyInstallation stepsSetting up an additional domain controllerAD DS installation checklist for an additional domain controllerDesign topologyInstallation stepsHow to plan AD migrationsMigration life cycleAuditingAD logical and physical topologyAD health checkSCOM and Azure SentinelApplication auditingPlanningImplementationAD migration checklistDesign topologyInstallation stepsVerificationMaintenanceSummary
Tools and methods for managing objectsWindows Admin CenterActive Directory Administrative CenterThe ADUC MMCAD object administration with PowerShellCreating, modifying, and removing objects in ADCreating AD objectsCreating user objectsCreating computer objectsModifying AD objectsRemoving AD objectsFinding objects in ADFinding objects using PowerShellPreventing the accidental deletion of objectsAD recycle binSummary
Object attributesCustom attributesSyncing custom attributes to Azure ADUser accountsManaged Service Accounts (MSAs)Group Managed Service Accounts (gMSAs)Uninstalling MSAsGroupsGroup scopeConverting groupsSetting up groupsDevices and other objectsBest practicesSummary
OUs in operationsOrganizing objectsDelegating controlGroup policiesContainers vs. OUsActive Directory Groups vs. OUsOU design modelsThe container modelThe object type modelThe functions modelThe geographical modelThe department modelThe hybrid modelManaging the OU structureDelegating controlSummary

Benefits of group policiesMaintaining standardsAutomating administration tasksPreventing users from changing system settingsFlexible targetingNo modifications to targetGroup Policy capabilitiesGroup Policy objectsThe Group Policy containerThe Group Policy templateGroup Policy processingGroup Policy inheritanceGroup Policy conflictsGroup Policy mapping and statusAdministrative templatesGroup Policy filteringSecurity filteringWMI filteringGroup Policy preferencesItem-level targetingLoopback processingGroup Policy best practicesUseful group policies Summary
Overview of AD LDSWhere to use LDSApplication developmentHosted applicationsDistributed data stores for AD-integrated applicationsMigrating from other directory servicesThe LDS installationAD replicationFRS versus DFSRAD sites and replicationReplicationAuthenticationService locationsSitesSubnetsSite linksSite link bridgesManaging AD sites and other componentsManaging sitesManaging site linksThe site link costInter-site transport protocolsReplication intervalsReplication schedulesThe site link bridgeBridgehead serversManaging subnetsHow does replication work?Intra-site replicationInter-site replicationThe KCCHow do updates occur?The Update Sequence Number (USN)The Directory Service Agent (DSA) GUID and invocation IDThe High Watermark Vector (HWMV) tableThe Up-To-Dateness Vector (UTDV) tableSummary
Active Directory trustsTrust directionTransitive trusts vs Non-Transitive trustsActive Directory trust typesCreating an Active Directory trust Firewall portsConditional ForwardingSetting Up an Active Directory Forest Trust TestingRODCsActive Directory database maintenanceThe ntds.dit fileThe edb.log fileThe edb.chk fileThe temp.edb fileOffline defragmentationActive Directory Backup and RecoveryPreventing the accidental deletion of objectsActive Directory Recycle BinActive Directory snapshotsActive Directory system state backupActive Directory recovery from system state backupSummary
PKI in actionSymmetric keys versus asymmetric keysDigital encryptionDigital signaturesSigning, encryption, and decryptionSSL certificatesTypes of certification authoritiesHow do certificates work with digital signatures and encryption?What can we do with certificates?AD CS componentsThe CACertificate Enrollment Web ServiceCertificate Enrollment Policy Web ServiceCertification Authority Web EnrollmentNetwork Device Enrollment ServiceOnline ResponderThe types of CAPlanning PKIInternal or public CAsIdentifying the correct object typesThe cryptographic key lengthHash algorithmsThe certificate validity periodThe CA hierarchyHigh availabilityDeciding certificate templatesThe CA boundaryPKI deployment modelsThe single-tier modelThe two-tier modelThree-tier modelsSetting up a PKISetting up a standalone root CADSConfigDNCDP locationsAIA locationsCA time limitsCRL time limitsThe new CRLPublishing the root CA data to Active DirectorySetting up the issuing CAIssuing a certificate for the issuing CAPost-configuration tasksCDP locationsAIA locationsCA and CRL time limitsCertificate templatesRequesting certificatesMigrating AD CS from Windows Server 2008 R2 to Windows Server 2022Demo setupBacking up the configuration of the existing CA (Windows Server 2008 R2)Installing an AD CS role in the new Windows 2022 ServerRestoring the configuration from the previous CATestingAD CS disaster recovery Disaster recovery methodsSystem state backupThe certutil command utility + Registry ExportThe Backup-CARoleService PowerShell cmdlet + Registry ExportSummary
How does AD FS work?What is a claim?Security Assertion Markup Language (SAML)WS-TrustWS-FederationAD FS componentsFederation serviceAD FS 1.0AD FS 1.1AD FS 2.0AD FS 2.1AD FS 3.0AD FS 4.0What is new in AD FS 2022?The Web Application ProxyAD FS configuration databaseAD FS deployment topologiesA single federation serverA single federation server and single Web Application Proxy serverMultiple federation servers and multiple Web Application Proxy servers with SQL ServerAD FS deploymentDNS recordsSSL certificatesInstalling the AD FS roleInstalling WAPConfiguring the claims-aware application with new federation serversCreating a relying party trustConfiguring the Web Application ProxyIntegrating with Azure MFAPrerequisitesCreating a certificate in an AD FS farm to connect to Azure MFAEnabling AD FS servers to connect with the Azure MFA clientEnabling the AD FS farm to use Azure MFAEnabling Azure MFA for authenticationAzure AD federation with AD FSFederation sign-in with Azure ADCreating federation trust between Azure AD and AD FSConfiguring Azure AD ConnectTestingSummary
What is AD RMS?AD RMS componentsActive Directory Domain Services (AD DS)The AD RMS clusterWeb serverSQL ServerThe AD RMS clientActive Directory Certificate Service (AD CS)How does AD RMS work?How do we deploy AD RMS?Single forest-single clusterSingle forest-multiple clustersAD RMS in multiple forestsAD RMS with AD FSAD RMS configurationSetting up an AD RMS root clusterInstalling the AD RMS roleConfiguring the AD RMS roleTesting – protecting data using the AD RMS clusterTesting – applying permissions to the documentAzure Information Protection (AIP)Data classificationAzure Rights Management Services (Azure RMS)How does Azure RMS work?AIP implementationSummary
AD authenticationThe Kerberos protocolAuthentication in an AD environmentDelegating permissionsPredefined AD administrator rolesUsing object ACLsUsing the delegate control method in ADImplementing fine-grained password policiesLimitationsResultant Set of Policy (RSoP)ConfigurationPass-the-hash attacksThe Protected Users security groupRestricted admin mode for RDPAuthentication policies and authentication policy silosAuthentication policiesAuthentication policy silosCreating authentication policiesCreating authentication policy silosSecure LDAPWhat are the characteristics of secure LDAP? Enable secure LDAPMicrosoft Local Administrator Password Solution (LAPS)Review prerequisitesInstall Microsoft LAPSUpdate the AD schemaChange computer object permissionsAssign permissions to groups for password access Install CSE in ComputersCreate a GPO for LAPS settingsTestingOn-prem Azure AD Password Protection Azure AD Password Protection proxyAzure AD Password Protection DC agentHow does Azure AD Password Protection work with AD? Configuration TestingSummary
AD management with PowerShell – preparationPowerShell 7AD management commands and scriptsReplicationReplicating a specific objectUsers and groupsLast logon timeLast login date reportLogin failures reportFinding the locked-out accountPassword expire reportReview the membership of the high-level administrative groupsDormant accountsUsers with the Password Never Expires settingAzure Active Directory PowerShellInstallationGeneral commandsManaging usersManaging groupsMicrosoft GraphMicrosoft Graph ExplorerSummary
Extending on-prem AD to Azure ADEvaluating the present business requirementsEvaluating an organization's infrastructure road mapEvaluating the security requirementsSelecting the Azure AD versionDeciding on a sign-in methodPassword hash synchronizationFederation with Azure ADPass-through authenticationAzure AD Seamless SSOSynchronization between on-prem AD and an Azure AD managed domainAzure AD ConnectAzure AD Connect deployment topologyStaging the serverAzure AD Connect cloud syncAzure AD Connect cloud sync prerequisitesAzure AD Connect cloud sync configurationStep-by-step guide to integrating an on-prem AD environment with Azure ADCreating a virtual networkSetting up an Azure AD managed domainAdding DNS server details to the virtual networkCreating a Global Administrator account for Azure AD ConnectSetting up Azure AD ConnectInstalling the Pass-through Authentication agentAzure AD Connect configurationSyncing NTLM and Kerberos credential hashes to Azure ADEnabling secure LDAP (LDAPS) for an Azure AD DS managed domainEnable secure LDAP (LDAPS)Allow secure LDAP trafficTestingAzure AD DS resiliency with replica setsSet up a new resource group for an additional replica setSet up a new virtual network for an additional replica setSet up global VNet peering between two virtual networksCreate an Azure AD DS managed domain replica setSummary
Auditing and monitoring AD using built-in Windows tools and techniquesWindows Event ViewerCustom ViewsWindows LogsApplications and Services LogsSubscriptionsAD DS event logsAD DS log filesAD auditAudit Directory Service AccessAudit Directory Service ChangesAudit Directory Service ReplicationAudit Detailed Directory Service ReplicationDemonstrationReviewing eventsSetting up event subscriptionsSecurity event logs from domain controllersEnabling advanced security audit policiesEnforcing advanced auditingReviewing events with PowerShellMicrosoft Defender for IdentityWhat is Microsoft Defender for Identity?Defender for Identity benefitsPreventDetectInvestigateRespondMicrosoft Defender for Identity architecture Microsoft Defender for Identity prerequisitesLicensesConnectivity to the Defender for Identity cloud serviceService accountsHoneytoken accountFirewall portsAdvanced audit policiesNTLM auditingSAM-R PermissionsSizing toolDeployment Azure AD Connect HealthPrerequisitesConfigurationSummary

Content preview from Mastering Active Directory - Third Edition

17 Advanced AD Management with PowerShell

The very first Active Directory (AD) instance I set up was based on Windows Server 2003. It was a completely different approach from today's Active Directory installations. In Windows Server 2003, there were a lot of prerequisite tasks, such as installing a DNS role, setting up DNS zones, and adding the domain prefix. Even those tasks were directly related to Active Directory Domain Services (AD DS), and I had to configure them separately prior to running the DCPORMO.exe command. But today, the Active Directory role installation process is very straightforward. With basic knowledge and resources, anyone can get a domain controller up and running with a few clicks.

Microsoft has made server role installations ...