Active Directory (AD) is a directory service that Microsoft developed for Windows domain networks. It is included in most Windows Server operating systems as a set of processes and services. Initially, Active Directory was only in charge of centralized domain management. Starting with Windows Server 2008, however, Active Directory became an umbrella title for a broad range of directory-based identity-related services.
A server running Active Directory Domain Services (AD DS) is called a domain controller. It authenticates and authorizes all users and computers in a Windows domain type network—assigning and enforcing security policies for all computers and installing or updating software. For example, when a user logs into a computer that is part of a Windows domain, Active Directory checks the submitted password and determines whether the user is a system administrator or normal user. Also, it allows management and storage of information at admin level and provides authentication and authorization mechanisms and a framework to deploy other related services (AD Certificate Services, AD Federated Services, etc.).
Active Directory uses Lightweight Directory Access Protocol (LDAP) versions 2 and 3, Microsoft's version of Kerberos, and DNS.
Other Active Directory services (excluding LDS, as described below) as well as most of Microsoft server technologies rely on or use Domain Services; examples include Group Policy, Encrypting File System, BitLocker, Domain Name Services, Remote Desktop Services, Exchange Server and SharePoint Server.
AD CS predates Windows Server 2008, but its name was simply Certificate Services.
AD CS requires an AD DS infrastructure.
As the name suggests, AD FS works based on the concept of federated identity.
AD FS requires an AD DS infrastructure, although its federation partner may not.
External Links
References
https://en.wikipedia.org/w/index.php?title=Active_Directory&gettingStartedReturn=true
A server running Active Directory Domain Services (AD DS) is called a domain controller. It authenticates and authorizes all users and computers in a Windows domain type network—assigning and enforcing security policies for all computers and installing or updating software. For example, when a user logs into a computer that is part of a Windows domain, Active Directory checks the submitted password and determines whether the user is a system administrator or normal user. Also, it allows management and storage of information at admin level and provides authentication and authorization mechanisms and a framework to deploy other related services (AD Certificate Services, AD Federated Services, etc.).
Active Directory uses Lightweight Directory Access Protocol (LDAP) versions 2 and 3, Microsoft's version of Kerberos, and DNS.
Active Directory Services
Active Directory Services consist of multiple directory services. The best known is Active Directory Domain Services, commonly abbreviated as AD DS or simply AD.Domain Services
Active Directory Domain Services (AD DS) is the cornerstone of every Windows domain network. It stores information about members of the domain, including devices and users, verifies their credentials and defines their access rights. The server (or the cluster of servers) running this service is called a domain controller. A domain controller is contacted when a user logs into a device, accesses another device across the network, or runs a line-of-business Metro-style app sideloaded into a device.Other Active Directory services (excluding LDS, as described below) as well as most of Microsoft server technologies rely on or use Domain Services; examples include Group Policy, Encrypting File System, BitLocker, Domain Name Services, Remote Desktop Services, Exchange Server and SharePoint Server.
Lightweight Directory Services
Active Directory Lightweight Directory Services (AD LDS), formerly known as Active Directory Application Mode (ADAM),is a light-weight implementation of AD DS. AD LDS runs as a service on Windows Server. AD LDS shares the code base with AD DS and provides the same functionality, including an identical API, but does not require the creation of domains or domain controllers. It provides a Data Store for storage of directory data and a Directory Service with an LDAP Directory Service Interface. Unlike AD DS, however, multiple AD LDS instances can run on the same server.Certificate Services
Active Directory Certificate Services (AD CS) establishes an on-premises public key infrastructure. It can create, validate and revoke public key certificates for internal uses of an organization. These certificates can be used to encrypt files (when used with Encrypting File System), emails (per S/MIME standard), network traffic (when used by virtual private networks, Transport Layer Security protocol or IPSec protocol).AD CS predates Windows Server 2008, but its name was simply Certificate Services.
AD CS requires an AD DS infrastructure.
Federation Services
Main article: Active Directory Federation Services
Active Directory Federation Services (AD FS) is a single sign-on service. With an AD FS infrastructure in place, users may use several web-based services (e.g. internet forum, blog, online shopping, webmail)
or network resources using only one set of credentials stored at a
central location, as opposed to having to be granted a dedicated set of
credentials for each service. AD FS's purpose is an extension of that of
AD DS: The latter enables users to authenticate with and use the
devices that are part of the same network, using one set of credentials.
The former enables them use this same set in a different network.As the name suggests, AD FS works based on the concept of federated identity.
AD FS requires an AD DS infrastructure, although its federation partner may not.
External Links
- Active Directory Domain Services Overview
- Microsoft Technet: White paper: Active Directory Architecture (Single technical document that gives an overview about Active Directory.)
- Microsoft Technet: Detailed description of Active Directory on Windows Server 2003 Microsoft MSDN Library: [MS-ADTS]: Active Directory Technical Specification (part of the Microsoft Open Specification Promise)
- Active Directory Application Mode (ADAM)
- Microsoft MSDN: [AD-LDS]: Active Directory Lightweight Directory Services
- Microsoft TechNet: [AD-LDS]: Active Directory Lightweight Directory Services
- Microsoft MSDN: Active Directory Schema
- Microsoft TechNet: Understanding Schema
- Microsoft TechNet Magazine: Extending the Active Directory Schema
- Microsoft MSDN: Active Directory Certificate Services
- Microsoft TechNet: Active Directory Certificate Services
References
https://en.wikipedia.org/w/index.php?title=Active_Directory&gettingStartedReturn=true
Comments
Post a Comment