Migration d'un domaine Active Directory 2003 R2 vers 2008 R2 (tuto de A à Z)
1 Active Directory Windows Server 2008 R2 Updates.
-
Upload
allison-newton -
Category
Documents
-
view
238 -
download
0
Transcript of 1 Active Directory Windows Server 2008 R2 Updates.
1
Active Directory Windows Server 2008 R2 Updates
2
Session Objectives And Takeaways
Describe Active Directory features in Windows Server 2008 R2Discuss the importance of these features to our customersDemonstrate how some of these features will benefit our customers
3
Agenda
What’s new in Active Directory for Windows Server 2008 R2?
PowerShell CmdletsActive Directory Administrative centerBest Practice AnalyzerRecycle Bin for ADManaged Service accountsOffline Domain JoinAuthentication AssuranceHealth Model and Management Packs
Active Directory Tour demonstrationConclusion
4
Powershell for ADCommand line scripting for administrative, configuration and diagnostic tasks
Past limitations30+ command line tools for administering AD are not consistent in their usageDifficult to compose these tools to achieve complex tasks
Feature takeaway85+ AD cmdlets for comprehensive AD DS and AD LDS administration and configurationCommunicates using Web Service protocolsCan be used to manage Windows Server 2008 and 2003 domain controllers, using future AD Web Service download
5
Powershell Advantages
Consistent vocabulary and syntaxPredictable discoveryFlexible output formattingCmdlets can be easily composed (pipe) to build complex operationsEnd-to-End manageability with Exchange, Group Policy, etc
6
PowerShell Provider ModelProvides sessions, server context, security context and path contextEnables best practices sharing across connectionsCombination of cmdlets & provider means familiar model for usersPerform operations in AD that are similar to the file system or registry, such as rename, move, etc
7
Get-Command -CommandType Cmdlet *-AD*
Add-ADComputerServiceAccountAdd-ADDomainControllerPasswordReplicationPolicyAdd-ADFineGrainedPasswordPolicySubjectAdd-ADGroupMemberAdd-ADPrincipalGroupMembershipClear-ADAccountExpirationDisable-ADAccountDisable-ADOptionalFeatureEnable-ADAccountEnable-ADOptionalFeatureGet-ADAccountAuthorizationGroupGet-ADAccountResultantPasswordReplicationPolicyGet-ADComputerGet-ADComputerServiceAccountGet-ADDefaultDomainPasswordPolicyGet-ADDomainGet-ADDomainControllerGet-ADDomainControllerPasswordReplicationPolicyGet-ADDomainControllerPasswordReplicationPolicyUsageGet-ADFineGrainedPasswordPolicyGet-ADFineGrainedPasswordPolicySubjectGet-ADForestGet-ADGroupGet-ADGroupMemberGet-ADObjectGet-ADOptionalFeatureGet-ADOrganizationalUnitGet-ADPrincipalGroupMembershipGet-ADRootDSE
Get-ADServiceAccountGet-ADUserGet-ADUserResultantPasswordPolicyInstall-ADServiceAccountMove-ADDirectoryServerMove-ADDirectoryServerOperationMasterRoleMove-ADObjectNew-ADComputerNew-ADFineGrainedPasswordPolicyNew-ADGroupNew-ADObjectNew-ADOrganizationalUnitNew-ADServiceAccountNew-ADUserRemove-ADComputerRemove-ADComputerServiceAccountRemove-ADDomainControllerPasswordReplicationPolicyRemove-ADFineGrainedPasswordPolicyRemove-ADFineGrainedPasswordPolicySubjectRemove-ADGroupRemove-ADGroupMemberRemove-ADObjectRemove-ADOrganizationalUnitRemove-ADPrincipalGroupMembershipRemove-ADServiceAccountRemove-ADUserRename-ADObjectReset-ADServiceAccountPasswordRestore-ADObjectSearch-ADAccount
Set-ADAccountControlSet-ADAccountExpirationSet-ADAccountPasswordSet-ADComputerSet-ADDefaultDomainPasswordPolicySet-ADDomainSet-ADDomainModeSet-ADFineGrainedPasswordPolicySet-ADForestSet-ADForestModeSet-ADGroupSet-ADObjectSet-ADOrganizationalUnitSet-ADServiceAccountSet-ADUserUninstall-ADServiceAccountUnlock-ADAccount
8
Administrative Center for ADIncrease the productivity of IT Pros by providing a scalable, task-oriented UX for managing Active Directory
Past limitationsNon task-oriented UI causes customer pain
Example: resetting user passwordsRepresentation in MMC not scalable for large datasets
Feature takeawayTasks executed through PowerShell CmdletsTask oriented administration model, with support for larger datasetsConsistency between CLI and UI management capabilitiesNavigation experience designed to support multi-domain, multi-forest environments
9
Progressive disclosureTask orientedPowershell based instrumentationMulti-Domains/Multi-Forests
10
Best Practice Analyzer Identify deviations from best practices to help our customers better manage their Active Directory deployments
Past limitationsNo easy and automated validation of AD configuration against best practices
Feature takeawayAnalyzes AD settings that cause most unexpected behavior in customer environmentsLeverages PowerShell cmdlets to gather run-time dataMakes recommendations in the context of the deploymentAvailable through Server Manager BPA runtime tool
11
Best Practice Analyzer first set of scenariosVersion 1.0 of the BPA focuses mostly on common DNS issues
Checking SRV records for DC are registered with its DNS ServerA/AAAA records of a DC are registered with its DNS ServerDC has a valid host nameSchema Naming Master and Domain Naming Master FSMO are recommended to be on same machineRID and PDC recommended to be on same machineEach domain is recommended to have at least two DCs
12
AD Core
ADUC/ADSS/ADDT
LDAP
WSH
ADSI
LDAPDS RPC-Based Protocols
MMC
AD Web Service
S.DS.P/S.DS.AM/S.DS.AD
CLI
AD PSCLI
WCF.NET
MUX
WPF.NET
.NET
……DSRSAM
Windows Server 2008 Windows Server 2008 R2 Additions
GUI
SERVER
CLIENT
WCF.NET
DS RPC-Based Protocols……DSRSAM
ADMUX
GUI
BPA
AD Core
Recycle Bin for ADCustomer can undo an accidental deletion in Active Directory
Past limitationsAccidental object deletion causes business downtime – deleted users cannot logon or access corporate resourcesAccidental deletions are the number #1 cause of AD Disaster\Recovery scenarios
Feature takeawayRecycle bin for AD DS and AD LDS objectsFeature enabled with a new forest functional level
Requires all DCs in the forest to be Windows Server 2008 R2 DCsFor AD LDS, all replicas must be running in a new ‘application mode’
14
Recycle Bin for AD Object Life-cycle
Live Object Deleted Object Recycled Object
Tombstone Object
180 Days 180 Days
180 Days
Garbage collection
Garbage collection
Live Object
Windows Server 2008
Windows Server 2008 R2 with Recycle Bin enabled(If not enabled, behavior is similar to Windows Server 2008)
LDAP OID 1.2.840.113556.1.4.417
LDAP OID 1.2.840.113556.1.4.2064
Returns Tombstones
Returns Deleted and Recycled
Returns Deleted
Managed Service AccountsSimple management of service accounts
Past limitationsManagement of individual accounts for services is cumbersomePeriodic maintenance often causes outages
Example: resetting service account password
Feature takeawayA manageable solution that addresses isolation needs for services Better SPN management in Win7 Domain Functional Mode Lower TCO from reduced service outages (for manual password resets and related issues)One Managed Service Account per Service per box
No human intervention for password management!
Offline Domain JoinEnable easier provisioning of machines in the data center
Past limitationsReboot needed after domain joinInability to prepare the machine to be domain joined while offline
Feature takeawayAbility to pre-provision machine accounts in the domain to prepare OS images for mass deploymentMachines are domain joined on initial bootReduces steps and time needed to deploy in the data center
Authentication AssuranceApplications can control resource access based on authentication strength and method
Past limitationsCustomers cannot use authentication type or authentication strength to protect corporate data
Example: control access to resources based on claims such as use of smartcard for logon or the certificate used 2048 bit encryption
Feature takeawayAdministrators can map various properties, including authentication type and authentication strength to an identityBased on information during authentication, these identities are added to Kerberos tickets for use by applicationsFeature is enabled with a new domain functional level
All domain controllers in the domain need to be Window Server 2008 R2 DCs
18
Health ModelEnable IT administrators to better diagnose and resolve Active Directory issues
Past limitationsDiagnostic information is incomplete and inconsistent
Feature takeawayContinued investment towards completing the health modelA single authoritative source for information used in Management Packs, Best Practice Analyzer and online documentation
Management PackProvide proactive monitoring of availability and performance of Active Directory
Past limitationsCurrent management pack lacks support for Windows Server 2008 and MOM 2007
Feature takeawaySupport for Windows Server 2008 domain controllers
Multiple replication latency groupsAbility to monitor multiple forests from a single management groupManagement pack for MOM 2007
The journey to Windows Server 2008 R2
Upgrading to Windows 7 client while keeping existing servers, you can use:Off-line domain join
Once AD Web-service is available for existing servers, if you upgrade to Windows 7 client, you can use:
AD Powershell and ADAC with all your servers
Upgrading to Windows 7 client while installing one or more Windows Server 2008 R2 (one per domain), you can use:
Managed service account
If you change the domain functional level to Windows Server 2008 R2, you can use:
Authentication Assurance Managed service account with an enhanced SPN management experience
If you change the Forest functional level to Windows Server 2008 R2, you can use:
AD Recycle-bin
Tuesday, November 4th
Identity Lifecycle Manager 2 (Part 1): Empowering users with self-service identity management solutions 10:45-12:00pm
Windows Server 2008 R2 Active Directory: What's Coming Up? 1:30-2:45pm
Chalk & Talk: Windows Server Active Directory (IDA03-IS) 3:15-4:30pm
Windows Vista PKI Enhancement in Windows 7 and Windows Server 2008 R2 3:15-4:30pm
Going Virtual with the Intelligent Application Gateway and a Sneak Peak at the Future! 3:15-4:30pm
Forefront Security for Exchange Server: Advanced Spam and AntiMalware Scanning Today and Tomorrow 5:00-6:15pm
Active Directory Rights Management Services (AD RMS) - End to End 5:00-6:15pm
Wednesday, November 5th
Microsoft Forefront Security for SharePoint: The Next Generation of Collaboration Security 9:00-10:15am
Ask The Experts 12:15-12:45pm
Identity Lifecycle Manager 2 (Part 2): Expressing and enforcing business policy 1:30-2:45pm
Introduction to Microsoft Forefront Codename Stirling 1:30-2:45pm
Connecting Active Directory to Microsoft Cloud Services 3:45-5:00pm
Hybrid Messaging Security for Exchange Server 3:45-5:00pm
Using Active Directory Domain Services for Linux Servers 5:30-6:45pm
Related Content
Visit the Identity & Security booths for a detailed guide to activities at TechEd EMEA
22
Related ContentThursday, November 6th
Windows Server 2008 Active Directory Best Practices (IDA08) 8:30-9:45pm
Notes from the Field: Deploying Microsoft Identity Lifecycle Manager 2007 Certificate Management 10:15-11:30am
Ask The Experts 12:15-12:45pm
Successful deployment tips for Security and Strong Authentication 1:00-2:15pm
Using Network Access Protection (NAP) in combination with FCS 1:00-2:15pm
Identity Lifecycle Manager 2 (Part 3): Extensibility and provisioning with ILM 2 2:40-3:55pm
Universal sign-in utilizing AD, CardSpace and federation technologies: How to sign in any user, in any kind of application, in any scenario, using 'Zermatt' and claims-based identity 4:20-5:35pm
Windows Server 2008 R2 Active Directory: What’s Coming Up? (IDA309–REPEAT) 6:00-7:15pm
Friday, November 7th
Active Directory Information Security - Where is the boundary? 9:00-10:15am
A Technical Preview and Deep Dive of Next Generation ISA Server 9:00-10:15am
A DS Geek's Notes from the Field - Active Directory Uncovered 10:45-12:00pm
Infrastructure services for SOA security and federation: 'Geneva' Security Token Services 3:15-4:30pm
Visit the Identity & Security booths for a detailed guide to activities at TechEd EMEA
23
© 2008 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED
OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.