Active Directory Design Guide

Companies use the Active Directory Domain Services (AD DS) in a server environment to make the work of network users less complicated and ensure resource sharing and management is secure, scalable, and all objects work as per their respective configurations. A well-designed AD DS can be used to manage the entire network infrastructure including the branch office and multiple forest environment. System Administrators should develop a habit of documenting all aspects of the domain structure and security strategies, as this becomes the new plan for future infrastructure and possible migration.

The Basics of Active Directory Planning

When planning for a domain, two things come into play: domain upgrading and domain restructuring. Upgrading your domain is more than just upgrading every domain controller; it involves the upgrading of both the Primary Domain Controller (PDC) and the Backup Domain Controller (BDC). Restructuring involves the creation of a new Active Directory from scratch. Restricting may lead to few but expanded domains.

Develop a Migration Strategy

Having a migration strategy in place is an integral part of your overall design plan. Migration strategy involves studying the current or proposed configuration details and identifying which aspects of the domain will be migrated. A fall back system also has to be in place to counter any possible failure.

Working with a Simple Design

An Active Directory should be flexible in giving you an easy time when designing the forests. Designing a Domain for every department may look desirable in an organization but do not forget the general rule of running fewer but effective domains. An alternative to creating domains for every department is to use the Organizational Units, which are flexible and easy to manage.

Active Directory Domain Design

An Active Directory has four main divisions: the forests, the domain, the sites, and the organizational units. The system Administrators should maximize on the potential of these divisions to get the best out of any directory structure.

When creating your domains, it is recommended that you use domain members who are near each other as possible. This is the best practice because the level of traffic within a domain is higher than you would expect between two different domains. Smaller domains also limit the need for investing in expensive connections to increase bandwidth. Remember to use the Organizational units to delegate Administrative privileges within an Active Directory.

The Design of Groups and Organizational Units

Before thinking of how the Groups and Organizational Units will work, System Administrators should know in advance the role of each group or units. The idea is to have a functional Organizational Unit and Groups in a bid to simplify the Active Directory environment. This goes a long way in simplifying management by giving you more control over the Active Directory. An active directory without a logical design of its users may lead to confusion. Here are some of the best practices when designing Organizational Units:

Maintain a simple OU structure
Limit OU nesting to less than 10 layers
Apply Group Policy to groups via the Group Policy Filtering
Do not utilize local groups for permissions in a domain environment
Use local groups in the domain to control access to resources and group similar user groups.

You can also use hidden OU to prevent viewing or altering in an environment where network application services are shared within departments and with external customers.

Use Rules for Active Directory Sites

Using Directory sites is an important element for any Active Directory domain. Sites can be limited to any computer object within a forest. Thus, they can be found across domains and organizational units. Sites are used to impose physical network to facilitate traffic flow. Sites also regulate traffic flowing to slower WAN links within the network; this will effectively increase productivity and serve to reduce costs on connectivity.

The general good practice when designing sites

Sites should be a reflection of the physical and geographical topology
Every site should have at least one local Domain Controller
Sites should be connected to faster links
Remote clients do not need a dedicated site
Sites are desirable when replication services are needed
Sites can be added, changed, removed, without affecting network operations or configurations

Active Directory Design Requirements

Before the deployment of any Active Directory Services, the logical structure that reflects the working environment should be in place. The AD DS logical structure defines directory objects are organized and a method of managing individual accounts and shared resources. When planning for the logical structure, determine the number of forests, domain designs, the Domain Name System infrastructure, and Organizational Units.

The Design of the Logical Structure should follow the following process

Identification of the technical staff in charge of deployment
Creation of the forest design
Creation of the domain design for each forest
Design a DNS infrastructure to support AD DS for every forest
Design organizational units for delegating administrative tasks for every forest

Designing the Site Topology

The site topology of the Active Directory network is a logical representation of the physical network. It has all the information about the AD DS location sites, the site of Domain Controllers, and the site links that support the AD DS replication taking place between sites.

The site topology design goes through the following process

Gather all network information
Plan where to place the domain controllers
Create the site design
Create the link design
Create the site link bridges

2. Planning for Domain Controller Capacity

For an efficient output of the AD DS, System Administrators should determine the number of domain controllers for each site. Capacity planning for the domain controllers takes care of all the hardware requirements and avoids incidences of poor performance by the domain controllers

The process of planning for the domain controller capacity planning involves:

Collect site topology and design information
Determine the number of domain controllers
Create the site design
Assess disk space and memory requirements
Monitor domain controller performance

Please note that some features can be added to the Domain design by raising the functional levels of the forests.

Conclusion

The strategies presented in this guide apply in any server-operating environment. If you are not sure if your environment can meet the minimum system requirements, consult with other professionals on what needs to be done to deploy the AD DS.

Want to have efficient and accurate reports about NTFS permissions on all your folders on your Windows Server Environment?

Protect yourself and your clients against security leaks and get your free trial of the easiest and fastest NTFS Permission Reporter now!