Inside Out in C#

Drawer QR-Code in C# Inside Out

34

Geographically separated sites Geographically separated business units may want completely separate forests or domains. Although there may be business reasons for this, the decision should not be made based on perceived limitations in Active Directory. As long as a connection can be made between locations, there is no need for separate forests or domains. Active Directory sites provide the solution for connecting across limited bandwidth links. With the automatic compression feature for site bridgehead servers, replication traffic is compressed 85 to 90 percent, meaning that it is 10 to 15 percent of its non-compressed size. This means that even low bandwidth links can often be used effectively for replication. For more information on sites, see 35, Configuring Active Directory Sites and Replication.

Most companies opt to deploy a single forest, and it is only through merger or acquisition that additional forests enter the picture. In part, this is because there is no easy way to merge forests if you decide to do so later: You must migrate objects from one forest to the other, which can be a very long process. For this and other reasons, you should decide from the start how many forests are going to be implemented and you should justify the need for each additional forest. Sometimes additional forests are deployed because of organizational politics or the inability of business units to decide how to manage the top-level forest functions. At other times, additional forests are deployed to isolate business units or give complete control of the directory to a business unit. The organization should consider the following factors before creating additional forests:

Additional forests make it more difficult for users to collaborate and share informa-

tion. For example, users have direct access to the global catalog and can search for resources easily only for their own forest. Access to resources in other forests must be configured, and the users will not be able to directly search for available resources in other forests.

Additional forests mean additional administrative overheard and duplication of infra-

structure. Each forest will have its own forest-level configuration and one or more additional domain-level configurations that need to be managed. The ability to share resources and synchronize information across forests must be specifically configured rather than implemented by using built-in trusts and synchronization. Sometimes, however, the additional controls put in place with additional forests are needed to give reasonable assurance that administrators from other domains in a forest do not make harmful changes to the directory, which are then replicated throughout the organization. All the domain controllers in a forest are tightly integrated. A change made on one domain controller will be replicated to all other domain controllers. Replication is automatic, and there are no security checks other than the fact that the person making the change must have the appropriate permissions in the first place, that is, the person must be a member of the appropriate administrator group for the type of change being made. If such an administrator is acting maliciously in making changes, those changes will be replicated regardless of the effect on the organization. That said, reasonable assurance can be addressed by putting strict administration rules and procedures in place. With strict rules and procedures, the organization will have the following multiple levels of administrators:

High-level administrators with domain-wide privileges who are trusted with domain-

wide administration. These administrators are members of the Domain Admins, Administrators, Server Operators, or Backup Operators groups.

include being a member of the Server Operators, Backup Operators, or similar groups. To give reasonable assurance, the organization will also need to physically secure domain controllers, set policies about how administrators use their accounts, such as running tasks as an administrator only when needed for administration, and configure auditing of all actions performed by both users and administrators.