Active Directory Rocks

By Author: Peter Wendt
Total Articles: 34
Comment this article

Active Directory, Microsoft's official directory service, is excellent at accomplishing all that it sets out to do. In the directory service world there are plenty of systems available out there, but none of them compare to this gem created by MS employees. To put it quite simply, Active Directory rocks.

Active Directory Basics

Some people may be unfamiliar with the specifics of Active Directory and what its functions are. Basically, it serves to store massive amounts of various information about different objects, and then organizes that information into logical hierarchies. Broadly speaking, there are two main categories of objects for which this system stores information about. Those categories are resources and security principles. In the eyes of the program, each object appears as a single entity. For example, a printer, which would fall under the "resources" category, would be an entity. Every single bit of different information for that printer is stored in the system's database.

Schema

Schema, which is essentially the database's formal language, helps to define the attributes about the various ...
... entities that gets stored. The directory's schema also works as a sort of filter, by determining what types of entities the database can or cannot keep information on. The directory service's administrators have the ability to change and regulate the schema based on what level of information tracking they deem to be appropriate. One of the great things about Active Directory is that the interface for working with the schema is very organic and logical. Objects can be activated or deactivated through the schema, but they cannot be deleted. This means that once an object's information becomes a part of the directory service's system, it is there for good.

Organizational Units

Objects that share a common domain location can be further cataloged by being placed into what is called an Organizational Unit. An OU's purpose is to make a hierarchy for the domains, which makes it easier for administrators to work with them. Active Directory allows for the use of OU's rather than domains to define structure points, which is a great feature that makes an administrator's life significantly easier.

Shadow Groups

AD requires an additional procedure if an administrator desires to list an object in an OU as part of a grouping that already happens to be in that OU. However, the system's creators had the foresight to create a handy workaround. In the workaround, the administrator must write a script, using either Visual Basic or PowerShell, to create and stabilize a user group for each OU that is contained within their directory. These are known as shadow groups, which sometimes take the place of OU's in list of administration tools.

Peter Wendt is a writer and researcher in Austin, TX. If you are interested in this subject , he recommends you to check out visualclick.com .