{"id":1522,"date":"2014-08-15T16:11:00","date_gmt":"2014-08-15T21:11:00","guid":{"rendered":"http:\/\/lisa.rushworth.us\/?p=1522"},"modified":"2017-08-24T16:21:46","modified_gmt":"2017-08-24T21:21:46","slug":"microsoft-directories-nt-and-windows-2000200320082012","status":"publish","type":"post","link":"https:\/\/www.rushworth.us\/lisa\/?p=1522","title":{"rendered":"Microsoft Directories \u2013 NT and Windows 2000\/2003\/2008\/2012"},"content":{"rendered":"<p>Windows NT provided a limited repository for user id\u2019s and passwords.\u00a0\u00a0NT domain credentials had the advantage of providing single-sign-on access to other Microsoft resources such as file shares and Exchange.\u00a0\u00a0Exchange itself housed a secondary directory, used for the \u201cglobal address list\u201d type details for Exchange accounts.\u00a0\u00a0Address, phone number, manager, email addresses \u2026 basically anything other than the user\u2019s ID and password were stored within the Exchange directory.\u00a0\u00a0The Exchange directory then linked each account into an NT4 domain user account for logon credentials.<\/p>\n<p>With Windows 2000, Microsoft integrated the two directories into Active Directory.\u00a0\u00a0This allowed a more robust set of user details to be provided \u2013 and moved the LDAP compliant directory off the Exchange server onto the domain controllers.\u00a0\u00a0Major changes were introduced in Active Directory \u2013 an increased maximum object count (from 40,000 to ten million in a single domain\u00a0with a billions\u00a0of objects in an AD forest), multi-master architecture, and attribute level replication being some of the key changes.<\/p>\n<p><strong>Data Store<\/strong><\/p>\n<p>Active Directory data is stored in\u00a0ntds.dit.\u00a0\u00a0ESE (extensible storage engine) is used to access the data within the database.\u00a0\u00a0In addition to\u00a0ntds.dit, there are several peripheral database files \u2013\u00a0edb.log\u00a0is the current in-use transaction log file.\u00a0\u00a0EDB#####.log\u00a0may be present if the\u00a0edb.log\u00a0file has been filled.\u00a0\u00a0EDB.CHK is the checkpoint file \u2013 this keeps track of which transactions have been committed to\u00a0ntds.dit\u00a0and a crash of the system will cause the transaction logs to be replayed from the pointer referenced in the\u00a0chk\u00a0file.\u00a0\u00a0Res1.log and res2.log, ten\u00a0meg\u00a0in total, are placeholder files\u00a0<em>just in case<\/em>\u00a0should the server run out of disk space the files are removed to allow continued operation.<\/p>\n<p>Within NTDS.DIT there are two main tables:<\/p>\n<ul>\n<li>The link table \u2013 metadata for calculating linked values<\/li>\n<li>The data table \u2013 actual domain data<\/li>\n<\/ul>\n<p>There are four other tables about which no additional information will be provided here-in<\/p>\n<ul>\n<li>System Table \u2013 metadata for the DSA-defined tables and indices<\/li>\n<li>HiddenTable\u00a0\u2013 DSA metadata<\/li>\n<li>SDPropTable\u00a0\u2013 Transiently stores Security Descriptor propagation, records are removed from table as propagation completes<\/li>\n<li>MSysDefrag1 \u2013 ESE database table, not specific to AD<\/li>\n<\/ul>\n<p>For linked attributes, the\u00a0backlinked\u00a0attribute is not modified directly but rather determined when it is queried.\u00a0\u00a0As an example \u2013 Active Directory generates a reporting structure.\u00a0\u00a0An object has a manager, but the \u201creports\u201d listing is calculated based on object\u2019s managers.\u00a0\u00a0The\u00a0linkID\u00a0of a forward link attribute is always even and\u00a0it\u2019s\u00a0associated\u00a0backlinked\u00a0attribute is always the forward\u00a0linkID\u00a0plus one (consequently also always odd).\u00a0\u00a0A full list of forward\/back link pairs can be generated by looking at the linkID values.<\/p>\n<p>The data table contains three different naming contexts \u2013 the schema, the configuration, and the domain data.\u00a0\u00a0These correspond to the three partitions shown in REPLMON \u2013 \u201ccn=schema,cn=configuration,dc=windstream,dc=com\u201d, \u201ccn=configuration,dc=windstream,dc=com\u201d, and \u201cdc=windstream,dc=com\u201d.\u00a0\u00a0The term\u00a0<em>partition<\/em>\u00a0in Active Directory is used to indicate a naming context \u2013 in no way related to Novell\u2019s use of the term to indicate a replication\u00a0boundry.<\/p>\n<p>The schema and configuration partitions are replicated to all domain controllers in a forest \u2013 since we only have one tree in the forest rendering the point moot since all the domain controllers in the domain are also all the domain controllers in the forest.\u00a0\u00a0The domain partition is replicated to all domain controllers in the domain.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Active Directory \u2013 Schema<\/strong><\/p>\n<p>Microsoft\u2019s documentation on unmodified schema classes and attributes can be found at\u00a0<a href=\"http:\/\/msdn.microsoft.com\/library\/default.asp?url=\/library\/en-us\/adschema\/adschema\/active_directory_schema.asp\">http:\/\/msdn.microsoft.com\/library\/default.asp?url=\/library\/en-us\/adschema\/adschema\/active_directory_schema.asp<\/a>\u00a0\u00a0\u00a0The modifications Exchange makes to the AD schema can be found at\u00a0<a href=\"http:\/\/msdn.microsoft.com\/library\/default.asp?url=\/library\/en-us\/wss\/wss\/wss_ldf_AD_Schema_intro.asp\">http:\/\/msdn.microsoft.com\/library\/default.asp?url=\/library\/en-us\/wss\/wss\/wss_ldf_AD_Schema_intro.asp<\/a><\/p>\n<p>The schema management MMC is not automatically available on a Windows machine.\u00a0\u00a0To enable the snap-in, run\u00a0<strong>regsvr32 c:\\winnt\\system32\\schmmgmt.dll<\/strong>\u00a0\u2013 then \u201cActive Directory Schema\u201d will be an option when adding snap-ins to MMC<\/p>\n<p>Active Directory\u2019s schema is normally in a read-only mode and no user has rights to modify the schema.\u00a0\u00a0Prior to enacting a schema change, then, you must enable schema writes and add your account to the \u201cSchema\u00a0Admins\u201d group.\u00a0\u00a0To enable schema writes, right click on the \u201cActive Directory Schema\u201d item in the MMC and select \u201cOperation Master\u201d.\u00a0\u00a0Then check the box next to \u201cThe Schema may be modified on this domain controller\u201d<\/p>\n<p>When creating new schema classes or attributes, ensure you use the correct OID for our organisation.\u00a0\u00a0Preferably, too, create auxiliary classes and associate the aux class with a structural class.\u00a0\u00a0This prevents any vendor changes to the structural class from impacting your schema attributes.<\/p>\n<p>In AD, schema changes cannot be deleted (well, it <em>can<\/em> but the process is unsupported).\u00a0\u00a0An attribute can be deactivated, but it remains in the schema definition.<\/p>\n<p><strong>Active Directory \u2013 Configuration<\/strong><\/p>\n<p>The AD Configuration partition holds, as the name implies, configuration for the domain and some services within the domain.<\/p>\n<ul>\n<li>Display\u00a0Specifiers:\u00a0Under the\u00a0DisplaySpecifiers\u00a0CN you will see multiple three digit hex number combinations.\u00a0\u00a0These are codes for different languages \u2013 409 being English.\u00a0\u00a0<a href=\"http:\/\/www.microsoft.com\/globaldev\/reference\/win2k\/setup\/lcid.mspx\">http:\/\/www.microsoft.com\/globaldev\/reference\/win2k\/setup\/lcid.mspx<\/a>\u00a0lists the codes used within the Windows internationalisation features.\u00a0\u00a0Under each regional container you will find the actual display\u00a0specifier\u00a0for structural schema objects.\u00a0\u00a0On, for instance, the user-Display object, is defined what appears when you right-click a user object in Active Directory Users and Computers.\u00a0\u00a0Another attribute defines the pages which appear when you create a user and the order in which those pages appear.\u00a0\u00a0The\u00a0createDialog\u00a0attribute is of particular interest \u2013 we modify this to automatically create the display name as\u00a0lastname,\u00a0firstname\u00a0MI if you manually create a user within AD.\u00a0\u00a0This is done by defining the\u00a0createDialog\u00a0value as \u201c%&lt;sn&gt;, %&lt;givenName&gt; %&lt;initials&gt;\u201d<\/li>\n<li>Extended Rights:\u00a0\u00a0On the\u00a0controlRightsAccess\u00a0object,\u00a0appliesTo\u00a0defines structural schema objects to which the\u00a0controlRightsAccess\u00a0object applies.\u00a0\u00a0The\u00a0controlRightsAccess\u00a0objects themselves have several functions.\n<ul>\n<li>When\u00a0validAccesses\u00a0is set to 8, this is to validate writes \u2013 or check the attribute value beyond the schema definition.\u00a0\u00a0Implementation is not widespread.<\/li>\n<li>When\u00a0validAccesses\u00a0is 256, then the object defines an actual extended right \u2013 something not part of the normal ACL\u2019s.\u00a0\u00a0Recieve-as and Send-As, for instance, are a special operations for Exchange which can be found in the\u00a0ExtendedRights\u00a0container.<\/li>\n<li>Other\u00a0validAccesses\u00a0codes define ACL groups which can be assigned through the \u201cDelegate Control\u201d function.\u00a0\u00a0and\u00a0validAccesses\u00a0indicates what rights the ACL group permits \u2013 16 for read, 32 for write, and the sum of 48 for read\/write access.\u00a0\u00a0The membership object in\u00a0ExtendedRights, with\u00a0appliesTo\u00a0bf967aba-0de6-11d0-a285-00aa003049e2 and\u00a0validAccess\u00a0of 48 means this access group allows whomever is granted it to both read and write to user objects (bf967aba-0de6-11d0-a285-00aa003049e2 is the\u00a0guid\u00a0of the user schema object).\u00a0\u00a0On the schema object \u201cmember\u201d, then, the\u00a0rightsGUID\u00a0is entered as the\u00a0attributeSecurityGUID.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>An example of the rights grouping is the \u201cPersonal-Information\u201d object,\u00a0rightsGUID\u00a077B5B886-944A-11d1-AEBD-0000F80367C1.\u00a0\u00a0You will find the corresponding octet string, 0x86 0xb8 0xb5 0x77 0x4a 0x94 0xd1 0x11 0xae 0xbd 0x00\u00a00x00\u00a00xf8 0x03 0x67 0xc1, applied to several schema attributes \u2013\u00a0telephoneNumber,\u00a0facsimileTelephoneNumber,\u00a0streetAddress,\u00a0telexNumber, and so on:<\/p>\n<p>Thus using the \u201cDelegation\u00a0Of\u00a0Control\u201d wizard, it is possible to select \u201cRead and write Personal Information\u201d as a permission set rather than specifying each individual attribute you want editable. Note, too, in the ACL editor the listing of \u201cPersonal Information\u201d is retained<\/p>\n<p><strong>ForestUpdates<\/strong><\/p>\n<p>Under\u00a0ForestUpdates\u00a0you will see an \u201cOperations\u201d CN.\u00a0\u00a0Operations holds\u00a0a listing of updates made to the forest (e.g. exchange \/forestprep).\u00a0\u00a0This allows the system to check that the requisite forest updates are in place prior to installation without requiring the changes to be re-run.<\/p>\n<p><strong>LostandFoundConfiguration<\/strong><\/p>\n<p>This is basically the same thing \u201cLostAndFound\u201d in the domain naming context is, but within the configuration partition.\u00a0\u00a0All things being equal, it should be empty.\u00a0\u00a0Should an object be created within the Configuration partition at the same time\u00a0it\u2019s\u00a0parent is deleted, the object is moved to \u201cLostAndFoundConfig\u201d for holding.<\/p>\n<p><strong>Partitions<\/strong><\/p>\n<p>Contains\u00a0crossref\u00a0objects to all partitions within the forest \u2013 again not as interesting here as it could be with just one tree and domain.<\/p>\n<p><strong>Physical Locations<\/strong><\/p>\n<p>This is intended for use with Directory Enabled Networking.\u00a0\u00a0The DEN concept is maintained by DMTF (<a href=\"http:\/\/www.dmtf.org\/standards\/wbem\/den\/\">http:\/\/www.dmtf.org\/standards\/wbem\/den\/<\/a>) and is not at present implemented at Windstream<\/p>\n<p><strong>Services<\/strong><\/p>\n<p>Forest-wide application settings \u2013 objects within this container correspond directly to the \u201cServices\u201d listed within the \u201cActive Directory Sites\u00a0And\u00a0Services\u201d\u00a0snapin.\u00a0\u00a0One of the services listed is Microsoft Exchange.\u00a0\u00a0Should a server fail, running setup \/disasterrecovery\u00a0will recover most of the Exchange settings for the server from within this container.<\/p>\n<p><strong>Sites<\/strong><\/p>\n<p>The \u201cSites\u201d of \u201cActive Directory Sites and Services\u201d.\u00a0\u00a0IP subnets and their associated sites are defined in this container, as well as the replication partnerships between domain controllers.<\/p>\n<p><strong>WellKnown<\/strong><strong>\u00a0Security Principals<\/strong><\/p>\n<p>What I call the \u201cvirtual credentials\u201d \u2013 system security credentials like\u00a0Everyone\u00a0and Self are defined herein.<\/p>\n<p><strong>Active Directory \u2013 Domain Data<\/strong><\/p>\n<p>Objects specific to just one domain within the forest \u2013 the obvious users, computers, printers, file shares, groups, and contacts.\u00a0\u00a0Less obvious items too are stored within the domain data.\u00a0\u00a0If Windows DNS zones are configured as \u201cActive Directory Integrated\u201d, the DNS entries will appear under \u201ccn=MicrosoftDNS,cn=System,dc=\u2026\u201d.\u00a0\u00a0File replication service (FRS) shares (including the domain SYSVOL), some information on Group Polices, Oracle database connections \u2026 any of the structural schema objects \u2026 can also be found within this partition.<\/p>\n<p>An object named Infrastructure is in the root of the domain naming\u00a0context,\u00a0this object holds the NTDS settings for the domain infrastructure operations master.<\/p>\n<p><strong>Flexible Single Master Operations (FSMO) Roles<\/strong><\/p>\n<p>FSMO roles are assigned for functions which cannot practically be performed by any domain controller \u2013 functionality which cannot subscribe to the multi-master principal.<\/p>\n<p>There are two forest-wide FSMO roles, the Domain Naming Master and the Schema Master.<\/p>\n<ul>\n<li>The Schema Master is the server on which\u00a0<em>writes<\/em>\u00a0can be made to the schema.\u00a0\u00a0All domain controllers will have a read-only copy of the schema, but only the schema master can write changes.<\/li>\n<li>The Domain Naming Master is used when a new domain is created within a forest \u2013 it verifies the new domain has a unique name.<\/li>\n<\/ul>\n<p>Three additional FSMO roles exist in each domain within a forest.\u00a0\u00a0The Infrastructure Master, RID Master, and PDC Emulator.<\/p>\n<ul>\n<li>The Infrastructure Master, in a multi-domain environment, handles cleanup of phantom objects created as members are added to groups via a trust.\u00a0\u00a0The cleanup process is detailed by Microsoft at\u00a0<a href=\"http:\/\/support.microsoft.com\/default.aspx?scid=kb;EN-US;Q248047\">http:\/\/support.microsoft.com\/default.aspx?scid=kb;EN-US;Q248047<\/a>\u00a0\u00a0\u00a0\u00a0As\u00a0we have a single domain, this is somewhat immaterial.\u00a0\u00a0Should we begin implementing other\u00a0domains,\u00a0the Infrastructure Master will need to be moved to a non-global catalogue (GC) server.\u00a0\u00a0The GC functionality precludes the phantom objects from being created (and hence from being purged).<\/li>\n<li>The RID master allocates blocks of relative\u00a0ID\u2019s,\u00a0RID\u2019s, to the domain controllers within the domain to ensure unique\u00a0GUID\u2019s.\u00a0\u00a0Should the RID master be offline for a short interval, new objects can still be created until the already-allocated RID block has been exhausted.<\/li>\n<li>The PDC emulator is multi-function.\u00a0\u00a0Were\u00a0the domain to be in mixed-mode and therefore support NT4\u00a0BDC\u2019s, the PDC emulator is required by the NT4 domain controllers for backwards compatibility.\u00a0\u00a0Our domain is in native-mode and cannot have NT4\u00a0BDC\u2019s.\u00a0\u00a0This does not preclude NT4 member servers, just domain controllers.\u00a0\u00a0The PDC Emulator server is authoritative for the user\u2019s password.\u00a0\u00a0Any failed logons are re-checked against the PDC emulator.\u00a0\u00a0In the NT4 environment this was because a BDC was a read-only directory copy to which password changes could not be made.\u00a0\u00a0If you changed your password and attempted to authenticate prior to the domain replicating the change completely, you could receive an invalid password error using your correct new password.\u00a0\u00a0To prevent this issue, a password failure on the BDC was re-checked with the PDC before the logon attempt was failed.\u00a0\u00a0This is how we can allow CSO password changes into AD without requiring the user to wait for domain synchronisation.\u00a0\u00a0The\u00a0DirXML\u00a0AD driver is installed to the PDC emulator server to allow immediate use of the user\u2019s new CSO password.\u00a0\u00a0Group Policy Objects are created and edited on the PDC Emulator\u2019s SYSVOL share.\u00a0\u00a0The PDC emulator is also the time source for the domain.\u00a0\u00a0Our PDC emulator is configured to use time.windstream.com as its time source with a time sync period of eight hours.<\/li>\n<\/ul>\n<p>Normally you can move the FSMO roles between domain controllers using\u00a0MMC\u2019s.\u00a0\u00a0For the three per-domain roles the change is made in Active Directory Users and Computers.\u00a0\u00a0The Domain Naming Operation Master is changed from Active Directory Domains and Trusts\u201d; the Schema master is changed within Active Directory Schema Manager.<\/p>\n<p>Within Active Directory Users and Computers, right click the domain and select \u201cConnect\u00a0To\u00a0Domain Controller\u201d \u2013 select the domain controller which will receive the new role.\u00a0\u00a0Then right click the domain and select \u201cOperation Masters\u201d.\u00a0\u00a0You just click the \u201cChange\u201d button to move the role.<\/p>\n<p>In the event of a catastrophic server failure complete with no system state backups you\u00a0<em>can<\/em>\u00a0forcibly transfer the FSMO roles from a non-operational source.\u00a0\u00a0We have done this once in production, the ICM domain, but there is additional peripheral cleanup required to remove the failed domain controller from operation.\u00a0\u00a0<a href=\"http:\/\/support.microsoft.com\/kb\/255504\/\">http:\/\/support.microsoft.com\/kb\/255504\/<\/a>\u00a0contains instructions for seizing FSMO roles.\u00a0\u00a0Microsoft mostly documents the domain cleanup process at\u00a0<a href=\"http:\/\/support.microsoft.com\/kb\/216498\/\">http:\/\/support.microsoft.com\/kb\/216498\/<\/a>\u00a0\u00a0\u00a0If\u00a0you want to try it for the experience, build two servers, create a fake domain with the two of them, turn one off and seize all the roles onto the remaining machine.\u00a0\u00a0This is effectively what happened in the ICM domain, they had three domain controllers but the first which held all roles was destroyed.\u00a0\u00a0Be careful in production as the post-seizure cleanup is not fully documented.\u00a0\u00a0DNS entries will still exist in BIND.\u00a0\u00a0It is possible for your domain controller machine password to be out of sync with the domain.\u00a0\u00a0I\u2019m sure there are other situations which could arise as well which we didn\u2019t happen across.<\/p>\n<p><strong>Domain Registration \u2013 WINS<\/strong><\/p>\n<p>The WINS entries of your domain should only be used by \u2018legacy\u2019 clients, NT4 workstations and servers.\u00a0\u00a0If you configure your domain controllers TCP\/IP properties to use your WINS servers, the registration for the domain will be created automatically.\u00a0\u00a0Alternately you can create an LMHOST file for import into a foreign WINS server.\u00a0\u00a0The only reason we do this is to establish a trust with an NT4 domain.\u00a0\u00a0There are two records needed \u2013 and for our domain the text is included here-in.<\/p>\n<pre>10.33.8.25\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0SCARLITNT631\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0#DOM:ALLTEL\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0#PRE\r\n10.33.8.25\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\"ALLTEL\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\\0x1b\"\u00a0\u00a0#PRE\r\n<\/pre>\n<p>If you are attempting to create the LMHOST file for an alternate domain, you can just change the values\u00a0<strong>except<\/strong>\u00a0the \u201cALLTEL\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\\0x1b&#8221; entry.\u00a0\u00a0There is a quotation\u00a0mark,\u00a0sixteen characters only (insert holy hand grenade like joke here) followed by the \\0x1b then the closing quotation mark.\u00a0\u00a0If your domain name is BOB you cannot replace ALLTEL with BOB, you need to replace it with BOB and three trailing space characters.<\/p>\n<p><strong>Domain Registration \u2013 DNS<\/strong><\/p>\n<p>There are four \u201cunderscore zones\u201d \u2013 new DNS zones used to store the SRV records relevant to the domain. Active Directory works fine with BIND DNS servers &#8211; you need to allow dynamic updates from the domain controller IP addresses. Since I do\u00a0<em>not<\/em> allow dynamic updates on the root zone, I manually add the domain controller A records.<\/p>\n<ul>\n<li>_sites.domain.tld.\u00a0\u00a0\u00a0Service records advertise servers providing global catalogue, Kerberos, and LDAP services within each site.\u00a0\u00a0The sites are differentiated within the record name \u2013 _service._tcp.SITENAME._sites.domain.tld.\u00a0\u00a0\u00a0\u00a0The following lines are the _sites records for the\u00a0TWNUserAuth\u00a0site<\/li>\n<\/ul>\n<pre>$ORIGIN\u00a0_tcp.TWNUserAuth._sites.alltel.com.\r\n_gc\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0SRV\u00a0\u00a0\u00a0\u00a0\u00a00 100\u00a0\u00a0\u00a03268\u00a0\u00a0\u00a0\u00a0neohtwnnt630.alltel.com.\r\n_kerberos\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0    SRV\u00a0\u00a0\u00a0\u00a0\u00a00 100\u00a0\u00a0\u00a088\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0neohtwnnt630.alltel.com.\r\n_ldap\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SRV\u00a0\u00a0\u00a0\u00a0\u00a00 100\u00a0\u00a0\u00a0389\u00a0\u00a0\u00a0\u00a0\u00a0neohtwnnt630.alltel.com.\r\n_gc\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0SRV\u00a0\u00a0\u00a0\u00a0\u00a00 100\u00a0\u00a0\u00a03268\u00a0\u00a0\u00a0\u00a0neohtwnnt631.alltel.com.\r\n_kerberos\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0    SRV\u00a0\u00a0\u00a0\u00a0\u00a00 100\u00a0\u00a0\u00a088\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0neohtwnnt631.alltel.com.\r\n_ldap\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0SRV\u00a0\u00a0\u00a0\u00a0\u00a0 0 100\u00a0\u00a0\u00a0389\u00a0\u00a0\u00a0\u00a0\u00a0neohtwnnt631.alltel.com.\r\n<\/pre>\n<ul>\n<li>_tcp.domain.tld. Service records advertise all domain controllers within the domain providing global catalogue, Kerberos, LDAP, and\u00a0kpasswd\u00a0services.\u00a0\u00a0The following lines are the _tcp\u00a0records for the NEOHTWNNT630 server<\/li>\n<\/ul>\n<pre>$ORIGIN\u00a0_tcp.alltel.com.\r\n_gc\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0SRV\u00a0\u00a0\u00a0\u00a0\u00a00 100\u00a0\u00a0\u00a03268\u00a0\u00a0\u00a0\u00a0neohtwnnt630.alltel.com.\r\n_kerberos\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0SRV\u00a0\u00a0\u00a0\u00a0\u00a00 100\u00a0\u00a0\u00a088\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0neohtwnnt630.alltel.com.\r\n_kpasswd\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SRV\u00a0\u00a0\u00a0\u00a0\u00a00 100\u00a0\u00a0\u00a0464\u00a0\u00a0\u00a0\u00a0\u00a0neohtwnnt630.alltel.com.\r\n_ldap\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0SRV\u00a0\u00a0\u00a0\u00a0\u00a00 100\u00a0\u00a0\u00a0389\u00a0\u00a0\u00a0\u00a0\u00a0neohtwnnt630.alltel.com.\r\n<\/pre>\n<ul>\n<li>_udp.domain.tld. Used for UDP\u00a0kerberos\u00a0connections to get tickets and change passwords.\u00a0\u00a0Service records in this zone advertise the UDP Kerberos and\u00a0kpasswd\u00a0services for the domain.\u00a0\u00a0The following lines are the _udp\u00a0records for the NEOHTWNNT630 server<\/li>\n<\/ul>\n<pre>$ORIGIN\u00a0_udp.alltel.com.\r\n_kerberos\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0SRV\u00a0\u00a0\u00a0\u00a0\u00a00 100\u00a0\u00a0\u00a088\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0neohtwnnt630.alltel.com.\r\n_kpasswd\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0SRV\u00a0\u00a0\u00a0\u00a0\u00a00 100\u00a0\u00a0\u00a0464\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0neohtwnnt630.alltel.com.\r\n<\/pre>\n<ul>\n<li>_msdcs.domain.tld.\u00a0\u00a0Kerberos,\u00a0ldap, and global catalogue records by site and not.\u00a0\u00a0In addition each domain controller\u2019s GUID used for replication is registered here.\u00a0\u00a0Again the example provides the service records for NEOHTWNNT630<\/li>\n<\/ul>\n<pre>$ORIGIN\u00a0_msdcs.alltel.com.\r\n47c1965e-87e8-4445-8552-fd20892c08c2\u00a0\u00a0\u00a0\u00a0CNAME\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0neohtwnnt630.alltel.com.\r\n_ldap._tcp.e0f0a709-9edf-483b-96e6-55c0dd55c1a6.domains\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0SRV\u00a00 100 389\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0neohtwnnt630.alltel.com.\r\ngc\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0A\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a010.10.90.217\r\n$ORIGIN\u00a0_tcp.dc._msdcs.alltel.com.\r\n_kerberos\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0SRV\u00a0\u00a0\u00a0\u00a0\u00a00 100\u00a0\u00a0\u00a088\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0neohtwnnt630.alltel.com.\r\n_ldap\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0SRV\u00a0\u00a0\u00a0\u00a0\u00a00 100\u00a0\u00a0\u00a0389\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 neohtwnnt630.alltel.com.\r\n$ORIGIN\u00a0_tcp.TWNUserAuth._sites.dc._msdcs.alltel.com.\r\n_kerberos\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0SRV\u00a0\u00a0\u00a0\u00a0\u00a00 100\u00a0\u00a0\u00a088\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0neohtwnnt630.alltel.com.\r\n_ldap\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0SRV\u00a0\u00a0\u00a0\u00a0\u00a00 100\u00a0\u00a0\u00a0389\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 neohtwnnt630.alltel.com.\r\n$ORIGIN\u00a0gc._msdcs.alltel.com.\r\n_ldap._tcp\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0SRV\u00a0\u00a0\u00a0\u00a0\u00a00 100\u00a0\u00a0\u00a03268\u00a0\u00a0\u00a0\u00a0neohtwnnt630.alltel.com.\r\n$ORIGIN\u00a0_sites.gc._msdcs.alltel.com.\r\n_ldap._tcp.TWNUserAuth\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0             SRV\u00a0\u00a0\u00a0\u00a0\u00a00 100\u00a0\u00a0\u00a03268\u00a0\u00a0\u00a0\u00a0neohtwnnt630.alltel.com.\r\n<\/pre>\n<p>The PDC emulator is also advertised here<\/p>\n<pre>$ORIGIN\u00a0_msdcs.alltel.com.\r\n_ldap._tcp.pdc\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0SRV\u00a0\u00a0\u00a0\u00a0\u00a00 100\u00a0\u00a0\u00a0389\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0scarlitnt631.alltel.com.\r\n<\/pre>\n<p><strong>\u00a0<\/strong><\/p>\n<p><strong>Client Authentication<\/strong><\/p>\n<p>A client which has already authenticated to the domain will have a registry entry which retains the client\u2019s site.<\/p>\n<pre>[HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Netlogon\\Parameters]\r\n\"DynamicSiteName\"=\"LITUserAuth\"\u00a0\r\n<\/pre>\n<p>When a client attempts to authenticate to Active Directory, the service records for the\u00a0kerberos\u00a0service are used to determine an appropriate authentication source.\u00a0\u00a0In the case of the PC above, this would be a query for _kerberos._tcp.LITUserAuth._sites.dc._msdcs.alltel.com.\u00a0service\u00a0records is made.\u00a0\u00a0An LDAP connection is initiated over udp\/389 to every domain controller returned by the DNS query.\u00a0\u00a0Each connection is initiated in 1\/10<sup>th<\/sup>\u00a0intervals second.\u00a0\u00a0The receiving servers compare the client\u2019s IP address to the subnet configuration to verify the client is reaching the correct site for\u00a0it\u2019s\u00a0current subnet.\u00a0\u00a0The first LDAP response received is then used as the\u00a0kerberosauthentication server.\u00a0\u00a0If the client\u2019s site is incorrect a referral is returned for the correct\u00a0site \u2013 which then prompt\u00a0the client to re-query DNS for the correct new site.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Windows NT provided a limited repository for user id\u2019s and passwords.\u00a0\u00a0NT domain credentials had the advantage of providing single-sign-on access to other Microsoft resources such as file shares and Exchange.\u00a0\u00a0Exchange itself housed a secondary directory, used for the \u201cglobal address list\u201d type details for Exchange accounts.\u00a0\u00a0Address, phone number, manager, email addresses \u2026 basically anything other &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[30],"tags":[68,100],"class_list":["post-1522","post","type-post","status-publish","format-standard","hentry","category-system-administration","tag-active-directory","tag-dns"],"_links":{"self":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/1522","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1522"}],"version-history":[{"count":1,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/1522\/revisions"}],"predecessor-version":[{"id":1523,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/1522\/revisions\/1523"}],"wp:attachment":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1522"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1522"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1522"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}