?4? ??Active Directory???????

1
?4? ??Active Directory???????

• ??????????????
• ????????????????????????????????????,?????
  ?????????,???????????
• ????????,????,???,?????
• ?????????????
• ???????,???????,????????????????

2
???????????

• ??????
• ????DC?????
• ???SAM????
• ???????? ?
• ??????
• ??DC?
• ?AD?
• ?????????????

3
??? ???

• ???????
• 1. ???(Local Groups)
• ????????????Windows Server 2003??DC??????,????
  ?????????????????,????????????????????
• ????????????????????????,?????????????????????
  ??

4
2. ???(Built-in Groups)

• ????? Windows Server 2003 ?????????????,??????
  ????????????????????,??????????????
• ????????,??????????????????

5
?????????

• ??????????????????????????????????
• ???????????????????????????????,??????????????
  ???????,???????????????????????????

6
???????

• ???????Administrator??Account
  Operators????????,???????

7
??????

• ???,??????????????

8
?????????????????
9
??????

• ?????????

10
?????
11
????
12
????????????????
13
??? ??????

• ????????
• 1. ???
• ??????????????????,???????????(?
  Exchange)?,????????????????????
• 2. ???
• ?????????????????
• ???????? Active Directory ?????
• ????????????

14
????????????

• ??(permission)???????(???????????)???????????
  ?,????????????????????????
• ??(right)??????????????,??????????????????????
  ???
• 3. ????????????
• ??????????????,?????

15
3. ????????????
16
????????????

• ?????????????????????????????????????????
  ????????????
• ???(Global group)
• ?????????????????????
• ?????????????
• ????????????????????
• ???????????(??????????)?

17
????(Domain local group)

• ?????,?????????????????????,???????
• ?????,????????????????,??????????????
• ???????????????????Windows 2000 ? Windows
  Server 2003 ?,????????????
• ????????????????Windows 2000?Windows Server
  2003??????????????????

18
???(Universal group)

• ?????????,?????????
• ????????????
• ??????????????????(?????)
• ?????????????????

19
????????????

• 1. ??????????????
• ?????????????????????????????
• ?????????????????????????????????????????????
  ??????????????

20
2. ?????????????

• ??????????????????????????,???????????????????
  ???????????,?????????????????????,????????????????
  ???????

21
3. ?????????????

• ????????????????????????,?????????????????????
  ????????????????????,?????????????????????????????
  ??????

22
?? ??????

• ?????,??????,????????????????,????????????
• ????????????????????????????,????????
• ?????????????????????????????,????????
• ???????????????????????????,????????
• ??????????????

23
??????????

• ?Administrators??Account Operators?????????
  ??????? ?Active Directory??????

24
?????

• ??Users??,??????????? ??

25
Active Directory?????? ??????
26
?????

1. ?????

27
?? ???

• ?Active Directory?????????????????????????????
  ,??security identifier(SID,?????)?Windows Server
  2003??SID????????????????????,Windows Server
  2003???????????SID,?????????????????????,?????????
  ???????????????????,??????????????????????????????
  ????

28
????????????

• ????????,??????????????????????Administrators?
  ???
• ???????Administrator???????,???????????
• ??????????????????????MMC?????????????Shift?
  ,???,????????????? ?

29
?????????
30
??? ???

• ???????Active Directory???????????????????????
  ????????????,???????????????
• ??Builtin?????
• Account Operators??????????????Users?Computers
  ?????????????????????????,??Domain
  Controllers?????

31
Administrators???????????????????

• Backup Operators?????????????????????,????????????
  ????
• Domain Guests ????????????
• Network Configuration Operators????? TCP/IP
  ????????????????? TCP/IP ???
• Performance Monitor Users?????????????????????????
  ????

32
Performance Log Users?????????????????????????????
??????

• Pre-Windows 2000 Compatible Access????????????????
  ?????
• Print Operators??????????????????????????????
• Remote Desktop Users???????????????????????????
  ??????????
• Replicator ??????????,????????????????????

33
Server Operators ??????,??????????????????????????
?????????????????????,????????

• Users????????????,??????????????????,????????

34
??Users?????

• Cert Publishers????????????????
• DnsAdmins(?DNS??) ????? DNS Server ?????????
• DnsUpdateProxy(?DNS??)???????????(? DHCP
  ???)??????? DNS ????
• Domain Admins??????????????
• Domain Computers??????????????????
• Domain Controllers?????????????

35
Domain Guests????????

• Domain Users????????
• Enterprise Admins(????????)??????????????????
• Group Policy Creator Owners?????????????
• IIS_WPG(? IIS ??) IIS_WPG ?? Internet ???? (IIS)
  6.0 ??????
• RAS ? IAS Servers ?????????????????????
• Schema Admins(????????)????? Active Directory ???
  

36
??? ???

• ?????????????????????????
• ??????????,???????????????
• ?? ?????
• ??????????,???????????????????????????????????
  ????????????????????????OU????????????
• ?????????????

37
1. ?????

• (1)??????
• (2)??????
• ?????????????????
• ????????,????????????????????
• ???????????????????????????????
• ??????????????????????????????
• ???????????????????

38
2. ?????

• ??????????????????
• ??????????????????
• ??????,?????????????????????,?????????????,?
  ????????????
• ??????,??????????????????????????????????????
  /??????????????????????????
• ????????????????????????????????????????? ?

39
???????????????????????? ?

• ???????????????,?????????????,??????????,????????
  ??????
• ??????(RIS)??????????,????????RIS?????
• ???????????Windows Server 2003???????????????????
  ??????,??????????? ?

40
???????

• ???????????????????????????????????????????(GP
  O)??
• ???????????????????????(GPC)??????(GPT)?
• 1. ?????(GPO)
• GPO???????????OU???????
• ?????GPO??????????OU?
• ???GPC?????????????????????GFT???????????????

41
2. ?????

• ?????(GPC)???GPO??????????????????????????
  ?GPC???????????GPC?????GPT???????GPC???????GPO????
  ??????
• GPC???????????Windows Server
  2003???????????????????????API??????????,?????????
  ?????

42
3. ?????

• ?????(GRT)?????????systemroot\SYSVOL\sys
  vol\ltdomain_namegt\Policies???????????
• GPT??????????????????????????????????

43
???????

• 1. ??GPO

44
????????????
45
2. ????????
??????????????????????,????????????Window
s????????
46
?????

• ????????????????????,?????????????????????????
  ??????????????????????????
• ????
• ??????????????????,???????????????????????????
  ????????????????????????????????

47
3. GPO??

• ????GPO,????????????????????????????

??? ????
Authenticated Users ???????
Creator Owner ?GPO??????????Special Object ?Attribute??
Domain Admins ???????????????????
Enterprise Admin ???????????????????
System ???????????????????
48
??GPO??

• ???????GPO??????OU??????,?????,????????
  ?,????,?????????

49
???????

• ?????,???????????????????????????????,????????
  ????????????,????????????????????,???????????????,
  ?????????????????????

50
???????

• 1. ??????
• ??????????????????????????????????????????????
  ?
• ???????????????,????????Microsoft Windows
  Installer(.msi)????
• ???????????????,?????????????

51
??????

• ???????????,??????????????????????????????
  ?????????????????????????????????????????????,????
  ???????????????,????????????????????????????,???
  ??????????????????????????????,??????????????

52
??????

• ???????????,????????????????????????????????
  ???,??????????????????,?????????????????????,?????
  ???????????????????????????????????????/????????
  ??????????????????????

53
????????????

• (1)??????????????????????????????????
• (2)

54
?????????
55
????
56
????????????????
57
2. ????

• Windows Server 2003???????????????????????
  ?????????,?Windows Server 2003????????????????????
  ????,Windows Server 2003????????????
• ?????????Windows NT?????(.bat?.cmd),Windows
  Scripting Host?VBScript(.vbs)?Jscripts(.js)???

58
????
59
????
60
3. ??????

• ???????????????????????????
• ?Windows Server 2003???????????????????????
  ?(???????)?
• ???Windows Server 2003??????????????????????
  ?????,???????????,???????????

61
?????????

• ????
• ????
• ????
• ????
• ????
• ???
• ????
• ?????????IP????

62
4. ??????

• ?Windows Server 2003?,??????????????????????(.
  adm)????????????????????????????????????,?????????
  ??OU?
• ??????????????????????????????????Windows
  Server 2003?????????????????????????????????
  HYEY_LOCAL_MACHINE?HKEY_CURRENT_USER???

63
????????

• .adm?????Unicode????(Windows Server
  2003??Unicode.adm??)????????????????????,?????????
  ??????????????????????,?????????????,?????????????
  ?
• ?????,3?.adm??System.adm?Inetres.adm?Conf.adm,?
  ???????Windows Server 2003???????450????,?3???????
  ????????Inetres.adm?????Internet
  Explorer???,System.adm????????,Conf.adm??????Micro
  soft NetMeeting??,?????????????