Windows Small Business Server 2011 : An Active Directory Primer (part 2) - Using AD DS Tools - Using Active Directory Users and Computers

The use of terms such as tree and leaf in AD DS terminology should give some idea of the directory service’s hierarchical architecture. AD DS is based on domains, which you can group into trees and forests, but within each domain, you can build a root-like structure using OUs. Just as in a file system, influence in a domain flows downward through the container objects to the individual leaf objects. When you link a GPO to a domain object, the settings in that GPO flow down to all the OUs in the domain and all the leaf objects in the OUs. In the same way, linking a GPO to an OU causes all the leaf objects inside to receive the settings, even objects within subordinate OUs.

You can see one example of how the design of the AD hierarchy is useful to administrators in the default Windows SBS 2011 domain. As mentioned earlier, there is a Computers OU in your domain’s MyBusiness OU, and in the Computers OU, there are two more OUs: SBSComputers and SBSServers. Why use three OU levels, though, when you could simply create the SBSComputers and SBSServers OUs directly beneath the MyBusiness OU?

One reason is that adding the level containing the Computers OU enables you to apply Group Policy settings in three different ways. By linking a GPO to the SBSComputers OU or the SBSServers OU, you can apply settings to all the client computers or all the servers in the domain. However, by linking a GPO to the Computers OU, you can apply settings to all the computer objects in the domain clients and servers at once.

The downward flow of influence in an AD DS domain is not limited to Group Policy settings. AD DS has a system of permissions that define who can access particular objects and what they can do with the objects they access. The AD DS permissions system is completely independent from the other permission systems in Windows Server 2008 R2, such as NTFS and registry permissions, but it works in very much the same way. If you assign permissions to a container object, such as a domain or an OU, every object in that container inherits those permissions, including other container objects.

The Windows SBS Console enables you to perform many of the most common AD DS maintenance tasks, although it generally does not identify them as such. Windows SBS 2011 tries to insulate administrators from the complexities of AD DS, but when you create or manage a user or a group in the Windows SBS Console, you are actually creating an AD DS object and modifying its attributes.

Although you might want to stick to the Windows SBS Console when performing administrative tasks at first, you should also be aware of the AD DS tools included with the Windows Server 2008 R2 operating system. These tools provide more comprehensive access to the AD DS and enable you to work with AD DS objects on any Windows computer.

6.1 Using Active Directory Users and Computers

The Active Directory Users And Computers Console is the most commonly used AD DS management tool. Like most Windows Server 2008 R2 tools, it is a snap-in for the Microsoft Management Console (MMC) utility. Unlike Windows SBS Console, which displays only certain AD DS objects, Active Directory Users And Computers is based on a tree display of your entire domain, as shown in Figure 4.

Figure 6-4. The Active Directory Users And Computers Console.

In the Active Directory Users And Computers Console, the left pane (also called the Scope pane) displays your domain and all the container and OU objects beneath it, using an expandable tree arrangement, just like the file system in Windows Explorer. Selecting a container or OU in the Scope pane displays all the objects it contains in the right pane (also called the Detail pane). Double-clicking a leaf object, such as user, computer, or group, opens the Properties sheet for the object, as shown in Figure 5.

Figure 5. The Properties sheet for a user object in the Active Directory Users And Computers Console.

As you can see in Figure 5, a user object’s Properties sheet in the Active Directory Users And Computers Console contains much more information than its Windows SBS Console equivalent, and enables you to modify many more of the object’s attributes. This is not the full extent of the console’s capabilities, though. To see even more information about your AD DS domain, you can select Advanced features from the View menu to display additional objects, as shown in Figure 6. Few administrators require access to these advanced features on a regular basis, but it is good to know that they are available.

Figure 6. The Active Directory Users And Computers Console, in Advanced Features mode.

The Advanced Features mode also displays additional attributes for each object. The Properties sheet for a user object, for example, has five additional tabs, as shown in Figure 7.

Figure 7. The Properties sheet for a user object in the Advanced Features mode of the Active Directory Users And Computers Console.