Feeling the cosmic pull of Active Directory

Organisations are starting to feel the gravitational pull of Active Directory as it begins to gain strength in the market after...

Organisations are starting to feel the gravitational pull Active Directory as it begins to gain strength in the market after two years in limbo. But, like entering a black hole, there can be no turning back once you go in. Danny Bradbury looks at its strengths, weaknesses and quirks.

Active Directory, the Windows directory service, has arguably been Microsoft's most criticised product in recent years. Customer adoption of the technology, which was in February 2000 as part the Windows 2000 operating system, has been shaky. And one the biggest reasons has been the planning requirements that it placed on organisations that chose to implement it.

The Active Directory needs very careful planning, because once you have created your directory structure using the Domain Name Service (DNS) mechanism, it is non-reversible. And once you have rolled out your directory you could get into trouble if, for example, you found that another business unit had been using a different naming scheme and that the two were not compatible.

The upshot is that while many companies have implemented Windows 2000, few have chosen to switch on Active Directory. Richard Berends, chief technical officer at Microsoft reseller Lankind, says that only now are a significant number of companies beginning to use the technology.

For its own part, Microsoft will be eager to persuade customers of the potential business benefits of moving to a directory service. Five benefits often discussed are:

  • Creating, modifying, and removing end-users and system resources in one place and managing their access rights to multiple systems can save IT departments much time and energy, not to mention cost
  • Helping end-users find the information and resources relevant to them. Being able to search for a printer with particular properties that is located nearby can increase a user's productivity, for example
  • The directory can theoretically become an authoritative record of information about any particular user or resource
  • Integrating with other applications, such as Exchange, enables those applications to use the information in the directory
  • Employee life-cycle management. When an employee joins an organisation, the directory is used as a central point of administration and reference to create accounts for that individual in all necessary areas of the business. As the employee moves through the organisation, gaining access rights to different systems, all changes can be administered from a single point. When the employee leaves the organisation, all accounts can be shut down from the directory, leaving no security loopholes, such as unused accounts and old passwords.

All this sounds attractive, but as with many discussions of business benefit, there is a deep chasm between what Microsoft is proposing and what customers are experiencing. Adrian Polley, technical directory of IT consultancy Plan-Net, explains that applications have not been integrated with Active Directory because too many suppliers are pulling in different directions. "Microsoft provides the building blocks, but it's the other people providing end-user systems that need to adopt it as a central point of control," he explains. "There needs to be a much greater impetus for change."

So, customers using a variety of applications would need to transition user information from the native data store into Active Directory, or at least to use an interface between the two products to propagate information. Unfortunately, supplier support for Active Directory seems scant, undoubtedly because of the low customer take-up. And attempting to write custom interfaces between legacy applications and Active Directory is likely to fall fairly low on any user's list.

Another significant problem for implementers has been the quality of Microsoft's management tools. IT departments implementing Active Directory manage it through the Microsoft management console - the central resource in Windows 2000 into which "snap-ins" are added for the management of particular resources.

"The stuff that Microsoft provides is like a lot of systems management stuff - it's OK as a pass, but if you want more, you need to look at third-party software," says Polley.

Microsoft provides the basic operations framework for tasks such as creating users and other resources to be stored in the directory, for example, but implementers cannot assume that things will always run smoothly. "If you get errors, you have to find them and go fix them, and we're at a point where there is very little scope for repairing those things," warns Polley.

Berends explains that, for example, he would like to see a better facility for the direct editing of objects within Active Directory.

Ewan Dalton, an architectural systems engineer at Microsoft, doesn't encourage that, arguing that the administrators could do serious damage by manipulating the raw data within Active Directory. It is possible to make changes at the Lightweight Direct Access Protocol (LDap) level using Active Directory Service Interfaces (ADSIEdit), Microsoft's low-level directory editing tool, but it is not exactly intuitive. "There are certainly plenty of third-party tools that would make management of the Active Directory easier or more powerful from a scripting point of view," says Dalton.

Ratmir Timashev, president and chief executive of just such a third-party tools supplier, particularly criticises Microsoft's migration tools - or the lack of them. He manages Aelita, a company that produces a range of migration suites and wizards for Microsoft Exchange and Windows 2000. He particularly criticises Microsoft's lack of migration tools, not only for moving from pre-Active Directory products, but also from Active Directory to Active Directory. "You rarely do Active Directory perfectly the time," says Timashev.

His other bugbear is the lack application integration facilities within the product. There is no rules engine that can be configured to create work flow-level integration with external applications, for example, leaving manual updates in the hands technical staff. "If I hire someone, they come to the HR department, and I do their paperwork. That gets sent to an administrator, but the directory administrators are overwhelmed. It could take a month for that information to be entered," Timashev says.

At present, customers wanting to integrate Active Directory with other directory systems and with applications must do so at a lower level by manipulating LDap and ADSI, or use the Microsoft Metadirectory System. This product is currently being updated, and a new version will be released at the same time as .net Server 2003, which is being made available to enterprise server and datacentre server customers.

Just as with management and maintenance tools, the alternative for users who do not want to use Microsoft's facilities is to speak to one of the many third-party tools suppliers that have built their businesses on the lack of such facilities in Active Directory. A list of them can be found at www. microsoft.com/windows2000/partners/categories/deployed.asp, and include Quest Software (formerly FastLane), and NetPro.

Third-party tools also become particularly important when discussing data recovery in an Active Directory environment. Microsoft boffins explain that an Active Directory could corrupt for two reasons. , the right information could be entered in an invalid format, caused by a disc controller failure, for example. Second, the wrong information could be entered in a valid format, perhaps due to user error or a badly configured application. In the scenario, the data will not propagate, say Microsoft experts. In the second one, it will. In that case, you can either reapply the original value using low-level editing tools such as ADSIEdit - something which Dalton previously discouraged - or you can restore a previous back-up of the directory, propagating the restored values to the rest of the directory infrastructure.

That is all very well, says Timashev, but it makes the granular recovery of a particular object or user account far more difficult. "Secondly, you have to take the particular domain control offline, and it takes at least three or four hours to go through the recovery process," he argues, adding that such recoveries also create extensive replication traffic which slows down the network. Such a situation is far from ideal, and strengthens the case for third-party tools, which any potential Active Directory implementers should factor into their planning.

The world is set to change with the release of .net Server, Microsoft's next major server operating system release, which is due before the end of this year. This will include a version of Active Directory with a range of new features. One of the most important features will be the ability to rename domains, making it easier for companies to reverse their initial decisions on domain structure, although this will still require the domain controller to be rebooted. Other new features include the ability to deactivate attributes and class definitions in the Active Directory schema, so that mistakes made in the initial definition of the schema can be rectified. Replica can also be installed from media, meaning that if a large database has to be replicated, administrators can send a tape to the location, drastically reducing network traffic. And dependability features will enable systems administrators to verify replications between domain controllers.

Active Directory still has a long way to go before it can be said to be a successful product in terms of customer adoption. Nevertheless, Microsoft's commoditisation of the product by bundling it with the operating system, in conjunction with the management enhancements in the next version, will go some way towards opening up the market for its directory service. It has a long way to go before it reaches the level of market maturity that some of its rivals have, but it is coming along in leaps and bounds - as Microsoft always seems to do.

Guest editor's comment
Microsoft .net code release is due in December; with it comes greater flexibility within Active Directory.

This undoubtedly will make deployment in large enterprises much more of a reality than it was with Windows 2000. The question in my mind is what will this really mean? Active Directory will potentially become the cornerstone in many businesses. Eventually it will be integrated with many other systems, specifically human resource applications, and will provide the employee gateway to the whole enterprise network.

Does this make it business-critical? And if so, is Microsoft - and our own IT organisations - geared up to support the environment should it fail or corrupt?

Businesses considering implementation should review their directory services and enterprise architecture strategies carefully and holistically. They should then plan deployment and integration in minute detail to avoid inadvertently being sucked into a massive black hole.

A step-by-step guide to an AD roll-out

  • Planning an Active Directory structure is a complex task, but Microsoft advises the following basic steps in creating a domain structure:
  • Create a forest plan
  • Determine the number of forests
  • Create a change control policy for each forest
  • Create a domain plan for each forest
  • Determine the number of domains
  • Choose a forest root domain
  • Assign a DNS name to each domain
  • Plan DNS server deployment
  • Optimise authentication with shortcut trusts
  • Create an organisational unit (OU) plan for each domain
  • Create OUs to delegate administration
  • Create OUs to hide objects
  • Create OUs for group policy
  • Create a site topology plan for each forest
  • Define sites and site links
  • Place servers into sites.

Alternatives to rolling out Active Directory
Active Directory gets a lot of press, mostly because it is distributed free with the operating system. But there are other alternatives.

The two most common ones are iPlanet's directory, and Novell's, which is the industry veteran. Deployments of Active Directory are much lower than those of the other directory products according to industry commentators. Calendra, a directory content management system supplier, for example, says that 70% of the directory deployments it has seen have focused on the iPlanet Directory Server (now the Sun One Directory server).

Technical explanations and glossary
- Active Directory Service Interfaces. A set of interfaces that enable developers to query and manipulate directory service objects

Domain - a unit defined by its security boundary

Domain Controller - a Windows server responsible for controlling a local domain

Forests - domains in Active Directory can be structured into hierarchies called trees. A forest is a collection of domain trees

LDap - the Lightweight Directory Access Protocol. A lightweight replacement for the old X.500 mechanism that enables applications to access a directory service.

Case study: House of Fraser learns as it progresses
James Park, network systems manager for the House of Fraser, is in the middle of his Active Directory project. With 2,000 client machines distributed across 60 sites, a large IT centre and an equally large head office, he has his work cut out.

He chose to go with Windows 2000 and Active Directory after throwing in his lot with Microsoft and signing an enterprise agreement as part of the supplier's much-maligned Software Assurance-based licensing scheme. House of Fraser is currently finishing the design of the Active Directory network, which has proven to be a substantial task. "It was completely new to us and a bit scary," says Park, who worked with IT consultancy Plan-Net on this system. "We aren't replicating what was in the NT environment, because that got messy over the years. Now we have the chance to wipe the slate clean."

The company developed a team of people working under two managers, one of whom was in charge of the IT centre and the retail network, and the other who was responsible for the head office. The implementation team has planned the domain structure based on roles within the company, including buyers and store managers. It was able to use an existing organisational chart to work out the roles as it went along. Starting with the IT centre and head office and subsequently moving down through the retail network, the team is planning the design on an incremental basis, so that it is able to learn from its mistakes as it progresses.

Park explains that the team was not keen on Microsoft's native management tools, choosing instead third-party software company Quest for its Activeroles Active Directory management tools. This provides it with better visibility of permissions and properties for particular objects than the Microsoft MMC snap-in, says Park.

Having planned its Active Directory domain structure, the team now plans to gradually switch over its existing NT 4 domain controller architecture to the new domain controllers. On a site-by-site basis, it will run the NT 4 domain controllers in tandem with the new ones, gradually copying over the less-used files from one machine to the other. At the critical transition point, the team will copy over the final 10% of files that are more frequently used on the old machine, during a short period of planned downtime.

Park offers the following tips to organisations planning the transition to Active Directory:

  • Plan your directory structure from the top down and design it incrementally, tackling different parts of the organisation in succession so that you can learn from your mistakes as you go
  • Don't necessarily replicate your previous organisational structure. If appropriate, use the implementation of Active Directory to re-engineer previous systems' infrastructures that may have become unwieldy.

Case study: Basingstoke Council finds help with internal reorganisation
It doesn't normally take Terry Finch, IT manager at Basingstoke Council, three months to plan an IT project. Active Directory was different, however, because of the potential effect on his user base should the project go wrong. "It would affect every single user," explains Finch. "The complete business would have ground to a halt." Consequently, although he started planning in March this year, he did not begin migration until May.

His Active Directory project, led primarily by the need to move to Exchange 2000 and to deploy Microsoft's Sharepoint Portal server, is particularly complex because of the company's existing use of the Novell directory server. "It's very hit and miss, and it took a lot of research," says Finch. "Novell publishes instructions on how to do it, but it's very patch-oriented - you have to have specific versions of things."

The company did a trial migration from NT 4 to Active Directory and from NDS 8.5 to 8.6. Doing them individually was easy, but Finch says doing them together in an integrated environment is a nightmare. The biggest problem is that putting future patches onto a domain controller is like walking on eggshells, because patches have to be tested to ensure that they don't affect the existing Active Directory and NDS integration. That wouldn't be so bad if Microsoft didn't have such a propensity for issuing security patches. "It has made the administrative overhead very high," Finch complains.

Implementing Active Directory helped the council from an organisational perspective because it is currently reorganising internally. By moving to Active Directory and Exchange 2000, the council managed to flatten its company structure, enabling it to move users wherever they were needed in the directory structure. Finch likes the native Active Directory management tools provided by Microsoft, although he prefers command line administration. When training people in line support that haven't been brought up with Dos, they don't handle non-graphical user interface (GUI) activity very well, he says. Consequently, Microsoft's GUI-oriented approach was a boon for him.

Finch's advice to organisations migrating to Active Directory is:

  • Test your patches before rolling them out
  • Use fault-tolerant domain controller configurations where possible
  • Create a project board with business managers included, so that senior managers are aware of what you are doing.

When good directories go bad

What to do when Active Directory corrupts
In the event of corruption, you can recover Active Directory in two ways. Either re-install Windows 2000 and repopulate your directory through normal replication, or restore Active Directory from a back-up.

Recovery by re-installation and replication

  • Use the sites and services snap-in on an existing domain controller to remove references to the damaged controller
  • Re-install Windows 2000 Server on the damaged system
  • Install Active Directory, which will make the installed server a domain controller in the process
  • Wait for that implementation of Active Directory to be brought up to date via replication from a healthy controller.

Recovery by restoration from back-up
This requires that you restore in non-authoritative mode - meaning that the restored back-up will subsequently be updated through replication via another domain controller

  • Take Active Directory offline by putting the server into Directory Services Restore Mode
  • Restore your system using either the Restore Wizard, or manually via the graphical user interface
  • Perform advanced verification of the system using the appropriate utility (Ntdsutil) before restarting the domain controller in normal mode
  • If appropriate, perform an authoritative restore after the above steps have been completed. This lets you set an object or subtree to take precedence over those in other domain controllers. It is generally used where data corruption has occurred across the Active Directory infrastructure and a restored back-up needs to be propagated across the network.

Read more on IT risk management