Active Directory Domain Services (AD DS)

AD DS là gì?

Active Directory Domain Services là dịch vụ thư mục của Microsoft, lưu trữ thông tin về users, computers, và resources trong domain.

Các khái niệm cơ bản

Domain

Ví dụ: company.local
- Tên miền nội bộ
- Quản lý tập trung users, computers
- Authentication và Authorization

Forest

Forest = Tập hợp các Domain trees
Root domain: company.local
Child domain: hcm.company.local

Tree

Domain tree: company.local, hcm.company.local, hn.company.local

Organizational Unit (OU)

company.local
├── Users
│   ├── IT
│   ├── HR
│   └── Sales
├── Computers
│   ├── Desktops
│   └── Laptops
├── Servers
└── Groups

Cài đặt AD DS

Bước 1: Cài role

Install-WindowsFeature -Name AD-Domain-Services `
    -IncludeManagementTools

Bước 2: Tạo forest mới

Import-Module ADDSDeployment

Install-ADDSForest `
    -DomainName "company.local" `
    -DomainNetbiosName "COMPANY" `
    -ForestMode "WinThreshold" `
    -DomainMode "WinThreshold" `
    -InstallDns `
    -SafeModeAdministratorPassword (ConvertTo-SecureString "P@ssw0rd123" -AsPlainText -Force) `
    -Force

# Máy sẽ tự động restart

Bước 3: Join domain

# Trên client/server khác
Add-Computer -DomainName "company.local" `
    -Credential (Get-Credential "COMPANY\Administrator") `
    -Restart

Quản lý Users và Groups

Tạo User

# Tạo OU
New-ADOrganizationalUnit -Name "IT" -Path "DC=company,DC=local"

# Tạo User
New-ADUser `
    -Name "Nguyen Van A" `
    -GivenName "A" `
    -Surname "Nguyen Van" `
    -SamAccountName "nguyenvana" `
    -UserPrincipalName "nguyenvana@company.local" `
    -EmailAddress "a.nguyen@company.local" `
    -Path "OU=IT,DC=company,DC=local" `
    -AccountPassword (ConvertTo-SecureString "P@ssw0rd" -AsPlainText -Force) `
    -Enabled $true `
    -ChangePasswordAtLogon $true

Tạo Group

# Global group
New-ADGroup `
    -Name "IT_Admins" `
    -GroupScope Global `
    -GroupCategory Security `
    -Path "OU=IT,DC=company,DC=local"

# Thêm member vào group
Add-ADGroupMember -Identity "IT_Admins" -Members "nguyenvana"

Tạo User hàng loạt từ CSV

Name,SamAccountName,Department,Title
John Doe,jdoe,IT,Developer
Jane Smith,jsmith,HR,Manager
Bob Wilson,bwilson,Sales,Executive

Import-Csv "users.csv" | ForEach-Object {
    $password = ConvertTo-SecureString "P@ssw0rd123" -AsPlainText -Force
    New-ADUser `
        -Name $_.Name `
        -SamAccountName $_.SamAccountName `
        -UserPrincipalName "$($_.SamAccountName)@company.local" `
        -Department $_.Department `
        -Title $_.Title `
        -Path "OU=Users,DC=company,DC=local" `
        -AccountPassword $password `
        -Enabled $true
}

Group Policy Objects (GPO)

Các GPO phổ biến

1. Password Policy

Computer Configuration → Policies → Windows Settings 
→ Security Settings → Account Policies → Password Policy

Settings:
- Minimum password length: 12
- Password complexity: Enabled
- Maximum password age: 90 days
- Enforce password history: 24

2. Desktop Restrictions

User Configuration → Policies → Administrative Templates 
→ Desktop

- Prohibit changes to desktop
- Remove Recycle Bin from desktop
- Hide desktop icons

3. Control Panel Restrictions

User Configuration → Policies → Administrative Templates 
→ Control Panel

- Prohibit access to Control Panel and PC settings

4. Mapped Drives

User Configuration → Preferences → Windows Settings 
→ Drive Maps

Actions: Create
Location: \\SERVER\Share
Drive Letter: S:

5. Software Installation

Computer Configuration → Policies → Software Settings 
→ Software Installation

Assign MSI packages

Tạo và Link GPO

# Tạo GPO
New-GPO -Name "Desktop Restrictions" `
    -Comment "Restrict desktop changes"

# Link GPO tới OU
New-GPLink -Name "Desktop Restrictions" `
    -Target "OU=IT,DC=company,DC=local"

# Configure GPO settings (via GUI hoặc PowerShell)
# Force update
Invoke-GPUpdate -Computer "PC01" -Force -RandomDelayInMinutes 0

Backup và Restore GPO

# Backup all GPOs
Backup-GPO -All -Path "C:\GPOBackup" -Comment "Weekly backup"

# Backup single
Backup-GPO -Name "Desktop Restrictions" `
    -Path "C:\GPOBackup"

# Restore
Restore-GPO -Name "Desktop Restrictions" `
    -Path "C:\GPOBackup"

# Import
Import-GPO -BackupGpoName "Desktop Restrictions" `
    -Path "C:\GPOBackup" `
    -TargetName "Desktop Restrictions New"

FSMO Roles

5 FSMO roles

Forest-wide:
1. Schema Master
2. Domain Naming Master

Domain-wide:
3. PDC Emulator
4. RID Master
5. Infrastructure Master

Xem FSMO roles

# Xem Schema Master
Get-ADForest | Select-Object SchemaMaster

# Xem Domain Naming Master
Get-ADForest | Select-Object DomainNamingMaster

# Xem RID Master
Get-ADDomain | Select-Object RIDMaster

# Xem PDC Emulator
Get-ADDomain | Select-Object PDCEmulator

# Xem Infrastructure Master
Get-ADDomain | Select-Object InfrastructureMaster

# Hoặc dùng netdom
netdom query fsmo

Replication

Kiểm tra replication

# Xem replication status
repadmin /replsummary

# Xem chi tiết
repadmin /showrepl

# Force replication
repadmin /syncall /APeD

# Kích hoạt replication
repadmin /kcc

AD Sites and Services

Tạo Site

Sites:
- Default-First-Site-Name
- HCM-Site
- HN-Site

Subnets:
- 192.168.1.0/24 → HCM-Site
- 192.168.2.0/24 → HN-Site

Cấu hình Site Link

Khi có multiple sites, cần cấu hình:
- Site Link (cho replication)
- Site Link Bridge (nếu cần)
- Inter-Site Transport

Trust Relationships

Các loại trust

- Parent-Child: Tự động
- Tree-Root: Tự động
- External: Manual
- Forest: Manual
- Realm: Manual

Direction:
- One-way: A → B
- Two-way: A ↔ B

Transitivity:
- Transitive: A → B → C
- Non-transitive

Tạo External Trust

New-ADTrust -Name "partner.local" `
    -Direction "Bidirectional" `
    -TrustType "External" `
    -Target "partner.local" `
    -Credential (Get-Credential)

DNS trong AD

Các DNS Record quan trọng

A record: Tên host → IP
CNAME: Alias
MX: Mail Exchange
NS: Name Server
SOA: Start of Authority
SRV: Service records (AD cần)

Ví dụ SRV records:
_ldap._tcp.company.local
_kerberos._tcp.company.local
_gc._tcp.company.local

Cấu hình DNS Forwarder

# Set forwarder
Set-DnsServerForwarder -IPAddress "8.8.8.8", "1.1.1.1"

AD Recycle Bin

Enable

Enable-ADOptionalFeature -Identity 'Recycle Bin Feature' `
    -Scope ForestOrConfigurationSet `
    -Target "company.local"

Restore deleted object

# Find deleted objects
Get-ADObject -Filter {Deleted -eq $true} `
    -IncludeDeletedObjects -Properties *

# Restore
Restore-ADObject -Identity "CN=John Doe,CN=Users,DC=company,DC=local"

Best Practices

Security

1. Tiered Administration Model
2. Protected Users group
3. LAPS (Local Admin Password Solution)
4. Fine-Grained Password Policies
5. Audit AD changes
6. Regular backup System State
7. Monitor privileged accounts

Design

1. Ít domain nhất có thể
2. OU structure theo business
3. Group-based access (không gán trực tiếp user)
4. GPO theo chức năng
5. Sites cho chi nhánh
6. Đặt tên nhất quán

Bài tập thực hành

Hãy triển khai AD DS cho doanh nghiệp!