Good day, Cloud Gurus, and welcome back.
Congratulations on making it to the end of this section.
What a journey it's been!
Let's take a look at some of the most important points
to remember from this section.
First, let's revise some
of the key Active Directory concepts
that you need to be familiar with.
The first is the Active Directory forest,
and a forest is a collection of one or more domain trees
that trust each other and share a schema.
Another important Active Directory component is the domain,
and a domain is a replication boundary
and an administrative unit within a forest.
And then we have domain controllers,
and domain controllers provide authentication
and authorization within a domain.
They update, store,
and replicate the Active Directory database.
And it's also important to remember
that you can use Read-Only Domain Controllers
to improve the security of domain controllers located
at your branch office,
by controlling which passwords are replicated
to that Read-Only Domain Controller.
It's also important to understand the concept
of Active Directory sites.
And Active Directory sites are used to control replication
and help Active Directory client computers
and users locate services close to them.
They are defined by the subnets
and domain controllers located at that site.
And sites are connected by site links,
and Active Directory sites will typically
mirror your network topology.
And finally, it's important to remember the purpose
of the Global Catalog.
The Global Catalog is a reference
to every object in the forest.
It's used to locate objects within the forest.
Now, ideally, every domain controller
in the forest should be a Global Catalog
but if that can't be the case,
then at least one Global Catalog should exist
per Active Directory site.
And as we mentioned in this section,
there are a number of roles
that can't exist on more than one domain controller
in the forest or the domain,
and these are referred to as operations masters.
Let's revise the operations master roles.
First we have the forest level operations masters,
and these exist once per Active Directory forest.
The first is the schema master,
and it's used to introduce schema changes
to the Active Directory forest.
And we also have the domain naming master,
and it's required when you add or remove domains
from the Active Directory forest.
And it's also required when you add
or remove application partitions.
And then we also have the domain-level operations masters,
and these exist once per domain.
The first is the RID master,
or the relative identifier master.
And the RID master allocates relative identifier pools
to new and existing domain controllers.
And we also have the infrastructure master,
and it updates the cross-domain references
from the Global Catalog.
And then finally,
we have perhaps the most important operation master
of them all, the PDC emulator,
and it receives updates when passwords are changed
for users and computers,
and the PDC emulator should be online
as much as possible, preferably 24/7.
All right, now let's take a look
at some of the key points
to remember regarding trust relationships.
And you'll remember that a trust is used to provide access
between Active Directory forests and domains.
The first most common
and most recommended trust type to be aware of
is the forest trust,
and it's used to provide access between 2 forests.
And forest trusts can be either one or two-way,
and forest trusts are always transitive.
And then we have external trusts,
and they're used to provide access between 2 domains
in separate forests where no forest trust exists.
They can be either one or two-way,
and external trusts are always non-transitive.
And then we have the realm trust type,
and it's used to provide access
between a Windows-based domain
and a non-Windows Kerberos realm.
And it can be either one-way or two-way,
and it can be either transitive or non-transitive.
And then finally, we have the shortcut trust.
And it's used to reduce authentication time
between domains in the same Active Directory forest.
It can be one or two-way,
and because trust relationships already exist
between all the domains in a forest,
shortcut trusts are always transitive.
And one final thing before we wrap up this section.
I want 2 things for you
after you've worked your way through this course.
Firstly, I want you to be a great Azure Hybrid Administrator
because the world needs more of them, a lot more.
But I also want you
to prove you're a great Azure Hybrid Admin,
and to do that, you need to pass the exam.
And Active Directory Domain Services is a massive portion
of the AZ-800 exam.
So let's review some of the key tips
that I gave you during the section,
and I'll give you a few more
that'll help you prepare for the exam.
And these are going to come at you fairly quick fire.
So have your notes ready.
You have notes, right?
And pause the video if you need to.
The first tip is that you must be a member
of the Enterprise Admins group to add a new domain
to an existing forest.
And you must be a member of the Domain Admins group
to deploy a new domain controller
in an existing domain.
It's also important to remember that
if you are staging a Read-Only Domain Controller's account,
you should not domain join the Read-Only Domain Controller
prior to attaching it to its account.
It's also important to remember
that trust relationship transitivity does not apply
to multiple forests,
only domains within the forests
that directly trust each other.
And there are 2 types of authentication
with forest trusts:
forest wide and selective.
Just remember that selective authentication users
still require access to be granted
on the resources they intend to access in the target forest.
It's also important to remember
that the RID master role is responsible
for delegating relative IDs,
which form part
of an Active Directory object's security identifier,
more commonly referred to as the SID.
And the infrastructure master role
shares a similar responsibility to the Global Catalog.
And these roles should not exist
on the same domain controller,
unless all domain controllers also host a copy
of the Global Catalog.
And it's also important to know
that you can create a custom application partition
in the Active Directory database for DNS
with either the ntdsutil or the dnscmd command-line tools.
And you can also use the ntdsutil command-line utility
to create install from media using the ntdsutil ifm command.
And it's also important to remember
that the command-line tool Djoin is used
to perform an offline domain join.
All right.
Hopefully those tips help you prepare for your exam.
And if you need to refresh any of the concepts we've covered
in this section,
please feel free to jump back to those lessons
or to those hands-on labs
to help reinforce any of those concepts.
All right.
That was a pretty decent amount of information
in this section.
Congratulations on making it to the end,
and I look forward to seeing you in the next section.