In summary, what are you walking away from this lesson with?
Well,
I just want to, again, repeat that Microsoft's current guidance
is for you to standardize on one forest, one domain unless you
have specific reasons to do otherwise.
If you find that intra‑domain traffic is just too intense given your
distributed infrastructure, okay, I guess the real lesson is to not
overcomplicate your Active Directory forest environment.
The v1 approach to forest and domain security and site topology used to
be Enhanced Security Admin Environment, or ESAE, where you would have a
management forest and a resource forest,
but that really suffers from the over engineering,
over‑complication problem that I mentioned earlier.
Nowadays, the v2 current guidance for Microsoft is a
privileged access strategy for your workstations,
servers, and users where you're looking at configuring your servers to run
only trusted code and then for your users to run with standard permissions
and only elevate their permissions when they need to and to be operating
on a non‑elevated system and do their administrative work on a privileged
access workstation.
You can check the exercise files. I give you some more references in
the Microsoft docs about this shift in guidance. Regarding
replication, you're not smarter than the KCC.
It's kind of a clever comment, but it's not mine. It's from Microsoft. Here's a
link to a really old TechNet article where a Microsoft engineer makes the
argument that by trying to horse around with your site links by creating them
manually, thinking that you're smarter than the Knowledge Consistency Checker,
you could wind up introducing problems into your environment and wind up with a
less efficient Active Directory replication strategy than if you just let the
KCC do what it does best. Up next, we're going to learn about AD DS security
principals.
This is users, groups, computer accounts, and the like.
I look forward to seeing you then. Thanks very much.