List Archives

This forum is an archive of all posts to our mailing list over the past few years. The forum is set read only therefore to contribute you will need to join our list community. See more info about this here.

When subscribed to the list you should use your standard email client to send your posts to ActiveDir@mail.activedir.org.

List Archives

Unanswered Active Topics

Forums Search

Forums >ActiveDir Mail List Archive >List Archives

Subject: RE: [ActiveDir] Exchange and Active Directory authentication confusion

Prev Next

You are not authorized to post a reply.

Author

Messages

ddriggs

Posts:9

07/03/2009 1:20 AM
I had a hard time describing what the consultant did. The domain design looks like this: \|Administrative Root domain \|High school domain \|Middle school domain \|Elementary school domain As opposed to a Parent Administraive Root domain with the other domains being branches of the root domain in a "tree". By forest domain design I mean just how the domains are arranged visually in the forest. The consultant's design does not have child or branch domains at least not visually. From: activedir-owner@mail.activedir.org [mailto:activedir-owner@mail.activedir.org] On Behalf Of Crawford, Scott Sent: Thursday, July 02, 2009 2:17 PM To: activedir@mail.activedir.org Subject: RE: [ActiveDir] Exchange and Active Directory authentication confusion That was my first thought too, but the fact that he says "forest domain design" seems to imply that he sees a distinction. Of course, we could just wait til the OP relies. From: activedir-owner@mail.activedir.org [mailto:activedir-owner@mail.activedir.org] On Behalf Of Rick Sheikh Sent: Thursday, July 02, 2009 3:57 PM To: activedir@mail.activedir.org Subject: Re: [ActiveDir] Exchange and Active Directory authentication confusion Didn't Dave mean separate forests by "All of the domains are flat rather than parent child hierarchical. The explanation for this was better security." ? On Thu, Jul 2, 2009 at 3:48 PM, Paul Bergson (ALLETE) <pbergson@allete.com> wrote: Agree with Brian. Security boundary is the forest not the domain. Thanks Paul From: activedir-owner@mail.activedir.org [mailto:activedir-owner@mail.activedir.org] On Behalf Of Brian Desmond Sent: Thursday, July 02, 2009 3:17 PM To: activedir@mail.activedir.org Subject: RE: [ActiveDir] Exchange and Active Directory authentication confusion Said explanation is 100% wrong. Thanks, Brian Desmond brian@briandesmond.com c - 312.731.3132 Active Directory, 4th Ed - <http://www.briandesmond.com/ad4/> http://www.briandesmond.com/ad4/ Microsoft MVP - <https://mvp.support.microsoft.com/profile/Brian> https://mvp.support.microsoft.com/profile/Brian From: activedir-owner@mail.activedir.org [mailto:activedir-owner@mail.activedir.org] On Behalf Of Dave Sent: Thursday, July 02, 2009 3:13 PM To: activedir@mail.activedir.org Subject: RE: [ActiveDir] Exchange and Active Directory authentication confusion This forest domain design was done before my time by a consultant. It is a very odd design. All of the domains are flat rather than parent child hierarchical. The explanation for this was better security. If anyone compromised one domain it would be more difficult to get access to the other domains. I am somewhat skeptical of this explanation. This is a K-12 environment so there is the possibility of malicious end users. The next iteration to 2008 server I hope to migrate to the one forest one domain design that seems to be the consensus for better and easier maintenance? From: activedir-owner@mail.activedir.org [mailto:activedir-owner@mail.activedir.org] On Behalf Of joe Sent: Thursday, July 02, 2009 5:26 AM To: activedir@mail.activedir.org Subject: RE: [ActiveDir] Exchange and Active Directory authentication confusion Have a domain controller for every domain you want authentication to be available for in the locations you want it available. Alternately, get collapse the six domains down to one, you likely don't really need six domains. -- O'Reilly Active Directory Fourth Edition - http://www.joeware.net/win/ad4e.htm _____ From: activedir-owner@mail.activedir.org [mailto:activedir-owner@mail.activedir.org] On Behalf Of Dave Sent: Wednesday, July 01, 2009 6:31 PM To: activedir@mail.activedir.org Subject: RE: [ActiveDir] Exchange and Active Directory authentication confusion Thank you for clearing this up for me. Another hole in my knowledge has been patched! Are there any workarounds for this limitation? From: activedir-owner@mail.activedir.org [mailto:activedir-owner@mail.activedir.org] On Behalf Of joe Sent: Wednesday, July 01, 2009 3:03 PM To: activedir@mail.activedir.org Subject: RE: [ActiveDir] Exchange and Active Directory authentication confusion The security information to authenticate/authorize a user is not replicated forest wide. A user can only be authenticated by a domain controller for the domain they are a member of. So say you have one DC for DomainXYZ and it went down, even though you have 100 DCs for DomainPDQ not a single DomainXYZ user could logon. -- O'Reilly Active Directory Fourth Edition - http://www.joeware.net/win/ad4e.htm _____ From: activedir-owner@mail.activedir.org [mailto:activedir-owner@mail.activedir.org] On Behalf Of Dave Sent: Wednesday, July 01, 2009 5:51 PM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] Exchange and Active Directory authentication confusion I am having some confusion about Exchange authentication and Active Directory. We have a single forest with six domains that is Windows server 2003 R2SP2. The Exchange Server (2003) is in the root domain on a server that is not a domain controller. Two of the domains in our forest are remote sites connected via a T1 WAN link. Recently the T1 link to one of our sites went down. As a result no one at the remote site could log into the Exchange server. This is understandable when the employees are on the site with the dead T1 connection. What confuses me is that none of the employees at this site could login to e-mail remotely via Outlook Web Access. Now if user accounts are replicated forest-wide? Then why could the users at the disconnected remote site not log into OWA via another domain controller (which authenticates users for the unreacheable remote server) not disconnected due to a out of service T1 WAN link?

You are not authorized to post a reply.

Forums >ActiveDir Mail List Archive >List Archives > RE: [ActiveDir] Exchange and Active Directory authentication confusion

ActiveForums 3.7

Syndicate

Friends

List Archives

List Archives

Friends

Members

Articles

Related Links

Ads