MCSA/MCSE Self-Paced Training Kit (Exam 70-270): Installing ...

14-6 Chapter 14 Overview of Active Directory Service
!
Exam Tip You can delegate administrative tasks by assigning permissions to OUs. OUs
provide a way to structure the administrative needs of an organization without using excessive
numbers of domains.
Domains
The core unit of logical structure in Active Directory is the domain. Using domains
allows administrators to divide the network into manageable boundaries. In addition,
administrators from different domains can establish their own security models (including
password complexity and password-length requirements); security from one
domain can then be isolated so that other domains’ security models are not affected.
Primarily, domains provide a way to logically partition a network along the same
administrative lines as an organization. Organizations that are large enough to have
more than one domain usually have divisions that are responsible for maintaining and
securing their own resources. Grouping objects into one or more domains enables
your network to reflect your company’s organization. Domains share the following
characteristics:
■ All network objects exist within a domain, and each domain stores information
only about the objects that it contains. Theoretically, a domain directory can contain
up to 10 million objects, but 1 million objects per domain is a more practical
amount.
■ A domain is a administrative boundary. Access control lists (ACLs) control access
to domain objects. ACLs contain the permissions associated with objects that control
which users can gain access to an object and what type of access users can
gain. In Active Directory, objects include files, folders, shares, printers, and Active
Directory objects. All security policies and settings—such as administrative rights,
security policies, and ACLs—do not cross from one domain to another.
Trees
A tree is a hierarchical arrangement of one or more domains that share a common
schema and a contiguous namespace. In the example shown in Figure 14-3, all the
domains in the tree under the microsoft.com root domain share the namespace
microsoft.com.