IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
for the domain. Particularly when a large number of users are involved, this
feature can be used to distribute the load generated by the user logins among
several servers.
If possible, every domain should have at least one backup domain controller,
to ensure that management of the domain continues even after a failure of the
primary domain controller. In such cases, it is possible to upgrade the backup
domain controller to a primary domain controller. If no backup domain
controller has been configured, it is not possible to install a new primary
domain controller in a domain.
If the domain servers are distributed among several estates linked together via
a WAN, at least one backup domain controller should be installed in each
estate.
c) Member server
Member servers are not configured as primary or backup domain controllers.
These servers do not have copies of the user-account database of the domain.
Consequently, they cannot process user logins for the domain.
The addition of a member server to a domain proves beneficial in the
following situations:
- If a server needs to perform time-critical tasks, or large applications
need to be executed on this computer, so that user logins constitute an
unacceptable load.
- If a server is to be added to another domain in the near future. Such an
addition proves easier in this case, compared with a server which has
been configured as a backup domain controller.
One essential aspect of the domain concept is that all user accounts for each
domain only need to be defined once. Management is performed in the central
user database on the primary domain controller. This means that users only
need to authenticate themselves to this database when logging in. After that,
they can access all objects and resources which have been shared for them,
regardless of which server these objects and resources are located on. If a user
needs to work on a computer running under Windows NT Workstation,
authenticating against the central user database is sufficient for gaining access
to this computer.
Organisation of domains
Although several domains can be configured in a network, each of these
domains must have a unique name. Every domain manages its own central
SAM database. For this reason, user and group accounts are only valid in the
domain in which they were defined.
Within a network however, a requirement might arise for users of one domain
to access resources in another domain. This requirement can be fulfilled by the
trust relationships between domains.
In this respect, a distinction is made between two types of domain: the trusted
domain and the trusting domain. User accounts and global groups of the
trusted domain can be assigned rights and authorisations in the trusting
domain, thus allowing access to the resources shared in the latter.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000