IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
The following domain models can be implemented:
a) Single-domain model
This is the simplest domain model, as it only involves the existence of one
domain in a network. Consequently, it is not necessary to manage trust
relationships. In this case, only one SAM database exists for management
purposes in the entire network. One variant of this model consists of a
configuration of several individual domains in a network, between which no
trust relationships are defined. In this case, each domain manages its own
SAM database as well as user and group accounts. The single-domain model
is particularly suitable for networks with a low number of users (approx. 200
to 300) and computer nodes. A disadvantage of this model is the decrease in
performance which occurs as the number of users and user groups rises.
Furthermore, it is not possible to group resources into organisational units, for
example, in order to reserve a server for a particular department.
b) Master-domain model
The main characteristic of this model is that it divides a network into several
domains, one of which centrally manages all user accounts and group
accounts. This domain is termed master domain. The other domains hold the
resources. These resource domains trust the domain holding the user accounts.
Trust Trust
Trust
The master-domain model is illustrated in the following diagram:
According to Microsoft, this domain model can handle up to 15,000 users. It is
particularly suitable for organisations which consist of several departments,
each needing to manage its own resources, and in which user administration is
performed centrally. This domain model allows a separate person to be
appointed for the administration of each of the resource domains, and also
permits central security management.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000
Master-
Domäne
Ressourcen-Domänen