Lightweight Directory Services is a lightweight version of Active Directory Domain Services. This video provides an introduction to Lightweight Directory Services and what it can and cannot do.
Download the PDF handout http://itfreetraining.com/handouts/adlds/adlds-intro.pdf
Active Directory Lightweight Directory Services (AD LDS) was originally a downloadable add-on to Windows Server called Active Directory Application Mode (ADAM). In Windows Server 2008 this became an additional role included in the operating system. AD LDS uses the same code as AD DS and thus provides some of the same functionality. As you will see, it provides a lot of the same functionality but is also flexible enough to offer additional options that are not possible using AD DS.
AD LDS Example
In this example, a user needs to access a web server. This web server has been placed on a perimeter network and separated from the internet and the internal network by a firewall. The web server needs to be able to authenticate users, however for security reasons the company does not want to place a Domain Controller on the perimeter network. Rather than install a Domain Controller on the perimeter network, another option is to install AD LDS on the web server. Since it uses the same code base as a Domain Controller, it is able to authenticate users the same way a Domain Controller would. In order to achieve this, the user's database is replicated from a Domain Controller on the commercial network to the perimeter network. AD LDS also allows you to choose which data you want to replicate, for example, you could choose to replicate the user data but not the group data. AD LDS also supports additional data to be added. This means additional data can be added that the web server can be accessed through AD LDS which means this additional data does not need to be added to AD DS. This solution helps keep Active Directory secure and also help prevents extra data being added to the database.
Differences between AD LDS and AD DS
AD LDS is designed more to run software rather than to run domains so it not a replacement for AD DS. It can run on a computer that is in a workgroup, does not require DNS and also can run on client operating systems like Windows 7 and 8. For this reason, it is a good choice for application support and for testing. For example, a developer can have their own install running on their client operating system and thus be able to make whatever changes they want, something that is not possible using a production domain. AD LDS supports multiple instances as well, so the administrator is free to create as many local copies as they wish. AD LDS does not support domain features like group policy, global catalog support and the ability to manage workstations. For this reason it cannot be used as a replacement for Domain Controllers. Even though these domain features are not available, AD LDS does support sites and replication. This means AD LDS installation can replicate data between each other and also with Domain Controllers, however support of trusts is not supported so this limits an AD LDS instance to working with only the one domain.
Differences between Directory Services and Databases
A directory service and a database fundamentally work differently. For this reason they tend to be used for different types of applications. Directory Services are hierarchical based, allowing security to be applied to an object. If you want to add additional objects you need to change the schema. Changes to the schema cannot be undone after they have been made. Since Directory Services is hierarchical in nature, it can perform fast searches, for example looking up a person in the Directory Service would be quite fast. Directory Services can be modified in multiple locations at the same time. If multiple changes are made at the same time, the last write performed will overwrite any previous writes.
A relational database in comparison offers faster write times than a directory service as the data is stored in rows and column rather than a hierarchy. Data is locked before it is updated so there is no chance that data will be changed in two locations at the same time. A relational database does not have a schema so changes to the layout of the data can be changed at any time. This include the ability to reverse changes later on which is not possible with a Directory Service.
For the rest of the descrption please see http://itfreetraining.com/adlds#intro
See http://YouTube.com/ITFreeTraining or http://itfreetraining.com for our always free training videos. This is only one video from the many free courses available on YouTube.
"MCTS 70-640 Configuring Windows Server 2008 Active Directory Second edition" pg 731 -741
"Active Directory Lightweight Directory Services Overview" http://technet.microsoft.com/en-us/library/hh831593.aspx
Microsoft... DELETE THIS STUPID IDEA! this is obsolete, dont usefull... only used to: object = computer / user / etc and domain = something.local... the rest of attributes are a lost of time !... anyone know how read attributes like Windows workstations do but are a Pentagon Secret ?? . Eg.: login user name, last name in logon screen appear, but if I need to retrive this data need install lots of aditionals components in the workstations. And stop with philosophy and put hand in the work with code, commands and the usefull things.
Excellent explanation. Nice, deep and clear voice makes listening really comfortable. Professional job. It was pleasure to watch this video. Thank you.
I only don't understand why it is safe to use LDS in perimeter network. If I keep there the same users as in AD with their passwords so it looks also very dangerous. (I know, there is no additional info about GPOs, domains etc.) If hacker would get my ntds.dit file he could log on every user's account (also administrator). Probably we don't need to copy all users objects to LDS but still some important accounts are exposed to danger of hacking attempts.
Maybe I'm wrong but passing these authentication requests from WEB server through nest firewall into internal network to e.g. RODOC (allowed to keep passwords for web users group) seems to be more secure.
+Colbert Philippe Think of it as a Domain Controller with less features. It is mainly for authentication. It does not support features like Group Policy. So can ADLS be used to create a domain, not it cannot as it does not have enough features.
Is there a way to search and find all the ADLDS servers in the environment. I'm in a large Enterprise with over 70,000 users and there are several Apps that use AD/LDS. Yet the current IT staff does not know how many servers/Instances of ADLDS are in the environment. I was wondering if you know of a way to query AD or the Network to find such servers with such service? Thanks again for the great videos.
I don't think you would be able to find them by querrying the AD database as the computer storing the AD LDS does not need to be in the domain. I would suggest using some auditing software to find out if the role is installed on the computer.
It is under /adlds. We are working on finishing the coding for the new course layout so there maybe a delay getting the videos on the web site till we finish coding it. Once it is done you will be able to find video very quickly and customize which videos you see depending on which course or operating system you want to watch.
What do you mean by resetting the computer? Do you mean re-installing the operating system using the original DVD's. If they are restore DVD's then the company may have included Microsoft Office with the install. However they may have also installed it afterwards. Have a look what DVD's came with the computer. Microsoft Word is not part of Windows and thus it needs to installed afterwards. How, that depends on what DVD's were shipped to you with the computer.
So, this doesn't relate to the video but I need an answer! When I bought my computer, it can with Microsoft Office. If I do a factory reset of my computer (Backing up files such as Music, Videos, e.t.c manually.), will it start with Microsoft Word automatically or will it be the bare Windows7? This is the reason why I am scared to reset my computer. (Also, where exactly do I reset my computer, also, is my logic behind how this works correct?) I am doing this in hope of my computer running faster
AD LDS is a role in Windows Server 2012/2008. So you add it using server manager. In Windows Server 2003 it was an add on called ADAM which was a free download. It does not cost anything to use assuming you own Windows Servers or a client operating system. In Windows 8 it is a feature that you add to the operating system. I assume Windows 7 is the same, otherwise it is just a free. download from Microsoft.
Cult Film Collective and the Trylon team-up for a can’t miss for film fans Pedro Almodóvar 35mm Double Feature. [TIX] First Ave is insane this week, including the annual Rebel Rebel: Rock for Pussy David Bowie covers benefit for Feline… Continue Reading →
Quick Q+A: George McConnell + SUPERHERO.
As Captain America says in the under-appreciated Age of Ultron, “We have an enhanced in the field.” Not just the field, Cap. Everywhere you look these days Superheroes are flying or speeding or stretching by—in our films, in our art,… Continue Reading →
Whiz Bang Days Celebration.
Bird Town (as we know it) aka Robbinsdale (as you maybe know it) has a proud history of wrasslin’, so we shouldn’t be so surprised to see the high flyin’ brawlers and knuckle sandwich makers and #1 heel Darin Corbin… Continue Reading →
Sat // The Beer & Bacon Classic.
Previous beer fest experiences (and there have been many) indicate the snacklace is reaching an all-time high in sophistication—but you’ll want to leave it at home for this one. Consider it research for your next creation: the Bacon and Beer… Continue Reading →
Bell Museum Grand Opening.
The Bell Museum celebrates nearly 150 years of existence, 50 years of active learning programs, and 24 feet of woolly mammoth at its grand opening this weekend, which welcomes the public to experience its beautifully grandiose new digs in St…. Continue Reading →
Lumières Françaises + Bastile Day.
Did the MSP Film Society know France would be on the cusp of a World Cup win when they planned their week of independent French film? DID THEY? The smarties actually likely scheduled Lumières Françaises to coincide with Sat’s Bastille… Continue Reading →
Weds // TV Girl + Infinity Crush + Cheap Fantasy.
“Here in New York you don’t need excuses to dress like a girl.” The effortless hipster cool of TV Girl’s sound mixes a sunny produced pop, throwback to ’60s French yé-yé, with more relaxed late night beats and samples, making them… Continue Reading →
Thurs // The Summit Ratskeller’s Grand Reopening.