[Active Directory] 8 Implémentation des contrôleurs de domaine (RODC et GC)

Vous êtes ici : Accueil > Articles

Publié le : 20/06/2011 vers 16h
Mise à jour le : 11/10/2011 vers 20h
Catégories :
  • Active directory

Auteur(s) :
Loïc THOBOIS (Membre depuis le 04/09/2007)
Société : AVAEDOS
Fonction : Consultant/Formateur
Contactez cet auteur - Affichez les ressources de cet auteur

8.1 Le rôle du serveur de catalogue global

8.1.1 Définition du serveur de catalogue global

Le catalogue global ou GC (Global Catalogue) permet aux utilisateurs d’effectuer 2 tâches importantes :

Trouver des informations Active Directory sur toute la forêt, quel que soit l’emplacement de ces données.

Utiliser des informations d’appartenance à des groupes universels pour ouvrir une session sur le réseau.

Un serveur de catalogue global est un contrôleur de domaine qui conserve une copie du catalogue global et peut ainsi traiter les requêtes qui lui sont destinées. Le premier contrôleur de domaine est automatiquement le serveur de catalogue global. Il est possible de configurer d’autres contrôleurs de domaine en serveur de catalogue global afin de réguler le trafic.

8.1.2 L’importance du catalogue global dans le processus d’authentification

Voici les étapes importantes qui sont réalisées lorsqu’un utilisateur s’authentifie sur le domaine :

  1. L’utilisateur entre des informations d’identification (son identifiant, son mot de passe ainsi que le domaine sur lequel il souhaite ouvrir une session) sur un ordinateur membre du domaine afin d’ouvrir une session.
  2. Ces informations d’identification sont cryptées par le centre de distribution de clefs ou KDC (pour Key distribution Center), puis envoyées à l’un des contrôleurs de domaine du domaine de l’ordinateur client.
  3. Le contrôleur de domaine compare les informations d’identification cryptées du client avec celles se trouvant sur Active Directory (les informations stockées dans le service d’annuaire Active Directory qui sont cryptées nativement). Si les informations concordent alors le processus continue, sinon il est interrompu.
  4. Le contrôleur de domaine crée ensuite la liste de tous les groupes dont l’utilisateur est membre. Pour cela, le contrôleur de domaine interroge un serveur de catalogue global.
  5. Le contrôleur de domaine fournit ensuite au client un ticket d’accord ou TGT (Ticket Granting Ticket). Le TGT contient les identificateurs de sécurité ou SID (Security Identifier) des groupes dont l’utilisateur est membre (Un TGT expire au bout de 8 heures ou bien quand l’utilisateur ferme sa session).
  6. Une fois que l’ordinateur client a reçu le TGT, l’utilisateur est authentifié et peut tenter de charger son profil et d’accéder aux ressources du réseau.

Si le serveur de catalogue global n’est pas joignable, le processus d’authentification est mis en échec. En effet, le contrôleur de domaine ne peut pas obtenir les SID des groupes dont l’utilisateur est membre lorsque le serveur de catalogue global est indisponible. Dans ce cas le contrôleur de domaine n’émet pas de TGT et l’utilisateur ne peut pas ouvrir sa session.

8.1.3 L’importance du catalogue global dans le processus d’autorisation

Voici les étapes importantes qui sont réalisées lorsqu’un utilisateur authentifié essaye d’accéder à une ressource sur le domaine :

  1. Le client essaye d’accéder à une ressource située le réseau (ex. : serveur de fichier).
  2. Le client utilise le TGT qui lui a été remis lors du processus d’authentification pour accéder au service d’accord de ticket ou TGS (Ticket Granting Service) situé sur le contrôleur de domaine.
  3. Le TGS émet un ticket de session pour le serveur sur lequel se trouve la ressource qu’il envoie au client. Le ticket de session contient les identificateurs SID des groupes auxquels l’utilisateur appartient.
  4. Le client envoie son Ticket de session au serveur de fichier.
  5. L’autorité de sécurité locale ou LSA (pour Local Security Authority) du serveur de fichier utilise les informations du ticket de session pour créer un jeton d’accès.
  6. L’autorité LSA contacte ensuite le contrôleur de domaine et lui envoie les SIDs de tous les groupes figurant dans la liste DACL (Discretionary ACcess List) de la ressource. Le contrôleur de domaine doit ensuite joindre un serveur de catalogue global afin de connaître les identificateurs de sécurité (ou SIDs) des groupes de la liste DACL dont l’utilisateur est membre.
  7. Enfin, l’autorité LSA compare les identificateurs SID du jeton d’accès avec les SID des groupes dont l’utilisateur est membre et qui figurent dans la liste DACL. Si les groupes auxquels l’utilisateur appartient sont autorisés à accéder à la ressource alors l’utilisateur peut accéder à la ressource sinon, l’accès est refusé.

Si le serveur de catalogue global est indisponible, alors le processus d’autorisation ne peut pas se poursuivre et l’utilisateur ne peut pas accéder à la ressource.

8.1.4 La mise en cache de l’appartenance au groupe universel

La fonction de mise en cache de l’appartenance au groupe universel est disponible uniquement sur les contrôleurs de domaine exécutant Windows Server 2003 ou ultérieur. La mise en cache de l’appartenance au groupe universel consiste à stocker sur un contrôleur de domaine les résultats des requêtes effectuées auprès d’un serveur de catalogue global.

La mise en cache de l’appartenance au groupe universel est principalement utilisée lorsque deux sites sont reliés entre eux par une liaison WAN (Wide Area Network) possédant une faible bande passante (par exemple une connexion RNIS à 128Kb/s). En effet, dans ce cas de figure la connexion WAN impose diverses restrictions au niveau de l’implémentation du réseau :

Il est obligatoire de placer un contrôleur de domaine dans le site distant sinon la connexion ralentira les ouvertures de session.

Il n’est pas possible d’héberger le catalogue global sur le site distant car la réplication entre les serveurs de catalogue global entraîne un trafic réseau trop important.

Malgré le fait qu’un contrôleur de domaine soit disponible en local dans le site distant, le trafic entre les deux sites reste élevé puisque pour chaque ouverture de session ou bien chaque accès à une ressource partagée, le contrôleur de domaine accède à un serveur de catalogue global situé dans la maison mère. Une solution à ce problème est donc l’implémentation de la mise en cache de l’appartenance au groupe universel.

Lorsqu’un utilisateur du site Learning tente d’ouvrir sa session pour la première fois, il contacte le contrôleur de domaine qui va lui-même contacter le serveur de catalogue global (GS sur le schéma) afin de récupérer les SIDs des groupes dont l’utilisateur est membre. Le contrôleur de domaine va ensuite mettre en cache les informations qu’il a reçues du serveur de catalogue global pendant une durée de 8 heures (durée par défaut). La même opération (mise en cache) est effectuée lors du premier accès de l’utilisateur à une ressource partagée.

Si l’utilisateur se « logue » de manière récurrente sur le domaine ou bien si il accède régulièrement à des partages réseaux, le contrôleur de domaine du site Learning utilise les informations situées dans son cache. Cela offre trois grands avantages :

Les authentifications des utilisateurs et les accès aux ressources du réseau sont moins dépendantes de la liaison WAN.

Le trafic d’authentification et d’autorisation au niveau de la liaison WAN utilise peu de bande passante.

La résolution de l’appartenance au groupe universel est plus rapide puisque le contrôleur de domaine possède les informations nécessaires en local.

Votre commentaire:

Votre pseudo :

Votre commentaire :

Saisir les caractères ci-contre dans le champ suivant :
 Rafraichir

PseudoCommentaire
JimmiNi
20/10/2017 19:11:02
wiBjQv http://www.FyLitCl7Pf7ojQdDUOLQOuaxTXbj5iNG.com
Rocco
07/07/2017 05:56:18
I've been cut off elocon cream untuk apa visa While the Veterans Affairs Department and state Medicaid programs have legal authority to obtain steep discounts from drug makers, that doesn't include the largest payer, Medicare male enhancement pills sold at 7-11 In other areas, many of these services are unavailable for non-cancer patients despite the fact that treatment for both groups of patients is identical oral dexamethasone half life shot A munitions factory was heavily damaged, sending a massive plume of smoke into the air. re viagra generics safe Investors tend to buy the yen in times of geopolitical oreconomic stress, but the overall outlook for the Japanesecurrency stayed downbeat as the economy is still in the midst ofmassive quantitative easing detrol la wiki cost without insurance shale output, but Tuesday's talks had led to speculation in some quarters that Riyadh might back a coordinated cut involving non-OPEC members.
Kelley
07/07/2017 05:56:16
It's funny goodluck cheap buy viagra men Part of the Abkatun Pol Chuc offshore complex, thedamaged platform separates crude oil and gas from various wells. buy viagra pretoria purchase As far as I know there is no master list of Elaine's work, says the NPG's Kim Sajet order levitra keychain quotes Today's diehard (centre-right and centre-left) blockpolitics gives Jimmie Akesson space to play his games, MikaelDamberg, group leader of the Social Democrats in parliament,said to news agency TT on Wednesday. viagra 25mg us But back in England, John McSorley, who had built the crate and delivered Spiers to the airport, was desperately worried about his friend buy intivar online troops have killed themselves than have been killed in Afghanistan, and suicides among reservists and National Guard members are spiking — that they are now background noise to many Americans, unpleasant reminders of wars most of us have forgotten about buy levitra viagra law zones Kelly, the 14-year-old giraffe, needed a general anaesthetic to allow experts to have a look inside her mouth to check her teeth. buy generic viagra uk order Patricia King, the mother of Mr Brett King and grandmother to Ashya, told Sky News: They've treated them like murderers, putting handcuffs on them and everything eputable online generic viagra Late Friday, the Wall Street Journal reportedthat the company was seeking a possible buyer, though a personfamiliar with the board's thinking told Reuters he was not awareof any such plan.
Zachery
07/07/2017 05:56:14
The line's engaged can you buy rogaine walmart canada In an always-volatile NFL, the top of the Daily News Rankings remain unchanged after Week 4 buy amiloride can used acne Federal Reserve is gradually winding down its bond-buying program as the economy improves and is beginning to think about tighter monetary policy. rosa impex pvt ltd viagra “The planetary science community has theorized for decades that planets like Jupiter and Saturn would have had, at an early stage, disks around them that then led to the formation of satellites 100 mcg fentanyl patch street value The agreement among the European Union countries expanded the package of sanctions against Russia to measures related to access to capital markets, defense, dual-use goods with both military and civilian applications and sensitive technology
Refugio
07/07/2017 05:56:13
I'm sorry, I didn't catch your name buy viagra london He was released on a $100,000 unsecured bond, ordered to appear for arraignment March 5 and told to continue mental health treatment. cheap levitra tablet dosage buys To date, there have been no clinical trials in Ireland for PI3K pathway-targeted drugs in lung cancer, but we believe the data generated during this project supports this new treatment approach, said lead researcher, Dr Susan Heavey. how old can you be to take viagra mg Citigroup tried to downplay its decision to quit the Argentina custody business, saying that business has no meaningful connection with banking business in general, and concerns only servicing assets belonging to clients. online viagra brands in india He also says the intervention of former Labour ministers Alan Milburn and John Hutton yesterday - who argued that Ed Miliband had to go beyond simply advocating for more NHS spending to offering a programme for proper healthcare reform - was made for two reasons viagra buy 100 mg Nearly 400 union members and allies descended on Capitol Hill to meet with lawmakers on the so-called fast track legislation that would allow Congress to set negotiating objectives for trade deals in exchange for a yes-or-no vote, without amendments. elocon cream use for acne youtube Progress in the increase in new school buildings and the move away from prefabs across the country in 2014 resulted in the second ‘A' grade in this section, the CRA noted. suboxone hydrocodone With a legal stand-off emerging between HIQA and the HSE over the findings of the Portlaoise probe, a leading expert has said the hospital's rate of unexpected infant deaths in recent years is well within current norms
Claire
07/07/2017 05:56:11
I'm sorry, she's buy tretinoin cream 0.1 The company’s revenue for the quarter was up 34.2% on a year-over-year basis donde comprar fematril en venezuela Ian McCafferty and Martin Weale voted to raise rates to 0.75% from 0.5%, as they had in August buy free samples cialis youtube I think that in many ways is a broader term not just for a racial identity, but also your relationship with yourself and your acceptance of yourself.
Orval
07/07/2017 05:56:08
Another year tadalafil 20mg generic cialis tabs In fact, the eye disease is the leading cause of blindness in working-age adults in Ireland and in about 10% of those affected, diabetic macular edema (DME) may occur, which if not caught and treated effectively, can lead to a rapid form of vision loss. mg is viagra legal in italy And even if they do that, go ahead and believe that all the necessary tiebreakers will somehow, magically go their way.
Demarcus
07/07/2017 05:56:03
Which university are you at? amoxicillin 125 mg dosage As our lives become increasingly sedentary we miss out on the vast array of bacteria that lurk in our gardens and waft through the air. qualis pharmaceutical phentermine what is it In the statement, BIO wanted the FDA to “outline its approach to naming and labeling, and clarify its conditions for determining a biosimilar to be interchangeable with its reference biological.” The FDA’s website describes a biosimilar as “a biological product similar to a U.S.-licensed reference biological product,” such as a vaccine, tissues or proteins, generally made from human or animal materials. zithromax prise He is 6-for-8 in the two games against the Sox and obviously feeling very comfortable hitting at the Stadium these days. stud 100 counterfeit The Bay Area has its best chance to win after three failed attempts with what leaders say is an economically sound plan that will keep most of the events in San Francisco order best way get results viagra This was “due to safety concernsfor our students at bus stops with an armed and dangerous gunman still on the loose in the area,” the district said in a statement is tongkat ali safe Meanwhile the bigger budgeted titles can negotiate first access to their trials in return for extra publicity from either Sony or Microsoft, for whom it can offer a more cost-effective way to differentiate their platforms than funding exclusive titles of their own.
Mikel
07/07/2017 05:56:01
Pleased to meet you buy free trial of cialis samples Sothe tax breaks would expire again within weeks, setting upanother fight over their long-term future next year in Congress. buy cialis official website uk In addition to questions over the ownership of blocks thatsupply private power generators and factories, state behemothCoal India is again under the gun for failing to providesufficient supplies to many power plants. levitra online cheap jerseys ebay They suggested that as many of the missed appointments were in the morning, ‘perhaps scheduling afternoon appointments for these patients would cut down on missed appointments'. cheapest place for doxycycline Earlier this week, Finance Minister Anton Siluanov saidlower oil prices and Western financial sanctions will costRussia around $130 billion-$140 billion a year, equivalent toaround 7 percent of its economy. priligy generico en barcelona If there is an agreement, I don't see how it could be meaningful without having some quantitative dimensions, he said, without elaborating. levodopa and carbidopa dose used together NEW YORK, March 27 (Reuters) - Wall Street and Europeanstocks edged ahead on Friday but remained en route to a losingweek while U.S
Emmanuel
07/07/2017 05:55:59
Another year turkish viagra honey cheap Before the end of this month the Bank of Italy will issue revisions to Italy's debt-to-GDP ratio
Lenny
07/07/2017 05:55:57
I'd like to order some foreign currency buy cialis online pharmacy uk Eager as they are for a historic victory for the left, Syriza officials are also prepared for a long struggle
Brooke
07/07/2017 04:16:15
I'd like to apply for this job cheapest generic levitra price usa The Optima maintains a very solid sport sedan appearance, with wide rear hips and side panels that are austere, but not dull buy hydroxyurea where can you drink “I did a good job in training camp and the preseason games where I feel like I’m ready.” buy viagra vipps order Niu Dun, China's vice minister of agriculture, said througha translator: The regulation (and) supervision of biotechnologyproducts is a priority in China-U.S
Brayden
07/07/2017 04:16:13
I'm not sure generic viagra soft shop fast IIf you’ve been keeping up with the news, it’s clear that if you want to punch out your girlfriend and avoid jail time, Atlantic County, N.J order levitra zodiac sign letters A late addition to the Chargers' 2014 roster immediately after signing a one particular-year, $three million deal in June, Flowers served as a significant upgrade to San Diego's ailing secondary in his very first season with the group astelin nasal spray directions gain Governments may grant a one-off tranche of aid to support a restructuring process once within a period of 10 years norvasc 10mg price image Trey Gowdy on Sunday refuted assertions that his House investigative committee has become a political tool for national Republicans and that the panel’s primary purpose is to attack top 2016 Democratic presidential hopeful Hillary Clinton.
Justin
07/07/2017 04:16:10
We're at university together is there a generic viagra cheap The support program was established in 1972 to promote cooperation and understanding between service members and their civilian employers, to assist in the resolution of conflicts arising from an employee’s military commitment. elocon cream india how to used The CDS tranche trades JPM’s CIO office undertook were effectively a hedge against short-term credit deteroriation that would have a negative impact on their loan book. rugs that dont mix cialis Of course, it's a tiny minority of the Muslim communityand Muslims are the first victims. can a gp prescribe antabuse Some would-be buyers have complained of long delays in getting loans as banks grow more cautious, while others may be holding off in anticipation of further price declines. estrace pills dose fet Newman, 65, has been with the Yankees for the past 26 years, serving as the team's senior VP of baseball operations for more than a decade
Devin
07/07/2017 04:16:08
Why did you come to ? where to buy viagra ice cream cheap Verizon is offering better discounts to Edgecustomers, too.Users can now receive a $15 discount every month on plans with 4GB of data or less cheap levitra online sales reports The agreement, which was outlined in a federal court filing on Tuesday and requires judicial approval, follows a June ruling by U.S cheap 20 mg levitra 20mg kits For a week, the ex-cricketer and the cleric Tahir ul-Qadri have led rallies in the capital Islamabad to demand the resignation of Nawaz Sharif over claims of corruption and that he rigged last year’s election. cheap levitra online us news usa ** Roche Holding AG will buy a majority stake inmolecular and genomic analysis firm Foundation Medicine Inc for up to $1.18 billion, Roche said on Monday, in a moveto bolster the Swiss drugmaker's personalized cancer treatments. manufacturers of tramadol Last year’s population of migrating monarchs was an all-time low, Taylor said took half a viagra prescription The dramatic fall in the cost of crude fueled fears of slowing economies and budget deficits throughout the Gulf. viagra free orderto thisincrease and European markets, after the state investor purchased a 10 percent stake in London-based information services company Markit last year and invested $500 million in U.S buy india generic cialis australia Jeter threw home to Jorge Posada, but pinch-runner Midre Cummings was safe after Posada dropped the ball.
Mauricio
07/07/2017 04:16:06
Some First Class stamps what is tamoxifen good for The week tilted a big nod towards the ‘Game of Thrones’ TV series seen through a kaleidoscope as Manish Arora created a fantasy land of warrior princesses and tribal chiefs in a flurry of pink and gold. prazosin ptsd fda They see an export market in the United States, challenging popular low-alcohol choices such as Moscato and Prosecco from Italy. prazosin online in usage Big Silicon Valley companies like Google, Facebook and Twitter, many of whose workers commute to work from San Francisco, have been accused of not doing enough to contribute socially and aggravating the homeless problem. estrace cream cost quantity Constitution established\nthe use of grand juries, saying that “no person shall be held\nto answer for a capital, or otherwise infamous crime, unless on\na presentment or indictment of a grand jury,” a right that is\nalso embedded in New York’s state constitution. thuoc cataflam 25 mg high LONDON/MADRID, March 12 (Reuters) - British bank TSB has received a takeover approach from Banco Sabadell,valuing the business at about $2.6 billion and sending itsshares soaring by nearly a quarter. buy cialis 20 mg discoun zoo TechCrunch estimates Facebook loses about $22,453 for every minute its down around the globe, but could have been more since the outage happened during a prime browsing time for Facebook’s markets in the West. depakote dosages adults (Reporting by Nate Raymond in New York; Editing by NoeleenWalder and Leslie Adler)
Cyril
07/07/2017 04:16:04
I stay at home and look after the children prescription saw palmetto military plans to train and equip moderate Syrian rebels, who Obama hoped, in time, would be able to take territory back from the Islamic State online where to buy viagra australia The role genes play in losing weight is unequivocal, but due to changes in technology we are beginning to find out what these genes are, says geneticist Dr Giles Yeo, from Cambridge University. canadian prednisone for dogs in pain Duval is currently ranked 88th in the world, after cracking the top 100 for the first time in July estrace cream coupons results Yet fund managers and analysts warn that small-cap stocksalready trade at valuations high above long-term averages, evenafter significantly lagging large-company shares in 2014 generic cialis eli lilly “It doesn’t take much of a leap to conclude these highly detailed maps developed with taxpayer funds are for the purpose of enforcing this rule,” Cramer said key buy levitra online zuma india Fashion Week’s new home is likely temporary since organizers are widely rumored to be relocating the event to Hudson Yards, a new multi-skycraper mega-development on the far west side, once the project’s new culture shed performance venue is completed in 2018 generic viagra reel sur le net BlackRock has benefited as investors pulled money out ofPacific Investment Management Co after Bill Gross announced onSept where to buy levitra 20mg glasses panel of climate scientists for causing more heatwaves, floods and rising sea levels
Wendell
07/07/2017 04:16:02
I'd like some euros viagra tablet shape online When the third line is running, Boeing could in theory produce 63 of the single-aisle planes a month, 21 from each line lopressor purchase prescription Coughlin spoke to the Giants about focusing on Sunday’s meeting with the Titans, and that’s what Manning plans to do this week. air rebusan tongkat ali And maybe it will: The network just announced the series had halted production, though it may rise from the dead. n ligne cialis meilleur prix Analyses of various patient subgroups, such older or younger than 80, by gender, severity of risk and whether patients had previously undergone coronary bypass procedures, all favored CoreValve, researchers found.
Lonnie
07/07/2017 04:16:00
I'd like some euros buy canada levitra uses used for Housing market activity has been cooling and house price growth slowing in recent months, but 2014 was still the strongest year for mortgage lending since 2008, said Bob Pannell, the CML's chief economist. fast shipping prednisone causing The researchers found that people who smoked at least 20 cigarettes per day prior to their first diagnosis of cancer had a five-fold increased risk of going on to develop a second smoking-associated cancer, compared to people who had survived the same cancers but had never smoked. generic 40 mg levitra ymca pool Take the Obama administration’s much-promoted pivot to Asia, which has been swept away by a tidal wave of nonessential crises.
Julia
07/07/2017 04:15:59
What university do you go to? buy cheap viagra thailand In 2013, the State Department planned to send a specialenvoy to Pyongyang to try to negotiate a release of Bae and atthe time insisted the nuclear negotiations and the human rightsnegotiations over Bae's jailing were unrelated. b cialis theme music online free Plans for this year would include 700 new armoured vehicles,126 new military planes, 88 new helicopters and two brigades ofIskander-M air defence systems, he said how to get astelin nasal spray uses So, in effect, you have a one-in-15,000,000 chance of being involved in a plane crash buy cheapest online cialis xlite Samsung has filled the homescreens with widgets and panels advertising its own apps and features, such as health monitoring via the built-in sensor (or a paired Samsung Gear wearable device) how soon before intercourse should you take viagra The Luger-Burger is a half-pound burger ($13.95) available for lunch every day until 3:45 p.m order cheap periactin online syrup This story was so weird and outlandish, that we kept saying, “God, can we work this in somehow?” And partly, I’d say, “This is the kind of thing I’d see on TV and wouldn’t believe, because it’s so crazy that I couldn’t believe it even though it’s true and you can look it up.” This guy, basically he’d come home once a year to visit his family and then he’d go back out West can you take prednisone and cialis ibuprofen while taking Peterson attended that and listened via telephone as the hearing continued on Dec
Nos partenaires : www.bestof-microsoft.com | www.exchangedump.com | www.exchangedump.com | www.formation-exchange.com | www.formation-management-dif.com | www.formation-mcpd.com | www.formation-pmp.com | www.formation-seven.com | www.formation-windows-7.com | www.formation-windows7.com | www.formation-windows-seven.com | www.certification-mcpd.com | www.certification-windows-7.com | www.consulting-exchange.com | www.e-managementinstitute.org | www.certification-mcitp.com | www.formation-mcsa.com | www.bestof-exchange.com | www.exchange-consulting.com | www.bestof-voip.com | www.formation-cisco.com www.formation-mcitp.com.com | www.laboratoire-exchange.com | www.messagerie-consultant.com | www.bestof-windows.com | www.bestof-sharepoint.com | www.messagerie-consultants.com | www.formation-mcts.com | www.consultant-messagerie.com