5 ms·

I'm not familiar with big orgs. What does active directory facilitate mostly? Like seeing a list of other computers in the company and accessing their drives?

by pixie_ 14y ago

damian2000 14y ago
Single sign on, group policies, user account control on a global scale.
jiggy2011 14y ago
In abstract, centralise everything. You have a "Domain Controller" which is basically a server which everything authenticates against. Settings from domain controllers (privileges etc) are propagated over the network to other servers (Email,File servers etc). So when you authenticate against a DC (by logging into your workstation etc) you get a token back which can be sent to other hosts on the network who then understand what to grant access to based on that token. This makes it easier for a large org with an international presence to allow say marketing teams in the London and New York offices to have access to the same files etc and be able to use each others workstations interchangeably whilst all being managed by the IT team in Mumbai. This means that if you stick to mainly MS products you get the advantage of knowing that everything will integrate into AD so you spend less time handrolling shared authentication etc.
- Spearchucker 14y ago
  Nitpick - AD supports a centralised topology, but is more effective when decentralised. You can deploy as many domain controllers as you like, you can separate global catalogues entirely, and deploy multiples of those, and you can even separate domains within forests, and then create cross-domain trusts. If you want to create cross-forest trusts you can do that using Active Directory Federation Services (ADFS). ADFS is hugely under-rated, and is arguably the most capable identity federation software out there because it's the only implementation I know of that does both passive- (browser-based), and active federation, which allows you to authenticate against AD from your JSON service. That story gets even better with U-Prove (http://www.microsoft.com/mscorp/twc/endtoendtrust/vision/uprove.aspx http://www.microsoft.com/mscorp/twc/endtoendtrust/vision/upr...).

I'm not familiar with big orgs. What does active directory facilitate mostly? Like seeing a list of other computers in the company and accessing their drives?

by pixie_ 14y ago

I'm not familiar with big orgs. What does active directory facilitate mostly? Like seeing a list of other computers in the company and accessing their drives?

damian2000 14y ago

Single sign on, group policies, user account control on a global scale.

jiggy2011 14y ago

In abstract, centralise everything. You have a "Domain Controller" which is basically a server which everything authenticates against. Settings from domain controllers (privileges etc) are propagated over the network to other servers (Email,File servers etc). So when you authenticate against a DC (by logging into your workstation etc) you get a token back which can be sent to other hosts on the network who then understand what to grant access to based on that token. This makes it easier for a large org with an international presence to allow say marketing teams in the London and New York offices to have access to the same files etc and be able to use each others workstations interchangeably whilst all being managed by the IT team in Mumbai. This means that if you stick to mainly MS products you get the advantage of knowing that everything will integrate into AD so you spend less time handrolling shared authentication etc.

Spearchucker 14y ago
Nitpick - AD supports a centralised topology, but is more effective when decentralised. You can deploy as many domain controllers as you like, you can separate global catalogues entirely, and deploy multiples of those, and you can even separate domains within forests, and then create cross-domain trusts. If you want to create cross-forest trusts you can do that using Active Directory Federation Services (ADFS). ADFS is hugely under-rated, and is arguably the most capable identity federation software out there because it's the only implementation I know of that does both passive- (browser-based), and active federation, which allows you to authenticate against AD from your JSON service. That story gets even better with U-Prove (http://www.microsoft.com/mscorp/twc/endtoendtrust/vision/uprove.aspx http://www.microsoft.com/mscorp/twc/endtoendtrust/vision/upr...).