What is at the main.
At the main is a logical container for managing user, computer group and other objects.
The Active Directory database stores all domain objects and each domain controller stores a copy of
the database.
The Active Directory database includes many types of objects.
The most commonly used objects are user accounts, computer accounts and groups.
Let me briefly describe these three object types.
User accounts contain information about users, of course, including the information required to authenticate
a user during the signing process and build the user success token.
Computer Accounts.
Each domain joint computer has an account in Active Directory.
User can use computer accounts for domain giant computers in the same way that you can use user accounts
for users.
And the third type of object is groups.
Groups organize users and computers or computers to make it easier to manage permissions and group policy
in the domain.
Now we have Active Directory domain as a replication boundary.
As you might remember from previous lesson, when you make changes to any object in the domain, the
domain controller where the change occurred replicates the change to all other domain controllers in
the domain.
If multiple domains exist in the forest, only subsets of the changes replicate to other domains.
AIDS uses a multi master replication model that allows every domain controller to make changes to objects
in the domain.
Active Directory allows a single domain to contain nearly 2 billion objects.
With this much capacity, most organisations can deploy only a single domain to ensure that all domain
controllers contain all domain information.
However, organisations with decentralised administrative structures or multiple locations might consider
implementing multiple domains in the same forest to accommodate their administrative needs.
The Active Directory domain is an administrative centre.
The domain contains an administrator account and a domain admins group.
By default, the administrator account is a member of the Domain Admins Group and the Domain Admins
Group is a member of every local administrators group of domain giant computers.
Also, by default, the domain admins group members have full control over every object in the domain.
The administrator account in the forest root domain has additional rights, as I have already mentioned,
in what is an AIDS forest lesson.
So please remember that administrator account in the forest root domain has additional rights.
Refer to the previous lesson.
If you don't remember, it has something to do with schema master role.
Another feature of Active Directory domain that it provides authentication.
Whenever a domain joint computer starts or a user signs in to a domain joint computer adds.
Authenticated authentication helps to verify that the computer or user has the proper credentials for
an account.
The next feature is that Domain provides authorization, Windows Operating Systems Use Authorization
and access control technologies to allow authenticated users to access resources.
Typically, authorization occurs locally at the resource level.
Domain based dynamic access control enables central access rules to control the access to resources.
Central access rules do not replace the current access control technology, but provide an additional
level of control.
Please remember that Dynamic Access Control is a feature introduced in Windows Server 2012 and allows
administrators to define rules that control access permissions.