SIDDHARTH BHAI: Welcome to the Google Cloud Security Showcase,
a special web series where we will
focus on security use cases that customers
can solve with Google Cloud.
My name is Siddharth, and I'm a product manager
at Google Cloud.
Today, we'll be walking through one
of the top questions we get from customers, how
do I run Microsoft Active Directory dependent apps
and servers in Google Cloud?
So let's start by thinking, why and when
would you even need Active Directory in the Cloud?
Some common use cases are if you have
VMs that are domain joined, you have
something that needs Windows integrated authentication,
group policy, you're trying to work with the darknet app,
and so on.
So at times like this, if you simply open up
network connectivity between your Google Cloud networks
and wherever your Active Directory resides,
you may find that things get too slow.
On the other hand, if you try to deploy full Active Directory
domain controllers, it's often a challenge
to find people who are skilled both in Active Directory
and in Google Cloud.
And even if you're lucky to have them on your team,
security or [? infraction ?] needs goes sky high.
That's where it's interesting to talk about this managed service
for Microsoft Active Directory.
It's a fully managed service.
It runs the actual Microsoft Active Directory domain,
and for each customer, active directory runs isolated.
It is protected against accidental misconfigurations
of IM policies or network firewall rules,
and the domain is frequently patched with the latest
security patches.
Here, you can see two domains, corporate and partners,
that have been set up as managed domains on Google Cloud.
You can see that the partners domain
has domain controllers deployed in two regions already.
And as your partnerships evolve, you
can always come back and add or remove regions from this list.
Let's take a closer look at the corporate domain.
You can see a lot of details about this domain.
You can set the password to get the credentials to be
able to manage this Active Directory domain,
and security is baked into the design of this service
from the get go.
The domain is only available on networks
you choose to authorize.
The service also deeply integrates
with Stackdriver monitoring.
As I switch over to a Stackdriver,
you can see that the domain has been performing in a good way.
It's healthy over the last hour, the last day, the last week,
and so on, and so forth.
As I come back to the domain details page,
I want to talk to you about an interesting requirement
I hear from customers often.
A lot of the times, people are interested in getting
the same users to be able to have access
to their infrastructure as it runs on Google Cloud
without having to sync identities in,
and they want users to be able to authenticate
against the Active Directory wherever it resides today.
To support that, we have an interesting feature,
which integrates with your existing on-premises Active
Directory domains.
You can see there is a one way trust setup established
with onprem.example.com, Active Directory domain,
and the Google Managed Active Directory domain
is trusting your other Active Directory domain.
As you can see, I'm RDPed into a Windows Server 2016 VM that
is running on Google Cloud.
You can see that it is domain joined to the GCP Managed
Active Directory domain corporate.example.com.
At this point, computer authentication,
authentication for any service accounts that
are running on this VM, as well as group policy
are being serviced out of the GCP managed Microsoft AD
domain.
It is interesting to see that I'm actually
logged in with a user account that
originated in the on-premises Active Directory
and is able to authenticate over the Active Directory trust.
While logged in as the same user,
I can use my familiar AD tools, such as Active Directory
Administrative Center, to manage the data inside the GCP managed
AD domain.
In fact, we have pre-created some groups
to make this even easier.
One question I often hear about is,
I only want certain users to be able to remote desktop
into the VMs that are running on Google Cloud.
No problem.
We have that covered.
Just add and remove users from this pre-created group,
and only those users will be able to remote desktop
into your domain joined VMs.
You can also use Active Directory PowerShell
and other AD tools to manage the data in this Active Directory
domain.
So, there you have it.
By using Google Cloud's managed service,
you can get up and going with Active Directory in the cloud.
Configure it as a standalone managed AD domain,
or connect with your existing Active Directory domains.
You can use it for infrastructure migration
and modernization needs as you bring your infra
to Google Cloud.
Thank you for tuning in.
Please visit cloud.google.com/security
for more content from Google Cloud experts.
[MUSIC PLAYING]