In this video from IT Free Training I will look at a feature in Windows Server 2008 called
Universal Group Membership Caching.
If you are using Universal Groups in your organization, a global catalog server will
be required in order for a user to login to the network. Universal groups are available
to every domain in the forest and thus need to be replicated via the global catalog server.
If Universal groups are being used and a global catalog server is not available, the following
will occur. If the user was the last one to login to that computer, then the user’s
credentials may be cached on that computer. If this is the case, the user will be able
to login locally to the computer using the cached credentials.
Cached credentials are what allow you to log into your laptop when you disconnect it from
the network. This will allow the user to access the local system but when they attempt to
access a resource on the network like a file share, the server will check the authentication
of the user. In order for the server to do this when universal groups are being used,
it requires access to a global catalog server. If no global catalog servers are available,
the connection will be denied. A server will always double checks each connection
before it is allowed access. This is done to ensure the user has not been disabled or
the account is locked. You may be thinking, could Windows provide access to everything
except what was specified in the universal groups? The problem with this approach is
that the universal group could be used to deny a user access to a resource. For this
reason, Windows takes the safe bet by denying the user access until it can check the user
against a global catalog server.
Whenever possible I would recommend making all Domain Controllers global catalog servers
but in some cases replication may be an issue and this is not possible. For example, if
you had 3 users separated from the main network by a slow unreliable network connection, it
is not worth having all the extra global catalog traffic travelling over the unreliable connection.
On a small network this may not be that noticeable, but in a multi domain environment with a lot
of users, there is not that much benefit to all that extra replication for 3 users.
The problem with this approach when you are using universal groups and the network is
down is that users on that part of the network may have a problem logging in and accessing
servers without a global catalog server. To get around this, you can enable universal
membership caching on the Domain Controller.
When you enable universal membership caching, the following happens. When a user logs in
to that Domain Controller, the Domain Controller will contact a global catalog in order to
obtain the universal group information. Once the Universal Group’s information is obtained
it is stored on that Domain Controller indefinitely. This will ensure that as long as the user
logs into the Domain Controller when a global catalog server was available to obtain the
universal group information, the user will always be able to login regardless of whether
a global catalog server was available or not. If a global catalog server is not available
when required, the domain controller will simply use the information in the cache. The
cached information will only be used if a global catalog is not available; it is not
designed to speed up performance when the network is functioning normally.
The universal group membership that is stored in the Domain Controller may become out of
date as the group membership is changed. For this reason, once Universal Group Membership
is stored on the Domain Controller it will be updated every 8 hours. All you need to
remember is that once universal group membership caching is enabled, the user is only required
to authenticate using the Domain Controller once for the user universal group membership
to be cached. I will change to my Domain Controller to look
at how to enable Universal Group Membership Caching.
To configure Universal Membership Caching, open Active Directory Sites and Services from
the start menu. From sties and services, expand down until you get to the site that you want
to enable universal group caching on, in this case London.
In the site container notice NTDS Site Settings. You need to ensure that you modify the NTDS
site setting under the site you want to configure. There are also NTDS Settings under Servers
but these apply to the Domain Controller. Universal group caching can only be set at
the site level; you will not find the option in the NTDS settings for a Domain Controller.
To access the settings, right click NTDS Site Settings and select properties. From here,
it is a simple matter to tick the tick box Enable Universal Group Membership Caching.
Once ticked, Universal Group Membership Caching will be enabled for all Domain Controllers
in that site if you have more than one Domain Controller at that site.
Notice the pull down refresh cache from. The default option will refresh the cache from
the closest Global Catalog server from that site. You could also select the same site.
You would only do this if you had a Global Catalog server and a Domain Controller at
the same site and you want to ensure replication only occurred locally from that global Catalog
server. Why would you do that? Perhaps the Domain Controller is on old hardware and it
was decided to reduce the load on the Domain Controller by not making it a Global Catalog
server. On this network there may also be another Domain Controller acting as a Global
Catalog server. If the Global Catalog server was down, the other Domain Controller could
authenticate users using the universal cache. If the Global Catalog was only expected to
be down for short periods of time, the decision may be made to only allow replication from
the local site. This is an unusual scenario, but Windows supports it if you wanted to configure
it that way. To review what we have covered: A Domain Controller
that is not a global catalog server can have Universal Membership Caching enabled at the
site level. Once enabled, the Domain Controller will cache universal group information on
the Domain Controller indefinitely. In order for this to occur, the user needs to authenticate
off that Domain Controller once. After this occurs their universal group membership is
stored on the Domain Controller and updated every 8 hours. The universal group membership
cache is only used if a global catalog server is unavailable on the network. Enabling universal
caching does not stop the Domain Controller from attempting to contact a global catalog
server when a user authenticates. If a global catalog server cannot be contacted, then the
universal group cached on the server is used. One more point to remember is that Universal
Group Caching only provides authentication, it does not replace the need to have a global
catalog server. This means the user will still be able to login, but will not be able to
perform searches that require a global catalog server. For example, Active Directory queries
could be run which software like exchange requires quiet heavy upon.
Thanks for watching another free video from IT Free Training. In the next video I will
look at how contacts work in Active Directory. Contacts allow you create a contact in Active
Directory that is not a regular user. For example, if you had an external contractor
that a lot of people used in the company, you could create a contact for that person.
This would provide their contact details to the user in the domain without having to create
a user account for that person.