Welcome to the next free video in this free Active Directory free course for the 70-640
exam. In this video I will look at the global catalog server. As we know from the
previous videos, each domain in an Active Directory forest has its own copy of the Active
Directory database. This is stored in the ntds.dit file and changes are replicated
to each domain controller in the domain. This works quiet well when you want to access
resources that are only in the one domain, but what happens when you attempt to access
a resource in a different part of the forest. If the resource you are trying to access is
in the same forest Windows will automatically use your username and password to access the
remote resource. Assuming that you have permission to the resource you will be given access.
The problem occurs when you want to access a resource in the forest and you don’t know
where it is. A domain only knows about resources that are in the domain itself. The domain
does not have information about resources that exist outside that domain.
To allow users to find resources in the forest Windows allows a domain controller to function
as a global catalog server. A global catalog server acts as an index for the forest. Just
like an index in a library, a global catalog server helps users find information. Any domain
controller can be made a global catalog server it is just a matter of ticking a tick box.
Objects in Active Directory have a number of attributes that are assigned to them. The
global catalog contains information about all the objects in the Active Directory forest.
This is not a full record of each object but rather a subset of each objects data. In other
words, only certain attributes are replicated to the global catalog server.
The information replicated is enough to find objects in the forest. Just like an index
in the library contains key information like the title of each book and the authors, the
global catalog server contains key information about every object in the forest.
Having Global catalog servers or GC’s means users in different domains can run queries
on the GC’s to find any object in the forest. Since users in different domains can access
resources in different domains in the forest there are also groups that work across the
forest. These groups can contain users from any domain in the forest. The global catalog
server is responsible for keeping information about these groups that include users from
different domains. Any domain controller can be a global catalog
server. In each domain you need to have at least one global catalog server. If you have
a large enough domain you should also have additional global catalog servers for redundancy
reasons. Losing your only global catalog server in your domain can cause problems. As long
as you have one global catalog server you can always make more domain controllers global
catalog servers. To make things as simple as possible there
is nothing stopping you from making all your domain controllers into global catalog servers.
In fact, Windows Server 2008 by default will make a new domain controller into a global
catalog server when it is promoted. The disadvantage to having more global catalog
servers is that they require more disk space and more bandwidth. Now days with disk space
and network bandwidth becoming a lot cheaper and more available, making all domain controllers
into global catalog servers is not such a big concern as it once was. For these reasons,
this is why Microsoft makes all domain controllers global catalog servers by default. You can
always switch this off when you promote the server or later on if you decide to. I will
now change to my windows server to show you how to change a domain controller to a global
catalog server or change it back if it is no longer required.
First of all I will open server manager from administrative tools under the start menu.
From here expand down through roles to Active Directory domain services. This contains some
of the admin tools for Active Directory. The tool I am interested in is Active Directory
users and computers. You could also run this tool by itself from the start menu. If I now
expand down to domain controllers, this will show all the domain controllers in this domain.
To change a domain controller into or remove the global catalog component open the properties
for its computer account. From the properties tab select the button NTDS settings. In
the NTDS settings you have a tick box global catalog. To remove the global catalog simply
un-tick the tick box. To make the domain controller into a global catalog server simply tick the
tick box. Once you tick or un-tick the tick box Windows will do the rest.
Making a domain controller into a global catalog server or removing the global catalog as you
can see is a simple task. The harder questions arises which domain controllers should be
made into global catalog servers. If you have the bandwidth and hard disk space you can
simply make all domain controllers into global catalog servers. This is the easiest solution.
One question you may also want to ask yourself is where do these domain controllers need
to be placed. Domain controllers authenticate users but they don’t have to be near the
users. For example, if you had a small office of only a few users it would not be worth
the money to deploy a domain controller to that location.
If the link between the small office and head office was unreliable you may deploy a domain
controller at the location to ensure users can always logon to the network. The next
decision is would you want to make that domain controller a global catalog server as well.
Let’s have a look at some of the reasons why you would deploy global catalog servers
in certain locations. Global catalogs are used when a user first
logs on. You would think a normal domain controller would have all the information to log a user
on but this is not correct. Domain controllers do not contain forest wide information. The
most notably missing information is universal groups. Groups and universal groups are covered
in more detail later in the course so I will only go into a lot of detail about them in
this video. Universal groups are groups that can include
users from different domains in the forest. For this reason, a regular domain controller
simply does not have this information. Even if you have a single domain and a single forest
you could still put a user in a universal group and thus you always need a global catalog
server. To illustrate this better, consider what happens
when you first logon to a domain. When you first logon to a domain Windows creates a
security token for you. This token contains everything that you have access to. In order
to create this token, well Windows needs to know everything you have access to. The security
token is created when you first logon and only when you first log on.
From a computing prospective it is time consuming to generate this token and this is why it
is only done once. This is also why if you change group member ship for a user this change
does not take effect until that user logs off and logs back on again.
The global catalog server is required to determine which universal groups the user is a member
of. Windows can cache credentials so if the global catalog server can’t be contact the
user may be able to still logon using the cached credentials. It is best to always have
a global catalog available on the network to ensure users don’t have any problems
logging in. The second reason you need global catalog
servers is that global catalogs servers are required when a user logs in using a Universal
Principal Name or UPN. A UPN is simply a username in the form of user name @ domain
name. The UPN is unique across the forest however
this does not mean the UPN has to be the same as the domain name. For example, you
could have a domain called ITFreeTraining and a domain called high cost training. Due
to high cost training failure in the market palace the employees there were moved to
ITFreeTraining however their user accounts stayed in the high costing training domain.
This was done because the cooperate change happened quickly but it will take time for
the IT department to move the users from the High Cost Training domain and move them
to the IT Free Training Domain. These kinds of things can happen often in
business. People move for area to area, company are purchased and sold and businesses restructured.
The IT department needs to be able to response quickly to the business need changes. The
quick changes may mean a user’s UPN does not match the domain they are in. Because
of this you need to global catalog server to work out where the person is users account
is located in the forest. The next reason you need a Global catalog
server is that they are used to locate directory information regardless of where the user is
in the forest. If you did not have a global catalog server you would need to know exactly
which domain this information is located in and forest wide services could not exist.
If you want to search for all large format color printers in the forest for example,
you could not do so without a global catalog server.
The next recommendation with global catalog server placement is that you place a global
catalog server at each one of your sites that is separated by a wide area network. In some
cases you many have a high speed link between the user and the server however it may be
blocked by a firewall.
If you can’t open these ports between the
client and the server you may need to place a global catalog server local to the client.
This can also apply if the link between the client and the global catalog server is unreliable.
If this occurs you should make a domain controller on the local network a global catalog server
or deploy a new domain controller to that network.
The next reason for global catalog server placement is that some software requires a
global catalog in order to run. Microsoft exchange is an excellent example of this.
If you have software like Exchange you need a global catalog server available for it to
run. On large networks you should consider having
more than one global catalog server’s available on the local network for the user. This gives
you redundancy in case one of the servers is not available but it also spreads the load
between the servers. In busy environments load balancing between global catalog servers
will help with keep response times low. Now that I have looked at all the reasons
that you would want to use a global catalog server, let’s look at why you would not
want to use global catalog servers. A global catalog sever contains a partial replicate
of every object in the forest and thus does put more load on the server answering queries.
A global catalog server must answer GC related queries as well as authenticate users.
A global catalog server also requires additional network traffic and hard disk space for forest
wide changes. In a small forest with not that many users this won’t be that noticeable,
but in a large forest with high volume of users and thus a high amount of changes this
can make a difference. Having said this, carefully planning is important
in global catalog placement. If possible I would personally make all domain controllers
global catalog servers as this is the simplest and easily configuration to support assuming
the network can support it. In the next video I will look at operation
master roles. These are unique roles at the forest and domain level. Like global catalog
servers, these operation master roles do take some planning to place them correctly. Once
again, thanks for watching are always free videos.