Welcome to the ITFreeTraining video on Active Directory Lightweight Directory Services.
This video will give you an introduction to how Active Directory Lightweight Directory
Services works, the features it supports and how you can best use it in your organization.
Active Directory Lightweight Directory Services, otherwise known as AD LDS, is software created
by Microsoft that allows an independent Directory Service to run alongside your existing domain
based directory service. Before Windows Server 2008 AD LDS was an add-on for Windows called
ADAM which is short for Active Directory Application Mode. With Windows Server 2008, AD LDS was
integrated into the operating system as another role.
To understand how the role works, consider the code that is used for directory services.
This code is also used by Active Directory Domain Services. This code is used by Domain
Controllers to provide domain services like authenticating users, storing objects in the
Active Directory database and replicating the database.
To understand what Active Directory Lightweight Directory Services is, first understand that
Lightweight Directory Services uses that same code as Active Directory Domain Services.
So, effectively, Lightweight Directory Services provides a lot of the same functionality as
Domain Services. Before I look at the difference between the two, I will first look at, why
you would use Lightweight Directory Services. Let's say that you have a web server that
you placed on your perimeter network. This web server runs an application that you want
roaming users on the internet to have access to. You want to use single sign on so the
users will not be prompted for a user name and password when accessing the web server.
In other words, the username and password that the user uses to access the domain should
also be used on the web server. The easiest way to achieve this would be to make the web
server a Domain Controller, however making the server a Domain Controller, even if you
use a read only Domain Controller, does present a security risk if the perimeter network were
to be compromised by a hacker. To get around this problem, you instead install
the Domain Controller on the internal company network and install lightweight directory
Services on the web server. The Domain Controller can then replicate user account information
to the Web Server for use with Light Weight Directory Services.
Notice that other information in Active Directory does not need to be replicated. This helps
to keep the rest of the data in Active Directory safe from attack. Notice also, that additional
data like application data can be added to Lightweight directory services. So you can
start to see how Active Directory Lightweight Directory services can be used. Since Active
Directory Lightweight Services uses the same code base as Active Directory Domain Services,
the Web Server can now perform user authentication and can be expanded to have access to additional
information that is not stored in Active Directory. You can see how Lightweight Directory Services
can be used with your existing Domain Services to add additional functionality and increase
security, but there are some differences between the two and this will affect your decision
where to use them. The first big difference between the two is
that Active Directory Lightweight Services supports multiple instances. With Active Directory
Domain Services you can run only one instance per Domain Controller. This effectively means
that one Domain Controller can hold one Active Directory Domain. This makes Lightweight Services
a great choice if you have multiple applications which each require a separate Directory Service.
This also means you can remove and add instances as the application requires. You are still
limited to one Schema per instance, however being able to create as many instances as
you want allows you to work around that limitation. The next difference is that Active Directory
Light Weight Services can be run on a client operating system. Domain services on the other
hand requires Windows Server. The next difference is that Lightweight Services
does not require DNS. One of the fundamental ideas behind Lightweight Domain Services is
that the application and the Directory Service can be installed on the same computer. By
having them on the same computer there is no delay for the application accessing data
in the directory service. In other words, Light Weight Directory Services is completely
stand alone and does not require any additional service to operate.
After seeing all the advantages you may consider this a replacement for Active Directory Domain
Services. The fact however is Active Directory Lightweight Domain Services only provides
a subset of the functionality that you would get with a Domain Controller. The most noticeable
missing features are no group policy support and no global catalog support. This reduces
where and how it can be used, however there are advantage like being able to run multiple
instance that make it a good choice in some circumstances.
The next most noticeable missing feature is that is does not have the ability to manage
workstations and servers. You cannot create a domain and add workstations using Lightweight
Directory Services. This also means that you do not need to install Active Directory Lightweight
Services on a computer that is part of the domain. You can install it on a workgroup
computer making it a good choice for computers that are directly connected to the internet.
Active Directory Lightweight Directory Services does however support sites and replication
just like Active Directory Domain Services. You can for example have multiple Lightweight
Directory service installs at different locations replicating changes to each other. This makes
it a multi-master replication model like Active Directory Domain Services but since there
is no domain support trusts are also not supported. You can start to see that Lightweight directory
services is aimed more at providing application support and can be used to improve security,
it not designed to be a replacement for domains. In the previous example I talked about storing
data in Lightweight Directory Services for use with a web server. The question you may
ask yourself, could this data have been stored using another product, for example SQL Server?
The choice between a Directory Service and a product like a database comes down to your
needs. Shown here is the core difference between Directory Services like Active Directory Domain
Services or Active Directory Lightweight Services and a database service like SQL Server.
First, directory services is hierarchical in design like the files and folders on your
hard disk. Using it you can place objects into folders. A database in comparison, is
designed based on rows and columns like the rows and columns found in excel.
Because the database is organized differently, this effects how security is applied. Security
is applied in a directory service based on the object. In a database, security is applied
on the row or column. The next difference is that a Directory Service
is based on a schema. If you want to add additional object types to the Directory Service you
need to make changes to the schema. A database on the other hand does not require a schema.
For this reason, if you make changes to a database these changes can be removed later.
Changes to the schema on the other hand, are not able to be deleted later on if it is decided
that they are no longer required. The next difference is that Directory Services
generally have fast read and search performance. Essentially this is because they are optimized
for look ups, which you would expect in a directory service. Databases on the other
hand are optimized for fast writes. The question you may ask yourself before deciding which
to use is your data mainly static and requiring a lot of search. If this is the case, a Directory
Service may be more appropriate. Otherwise, if the data does change a lot, a database
may be a better choice. The last point to consider is that databases
will lock a record when it is updated to prevent multiple people attempting to write to it
at the same time. A Directory Service on the other hand allows multiple updates to be performed
at the same time. If the Directory Service is in multiple locations, multiple updates
may happen at the same time. When changes are synchronized together the Directory Service
will use the most recent change and discard any other changes. For this reason, Directory
Services are useful for applications like staff directories. If your application does
not allow multiple changes to be made at the same time, for example you are using a banking
application, a database is a better choice than a directory service. To understand better
how Lightweight Directory Services works I will go through some example of where it may
be used. One of the major reasons to use Active Directory
Light Weight Directory Services is to support applications that require Schema changes.
If you have an existing domain, the domain has one Schema that is used by that domain
and all other domains in that forest. If you want to use an application that requires schema
change you would need to modify the schema which would have an effect on all domains
in the forest. This can overly complicate your environment, increase the time replication
takes to occur and schema changes are not reversible.
To get around this problem, Active Directory Light Directory Services can be used. When
an instance is created on the Lightweight Directory Service, this instance has its only
independent schema. If you want to deploy another application later on that requires
schema changes and you want to keep this application separate from the other, you simply need to
create another instance. You can see that if later on you decide to remove the application
from the network all that needs to happen is the instance with those schema changes
is removed and with it the Schema changes are also removed. You can see that by using
Active Directory Lightweight Directory Services you can add support for applications that
require schema changes without those schema changes effecting your network indefinitely.
The next advantage is that you can install Active Directory Light Weight Services on
the same computer as the application. This means the application can access the data
directly rather than having to travel over the network to access this information. This
can greatly improve the speed of the application and also means that you do not need to install
the application of a Domain Controller to improve access time to a directory service.
Installing additional software and applications on a Domain Controller is not recommended
when it can be avoided. The next use for Lightweight Directory Services
is to provide authentication and security. I have already looked at how you can use it
for authentication on a perimeter or DMZ network, however in this example you could also use
it on a secure network. In this case, you have a directory service
application that contains confidential data that is on a secure network. By using Active
Directory Lightweight Directory services, this data could be made available to users
on that network using their existing Windows login. However, since the data is only on
the one server on the secure network and not stored on any Domain Controller, it is safe
from external access assuming the firewall between the networks is configured correctly.
The last example that I will look at is Active Directory Lightweight Directory Services can
be installed on client operating systems like Windows Vista, 7 and 8. This makes it a good
choice for developers. This allows the developer to have their own private directory services
which they can experiment with and make changes on. The advantage with this is that they only
require local administrator rights. In order to make change to the schema and data using
Active Directory Domain Services the user would be required to be a member of Enterprise
Administrator and the Schema Admin groups. This is a lot of access and something that
most administrators would not want to give to a developer.
There has been a lot covered in this video, so I will now go through a quick summary of
Active Directory Lightweight Directory Services. Active Directory Lightweight Directory Services
uses the same code base as Active Directory Domain Services. For this reason a lot of
the same features are available in Lightweight services that are available with domain services.
This includes the ability to create sites and replicate data using multi master replication
just like Domain Services provides. There are some features missing in Lightweight
Directory services like the global catalog server and group policy. This does not make
it a replacement for Directory Services but rather add additional features and security.
You should consider Active Directory Lightweight Directory Services as just another application
and essentially this is what it is. For this reason you do not require a server to run
it on and thus it can be run on client operating systems like Windows 7 and Windows 8. Since
it really is only just another application running on the system, it does not require
additional resources like Domain Services would, for example DNS.
Some of the big reasons why you would use Active Directory Lightweight Directory Services
is for deploying applications to the domain. This can be done without modification to the
schema in your forest. This allows you to remove the application later on by simply
removing the install of Lightweight Directory Services. If you installed the application
using Active Directory Domain Services, you would be stuck with the schema changes and
they cannot be removed. Active Directory Lightweight Directory Services
also only requires local administrator access to the computer that it is running on. This
allows you to give the developer or application complete control over the install without
having to risk changes been made to your production environment.
You can start to see how Active Directory Lightweight Directory Services can be used
in your organization. Well I hope you have found this video informative.
In the next video I will look at how to install Active Directory Lightweight Directory Services.
Thanks for watching and see you in the next video.