Active Directory Structure and Storage Technologies

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2

Administrators use Active Directory to store and organize objects on a network (such as users, computers, devices, and so on) into a secure hierarchical containment structure that is known as the logical structure. Although the logical structure of Active Directory is a hierarchical organization of all users, computers, and other physical resources, the forest and domain form the basis of the logical structure. Forests, which are the security boundaries of the logical structure, can be structured to provide data and service autonomy and isolation in an organization in ways that can both reflect site and group identities and remove dependencies on the physical topology.

Domains can be structured in a forest to provide data and service autonomy (but not isolation) and to optimize replication with a given region. This separation of logical and physical structures improves manageability and reduces administrative costs because the logical structure is not affected by changes in the physical structure. The logical structure also makes it possible to control access to data. This means that you can use the logical structure to compartmentalize data so that you can control access to it by controlling access to the various compartments.

The data that is stored in Active Directory can come from many diverse sources. With so many different data sources and so many different types of data, Active Directory must employ some type of standardized storage mechanism so that it can maintain the integrity of the data that it stores. In Active Directory, objects are used to store information in the directory, and all objects are defined in the schema. The object definitions contain information, such as data type and syntax, that the directory uses to ensure that the stored data is valid. No data can be stored in the directory unless the objects that are used to store the data are first defined in the schema. The default schema contains all the object definitions that Active Directory needs to function; however, you can also add object definitions to the schema.

While the directory is exposed to you through a logical structure that consists of elements such as domains and forests, the directory itself is implemented through a physical structure that consists of a database that is stored on all domain controllers in a forest. The Active Directory data store handles all access to the database. The data store consists of both services and physical files. These services and physical files make the directory available, and they manage the processes of reading and writing the data inside the database that exists on the hard disk of each domain controller.

Active Directory Structure and Storage Architecture

The Active Directory structure and storage architecture consists of four parts:

• Active Directory domains and forests. Forests, domains, and organizational units (OUs) make up the core elements of the Active Directory logical structure. A forest defines a single directory and represents a security boundary. Forests contain domains.

• Domain Name System (DNS) support for Active Directory. DNS provides a name resolution service for domain controller location and a hierarchical design that Active Directory can use to provide a naming convention that can reflect organizational structure.

• Schema. The schema provides object definitions that are used to create the objects that are stored in the directory.

• Data store. The data store is the portion of the directory that manages the storage and retrieval of data on each domain controller.

  The following figure illustrates the Active Directory data structure and storage architecture.

Active Directory Data Structure and Storage Architecture

Active Directory Domains and Forests

Domains partition the directory into smaller sections within a single forest. This partitioning results in more control over how data is replicated so that an efficient replication topology can be established and network bandwidth is not wasted by replicating data where it is not required. OUs make it possible to group resources in a domain for management purposes, such as applying Group Policy or delegating control to administrators.

The following figure illustrates the relationships of OUs, domains, and forests in the logical structure architecture.

Logical Structure Architecture

DNS Support for Active Directory

Active Directory uses DNS as its domain controller location mechanism. When any of the principal Active Directory operations, such as authentication, updating, or searching, is performed, domain joined computers use DNS to locate Active Directory domain controllers, and these domain controllers use DNS to locate each other. For example, when a network user with an Active Directory user account logs on to an Active Directory domain, the user’s computer uses DNS to locate a domain controller for the Active Directory domain to which the user wants to log on.

To log on to a network that consists of an Active Directory forest, a client workstation must first be able to locate a nearby domain controller. The domain controller is necessary for initial authentication of both the workstation and the user and for subsequent authorization of the user for the files and resources to which the user needs access. The support that is provided to Active Directory by DNS enables a client workstation to locate a domain controller.

Active Directory Schema

The Active Directory schema contains definitions for all the objects that are used to store information in the directory. There is one schema per forest. However, a copy of the schema exists on every domain controller in the forest. This way, every domain controller has quick access to any object definition that it might need, and every domain controller uses the same definition when it creates a given object. The data store relies on the schema to provide object definitions, and the data store uses those definitions to enforce data integrity. The result is that all objects are created uniformly, and it does not matter which domain controller creates or modifies an object because all domain controllers use the same object definition.

The following figure illustrates the relationship of the schema to the data store in the schema architecture.

Schema Architecture

Active Directory Data Store

The Active Directory data store is made up of several components that together provide directory services to directory clients. These components include the following:

• Four interfaces:

  • Lightweight Directory Access Protocol (LDAP)

  • Replication (REPL) and domain controller management interface

  • Messaging API (MAPI)

  • Security Accounts Manager (SAM)

• Three service components:

  • Directory System Agent (DSA)

  • The database layer

  • Extensible Storage Engine (ESE)

• The directory database where the data is actually stored

The following figure illustrates the relationships of these components in the data store architecture.

Data Store Architecture

Active Directory Structure and Storage Components

You can define some components for structure and storage in Active Directory, while others are defined by the system and cannot be modified.

• Forests, domains, and OUs are components that constitute the logical structure of Active Directory. You define them during the installation of Active Directory.

• DNS support for Active Directory includes components that are used to locate domain controllers and that use DNS naming schemes. Each domain in a forest must adhere to DNS naming schemes, and domains are organized in a root and subordinate domain hierarchy.

• The schema is a single component that exists inside the directory. The schema contains definitions of the objects that are used to store information in the directory. These object definitions include two primary components: classSchema objects and attributeSchema objects.

• The data store consists of three layers of components. The first layer provides the interfaces that clients need to access the directory. The second layer provides the services that perform the operations that are associated with reading data from and writing data to the directory database. The third layer is the database itself, which exists as a single file on the hard disk of each domain controller.

Active Directory Domains and Forests

The logical structure of Active Directory is a hierarchical structure of Active Directory domains and OUs in a forest. The relationships of the components in the logical structure control access to stored data, and they control how information is replicated between the various domain controllers in the forest. The main components of the Active Directory logical structure are described in the following table.

Domain and Forest Components

DNS Support for Active Directory

In Active Directory, DNS is the means by which directory clients locate, or discover, domain controllers. The primary components of the architecture for DNS support of Active Directory include the domain controller Locator, Active Directory domain names in DNS, and Active Directory DNS objects.

The following table describes the Active Directory components that help directory clients locate nearby domain controllers.

Active Directory DNS Support Components

For more information about DNS support for Active Directory, see “DNS Support for Active Directory Technical Reference.”

Active Directory Schema

Everything that is stored in Active Directory is stored in an object. A definition for every type of object is stored in the schema. The definitions themselves consist of two types of objects: class objects and attribute objects. Classes define groups of attributes that are used to describe common objects. New object definitions are created by combining various class objects and attribute objects to make new combinations that contain the necessary attributes to meet the storage requirements of the new object type. The two main types of object definitions that are stored in the Active Directory schema are described in the following table.

Schema Components

Active Directory Data Store

The Active Directory data store is implemented on every domain controller in the forest. The data store consists of components that store and retrieve data inside the directory. The components of the Active Directory data store are described in the following table.

Data Store Components