Best practices for Active Directory Sites and Services
Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2
Best practices for Active Directory Sites and Services
Establish as a site every geographic area that requires fast access to the latest directory information.
Establishing areas that require immediate access to up-to-date directory information as separate sites will provide the resources required to meet your needs.
For more information, see Create a site.
Place at least one domain controller in every site, and create a global catalog on at least one domain controller in each site.
Sites that do not have their own domain controllers and at least one global catalog are dependent on other sites for directory information, making the utilization of network bandwidth between sites less efficient.
For more information, see Create a new forest and Enable or disable a global catalog.
Monitor replication regularly.
To help ensure a healthy network, monitor replication regularly. For more information, see Troubleshooting replication.
All sites must be associated with at least one subnet and in at least one site link, or they will not be usable.
For more information, see Associate a subnet with a site and Add a site to a site link.
Install an enterprise certification authority (CA) if any of your site links will use SMTP.
If you choose to use SMTP over site links, you must install an enterprise CA. The CA signs SMTP messages that are exchanged between domain controllers, ensuring the authenticity of directory updates.
For more information, see Installing and configuring a certification authority.
As a security best practice, it is recommended that you do not log on to your computer with administrative credentials.
When you are logged on to your computer without administrative credentials, you can use Run as to accomplish administrative tasks.
For more information, see Why you should not run your computer as an administrator and Using Run as.
To further secure Active Directory, it is recommended that you implement the following security guidelines:
Rename or disable the Administrator account (and guest account) in each domain to prevent attacks on your domains. For more information, see User and computer accounts.
Physically secure all domain controllers in a locked room. For more information, see Domain controllers and Securing Active Directory.
Manage the security relationship between two forests and simplify security administration and authentication across forests. For more information, see Forest trusts.
To provide additional protection for the Active Directory schema, remove all users from the Schema Admins group, and add a user to the group only when schema changes need to be made. Once the change has been made remove the user from the group.
Restrict user, group, and computer access to shared resources and to filter Group Policy settings. For more information, see Group types.
Avoid disabling the use of signed or encrypted LDAP traffic for Active Directory administrative tools. For more information, see Connecting to domain controllers running Windows 2000.
Some default user rights assigned to specific default groups may allow members of those groups to gain additional rights in the domain, including administrative rights. Therefore, your organization must equally trust all personnel that are members of the Enterprise Admins, Domain Admins, Account Operators, Server Operators, Print Operators and Backup Operators groups. For more information about these groups, see Default groups.
For general security information about Active Directory, see Security information for Active Directory and Securing Active Directory.