AD域级别和林级别提升的好处

简介:

有问,我将域级别和林级别提升了后,可以有什么好处呢?

功能级别决定可用的 Active Directory 域服务 (AD DS) 的域或林功能。它们还决定哪些 Windows Server 操作系统可以在域或林中的域控制器上运行。但是,功能级别不会影响哪些操作系统可以在加入到域或林的工作站和成员服务器上运行。

 

image 
 

以下列出了每个域功能级别可用的功能。

 

域功能级别

可用的功能

支持的域控制器操作系统

Windows 2000 native

All of the default AD DS features and the following directory features are available:

  • Universal groups for both distribution and security groups.
  • Group nesting
  • Group conversion, which allows conversion between security and distribution groups
  • Security identifier (SID) history

clip_image001Note

In Windows Server 2008 R2, the Personal Virtual Desktop feature was introduced. It requires the Windows 2000 native domain functional level.

  • Windows 2000
  • Windows Server 2003
  • Windows Server 2008
  • Windows Server 2008 R2

Windows Server 2003

All the default AD DS features, all the features that are available at the Windows 2000 native domain functional level, and the following features are available:

  • The domain management tool, Netdom.exe, which makes it possible for you to rename domain controllers
  • Logon time stamp updates 
    The lastLogonTimestamp attribute is updated with the last logon time of the user or computer. This attribute is replicated within the domain.
  • The ability to set the userPassword attribute as the effective password on inetOrgPerson and user objects
  • The ability to redirect Users and Computers containers 
    By default, two well-known containers are provided for housing computer and user accounts, namely, cn=Computers,<domain root> and cn=Users,<domain root>. This feature allows the definition of a new, well-known location for these accounts.
  • The ability for Authorization Manager to store its authorization policies in AD DS
  • Constrained delegation 
    Constrained delegation makes it possible for applications to take advantage of the secure delegation of user credentials by means of Kerberos-based authentication. 
    You can restrict delegation to specific destination services only.
  • Selective authentication 
    Selective authentication makes it is possible for you to specify the users and groups from a trusted forest who are allowed to authenticate to resource servers in a trusting forest.
  • Windows Server 2003
  • Windows Server 2008
  • Windows Server 2008 R2

Windows Server 2008

All of the default AD DS features, all of the features from the Windows Server 2003 domain functional level, and the following features are available:

  • Distributed File System (DFS) replication support for the Windows Server 2003 System Volume (SYSVOL)
    DFS replication support provides more robust and detailed replication of SYSVOL contents.
  • Domain-based DFS namespaces running in Windows Server 2008 Mode, which includes support for access-based enumeration and increased scalability. Domain-based namespaces in Windows Server 2008 mode also require the forest to use the Windows Server 2003 forest functional level. For more information, seeChoose a Namespace Type (http://go.microsoft.com/fwlink/?LinkId=180400).
  • Advanced Encryption Standard (AES 128 and AES 256) support for the Kerberos protocol
  • Last Interactive Logon Information 
    Last Interactive Logon Information displays the following information:
    • The total number of failed logon attempts at a domain-joined Windows Server 2008 server or a Windows Vista workstation
    • The total number of failed logon attempts after a successful logon to a Windows Server 2008 server or a Windows Vista workstation
    • The time of the last failed logon attempt at a Windows Server 2008 or a Windows Vista workstation
    • The time of the last successful logon attempt at a Windows Server 2008 server or a Windows Vista workstation

For more information, see Active Directory Domain Services: Last Interactive Logon (http://go.microsoft.com/fwlink/?LinkId=180387).

  • Fine-grained password policies 
    Fine-grained password policies make it possible for you to specify password and account lockout policies for users and global security groups in a domain. For more information, see Step-by-Step Guide for Fine-Grained Password and Account Lockout Policy Configuration (
    http://go.microsoft.com/fwlink/?LinkID=91477).
  • Personal Virtual Desktops 
    To use the added functionality provided by the Personal Virtual Desktop tab in the User Account Properties dialog box in Active Directory Users and Computers, your AD DS schema must be extended for Windows Server 2008 R2 (schema object version = 47). For more information, see 
    Deploying Personal Virtual Desktops by Using RemoteApp and Desktop Connection Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkId=183552).
  • Windows Server 2008
  • Windows Server 2008 R2

Windows Server 2008 R2

All default Active Directory features, all features from the Windows Server 2008 domain functional level, plus the following features:

  • Authentication mechanism assurance, which packages information about the type of logon method (smart card or user name/password) that is used to authenticate domain users inside each user’s Kerberos token. When this feature is enabled in a network environment that has deployed a federated identity management infrastructure, such as Active Directory Federation Services (AD FS), the information in the token can then be extracted whenever a user attempts to access any claims-aware application that has been developed to determine authorization based on a user’s logon method.
  • Automatic SPN management for services running on a particular computer under the context of a Managed Service Account when the name or DNS host name of the machine account changes. For more information about Managed Service Accounts, see Service Accounts Step-by-Step Guide (http://go.microsoft.com/fwlink/?LinkId=180401).
  • Windows Server 2008 R2

 

 

林功能级别

可用的功能

支持的域控制器操作系统

Windows 2000 native

All of the default AD DS features are available.

  • Windows Server 2008 R2
  • Windows Server 2008
  • Windows Server 2003
  • Windows 2000

Windows Server 2003

All of the default AD DS features, and the following features, are available:

  • Forest trust
  • Domain rename
  • Linked-value replication 
    Linked-value replication makes it possible for you to change group membership to store and replicate values for individual members instead of replicating the entire membership as a single unit. Storing and replicating the values of individual members uses less network bandwidth and fewer processor cycles during replication, and prevents you from losing updates when you add or remove multiple members concurrently at different domain controllers.
  • The ability to deploy a read-only domain controller (RODC)
  • Improved Knowledge Consistency Checker (KCC) algorithms and scalability 
    The intersite topology generator (ISTG) uses improved algorithms that scale to support forests with a greater number of sites than AD DS can support at the Windows 2000 forest functional level. The improved ISTG election algorithm is a less-intrusive mechanism for choosing the ISTG at the Windows 2000 forest functional level.
  • The ability to create instances of the dynamic auxiliary class named dynamicObject in a domain directory partition
  • The ability to convert an inetOrgPerson object instance into a User object instance, and to complete the conversion in the opposite direction
  • The ability to create instances of new group types to support role-based authorization. 
    These types are called application basic groups and LDAP query groups.
  • Deactivation and redefinition of attributes and classes in the schema. The following attributes can be reused: ldapDisplayName, schemaIdGuid, OID, and mapiID.
  • Domain-based DFS namespaces running in Windows Server 2008 Mode, which includes support for access-based enumeration and increased scalability. For more information, see Choose a Namespace Type (http://go.microsoft.com/fwlink/?LinkId=180400).
  • Windows Server 2003
  • Windows Server 2008
  • Windows Server 2008 R2

Windows Server 2008

All of the features that are available at the Windows Server 2003 forest functional level, but no additional features are available. All domains that are subsequently added to the forest, however, operate at the Windows Server 2008 domain functional level by default.

  • Windows Server 2008
  • Windows Server 2008 R2

Windows Server 2008 R2

All of the features that are available at the Windows Server 2003 forest functional level, plus the following features:

  • Active Directory Recycle Bin, which provides the ability to restore deleted objects in their entirety while AD DS is running.

All domains that are subsequently added to the forest will operate at the Windows Server 2008 R2 domain functional level by default.

If you plan to include only domain controllers that run Windows Server 2008 R2 in the entire forest, you might choose this forest functional level for administrative convenience. If you do, you will never have to raise the domain functional level for each domain that you create in the forest.

  • Windows Server 2008 R2

 

 




本文转自 VirtualTom 51CTO博客,原文链接:http://blog.51cto.com/virtualtom/1092666,如需转载请自行联系原作者

目录
相关文章
|
2月前
|
存储 域名解析 网络协议
AD域的搭建和操作使用
AD域的搭建和操作使用
|
11月前
|
安全 定位技术 数据安全/隐私保护
域环境管理
域环境管理
165 0
|
Windows
AD域中常见属性名词解释
<div class="markdown_views"><p><strong>AD域中常见属性名词解释</strong> <br> Active Directory(AD)活动目录 <br> schema对象模型 <br> Organizational Unit(OU)组织单位 <br> Distinguished name(DN)识别名 <br> Canonical Name
1932 0
|
运维 安全 数据安全/隐私保护
使用管控策略,设定多账号组织全局访问边界
企业上云多账号架构中,如何做到从上到下管理的同时,处理好员工的权限边界问题?
4966 0
|
关系型数据库 数据库
通用数据级别权限的框架设计与实现(2)-数据权限的准备工作
查看上篇文章通用数据级别权限的框架设计(1)-相关业务场景的分析",我们要继续做一些准备工作。 我们先要设置当前用户信息的类 /** * @description: 用户对象 * @author: starmark * @create: 2...
852 0
|
算法 数据安全/隐私保护 Windows
|
数据安全/隐私保护 网络协议

热门文章

最新文章

  • 1
    流量控制系统,用正则表达式提取汉字
    25
  • 2
    Redis09-----List类型,有序,元素可以重复,插入和删除快,查询速度一般,一般保存一些有顺序的数据,如朋友圈点赞列表,评论列表等,LPUSH user 1 2 3可以一个一个推
    26
  • 3
    Redis08命令-Hash类型,也叫散列,其中value是一个无序字典,类似于java的HashMap结构,Hash结构可以将对象中的每个字段独立存储,可以针对每字段做CRUD
    25
  • 4
    Redis07命令-String类型字符串,不管是哪种格式,底层都是字节数组形式存储的,最大空间不超过512m,SET添加,MSET批量添加,INCRBY age 2可以,MSET,INCRSETEX
    27
  • 5
    S外部函数可以访问函数内部的变量的闭包-闭包最简单的用不了,闭包是内层函数+外层函数的变量,简称为函数套函数,外部函数可以访问函数内部的变量,存在函数套函数
    23
  • 6
    Redis06-Redis常用的命令,模糊的搜索查询往往会对服务器产生很大的压力,MSET k1 v1 k2 v2 k3 v3 添加,DEL是删除的意思,EXISTS age 可以用来查询是否有存在1
    29
  • 7
    Redis05数据结构介绍,数据结构介绍,官方网站中看到
    21
  • 8
    JS字符串数据类型转换,字符串如何转成变量,+号只要有一个是字符串,就会把另外一个转成字符串,- * / 都会把数据转成数字类型,数字型控制台是蓝色,字符型控制台是黑色,
    19
  • 9
    JS数组操作---删除,arr.pop()方法从数组中删除最后一个元素,并返回该元素的值,arr.shift() 删除第一个值,arr.splice()方法,删除指定元素,arr.splice,从第一
    19
  • 10
    定义好变量,${age}模版字符串,对象可以放null,检验数据类型console.log(typeof str)
    19