AD DS maintenance. Any clients that are specifically bound to a stopped domain controller would simply contact another domain controller through discovery. Read-Only Domain Controllers (RODCs) A read-only domain controller (RODC) is a new type of domain controller available in the Windows Server 2008 operating system, designed primarily to be deployed in remote locations. RODC is covered in detail in the Remote Locations section of this paper. Server and Domain Isolation In a Microsoft Windows-based network, administrators can logically isolate server and domain resources to limit access to authenticated and authorized computers. For example, a logical network can be created inside the existing physical network, where computers share a common set of requirements for secure communications. Each computer in this logically isolated network must provide authentication credentials to other computers in the isolated network in order to establish connectivity. This isolation prevents unauthorized computers and programs from gaining access to resources inappropriately. Requests from computers that are not part of the isolated network are ignored. Two types of isolation can be used to protect a network: Server isolation—In a server isolation scenario, specific servers are configured using IPSec policy to accept only authenticated communications from other computers. For example, the database server can be configured to accept connections from the Web application server only. Domain isolation—To isolate a domain, administrators can use Active Directory domain membership to ensure that domain member computers accept only authenticated and secured communications from domain member computers. The isolated network consists of only computers that are part of the domain. Domain isolation uses IPSec policy to provide protection for traffic sent between domain members, including all client and server computers. Server and domain isolation can help protect specific high-value servers and data as well as protect managed computers from unmanaged or rogue computers and users.
AD DS maintenance. Any clients that are specifically bound to a stopped domain controller would simply contact another domain controller through discovery. Read-Only Domain Controllers (RODCs) A read-only domain controller (RODC) is a new type of domain controller available in the Windows Server 2008 operating system, designed primarily to be deployed in remote locations. RODC is covered in detail in the Remote Locations section of this paper. Server and Domain Isolation In a Microsoft Windows-based network, administrators can logically isolate server and domain resources to limit access to authenticated and authorized computers. For example, a logical network can be created inside the existing physical network, where computers share a common set of requirements for secure communications. Each computer in this logically isolated network must provide authentication credentials to other computers in the isolated network in order to establish connectivity. This isolation prevents unauthorized computers and programs from gaining access to resources inappropriately. Requests from computers that are not part of the isolated network are ignored. Two types of isolation can be used to protect a network: Server isolation—In a server isolation scenario, specific servers are configured using IPSec policy to accept only authenticated communications from other computers. For example, the database server can be configured to accept connections from the Web application server only. Domain isolation—To isolate a domain, administrators can use Active Directory domain membership to ensure that domain member computers accept only authenticated and secured communications from domain member computers. The isolated network consists of only computers that are part of the domain. Domain isolation uses IPSec policy to provide protection for traffic sent between domain members, including all client and server computers. Server and domain isolation can help protect specific high-value servers and data as well as protect managed computers from unmanaged or rogue computers and users.
WS08TechnicalOverviewFinal_En.docx