Infrastructure Planning

 

 

Infrastructure Planning is the process of designing and managing the complete IT environment of an organization so that business operations can run smoothly and continuously. It includes planning for servers, networking, storage, security, backup solutions, virtualization, and cloud integration. Modern businesses depend heavily on IT infrastructure because every application, database, and communication service runs on it.

Without proper infrastructure planning, organizations may experience downtime, slow application performance, data loss, security issues, and high maintenance costs. A properly designed infrastructure should always be scalable, secure, fault tolerant, high performing, and easy to manage.

Modern infrastructure planning mainly focuses on:

  • Data Center Design
  • Server Capacity Planning
  • Network Design
  • Security Strategy
  • Backup & Disaster Recovery
  • Virtualization & Cloud Integration

 

Importance of Infrastructure Planning

 

As businesses became more dependent on digital services, infrastructure planning also became critical. Today organizations rely on cloud platforms, online applications, remote access systems, email services, and databases for daily operations. Even a small infrastructure failure can affect productivity, customer experience, and revenue.

Banks require continuous availability for online transactions and ATM services, hospitals depend on patient databases and monitoring systems, and e-commerce companies require scalable infrastructure during high-traffic sales periods. Proper infrastructure planning helps organizations maintain business continuity, improve security, reduce downtime, and support future growth.

 

Main Goals of Infrastructure Planning

 

High Availability

 

High Availability (HA) ensures that systems and services remain operational with minimum downtime. Modern organizations cannot afford long service interruptions because customers expect services to remain available all the time.

To achieve High Availability, organizations use technologies such as redundant servers, failover clustering, load balancing, backup power systems, disaster recovery sites, and redundant networking paths.

Main benefits of High Availability include:

  • Reduced downtime
  • Better customer trust
  • Continuous business operations
  • Support for mission-critical applications

 

Scalability

 

Scalability refers to the ability of infrastructure to handle increasing workloads and future business growth without major redesign.

There are two types of scalability:

 

Vertical Scaling

 

Vertical Scaling means increasing resources inside the same server. This may include adding more RAM, upgrading CPUs, or increasing storage capacity. It is simple to implement but has hardware limitations.

 

Horizontal Scaling

 

Horizontal Scaling means adding additional servers to distribute workload across multiple systems. This method provides better scalability and fault tolerance but requires more complex management.

Large organizations and cloud environments commonly use horizontal scaling to handle high workloads efficiently.

 

Security

 

Security is one of the most important goals of infrastructure planning because organizations continuously face cyber threats such as malware, ransomware, phishing attacks, and unauthorized access attempts.

A secure infrastructure protects:

  • Customer data
  • Financial records
  • Business applications
  • Databases
  • Cloud services

Organizations use multiple security layers including firewalls, IDS/IPS, antivirus solutions, MFA, RBAC, VPN security, and encryption technologies.

Proper security implementation helps reduce cyberattack risks, prevent unauthorized access, and protect business reputation.

 

Performance Optimization

 

Performance Optimization ensures that applications, databases, and network services operate efficiently without delays. Infrastructure performance depends on CPU power, RAM allocation, storage speed, network bandwidth, and workload distribution.

Organizations improve performance using SSD storage, load balancing, clustering, virtualization technologies, and resource monitoring tools.

Good performance optimization provides:

  • Faster application response
  • Better user experience
  • Increased productivity
  • Efficient workload handling

 

Business Continuity

 

Business Continuity refers to the ability of an organization to continue operations during failures, disasters, or cyberattacks. Modern businesses cannot afford long interruptions because downtime directly affects operations and customer trust.

To maintain business continuity, organizations implement:

  • Backup systems
  • Disaster Recovery sites
  • RAID storage
  • UPS & generator backup
  • High Availability clusters
  • Cloud replication

These technologies help minimize downtime, protect data, and improve recovery capability.

 

Designing a Data Center

 

A Data Center is a facility used to store servers, networking devices, storage systems, and other IT equipment. It acts as the central location for hosting applications, databases, virtualization platforms, and enterprise services.

A properly designed data center improves:

  • Availability
  • Cooling efficiency
  • Power reliability
  • Physical security
  • Resource management
  • Business continuity

Without proper planning, organizations may face overheating, hardware failures, downtime, and security risks.

 

Data Center Tier Levels

Tier Levels define the reliability, redundancy, and uptime capability of a data center.

 

Tier I – Basic Data Center

 

Tier I is the simplest data center design with minimal redundancy. It uses a single power source and a single cooling path. It provides approximately 99.67% uptime and is suitable for small businesses or non-critical environments.

 

Tier II – Redundant Capacity

 

Tier II improves reliability by adding partial redundancy such as backup UPS systems and backup cooling components. It provides approximately 99.74% uptime and is suitable for medium-sized organizations.

 

Tier III – Concurrently Maintainable

 

Tier III allows maintenance activities without shutting down operations. It includes multiple power paths and redundant cooling systems. This design is commonly used in enterprise environments and provides approximately 99.982% uptime.

 

Tier IV – Fault Tolerant

 

 

Tier IV provides the highest level of redundancy and fault tolerance. It includes fully redundant infrastructure with no single point of failure. It provides approximately 99.995% uptime and is used in mission-critical environments.

 

Rack Layout & Cooling Design

 

Servers and networking devices are installed inside racks. Proper rack planning improves airflow, cable management, maintenance accessibility, and cooling efficiency.

Good rack design includes:

  • Proper spacing between racks
  • Organized cable management
  • Balanced power distribution
  • Easy front and rear access

 

 

Data centers also use Hot Aisle / Cold Aisle architecture to improve cooling efficiency. Cold aisles supply cool air to the front of servers, while hot aisles collect hot exhaust air from the rear side.

This design helps:

  • Reduce overheating
  • Improve airflow
  • Lower power consumption
  • Increase hardware lifespan

 

 

Power Redundancy

 

Continuous power supply is essential in enterprise environments because power failures may shut down servers and interrupt business operations.

Organizations use:

  • UPS systems
  • Generator backup

UPS (Uninterruptible Power Supply) provides temporary battery backup during power failure and prevents sudden shutdown.

Generators provide long-term backup power and maintain continuous operations during electricity outages.

 

Structured Cabling

 

Structured cabling is the organized installation of network cables inside the data center. Proper cabling improves scalability, airflow, troubleshooting, and network reliability.

Common cable types include:

Cat6 / Cat6a

Used for Ethernet networking and high-speed LAN communication.

Fiber Optic Cable

Used for backbone connectivity, high-speed networking, and long-distance communication.

Fiber optic cables provide very high speed, high bandwidth, and low signal loss.

 

Physical Security in Data Centers

 

Physical security protects infrastructure from unauthorized physical access and damage.

Enterprise data centers use:

  • Biometric access control
  • CCTV monitoring
  • Fire suppression systems

Biometric systems use fingerprint scanning, face recognition, or iris scanning for authentication. CCTV systems continuously monitor activities inside the data center.

Traditional water-based fire systems can damage IT equipment, so modern data centers use gas-based fire suppression systems and advanced smoke detectors.

 

Server Capacity Planning

 

Server Capacity Planning is the process of estimating hardware resources required for enterprise workloads. Organizations must carefully analyze CPU, RAM, storage, and network requirements before deploying servers.

The main objectives of server capacity planning are:

  • High performance
  • Resource optimization
  • Scalability
  • Reliability
  • Cost efficiency

Poor planning may lead to under-provisioning or over-provisioning.

 

Workload Requirements

 

Different applications require different hardware resources.

Web servers generally require moderate CPU and RAM with fast network connectivity.

Database servers are resource intensive and require high CPU power, large RAM capacity, and high-speed SSD storage.

Active Directory servers require stable performance and high availability because authentication services are critical.

File servers mainly require large storage capacity, redundancy, and backup solutions.

 

CPU Planning

 

CPU Planning determines the processing power required for servers. CPU performance depends on:

  • Core count
  • Threads
  • Clock speed

Small environments generally require 4–8 CPU cores, medium environments require 8–16 cores, and enterprise environments may require 16 or more cores.

If CPU resources are insufficient, applications may become slow and unresponsive.

 

RAM Planning

 

RAM directly affects application speed, multitasking capability, and virtualization performance.

Infrastructure architects commonly use the following approach:

Required RAM + 20–30% additional buffer

Typical RAM allocation:

  • Small Server → 8–16 GB
  • Medium Server → 32–64 GB
  • Virtualization Host → 128 GB or higher

Virtualization environments require large memory capacity because multiple virtual machines share physical resources.

 

Storage Planning

 

Storage planning focuses on storage capacity, performance, redundancy, and future scalability.

Poor storage planning may cause:

  • Slow performance
  • Downtime
  • Data loss
  • Scalability issues

Organizations commonly use RAID technologies for fault tolerance and performance improvement.

RAID 0 : Provides high performance but no fault tolerance.

RAID 1 : Uses disk mirroring for better protection and redundancy.

RAID 5 : Provides balanced performance and good redundancy using parity.

RAID 10 : Combines mirroring and striping for high performance and excellent fault tolerance.

 

 

Virtualization in Capacity Planning

 

Modern infrastructures heavily use virtualization platforms such as Hyper-V and VMware. Virtualization allows multiple virtual machines to run on a single physical server.

Benefits of virtualization include:

  • Better resource utilization
  • Reduced hardware cost
  • Easier deployment
  • Centralized management
  • High Availability support

Administrators must carefully calculate total CPU, RAM, storage, and scalability requirements for all virtual machines.

 

Network Design

 

Network Design ensures reliable communication between servers, client devices, and applications.

Network design mainly includes:

  • Topology planning
  • VLAN segmentation
  • IP addressing
  • Subnetting
  • DHCP
  • Routing
  • Network security

Poor network design may result in congestion, broadcast storms, communication failures, and security vulnerabilities.

 

Network Topologies

A network topology defines how devices communicate inside a network.

 

Star Topology

Star topology is the most commonly used topology where all devices connect to a central switch.

Advantages:

  • Easy management
  • Better scalability
  • Easy troubleshooting

Mesh Topology

Mesh topology provides multiple communication paths between devices.

Advantages:

  • High redundancy
  • Better fault tolerance
  • High availability

Hybrid Topology

Hybrid topology combines multiple topology types together and is commonly used in enterprise environments.

 

VLAN Segmentation

 

VLAN (Virtual Local Area Network) logically divides a physical network into multiple smaller networks.

Examples:

  • VLAN 10 → HR Department
  • VLAN 20 → IT Department
  • VLAN 30 → Finance Department

VLANs improve:

  • Security isolation
  • Broadcast management
  • Network performance
  • Administrative control

 

 

IP Addressing & Subnetting

 

IP Addressing assigns unique logical addresses to network devices.

Organizations commonly use private IP ranges such as:

  • 10.x.x.x
  • 172.16.x.x – 172.31.x.x
  • 192.168.x.x

Subnetting divides a large network into smaller subnetworks to improve organization, security, and traffic management.

Example:

  • HR → 192.168.10.0/24
  • IT → 192.168.20.0/24
  • Finance → 192.168.30.0/24

 

DHCP & Inter-VLAN Routing

 

DHCP automatically assigns:

  • IP addresses
  • Subnet masks
  • Default gateway
  • DNS information

DHCP reduces manual configuration and prevents IP conflicts.

Devices inside different VLANs cannot communicate directly. Inter-VLAN Routing is required for communication between VLANs and is usually implemented using Layer 3 switches or routers.

 

Layer 2 vs Layer 3 Switch

 

A Layer 2 switch performs switching inside the same VLAN using MAC addresses.

A Layer 3 switch supports both switching and routing. It allows Inter-VLAN communication and provides better scalability and routing performance.

 

Security Strategy

 

Security Strategy focuses on protecting systems, data, applications, and user accounts from cyber threats.

Modern enterprise security follows:

  • Prevention
  • Protection
  • Detection
  • Monitoring
  • Recovery

Organizations use multiple security layers together instead of depending on a single solution.

 

CIA Triad

The CIA Triad is the foundation of Information Security.

 

Confidentiality

Confidentiality ensures that sensitive information is accessible only to authorized users.

Security controls include:

  • Encryption
  • Password protection
  • MFA
  • Access control

 

Integrity

Integrity ensures that data remains accurate and unmodified.

Methods used:

  • Hashing
  • Digital signatures
  • Audit logs

 

Availability

Availability ensures that systems and services remain accessible whenever required.

Organizations maintain availability using:

  • Backup systems
  • Redundant infrastructure
  • UPS systems
  • Disaster Recovery solutions

 

Defense in Depth

 

Defense in Depth means implementing multiple security layers so that if one layer fails, another layer continues protecting the infrastructure.

Examples include:

  • Firewalls
  • IDS/IPS
  • Antivirus
  • MFA
  • Backup systems

This layered approach improves enterprise security.

 

Firewall, IDS & IPS

 

A Firewall monitors and controls incoming and outgoing network traffic. It blocks unauthorized access and filters communication.

IDS (Intrusion Detection System) detects suspicious activities and generates alerts.

IPS (Intrusion Prevention System) actively blocks malicious traffic and prevents attacks in real time.

 

Antivirus & EDR

 

Antivirus software protects systems from viruses, malware, worms, and Trojans.

EDR (Endpoint Detection & Response) continuously monitors endpoint activities and detects advanced threats using behavioral analysis and threat monitoring.

 

Multi-Factor Authentication (MFA)

 

MFA improves login security by requiring multiple verification methods such as passwords, OTPs, fingerprint scans, or authentication apps.

MFA significantly reduces unauthorized access risks.

 

Least Privilege & RBAC

 

Least Privilege means users receive only the minimum permissions required for their work.

RBAC (Role-Based Access Control) assigns permissions based on user roles such as HR Manager, IT Administrator, or Helpdesk Technician.

These methods improve security and simplify permission management.

 

Patch Management

 

Patch Management is the process of regularly updating operating systems and applications.

Updates help:

  • Fix vulnerabilities
  • Improve security
  • Resolve bugs
  • Improve performance

Regular patching is essential for maintaining secure infrastructure.

 

Backup Strategy

 

Backups protect organizations from hardware failure, ransomware, accidental deletion, and data corruption.

Organizations commonly follow the 3-2-1 Backup Rule:

  • Keep 3 copies of data
  • Store backups on 2 different media types
  • Keep 1 backup copy offsite

A proper backup strategy improves disaster recovery capability and business continuity.

 

QUESTIONS:

 

Q1. Can you explain what a data center is and why organizations use it?

A Data Center is a centralized facility used to store, manage, and operate servers, networking devices, storage systems, and other IT infrastructure.

 

Q2. Why is proper Data Center Design important in enterprise infrastructure?

Proper Data Center Design improves performance, availability, cooling efficiency, scalability, and business continuity.

 

Q3. What are the major factors affected by Data Center Design?

  • Performance
  • Availability
  • Security
  • Scalability
  • Cooling Efficiency
  • Infrastructure Reliability

 

Q4. What do you understand by Tier Levels in a Data Center?

Tier Level defines the reliability, redundancy, and uptime capability of a data center.

 

Q5. What is the difference between Tier III and Tier IV Data Centers?

Tier III supports maintenance without downtime, while Tier IV provides complete fault tolerance with no single point of failure.

 

Q6. Why is Rack Layout Planning important in a Data Center?

Rack Layout Planning is the process of organizing servers, storage devices, and networking equipment properly inside racks for better airflow and maintenance.

 

Q7. Can you explain the Hot Aisle and Cold Aisle concept?

Hot/Cold Aisle Design is a cooling method where cold air is supplied from the front of racks and hot air is exhausted from the rear side.

 

Q8. What is the role of a UPS in a Data Center?

UPS (Uninterruptible Power Supply) provides temporary battery backup during power failure and prevents sudden shutdown.

 

Q9. Why is Structured Cabling important in enterprise environments?

Structured Cabling improves network organization, troubleshooting, airflow management, and scalability.

 

Q10. What physical security methods are commonly used in Data Centers?

  • Biometric access control
  • CCTV monitoring
  • Access cards
  • Fire suppression systems

 

Q11. What is Server Capacity Planning?

Server Capacity Planning is the process of estimating CPU, RAM, storage, and network resources required for workloads.

 

Q12. Why is Capacity Planning important before server deployment?

Capacity Planning helps maintain performance, scalability, reliability, and cost efficiency.

 

Q13. What is Under-Provisioning and what problems can it cause?

Under-Provisioning means allocating insufficient hardware resources, causing slow performance and instability.

 

Q14. What is Over-Provisioning?

Over-Provisioning means purchasing unnecessary hardware resources, increasing infrastructure cost and power consumption.

 

Q15. Which server workloads generally require high RAM and fast storage?

Database servers require high RAM and fast storage systems.

 

Q16. What is the role of CPU cores in server performance?

CPU cores allow processors to execute multiple tasks simultaneously and improve multitasking performance.

 

Q17. Why is RAM important in server environments?

RAM stores temporary data used by applications and directly affects server performance and multitasking.

 

Q18. Can you explain what RAID is?

RAID (Redundant Array of Independent Disks) is a storage technology used for redundancy, performance, and fault tolerance.

 

Q19. What is the difference between RAID 1 and RAID 5?

RAID 1 uses mirroring for high protection, while RAID 5 uses parity with balanced performance and redundancy.

 

Q20. What is Virtualization and why is it used?

Virtualization allows multiple virtual machines to run on a single physical server using technologies like Hyper-V and VMware.

 

Q21. What is Network Design?

Network Design is the process of planning network topology, IP addressing, VLANs, routing, and communication infrastructure.

 

Q22. What do you understand by Network Topology?

Network Topology defines how devices are connected and communicate within a network.

 

Q23. Which network topology is most commonly used in enterprise environments and why?

Star Topology is most commonly used because it provides easy management and scalability.

 

Q24. What is VLAN?

VLAN (Virtual Local Area Network) is used to logically divide a physical network into multiple separate networks.

 

Q25. Why are VLANs important in enterprise networks?

VLANs improve security, reduce broadcast traffic, and simplify network management.

 

Q26. What is IP Addressing?

IP Addressing is the process of assigning logical addresses to devices for communication in a network.

 

Q27. Can you explain the concept of Subnetting?

Subnetting is the process of dividing a large network into smaller subnetworks.

 

Q28. What is DHCP and why is it used?

DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses and network settings to devices.

 

Q29. What is the role of a Default Gateway?

A Default Gateway allows devices to communicate outside their local network.

 

Q30. What is Inter-VLAN Routing?

Inter-VLAN Routing allows communication between different VLANs using routers or Layer 3 switches.

 

Q31. What is a Security Strategy in IT infrastructure?

Security Strategy is the process of protecting infrastructure, systems, applications, and data from cyber threats and unauthorized access.

 

Q32. Can you explain the CIA Triad?

CIA Triad is the foundation of information security and includes Confidentiality, Integrity, and Availability.

 

Q33. What is Confidentiality in information security?

Confidentiality ensures that sensitive information is accessible only to authorized users.

 

Q34. What is Integrity in cybersecurity?

Integrity ensures that data remains accurate, consistent, and unmodified.

 

Q35. What is Availability in the CIA Triad?

Availability ensures that systems and services remain accessible whenever required.

 

Q36. What is Defense in Depth security?

Defense in Depth is a layered security approach where multiple security controls are implemented together.

 

Q37. What is the function of a Firewall?

A Firewall monitors and controls incoming and outgoing network traffic based on security rules.

 

Q38. What is the difference between IDS and IPS?

IDS detects suspicious activity and generates alerts, while IPS also blocks malicious traffic automatically.

 

Q39. What is MFA and why is it important?

MFA (Multi-Factor Authentication) requires multiple verification methods during user login for better security.

 

Q40. Can you explain the 3-2-1 Backup Rule?

The 3-2-1 Backup Rule means keeping 3 copies of data, on 2 different media types, with 1 copy stored offsite.


 Active Directory Domain Services (AD DS) Concepts

 

Active Directory Domain Services (AD DS) is one of the most important roles in Windows Server. It provides a centralized directory service that stores information about all users, computers, groups, printers, and other network resources.

In simple words, AD DS acts like a central database and management system for the entire organization. Instead of managing each computer separately, administrators can manage everything from one location.

For example, in a company with 500 employees, all usernames, passwords, computer accounts, and security policies can be stored and managed through Active Directory.

 

What is Active Directory Domain Services (AD DS)?

 

 

Active Directory Domain Services is a server role in Windows Server that:

  • Stores information about network objects. 
  • Authenticates users and computers. 
  • Authorizes access to resources. 
  • Applies security policies across the organization. 

It helps administrators control the complete IT environment from a centralized location.

 

What are Objects in Active Directory?

 

Anything that is stored and managed in Active Directory is called an object.

Common Active Directory objects include:

  • Users 
  • Computers 
  • Groups 
  • Printers 
  • Shared folders 
  • Organizational Units (OUs) 

Each object contains its own set of properties.

Example:

A user object contains:

  • Username 
  • Password 
  • Email address 
  • Department 
  • Permissions  

 

Key Functions of AD DS:

 

1. Centralized User and Computer Management

Administrators can create and manage all user and computer accounts from one central location.

2. Authentication

Active Directory verifies usernames and passwords when users log in.

3. Authorization

After successful authentication, Active Directory checks what resources the user is allowed to access.

4. Group Policy Management

Administrators can apply security and configuration settings to multiple computers and users at once.

5. Replication

Changes made on one Domain Controller are automatically copied to other Domain Controllers.

 

Example :

Suppose HCL Technologies has offices in Chennai, Bangalore, and Pune.

Using Active Directory Domain Services:

  • All employee accounts are stored centrally. 
  • Users log in using one username and password. 
  • Security policies are applied automatically. 
  • Employees can access authorized resources from any office. 

Without Active Directory, administrators would need to create and manage accounts separately on each server.

 

Domain, Tree, and Forest 

 

Active Directory uses a hierarchical structure to organize and manage objects. The three main logical components are:

  • Domain  
  • Tree 
  • Forest  

These components help administrators organize resources in a structured and scalable manner.

 

Domain

 

A Domain is the basic administrative and logical boundary in Active Directory.

It contains:

  • Users 
  • Computers  
  • Groups  
  • Policies  
  • Shared resources 

All objects inside a domain share:

  • A common database 
  • Common security policies 
  • A common DNS name 

Example:

company.local

In this domain, all users and computers can be managed centrally.

 

Tree

 

A Tree is a collection of one or more domains that share a contiguous namespace.

A contiguous namespace means that child domains use the parent domain name.

Example:

  • evision.com  
  • sales.evision.com  
  • hr.evision.com  

These domains form a tree because they share the same root domain name.

 

Forest

 

A Forest is the highest level in Active Directory.

It contains one or more trees and acts as the security boundary of Active Directory.

All domains in a forest share:

  • Schema  
  • Configuration information 
  • Global Catalog 
  • Trust relationships 

Example:

A company may have multiple trees and domains that all belong to one forest.

Important Point:

The Forest is the ultimate security boundary in Active Directory.

 

Organizational Unit (OU)

 

An Organizational Unit is a container used to organize objects within a domain.

 

OUs help administrators:

  • Group similar objects 
  • Delegate administrative control 
  • Apply Group Policies 

Example:

A domain may contain:

  • HR OU 
  • IT OU 
  • Finance OU 
  • Sales OU 

Each OU can have different policies.

 

 

Examples of Domain, Tree, and Forest:

 

Suppose a company named Evision has the following structure:

Forest:

  • evision.com  

Domains:

  • evision.com 
  • sales.evision.com 
  • hr.evision.com  

Organizational Units:

  • HR 
  • IT 
  • Finance  

Objects:

  • Users 
  • Computers 
  • Groups  

This structure allows easy management of a large organization.

 

Domain Controller Roles

 

A Domain Controller (DC) is a server that runs Active Directory Domain Services and stores a copy of the Active Directory database.

It is responsible for: 

  • Authenticating users 
  • Applying Group Policies 
  • Storing directory information 
  • Replicating data to other Domain Controllers 

In simple words, the Domain Controller is the server that manages the domain.

 

Responsibilities of a Domain Controller

 

A Domain Controller performs several important tasks:

  • User authentication (logon validation) 
  • Authorization (access control) 
  • Directory data storage 
  • Group Policy processing 
  • Replication between Domain Controllers 
  • DNS integration 
  • Time synchronization 

 

Types of Domain Controllers:-

 

  1. Writable Domain Controller : Allows administrators to make changes to Active Directory data.
  2. Read-Only Domain Controller (RODC) : Stores a read-only copy of the Active Directory database and is used in branch offices where physical security is limited.

 

Logical vs Physical Structure in Active Directory:

 

Active Directory is divided into two structures:

  1. Logical Structure 
  2. Physical Structure 

 

Logical Structure

 

The logical structure defines how objects are organized in Active Directory.

It includes:

  • Forest  
  • Tree 
  • Domain  
  • Organizational Unit (OU) 

Logical structure is used for:

  • Administration  
  • Delegation  
  • Policy management 

 

Physical Structure

 

The physical structure defines how Active Directory is deployed across the network.

It includes:

  • Sites 
  • Subnets 
  • Domain Controllers 

Physical structure is used for:

  • Replication control 
  • Traffic optimization 
  • Logon performance 

 

Site

 

A Site represents one or more well-connected IP subnets, usually corresponding to a physical location.

Examples:

  • Pune Office 
  • Bangalore Office 
  • Delhi Office 

Each office can be configured as a separate site.

 

Subnet

 

A Subnet is a range of IP addresses assigned to a location.

Example:

192.168.1.0/24

Subnets help Active Directory determine which site a computer belongs to.

 

Example (Logical vs Physical Structure):

 

A company may have:

Logical Structure:

  • Forest: hcl.com 
  • Domain: india.hcl.com 
  • OUs: HR, IT, Finance 

Physical Structure:

  • Sites: Jamshedpur, Bangalore, Pune 
  • Subnets assigned to each site 
  • Domain Controllers in each location 

This design allows centralized administration while optimizing replication and logon traffic.


AD DS Installation and Promotion to Domain Controller

 

After understanding the concepts of Active Directory Domain Services (AD DS), the next step is to install the AD DS role on a Windows Server and then promote that server to a Domain Controller.

Installing the role only copies the required Active Directory files and tools to the server. The server does not become a Domain Controller until it is promoted.

In simple words:

  • Install AD DS Role → Adds the Active Directory service to the server. 
  • Promote to Domain Controller → Configures the server to create or join a domain. 

 

What Happens During AD DS Installation?

 

When you install the AD DS role:

  • Active Directory binaries are installed. 
  • Administrative tools are added. 
  • The server is prepared to become a Domain Controller. 
  • No domain is created yet. 

After installation, a notification appears in Server Manager saying: Promote this server to a domain controller

 

Prerequisites Before Installing AD DS

 

Before installing Active Directory, make sure the following requirements are completed:

  • Windows Server is installed. 
  • A static IP address is configured. 
  • The server has a meaningful computer name. 
  • DNS settings are configured properly. 
  • The Administrator password is known. 
  • The server time and date are correct. 

 

Why is a Static IP Address Required

 

A Domain Controller must always be reachable at the same IP address.

If the IP changes automatically through DHCP:

  • Clients may not find the Domain Controller. 
  • DNS records may become incorrect. 
  • Authentication problems can occur. 

Example:

  • Server Name: DC01 
  • IP Address: 192.168.1.10 
  • Preferred DNS: 192.168.1.10 

 

AD DS Role Installation Steps:

 

The AD DS role can be installed using Server Manager.

Step 1: Open Server Manager

Server Manager opens automatically after login. It is the central console used to install and manage roles and features.

 

 

Step 2: Click "Add Roles and Features"

This launches the Add Roles and Features Wizard

 

 

Step 3: Select Installation Type

Choose: Role-based or feature-based installation

This option is used to install server roles such as AD DS, DNS, and DHCP.

 

 

Step 4: Select Destination Server

Select the local server where you want to install AD DS.

 

 

Example: DC01

Step 5: Select Server Roles

Check: Active Directory Domain Servicesà (A pop-up window appears asking to install required management tools).

Click: Add Features

 

 

Step 6: Continue Through the Wizard

Click Next until the Confirmation page appears.

 

Step 7: Click Install

The AD DS role will be installed.

 

 

Step 8: Close the Wizard

Once installation completes, close the wizard.

At this stage, the server is ready to be promoted to a Domain Controller.

 

Promote the Server to a Domain Controller

 

After installation, click the flag notification in Server Manager and select: Promote this server to a domain controller

This starts the Active Directory Domain Services Configuration Wizard

 

 

Deployment Configuration Options

You will see three options:

  1. Add a domain controller to an existing domain 
  2. Add a new domain to an existing forest 
  3. Add a new forest 

For a new environment, select:

Add a new forest

 

Root Domain Name

Enter the root domain name.

Examples:

  • company.local  
  • evision.com  
  • corp.local  

This becomes the first domain in the forest.

 

Domain Controller Options

Configure the following:

  • Forest functional level 
  • Domain functional level 
  • Domain Name System (DNS) Server 
  • Global Catalog (GC) 
  • Directory Services Restore Mode (DSRM) password 

 

DNS Server

Selecting this option installs DNS automatically on the Domain Controller.

DNS is required because Active Directory depends on DNS to locate services and Domain Controllers.

 

Global Catalog (GC)

The Global Catalog stores a partial copy of all objects in the forest and helps users search for objects quickly.

The first Domain Controller is automatically configured as a Global Catalog server.

 

DSRM Password

The Directory Services Restore Mode password is used when starting the server in recovery mode for Active Directory maintenance or restoration.

This password should be stored securely.

 

DNS Options

A warning about DNS delegation may appear if no existing DNS infrastructure is present.

This is normal in a new forest and can be safely ignored.

 

Additional Options

The wizard automatically generates the NetBIOS domain name.

Example:

  • Domain Name: company.local 
  • NetBIOS Name: COMPANY 

 

Paths for AD Database Files

Default paths are:

  • Database: C:\Windows\NTDS 
  • Log Files: C:\Windows\NTDS 
  • SYSVOL: C:\Windows\SYSVOL 

These folders store the Active Directory database and Group Policy files.

 

Prerequisite Check

The wizard checks whether all required settings are valid.

Warnings may appear, but if there are no errors, installation can continue.

 

Install and Restart

Click Install.

The server will:

  • Configure Active Directory. 
  • Install DNS if selected. 
  • Create the domain and forest. 
  • Restart automatically. 

After restart, the server becomes a Domain Controller.

 

Verifying Successful Installation

After logging in, you can verify the installation by checking:

  • Server Manager 
  • Active Directory Users and Computers 
  • Active Directory Domains and Trusts 
  • DNS Manager 

You should see your new domain and default containers.

 

Default Containers Created

When the first Domain Controller is created, Active Directory automatically creates:

  • Users  
  • Computers  
  • Domain Controllers 
  • Built-in  

These containers store default objects.

 

Example:

Suppose a company named Evision is setting up Active Directory for the first time.

The administrator performs the following steps:

  1. Installs Windows Server on DC01. 
  2. Assigns static IP 192.168.1.10. 
  3. Installs the AD DS role. 
  4. Promotes the server to a Domain Controller. 
  5. Creates a new forest named evision.local. 
  6. Sets a DSRM password. 
  7. Restarts the server. 

After installation:

  • Employee accounts can be created. 
  • Computers can join the domain. 
  • Group Policies can be applied. 
  • Authentication becomes centralized. 

 

Difference Between Installing AD DS and Promoting to Domain Controller

 

StepPurpose
Install AD DS RoleCopies Active Directory files and tools
Promote to Domain ControllerCreates or joins a domain and activates AD DS

 

Important Best Practices

  • Always use a static IP address. 
  • Use meaningful server names such as DC01. 
  • Store the DSRM password safely. 
  • Verify DNS configuration. 
  • Use snapshots or backups before major changes. 

 

QUESTIONS:

 

Q1. What is Active Directory Domain Services (AD DS)?

AD DS is a Windows Server role used for centralized authentication, authorization, and management of users, computers, and resources in a domain environment.

 

Q2. What are the prerequisites before installing AD DS?

Before installing AD DS:

  • Configure a static IP address
  • Configure DNS settings
  • Rename the server properly
  • Ensure proper network connectivity
  • Install Windows Server updates

 

Q3. Why is a static IP address required for a Domain Controller?

A static IP address ensures that clients can always locate the Domain Controller and DNS server without IP address changes.

 

Q4. What is the role of DNS in Active Directory?

DNS helps clients locate Domain Controllers and Active Directory services inside the network.

 

Q5. What happens after promoting a server to a Domain Controller?

After promotion:

  • AD DS database is created
  • DNS server may be installed
  • SYSVOL folder is created
  • The server becomes a Domain Controller

 

Q6. What is a Domain Controller (DC)?

A Domain Controller is a server that stores Active Directory data and manages authentication and security policies in a domain.

 

Q7. What is the difference between a Workgroup and a Domain?

Workgroup:

  • Decentralized management
  • Separate user accounts on each PC

Domain:

  • Centralized management
  • Authentication through Domain Controller

 

Q8. What is a Forest in Active Directory?

A Forest is the top-level structure in Active Directory that contains one or more domains sharing a common schema and configuration.

 

Q9. What is SYSVOL in Active Directory?

SYSVOL is a shared folder that stores Group Policy files and scripts required for domain operations.

 

Q10. Why should multiple Domain Controllers be used in an enterprise environment?

Multiple Domain Controllers provide:

  • Redundancy
  • High availability
  • Fault tolerance
  • Load balancing
  • Better reliability

 

FSMO Roles (Flexible Single Master Operations)

 

In Active Directory, most information is replicated between all Domain Controllers. This means that if you create a user account on one Domain Controller, that information is automatically copied to all other Domain Controllers.

However, some operations are so important that they cannot be performed by multiple Domain Controllers at the same time. If all Domain Controllers tried to perform these tasks simultaneously, conflicts and inconsistencies could occur.

To prevent this, Microsoft introduced FSMO Roles (Flexible Single Master Operations). These are special roles assigned to specific Domain Controllers to perform unique tasks.

In simple words, FSMO roles ensure that certain critical Active Directory operations are handled by only one Domain Controller at a time.

 

Why FSMO Roles Are Required

 

Active Directory uses multi-master replication, where all Domain Controllers can update most data. But some tasks must be controlled by a single server to avoid duplication or conflicts.

Examples:

  • Two Domain Controllers should not generate the same RID numbers. 
  • Multiple servers should not modify the schema at the same time. 
  • Time synchronization must come from one authoritative source. 

FSMO roles solve these problems by assigning these tasks to designated Domain Controllers.

 

Total Number of FSMO Roles:

 

There are five FSMO roles in Active Directory.

These roles are divided into two categories:

  • Forest-Level Roles (One per Forest)
  1. Schema Master 
  2. Domain Naming Master 
  • Domain-Level Roles (One per Domain)
  1. RID Master 
  2. PDC Emulator 
  3. Infrastructure Master 

 

Forest-Level FSMO Roles

Forest-level roles exist only once in the entire forest.

 

1. Schema Master

 

The Schema Master controls all changes to the Active Directory schema.

The schema defines the structure of all objects and attributes in Active Directory.

Examples of schema changes:

  • Extending the schema for applications such as Microsoft Exchange. 
  • Adding new object classes or attributes. 

Important Point:
Only the Domain Controller holding the Schema Master role can modify the schema.

 

2. Domain Naming Master

 

The Domain Naming Master controls the addition and removal of domains and application partitions in the forest.

Examples:

  • Adding a child domain such as sales.company.com. 
  • Removing an unused domain. 

Important Point:
Without this role, new domains cannot be added or removed from the forest.

 

Domain-Level FSMO Roles

These roles exist once in each domain.

 

3. RID Master

 

RID stands for Relative Identifier.

Every security principal (user, group, computer) receives a unique Security Identifier (SID).

A SID consists of:

  • Domain SID 
  • RID 

The RID Master allocates pools of RID numbers to Domain Controllers.

Example:
When a new user is created, the Domain Controller uses an available RID from its assigned pool.

Important Point:
Without the RID Master, new security objects cannot be created after existing RID pools are exhausted.

 

4. PDC Emulator

 

The PDC Emulator is the most important and busiest FSMO role.

It performs several critical functions:

  • Handles password changes immediately. 
  • Processes account lockouts. 
  • Synchronizes time for all systems in the domain. 
  • Acts as the preferred server for legacy systems. 
  • Supports Group Policy updates. 

 

Why the PDC Emulator is Important

 

When a user changes a password, the change is sent first to the PDC Emulator. If a user logs on to another Domain Controller before replication occurs, that Domain Controller can contact the PDC Emulator to verify the new password.

The PDC Emulator is also the authoritative time source for the domain.

 

5. Infrastructure Master

 

The Infrastructure Master updates references to objects from other domains.

Example:
If a user from Domain A is a member of a group in Domain B and the user is renamed, the Infrastructure Master updates the reference in Domain B.

Important Point:
This role is especially important in multi-domain environments.

 

Summary of FSMO Roles

 

FSMO RoleScopeMain Function
Schema MasterForestControls schema modifications
Domain Naming MasterForestAdds/removes domains
RID MasterDomainAllocates RID pools
PDC EmulatorDomainPassword changes, time sync, lockouts
Infrastructure MasterDomainUpdates cross-domain references

 

Role Placement Recommendations

Proper placement of FSMO roles improves performance and reliability.

 

Single Domain Controller Environment

If only one Domain Controller exists, all five FSMO roles are automatically assigned to that server.

Example:

  • DC01 holds all FSMO roles. 

 

Multiple Domain Controller Environment

 

When multiple Domain Controllers exist:

  • Place the PDC Emulator on a reliable and powerful server. 
  • Place the RID Master on the same server as the PDC Emulator. 
  • Keep the Schema Master and Domain Naming Master on well-protected servers. 
  • In multi-domain forests, place the Infrastructure Master carefully. 

 

Recommended Placement Example

 

In a company with two Domain Controllers:

DC01

  • PDC Emulator 
  • RID Master 
  • Schema Master 
  • Domain Naming Master 

DC02

  • Infrastructure Master 

This arrangement is common in many organizations.

 

How to Check FSMO Role Holders

Use Command Prompt: netdom query fsmo

This command displays the Domain Controllers holding each FSMO role.

 

How to Transfer FSMO Roles

FSMO roles can be transferred:

  • Through graphical tools. 
  • Using PowerShell. 
  • Using ntdsutil. 

 

What Happens if an FSMO Role Holder Fails?

 

The impact depends on which role is unavailable.

Examples:

  • If the PDC Emulator fails, password changes and time synchronization are affected. 
  • If the RID Master is unavailable for a long time, new users and groups may eventually stop being created. 
  • If the Schema Master fails, schema changes cannot be made. 

Normal authentication and day-to-day operations usually continue for some time.

 

Example:

Suppose HCL Technologies has Domain Controllers in Jamshedpur and Bangalore.

  • DC01 (Pune) holds the PDC Emulator and RID Master. 
  • DC02 (Bangalore) holds additional roles. 

When an employee changes a password in Bangalore, the PDC Emulator on DC01 receives the update immediately. If the employee logs in from another office, the updated password is validated correctly.

This ensures smooth operation across all locations.

 

Best Practices for FSMO Roles

 

  • Keep the PDC Emulator on the most reliable Domain Controller. 
  • Synchronize the PDC Emulator with a trusted external time source. 
  • Regularly verify FSMO role ownership. 
  • Ensure Domain Controllers are backed up. 
  • Document role placement for disaster recovery.

 

QUESTIONS:

 

Q1. What are FSMO Roles in Active Directory?

FSMO (Flexible Single Master Operations) Roles are specialized Active Directory roles assigned to Domain Controllers for handling specific operations.

 

Q2. Why are FSMO Roles important in Active Directory?

FSMO Roles help prevent conflicts and ensure proper management of critical Active Directory operations.

 

Q3. How many FSMO Roles exist in Active Directory?

There are 5 FSMO Roles in Active Directory.

 

Q4. What are the five FSMO Roles?

  • Schema Master
  • Domain Naming Master
  • RID Master
  • PDC Emulator
  • Infrastructure Master

 

Q5. What is the function of the Schema Master role?

The Schema Master controls and manages changes to the Active Directory schema.

 

Q6. What is the role of the Domain Naming Master?

The Domain Naming Master manages the addition and removal of domains in the forest.

 

Q7. What is the function of the RID Master?

The RID Master allocates unique Relative Identifiers (RIDs) to Domain Controllers for creating security objects like users and groups.

 

Q8. What is the purpose of the PDC Emulator role?

The PDC Emulator handles:

  • Password changes
  • Time synchronization
  • Legacy system support
  • Account lockout processing

 

Q9. What does the Infrastructure Master do?

The Infrastructure Master updates references to objects when changes occur across domains.

 

Q10. How can you check FSMO Role holders in Windows Server?

FSMO Roles can be checked using:

  • netdom query fsmo command
  • Active Directory administrative tools
  • PowerShell commands

 

🔗 Click the link and kickstart your Azure System Administration career today! 🚀

https://www.evisiontechnoserve.com/corporate-training/it-certifications/azure-system-administration-job-ready-internship-program-live