Summary

To make it easy for administrators and users to identify accounts within Active Directory, an organization should develop a naming strategy. This strategy should allow employees with the same name to be differentiated. Computer names should identify the computer and its purpose and group accounts should identify the group s scope, purpose, and owner.

The account authentication policy should identify the password and account lockout settings that will be enforced in order to keep the organization s resources secure. The method of authentication should also be determined. The typical sign-on measures, username or UPN and password, can be used in most cases, but if a more secure method of authentication is required, multifactor authentication using smart cards or biometrics may be necessary.

It can be difficult to decide upon the best method of allowing users to access resources. You should determine the resource access requirements for users and then form a group strategy. Usually, administrators find the AG/RG strategy the easiest to use, but the A/DACL or AG/DACL options are available also.

This puts an end to the Active Directory design portion of the book. Starting with the next chapter, we will be looking at the options available for the network infrastructure design that will be necessary to support the Active Directory design.