|
Well I
believe there is a way to log excessive LDAP activity against a Windows 2000
Domain. That is where I would start first if I was looking for a technical
way to detect when the servers come up. Next Since most people developers
are not that interested in being different, they probably will setup their ADAM
on 389, so sweeping subnets for port 389 along with Port 80 might turn up some
additional hits (I know ADAM can be hosted on any port). I also feel that
a strong IT standards and the threat of unsupportablility if they are not
followed can also lead to a more compliance as well.
Good
application and infrastructure architecture with strong leadership should be
able to address the possibility of a weedy ADAM base. My advise, get a
hold of it while you still can.
Todd
Do
you have a method of searching for the AD/AMs or otherwise preventing
developers from spinning them up and using them without your knowledge in a
production way?
My
general experience is that if you allow developers to just do what they want
to do, they will set things up in a way that do not josh with your production
environment and will expect you to change your production environment to
support their application on their timeline. Usually you find this out in too
short of a time frame to fix the app that they wrote and the changes too
unique to their app to change your global AD deployment so they end up going
live on their dev environment.
We
have a "dev only" AD that initially came up on Beta3 W2K that was supposed to
go away within a few months of the production forest coming up in 2000 but is
still functioning as a production environment now in 2003 with tremendous
migration pains trying to pull the apps off of it. It is still there because
apps slipped from dev to prod without any real fine line, the pilots just got
bigger and bigger until it was too big and too needed to make the jump.
Also
that brings up the question of whether or not companies are publishing AD
programming/application guidelines and if so, is anyone willing to share what
they have? As more and more people look at using our centralized
authentication environment we are getting lots of requests for "how do we do
it" especially from Java and UNIX environments. So we are looking at trying to
publish guidelines but that is sort of like extra work on top of everything
else.
joe
Todd,
I agree.
My point was that our apps dev guys are looking
into integrating with AD for some of the corporate apps. ADAM lets us
deploy very quickly a "lookalike" of our AD infrastructure (users, etc)
and let them play to their hearts content without requiring us to
continuiously set up and pull down a "real" AD forest. When the time
comes for them to integrate with the "real" AD, we then setup a pre-prod
forest for them to play with.
Lets them work out the kinks in their software
without hassling us every couple of days, and saves on the hardware costs of
multiple AD forests (minimum 2 DCs for each instance).
For real corporate applications, we only
provide a single directory, AD.
Glenn
----- Original Message -----
Sent: Saturday, June 28, 2003 11:29
AM
Subject: RE: [ActiveDir] MMS 2003 and
ADAM 2003
I would encourage
organizations to consider a registry for Adam's or LDAP type
directories. You don't want to end up with the same mess NT 4
domains created for applications. I would find out if the
application does authentication via the directory, and if it does,
encourage the developers to use an infrastructure Single Sign On
product.
Just my humble
opinion.
Todd
-----Original
Message-----
From: Glenn
Corbett [mailto:[EMAIL PROTECTED]
Sent: Friday, June 27,
2003 8:54
PM
To:
[EMAIL PROTECTED]
Subject: Re: [ActiveDir] MMS 2003 and
ADAM 2003
ADAM is
also good for those applications that want to start doing some AD
integration functionality without actually having to set up an AD
forest.
Makes us
Infrastructure guys nice and happy, don't have to keep setting up and
pulling down AD forests every week or so for the apps dev guys
:)
-----
Original Message -----
Sent: Friday, June 27, 2003 11:38
PM
Subject: RE: [ActiveDir] MMS 2003
and ADAM 2003
IMHO, ADAM is
the more exciting of the two. Granted MMS is nice in what it does
(been working with it on and off for a while) but ADAM is really a
special product in what you can do with it. For those of you that
want to integrate your application, but don't want to go to the time
expense and trouble of integrating AD or directory sevices (e.g. LDAP)
into the app natively, ADAM could be your answer.
Other solutions
abound - from simple services to security uses.
Rick
Kingslan MCSE, MCSA, MCT
Microsoft MVP - Active
Directory
Associate Expert
Expert Zone -
www.microsoft.com/windowsxp/expertzone
From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Myrick, Todd
(NIH/CIT)
Sent:
Friday, June 27,
2003 7:24 AM
To: '[EMAIL PROTECTED]';
[EMAIL PROTECTED]
Subject: [ActiveDir] MMS 2003 and
ADAM 2003
I just
got word that MMS 2003 and ADAM 2003 are shipping the week of July
3rd.
Now to
afford the server requirements to run MMS 2003.
Requirements for MMS
2003
Makes
Simple Sync look very attractive, but the MMS requirements do offer some
tangible benefits.
|
