Best practices for simple adPosted by Ottesen Groth on February 13th, 2021 to prevent problems and make full use of AWS managed Microsoft ad, you should consider the following tips and recommendations. consider these directions before making a directory. AWS directory service supplies a variety of ways to combine Microsoft active directory with other AWS services. You are able to select a directory service with appropriate functions to meet your needs based on the budget cost: for a more step-by-step comparison of AWS directory service options, please refer to select which. To connect to, manage, and use a directory, the VPC from the directory must be configured correctly. For details about VPC security and network requirements, see AWS managed Microsoft ad prerequisites, ad connector prerequisites, or simple ad prerequisites. if you want to add an instance to a domain, make sure you have an example connection and will access the instance remotely, as described in adding an EC2 instance to the AWS managed Microsoft ad directory. Understand different restrictions for your specific directory type. The amount of objects you are able to store in your directory is bound only by the possible space for storage and the aggregate size of your objects. To find out more about the directory you selected, see restrictions for AWS managed Microsoft ad, ad connector, or simple ad. AWS creates a security group and attaches it to the directory's domain controller elastic network interface. AWS will configure security groups to block and allow unnecessary traffic to the directory. Modify the security number of the directory if you wish to modify the security of the security band of the directory, you certainly can do so. Make such a change as long as you fully understand how security group filtering works. To learn more, see https://docs.amazonaws.cn/AWSEC2/latest/UserGuide/using-network-security.html Amazon EC2 in the user's Guide applies to the Amazon EC2 security group for Linux instances. Incorrect changes can lead to loss of communication with the target computer and instance. AWS recommends that you don't try to open other ports to your directory, as this will certainly reduce the security of the directory. Please take a closer go through the AWS responsibility sharing model. simple ad will not support trust relationship. If you need to establish trust between the AWS directory service directory and other directories, you should utilize AWS directory service for Microsoft active directory. here are a few suggestions to consider when creating a directory. when setting the directory, you need to supply the password of the administrator account. The account ID is administrator for simple ad. Remember the password you designed for this account; otherwise, you can't add objects to your directory. AWS directory service supports most of the character formats that can be used to make user names. But there are a few character restrictions on the user name used to log on to AWS applications such as Amazon workspaces, Amazon workdocs, Amazon workmail, or Amazon quicksight. These restrictions require that the following characters really should not be used: before programming the job, please think over the next: When developing applications, please use windows DC locator service or AWS managed Microsoft ad's dynamic DNS (DDNS) service to get the location of domain controller (DC) . Do not use the address of the DC to hard code the applying. The DC locator service ensures that directory loads are distributed, enabling you to benefit from horizontal scaling with the addition of domain controllers to the deployment. In the event that you bind a software to a hard and fast DC, and the DC is patched or restored, the application willAccess to DCS will be lost instead of utilising the remaining DCS. In addition , the hard coding of DC can result in hot spots on a single DC. In severe cases, hotspots could cause your DC to don't respond. This kind of situation could also cause the AWS directory automation function to mark the directory as "damaged", and may trigger the healing up process of replacing the unresponsive DC. Make sure you perform lab tests on the objects and requests that represent your production workload to confirm that the catalog will extend to the job workload. If you'd like more capacity, you need to use AWS directory service insteadFor Microsoft active directory so that you can add domain controllers for high end. To find out more, see deploying additional domain controllers. extensive LDAP queries on domain controllers for 1000s of objects will produce significant CPU impact in a single DC Cycle consumption contributes to hot spots. This might affect applications that share the same DC during the query. aws solution architect exam spotoLike it? Share it! |