ADDS_ACtive directory domain service windows server 2008 complete full Gorvam_Saddar

Introduction

Gaining an understanding of the Active Directory™ directory service is the first step in understanding how the Windows® 2000 operating system functions and what it can do to help you meet your enterprise goals. This paper looks at Active Directory from the following three perspectives:

• Store. Active Directory, the Windows 2000 Server directory service, hierarchically stores information about network objects and makes this information available to administrators, users, and applications. The first section of this paper explains what a directory service is, the integration of Active Directory service with the Internet's Domain Name System (DNS), and how Active Directory is actualized when you designate a server as a domain controller¹.
• Structure. Using Active Directory, the network and its objects are organized by constructs such as domains, trees, forests, trust relationships, organizational units (OUs), and sites. The next section in this paper describes the structure and function of these Active Directory components, and how this architecture lets administrators manage the network so that users can accomplish business objectives.
• Inter-communicate. Because Active Directory is based on standard directory access protocols, it can interoperate with other directory services and can be accessed by third-party applications that follow these protocols. The final section describes how Active Directory can communicate with a wide variety of other technologies.
•  
• for full knowledge about ....ADDS

rootkits_investigation_procedures_Gorvam_saddar

Rootkits

What is a rootkit?

          A rootkit is a special variant of a Trojan, a.k.a. a RAT (Remote Administration Tool).  What separates a rootkit from a regular Trojan is that a rootkit, by definition, occupies Ring 0, also known as root or kernel level, the highest run privilege available, which is where the OS (Operating System) itself runs.  Non-rootkit trojans typically run in Ring 3, or user level, which is where ordinary applications run, though some sources refer to userland trojans as “rootkits” also.  Usually, but not always, a rootkit will actively obfuscate and attempt to hide its presence from the user and any security software present......