Tuesday, December 11, 2012

AD:DS verses AD:LDS

 

You have a requirement to provide an LDAP directory service to applications. And as a part of this there has been a discussion comparing full Active Directory (AD:DS) verses an Active Directory as an LDAP instance (AD:LDS).

The key differentiators between the two services are:

 

Active Directory Domain Services

Active Directory was designed and built in the late nineties for release with Windows Server 2000. The system was a direct replacement for Windows NT 4 Domains but is based on the X.500 standards. The solution was built as a replacement for file and print management but always contained methods to extend the schema and therefore extending functionality.

 

Active Directory Lightweight Directory Service

Designed and delivered as a direct competitor to traditional LDAP services such as iPlanet LDAP server AD:LDS (released as ADAM in Windows Server 2003) uses the same code base as traditional Active Directory but decouples many of the file and print specific details such as Domain Controllers , Domains and Forests. With a traditional Active Directory there is a single instance per server of the directory whereas AD:LDS can run many different ‘services’ on the same computer. AD:LDS comes without most schema objects to allow for custom schemas and is ideally suited to multi-million objects in web facing environment.

 

Comparing Services

Many of the features are listed below and shown if they are supported on both platforms.

Feature

AD:DS

AD:LDS

Forest and Domain

Yes

No

Sites

Yes

Yes

Run as a services

No

Yes

Trusts

Yes

No

LDAP 2/3

Yes

Yes

Kerberos

Yes

Partial

DNS Integration (SRV records required)

Yes

No

Schema modification

Yes

Yes

Computer objects (required)

Yes

No

Hosts computers (domain members)

Yes

No

Unique names (SAMaccountName)

Yes

Yes

Support iNetOrgPerson

Yes

Yes

Static ACL (stamped)

Yes

Yes

Global Catalogue

Yes

No

Custom Indexed objects

Yes

Yes

Scale (above 1 billion objects)

Yes

Yes

FSMOs

Yes

Yes

Trusts – Traditional Kerberos

Yes

No

SAML support

Yes

Yes

ADFS support

Yes

Yes

Group policy support

Yes

Partial

GPO based object rules

Yes

No

Active Directory Users and Computers support

Yes

No

LDAP tool support

Yes

Yes

ADSI Edit

Yes

Yes

Server Core support

Yes

Yes

Self-managed (via GPO)

Yes

No

Event log

Yes

Partial

Auditing

Yes

Partial

Higher computing power required

Yes

No

Built in Active Directory sync tool

No

Yes

Security outside of “Domain Admins”

No

Yes

 

High-level comparison

Some of the key aspects of Active Directory verse LDS.

Key: The larger area is best.

clip_image002

Post a Comment

Blog Archive