Workgroups and domains in computer networks. Workgroups and domains. Joining a domain

Hello, dear readers of the blog site. This blog has detailed information. After or while reading this publication, I advise you to read that article so that a complete picture emerges. I also advise you to read my publications on the topic of what and means.

Today we have a question on our agenda - what is domain or Domain name (in fact, these are synonyms). Well, it's actually simple. This is the name for the site, which is assigned to it instead of the difficult-to-remember IP address of the server on which this site is hosted (see). Enter this name in the address bar of your browser and the site will open.

But the difficulties arise precisely in the details. What are they, how does it all work, what domain zones are, how to understand what level domain and which of them can be registered, where this can be done and which zone to choose. There are a lot of questions and I will try to answer them all in this “small note”.

What is a domain?

As I mentioned above, domain is the name for the site..162.192.0. And besides, imagine the situation. You have placed your website on a hosting server (see what this is above) and received an IP address. But, moving to another hosting, the IP will change, which will cause a disaster. But in the case of domain names, this will not happen. Why?

The fact is that there are thousands of DNS (domain name system) servers on the Internet, which will state that the domain site is accessible at the IP address 108.162.192.0. If I move to another hosting, I will go to the domain name registrar panel (where I bought it), change some things in all DNS servers The Internet will indicate that the site needs to be searched at a different IP address. Convenient right?

Convenient, but probably not yet clear. The main thing you need to understand is a name for a site is a very important thing and it is for life (as a rule, although you can transfer the site to another domain if you wish, this is not easy). Whatever you name the boat, that’s how it will float. True, not only the name is important, but also the level of the domain, as well as the zone to which it belongs. Is it unclear again? Well, let's take things in order.

How a domain name works

Let's start with the basics. The domain record (site name) must include all levels of nesting of the domain (all zones in which it belongs) so that it is unique and does not cause confusion.

There are two main domain name registration rules:

The zones that a given domain belongs to are listed from right to left.
Dots are used as separators.

It might look like this, for example:

Net.blog.site

We get the fourth level domain net, which is part of domain zone third level “blog”, which is included in the second level zone “ktonanovenkogo” belonging to the first level zone.ru. Nonsense, right? (my wife, who checks errors in the article, will be happy to confirm this).

What domain levels are distinguished?

Root domain(level zero) is considered to be an empty entry, denoted simply by a dot (.). In theory, the full record of a domain name should always end with a period, but in most cases it is omitted (as if meaning) and instead of the record: site.
They use the already well-established relative notation of domains (without a dot at the end):
Next comes the first level - this is usually regional(national) domains (.ru, .su, .ua, .us, .de, .fr, etc.) or thematic(.com, .edu, .org, .net, etc.). But there are also first-level domain names that include national alphabets(for example, .рф).
Second level- these are already the same domains that you and I we buy(we register with special registrars). Their prices vary not only depending on their belonging to a particular first-level domain (for example, xxxxxxx.ru is usually cheaper to buy than xxxxxxx.com), but also depending on the registrar (or its reseller - retailer).
Third, fourth, etc. — you no longer need to buy them (as a rule) and can be created independently (without registering anywhere) based on the purchased second-level domain. For example, I can create a name like this for a new site - forum..forum..

Let me explain all this again For example:

. (dot) - zero (root) level domain
ru - first level, also called domain top level or zone
website - second level domain name
blog.site - third level domain
net.blog.site - fourth level

Top (first) level domains

Apart from the zero level (root domain), because this is emptiness, then the base is the so-called zones or top-level domains(the name of any site begins with them, although it seems that it ends with them - but not the point). They cannot be bought by an ordinary person, but it is from these zones that we will choose when purchasing a second-level domain (a name for our website).

So what are they?

First (highest) level domains, assigned to countries, which are usually called among very smart people by the abbreviation Cctld, meaning country code top-level domain. Russia has two of them:
1. su is a remnant left over from the Soviet Union and now represents the space of resources in Russian
2. ru - originally assigned to Russia
Domains with national alphabets, which are usually abbreviated Idn (internationalized domain name). In Russia it is zone.rf. In fact, their names are still written in English characters (recoding occurs), but this is, as it were, hidden from view. However, if you enter the address in your browser: http://ktonanovenkogo.rf/
and after going to this site, copy its address from the address bar, you will get completely indigestible nonsense:
Http://xn--80aedhwdrbcedeb8b2k.xn--p1ai/ It turns out he looks so unpleasant. And it is in this form that it will have to be added to various services (such as ), and not in the form of ktonanovenkogo.rf. This needs to be taken into account. Yes, other problems are possible, although not obvious at first.
Upper generic domains, usually called Gtld, which means generic top-level domain, are registered (sold) regardless of the country in which the webmaster lives. The most used of them:
1. .com - for commercial projects
2. .org - for non-profit websites of various organizations
3. .net - for Internet-related projects
4. .edu - for educational institutions and projects
5. .biz - only commercial organizations
6. .info - for all information projects
7. .name - for personal sites
8. .gov - for US government agencies

How and where you can register (buy) a domain in top-level zones

As a rule, you can’t get second-level domain names just like that (and it’s better not to try, because the name for the site is too important to risk registering it with someone unknown). They cost money. Moreover payment is made annually, and then the domain lease needs to be renewed.

Let me draw your attention once again - buy second level domain names, and everything above - you can create on their basis yourself. This is usually done in the panel of your hoster in the subdomains section - these are third and higher level domains, such as blog..blog.site.

There are not so many such companies (prominent examples include RegRu And WebNames), but they may have a whole network of resellers (partners) who will select and sell domains on their behalf. If you are not satisfied with the current reseller in some way or you have any tension with him, then by contacting the registrar, you can choose another reseller or go directly under the wing of the registrar.

At all no limits You can buy domains in the public zones .com, .net, .org, .info, .biz and .name. In the .edu, .gov and .mil zones, this opportunity is provided only for institutions, as well as state educational and military institutions. There are also a number of specialized first-level domains, for example, .travel, .jobs, .aero, .asia.

Second level domain names in these public areas can be purchased from any registrar(not only national), which, in fact, is what some resources use, which may have conflicts with copyright holders. The same torrent was forced to move to the public zone org, because its resource was blocked in the national domain zone ru.

Second level domains - employment verification and Whois

There are already about half a billion domain names registered on the Internet in various zones, so choosing a good (short, simple, sonorous) name in the right zone is now very easy. not an easy task(just like it's difficult). A third of the registered names are not used at all, because they were purchased for resale (successful domains can be expensive on the secondary market - sometimes many millions of dollars).

Domain name occupancy check

Therefore, the first thing you should do when selecting a suitable domain for your website is . This can be done at different registrars (the result will be the same, since they use a common database).

Therefore, when viewing domain information in the so-called whois records, you may find there your personal data that was required to be provided during registration. In my opinion, it is better to hide this information, because there are plenty of dashing people on the Internet (although, if you need problems out of the blue...).

Domain name history and purchasing vacant domains

The history of domain ownership can be traced in the so-called . There you can clearly see what kind of sites were ever hosted on this domain name, what they were like and whether their history will affect the initial relationship search engines to your site.

Below are released in this moment domains(click on price for detailed view):

Good luck to you! See you soon on the pages of the blog site

Register IP addresses

If the IP parameters in your network are not assigned automatically, you need to register them manually ( Please check the need for this item with the administrator of your work group!). To do this you need to take the following steps:

Open the “View Network Computers and Devices” icon in the Control Panel (Start - Control Panel - Network and Internet - View Network Computers and Devices)

On network adapter, with which you are connected to the network, right-click and select “Properties”

Select “Internet Protocol Version 4 (TCP/IPv4)” and click the “Properties” button

We register the IP address (1). In it, the first three values are the same for all members of the working group. The last digit (2) is unique for each computer. Subnet mask, Default gateway (4) Preferred DNS server (4) - the same on all computers.

Check with your administrator for general values for the entire workgroup, or look at a computer that is already part of this group. The Default Gateway and Preferred DNS Server are required for Internet sharing. If this is not the case, then these fields are not filled in.

A - flows in user space

B - threads in kernel space

In case A, the kernel knows nothing about threads. Each process needs a thread table, similar to the process table.

Advantages of Case A:

Such multithreading can be implemented on a kernel that does not support multithreading

Faster switching, creation and termination of threads

A process can have its own scheduling algorithm.

Disadvantages of Case A:

No timer interrupt within one process

When using a blocking (the process is put into standby mode, for example: reading from the keyboard, but no data is received) system request, all other threads are blocked.

Implementation complexity

Multiplexing user threads into kernel threads

2.2.5 Windows implementation features

Four concepts are used:

Job - a set of processes with common quotas and limits

Fiber - lightweight flow managed entirely in user space

Threads run in user mode, but switch to kernel mode when making system calls. Due to switching to kernel mode and back, the system is very slow. Therefore, the concept of fiber was introduced. Each thread can have multiple fibers.

Lecture 2. OS of workstations and servers. Workgroups and domains. Active Directory. The main servers and services in the enterprise network.

Workgroups and domains.

Domain is a logical association of computers on a network that share a central directory database. The directory database contains user accounts and security policy information for the domain. This database is called a directory and is part of the service database Active Directory- Windows directory services.

In a domain, the directory is located on computers - domain controllers. A domain controller is a server that coordinates all security settings between the user and the domain and centralizes administration and management of security policies.

You can only designate a computer on one of the Microsoft series platforms as a domain controller Windows Server 2000/2003/2008. If all computers on the network are running Windows XP/Vista/7/8, then the only available type of network will be a workgroup. In the following, in the lecture notes, for brevity, we will call all server versions Windows Server, and workstation operating systems Windows XP/Vista/7/8 - Windows for workstations.

A domain does not refer to a location on a network or a specific type of network configuration. Computers in a domain may be located nearby on a small local area network (LAN) or located in different parts of the world. They can communicate with each other over any physical connection, including telephone lines, ISDN lines, fiber optic lines, Ethernet lines, token rings, frame relay connections, satellite communications and dedicated lines.

Domain advantages are obvious:

Centralized administration, because all user information is stored in one place;

One-time user registration to gain access to all network resources (files, printers and programs) with the required access rights. In other words, you can log on to one computer on the network and use the resources of another computer, provided that you have the appropriate access permissions;

Scalable, allowing you to create very large networks.

The types of computers that a typical Windows domain includes are listed below:.

Domain controllers on the Windows Server platform. Each domain controller stores and maintains a copy of the directory. In a domain, you create a single user account, which Windows writes to the directory. When a user logs on to a computer in a domain, the domain controller authenticates the user by checking the directory for the user's account, password, and login restrictions. There can be multiple domain controllers in a domain, and they periodically exchange data about their copies of the directory.

Server without controller status in a specific domain. A member server does not maintain a directory and is not able to authenticate users. Member servers provide shared access to network resources, such as shared folders or printers.

Client computers on the Windows XP/Vista/7/8 platform or any other operating system Microsoft system, not used as a server. Client computers are user desktop systems that provide users with access to domain resources.

Windows workgroup - a logical association of networked computers that share common resources such as files and printers.

A workgroup is also called a peer-to-peer network because all computers in it can use shared resources on equal terms, i.e., without a dedicated server.

Every computer in working group maintains only its local security policy database. This database is a list of user accounts and information about access rights to resources on the computer where it is permanently located. Therefore, using a local computer security policy database decentralizes the administration of user accounts and resource access policies in the workgroup.

Note: A workgroup, along with computers with a client OS, may include computers on Microsoft platforms such as Windows Server, unless, of course, it is configured as a domain controller. In a workgroup, a computer running Windows Server is called a stand-alone server.

Because workgroups decentralize administration and resource access policy, the following statements are true: a user must have an account on each computer that he wants to access; any change to user accounts, such as changing their password or creating a new one account, must be run on each computer in the workgroup.

If you forget to register a new account on one of your workgroup computers, the new user will not be able to access that computer and its resources.

The working group has the following advantages:

It does not require a domain controller to be included in the network to store centralized information about security policies;

It is easy to design and operate. Unlike a domain, it does not require large-scale planning and administration;

This is a convenient network environment for a small number of computers located not too far from each other.

Lecture 3 Creation and management of user and computer accounts (in the domain)

User account – this is a record that contains information necessary to identify the user when connecting to the system, as well as information for authorization and accounting. (difference between identification and authorization?)

This username and password (or other similar means of authentication - for example, biometric characteristics). The password or its equivalent is usually stored in encrypted or hashed form (for security purposes).

To increase reliability, along with a password, alternative means of authentication may be provided - for example, a special secret question (or several questions) of such content that the answer can only be known to the user. Such questions and answers are also stored in the account.

The account may contain the following additional personal data about the user:

surname;
nickname (nickname);
nationality;
race;
religion
blood type;
Rh factor;
date of birth;
E-mail address;
home address;
business address;
netmail address;
home phone number;
work phone number;
Mobile phone number;
ICQ number;
Skype ID, IRC nickname;
other contact information for instant messaging systems;
address home page and/or blog on the Internet or intranet;
information about hobbies;
information about the range of interests;
family information;
information about past illnesses;
information about political preferences;
and much more

An account may also contain one or more photos or an avatar of the user. The user account can also take into account various statistical characteristics of the user’s behavior in the system: how long ago he last logged into the system, the duration of his last stay in the system, the address of the computer used when connecting, the intensity of use of the system, the total and (or) specific number of certain operations performed in the system, and so on.

All computers are peer nodes on the network; no one computer can control another.

Each computer has multiple user accounts. To log on to any computer that belongs to a workgroup, you must have an account on that computer.

A workgroup usually contains no more than twenty computers.

The workgroup is not password protected.

All computers must be on the same local network or subnet.

In the home group:

Computers in home network must belong to a workgroup, but they can also belong to a homegroup. Homegroup makes it much easier to share pictures, music, videos, documents, and printers with others.

The HomeGroup is password protected, but it is entered only once when adding a computer to the HomeGroup.

In the domain:

One or more computers are servers. Network administrators use servers to control security and permissions for all computers in a domain. This makes it easy to change settings because changes are automatically made for all computers. Domain users must provide a password or other credentials each time they access the domain.

If a user has an account on a domain, they can log on to any computer. To do this, you do not need to have an account on the computer itself.

Rights to change computer settings may be limited because network administrators want to ensure that computer settings are consistent.

There can be thousands of computers in a domain.

Computers may belong to different local networks.

Working group is a logical grouping of computers united by a common name to facilitate computer navigation within the network.

It is fundamentally important that everyone in the workgroup has equal rights (that is, the network is peer-to-peer) and maintains its own local database of user accounts (Security Accounts Manager, SAM).

This is the main problem that prevents the use of working groups in large corporate networks.

Indeed, logging into a protected system is mandatory, and direct and network logins are fundamentally different (direct is controlled by the local computer, and network is controlled by the remote one), then, for example, a user logged into computer Comp1 under the local User1 account will be denied access to the printer installed on the Comp2 computer, since its local database does not have a user named Userl (Figure 1).

Rice. 1 Workgroups and domains

Thus, to ensure “transparent” interaction in a workgroup, you need to create the same accounts with the same passwords on all computers where users work and resources are located.

In Windows OS, there is a special mode for workgroups: “Use simple general access to files”, which allows you to bypass this problem (this mode is enabled by default).
In this case, connecting to any network computer is carried out on behalf of his local guest account, which is enabled using the Network Setup Wizard (it is disabled by default) and for which the required access level is configured.

For OS Windows versions Home Edition, this method of network interaction is the main one and cannot be disabled (therefore, computers with this OS cannot be made domain members).
It is clear that managing accounts and resources in a workgroup is only possible with a small number of computers and users.

Large networks should use domains.

Domain is a logical grouping of computers united by a common database of users and computers, security and management policies.
Domains are created on the basis of Windows network operating systems, and the database is maintained by domain controllers.
An important thing in domains is that all computers here do not themselves verify users upon login, but delegate this procedure to controllers.

This organization of access makes it easy to perform a one-time verification of the user when entering the network, and then, without verification, provide him with access to the resources of all computers in the domain.

Rice. 2 Domains

Main threats when working online

There are quite a few threats that await users when connecting a computer to the network:

“hacking” a computer is usually carried out with the goal of seizing control of the operating system and gaining access to data;
system damage is most often organized to disrupt the performance (cause a denial of service - “Denial of Service”) of any services or computer (usually a server) as a whole, and sometimes even the entire network infrastructure of the organization;

Basic safety precautions when working online

They can be formulated as the following set of rules:

turn off your computer when you are not using it. As computer security experts like to say, “the most secure computer is a switched off computer stored in a bank safe”;
update your operating system promptly. In any OS, so-called “vulnerabilities” are periodically discovered that reduce the security of your computer. The presence of vulnerabilities must be carefully monitored (including reading the “computer” press or information on the Internet) in order to take timely measures to eliminate them.
theft of data due to incorrectly set access rights, during data transfer or “hacking” of the system allows you to gain access to protected, often confidential information with all the ensuing unpleasant consequences for the owner of this data;
data destruction aims to disrupt or even paralyze the operation of systems, computers, servers or an entire organization.
use a limited set of well-tested applications, do not install or allow others to install on your computer programs taken from unverified sources (especially from the Internet). If the application is no longer needed, delete it;
Do not share your computer resources unnecessarily. If this is still required, be sure to configure the minimum required level of access to the resource only for registered accounts;
Install (or enable) a personal firewall (firewall) on your computer. For corporate networks, install firewalls on both the routers connecting your local network with the Internet and on all computers on the network;
Even if you are the only owner of the computer, use a user account for normal work: in this case, damage to the system, for example, when infected with a virus, will be immeasurably less than if you were working with administrator rights. For all accounts, especially administrative ones, set and remember strong passwords.

A complex password is one that contains a random combination of letters, numbers and special characters, for example jxglrg$N. Of course, the password should not be the same as your account name. In operating rooms Windows systems a complex password can be generated automatically using NET command USER with the /RANDOM key, for example:
NET USER Username /RANDOM

when working with by email Never immediately open attachments, especially those received from unknown senders. Save the attachment to disk and check it antivirus program and only then open it. If possible, enable it in your mail program protect against potentially harmful content and disable HTML support;
When working with websites, take reasonable precautions: try to avoid registration, do not give personal information about yourself to anyone, and carefully work with online stores and other services that use online payment methods using credit cards or systems such as WebMoney, Yandex-Money etc.
To organize work in Microsoft networks, two models are used: workgroups, used with a small number of computers, and domains, which make it possible to easily unite a large number of users, workstations and servers.
All network operating systems and data stored on computers must be reliably protected, and it is desirable that the security system used be multi-level.