On the web page, some content shows on the screen first, and some show out later. Hiya! How does the browser know which resources to load first? Can we influence the priority or measure how fast the main content is loaded on screen? Yes. Today, we're going to talk about Large Contentful Paint, or LCP, and a way to improve it with fetch priority. LCP is one of three core web vitals that Google uses to measure user experience on web pages. LCP is the loading metric and measures how long the page takes for the user to consider it mostly loaded. We define that as looking at when the largest bit of content is loaded. This is often an H1 element or a banner image, and images are what we're going to talk about here. You can find the LCP element in a number of different ways, but let's use the performance panel. After you record a trace, click on the LCP timing. Here you can see the LCP element is the hero image. Images can take longer to display than text. For a start, the browser needs to find the image details on the HTML, then it needs to download the image, and finally it needs to display it. Images can be expensive to display, so often the browser will wait until it knows it really needs the image before going through that whole process. If we switch to the network panel, we can see the priority the image has assigned. Let's filter on images and further adjust the image with hero in the name. Ensure the cache is disabled, and let's switch to slow 3G to really slow this down so we can see what's happening. Here you can see the image is initially a low priority, but after the browser knows that it's an on-screen image, it jumps it up to high to really prioritize it. Oh, that's just a flash and it's easily missed. Yes, luckily, there's a way to view both the initial and the final priority. In the network panel, you can enable the big request row setting to view both. Hover over it and you'll get a tooltip as well. We also show this in the network track of a performance trace. That's good to know, but it still seems like there is an initial period when it's still set to low. So it's good that we can easily see the low priority, but how can we actually avoid that and make it high from the beginning? Aha, let's talk about fetch priority next. Fetch priority is an API to allow you to tell the browser that a resource is higher or lower priority before it figures out for itself. For LCP images, developers probably know which one is the largest content when designing a page, so they can say, hey, browser, trust me, this one is important. Don't wait around to start fetching it. This API might sound complicated, but it's not at all. It's as simple as using the fetch priority HTML attribute on your image element. You can also use it on link elements for preloads or even script elements. Let's use the local overrides to fix this by a page. You can learn about local overrides with this link. Here, we find the HTML resource, we override the content, and then we find the image element to add fetch priority to it. But wait, this image has a loading equals lazy attribute on it too, you definitely don't want that for LCP images. So let's take that out and replace it with a fetch priority equals high. Then let's reload the page and this time we see the hero image starts off high straight away. Great. Interesting. Can you explain a little bit more on the difference between the loading attribute and the fetch priority attribute? Sure, they do similar, but slightly different things. The loading attribute controls lazy loading to tell the browser to hold off from loading content at all, until it's on screen or close enough to that. Lazy loading is a great way to avoid wasting users bandwidth and extra contention during that busy page load time. Fetch priority is all about telling the browser how important a resource is when it starts to fetch it. And that can mean it can start fetching it even earlier than it normally would during initial page load when the browser normally concentrates on more important resources. So one is about when to fetch resources and the other is about how to fetch them. In reality, you probably wouldn't really want loading equals lazy and fetch priority equals high at the same time. That would mean don't load it initially, but when you start to load it, load it with a high priority, which is kind of contradictory. Images you know to be very important on screen images should use fetch priority equals high. Images you know are likely to be off screen should use loading equals lazy. Images that are not super important may or may not be on screen should have neither attribute. Okay, is there any time you want to use fetch priority equal to low? Sure, you can use fetch priority equals low to lower the priority of resources. For example, if you have an image carousel, you can set the first image to be high priority, but the other images to be a lower priority. These other images are still above the fold, so it would still be bumped by the browser to be high priority. However, they're initially hidden from the user, so we don't need them to be high priority. Using loading equals lazy wouldn't be the right thing to do here, as they're still on screen or close enough. So we'd still be loaded despite that attribute. And we do want the images to load, so the carousel works when it flips from image to image. We just want to prioritize all the real on-screen images first. But a word of warning, do use this API with caution. In general, the browser is pretty good at choosing the right priorities, and this is a powerful API to override that, and you should only do that when there's good reason to. Using fetch priority equals high on LCP images is a clear use case. Other use cases may be less clear, so proceed with caution and don't overuse this API. All right, so how can we find images that we should add fetch priority equals highs to? You can use the network panel to see all images that may benefit from fetch priority equals high. Here you can see two images that change priority to high, the logo at the top of the screen, and the hero image. So these are the candidates to consider using fetch priority equals high on. While the hero image is the LCP element and will help improve that metric, your logo may also be important enough to you that you also want to prioritize that. However, as I said before, do not overuse fetch priority equals high. If you make everything a high priority, then nothing is. Limited to one or two resources you really want to make stand out above the others. All right, thanks Barry. Where can we learn more about fetch priority? Go to the link below for lots more details. That's all. See you for the next step, two tips. Ciao.


Welcome everyone to this CUBE Conversation. It's part of our Season 2 Episode 4 of the ongoing AWS Startup Showcase series. Today's theme, Cybersecurity, Detect and Protect Against Threats. I'm your host, Lisa Martin. I've got one of our alumni back with us, Rakesh Narasimhan joins me, President and CEO of Anishin Rakesh, it's great to have you back on the program. Thank you very much. Have a pleasure to be here. So some congratulations are in order. I see that Anishin was recently awarded nine Global InfoSec Awards at RSA Conference just this year, including a couple great titles here, Hot Company and Security Company of the Year. Talk to the audience who knows Anishin, what is it doing to enable and empower the digital transformation for enterprises that are, I mean, we've been talking about the acceleration of digital transformation. How is Anishin an enabler of that? Thank you again for the opportunity. I think a big change that we brought to the table, Anishin, is really what is typically a very manual, complex, time consuming, and quite expensive process. We've just brought software innovations to it. And really that's customers who are trying to do compliance or security in the cloud. We just provide a platform that basically accelerates a customer's application migration to cloud. And so that ability is the software innovation that we were able to bring to the space. And that just wasn't there before. And so we're just happy that we took the opportunity to innovate there and just bring it to the customers. So let's now talk to and address those AWS customers. When you're talking to prospects, existing AWS customers, what do you say are the differentiators that makes Anishin so unique in AWS? That's a great question. I think the biggest innovation, the biggest thing that we bring to the table is really acceleration and timeline and completion of their applications. If you're a customer and you're trying to get into a new market for compliance, for example, or you're trying to basically get a new application up and running in a secure environment, in either one of those cases, we have a product offering, a platform offering that enables you to quickly get up and running and get to production. And that's been the reason why we've enjoyed enormous success in the marketplace in the AWS customer base. One of the areas where I see that Anishin has been very successful is in helping cloud software vendors get FedRAMP compliant and be able to access what is a huge federal market. How are you able to do that? Yeah, I think the big thing that we focused on was you have a complete class of SaaS vendors out there who provide enormous innovation that they bring to the marketplace. But the government market in general has not been able to participate in it because again, like I said, it's very complex, it takes time and it's very expensive. And so we focused on that opportunity to really make it easier for all of these cloud service providers to be able to bring their innovations to the government market, for example, with FedRAMP. And so we helped with the automation and the acceleration with our platform offering on top of cloud providers like AWS. And that enables the SaaS provider to offer that opportunity that hitherto is not available to make it available in the government marketplace. And that's a huge buyer, if you will, their budgets are huge, they're still buying even in a downturn in the market. Even as commercial vendors look at that, that market, everybody's nervous about it. But if you look at the government market, they have budget, they're buying, and that needs to be provided to the install base. And so we helped make that happen. How does that make you unique from a competitive perspective to be able to accelerate FedRAMP for AWS customers in particular? I think the biggest issue has always been three things, right? It's complex, it's time consuming. But most importantly, how quickly can a company make their software innovations available to a large market has always been sort of the challenge, especially in the federal market. So we, by basically pre-engineering a platform, taking care of all the requirements of the standard in compliance and security, and then essentially help the customer bring that innovation on top of the AWS environment and making it available to customers in record time. That's the reason why we're able to enjoy the success. Historically, the space has been very focused on a lot of consulting folks, really providing consulting on an hourly basis. We thought of actually bringing a software-oriented approach just like people buy email, they buy a service, and then all the innovations that come along with it for the subscription that you pay, it's a very similar concept we brought to the space. Prior to this, either people did it themselves or they hired a lot of consulting folks to tell them what to do. And that could take a long time. And then not just time and expense, but every single time they made a change, they would still again have to go redo all that work. We just brought a platform approach which is well understood by now in the industry and you pay a subscription, you buy a platform, and all the innovations come along for them. So that's a huge productivity, time to market, but most importantly, it enables them to achieve their revenue goals because they're trying to get to market and service a customer, right? So we helped them accomplish that in record time. So you're really impacting your customer's bottom line. You've been very successful in helping AWS public sector customers to accelerate FedRAMP as you talked about FedRAMP compliance. How are you now switching gears to focus on the AWS commercial customers and even enterprise DevOps teams to be able to accelerate cloud application security? Yeah, I think, again, we started from a place of a humility, if you will. There's a lot of vendors, a lot of folks make a lot of claims. We wanted to make sure that we first were very good at doing something and that something was really go after the federal market. And the success we achieved in that marketplace had a few insights for ourselves, which was people really struggle in all kinds of environments, not just public sector. And what we found is that commercial customers are also trying to go to cloud. They're also dealing with the issues of security and securing their environments. And it's really the DevOps and DevSecOps folks on whom this burden falls. And they have to answer to so many different constituencies in an enterprise company. And so we time and time again, while we did the work in FedRAMP, we learned that it's not just about compliance, it's also about securing on the base of standards. So how could we provide the same pre-engineered environment for DevOps and DevSecOps teams to be able to run that environment for their applications? That became an aha for us because we were running into it all the time in the public sector side. So we went and talked to a few customers and said, hey, how about we do the same thing on the commercial side for you? And I wish I could take credit for this, but it's actually not true. It's actually customers who came to us and said, hey, you did this really well for us in public sector side. Could you provide the same thing for us in the commercial side, where it's not about all the documentation and all the audits and things that happen in the compliance side of the house. I just want you to provide an environment so that our DevOps teams could just operate in that environment and Devs can work on it. Can you do that and we'll pay you? And that was born really our idea of secure cloud enterprise. Our primary offering historically has been secure cloud compliance with the compliance business, if you will, where people could go into market and have a completely new market to go after. Whereas in the enterprise side, we brought those innovations, those learnings and brought it to a commercial market. And so that's the new product, if you will, that we're launching to service that customer base, if you will. So if I'm an AWS customer, when do I know it's time to contact Anishin and say, guys, we need help and we think you're the right ones to help us accelerate? Yeah, I think it's really straightforward. If you are a customer, a commercial SaaS vendor, if you will, that runs on AWS and you want to go after a new market, then you come to us and we can help you quickly get to all the compliance standards so that you can go sell in the government marketplace. That's an offering we already have.  You have a subscription to AWS and you have a subscription to us. And then that basically provides you a secure environment in which you can start developing your applications and start developing, deploying them much like your DevOps cycle would work. So we provide that basis already for you. So if you're a customer on the B2B side and you're going to cloud to get your applications to the marketplace on AWS, we're a great solution for you to actually have that engineered platform in place already. So those are the two areas where you can contact us and we can help you out. And talk to me about when you're in customer conversations, especially as we've had such challenging times the last couple of years, how have those customer conversations changed and evolved? Are you seeing an acceleration up the C-suite stack? Is this a key priority for the CEO and his or her team? Yeah, yeah. I think it's a phenomenal point. I think security has always been top of mind for folks, not just the C-suite, but in boardrooms as well. But the key thing we found is that even in a down market, sometimes in the environment that is playing out in the macro environment, I think the thing that has not changed is people are still trying to figure out how to make their dollar go further and how do I get a better return on investment? So if you look at our compliance business, that growth is all about, that market is growing, there's still opportunity and people are still having budgets and spending. So commercial companies are still trying to figure out how can I extend my market creation to new markets? So that's an area that the C-suite is really interested in. Funny enough, you would think in the cyber world, it's the CISOs or the ones who actually are looking for solutions from us. That's certainly in the audience, but CEOs and CROs are the folks who really clamor for our solution because it is their ability to enter a new market and go after a new budget that can grow their business and have an ROI pretty quickly. That's the ability for them to make that decision. So it's very pertinent to their buying behavior that we've aligned ourselves to. Very simply put, by engaging us, they get to go after a new market. They establish a new line of revenue they didn't have before. So that's always interesting to any C-suite member as you can imagine, and that's the compliance side. Absolutely, establishing new revenue streams is huge and that's a big competitive differentiator. We've seen a lot of customers that weren't able in any industry to do that during the challenging pandemic times and that is a game changer for organizations across industries. Exactly, exactly. And we're seeing that play out, not just on that side, but even on the commercial side where people are also trying to figure out how do I basically make sure it's pre-done so that it's one less thing for me to have to worry about so that I can be more productive, I can get to market pretty quickly, which means I can again deliver to my customers quickly, which means revenue for them as well. So we are the security business, but really if you notice, we're solving a business problem for our customers and we're aligned to the ROI so that it's relatively easier for them to make a decision. They certainly get security and compliance, but the bigger benefit for them is to grow their business itself. So we're trying to accelerate that momentum for them. That's critical and I'm sure your customers really appreciate the impact that you're having on their growth, their ability to deliver to what I can only presume is they're demanding customers as one of the things right now that's been in short supply in the last couple of years is patience and tolerance. Is there a customer story that you think really articulates the value of what Anishin is delivering? Like maybe a favorite customer story that you mentioned when you're giving talks. Sure, we really have a very customer base across the landscape. If you think about our compliance business, Smartsheet is a great example who partnered early. They were not even in the cloud before and then that's a great example with AWS where the three of us work together to offer Smartsheet, the collaboration software public SaaS company if you will, who really established themselves and differentiated themselves in the marketplace by offering that on AWS and we helped them accomplish their FedRAMP itself not just for once, but they've been great customers of ours, multiple renewals over the years and every single year that the business that they get on the federal size has increased because of the work that they did first with us. And so we've looked for more opportunities with them certainly on that part and increasingly we start thinking about where else can we help them grow? Because typically most customers have a thing to solve or on a compliance standard, but it turns out that the compliance journey is, some companies are trying to do a sock to to be able to even sell, then you want to do electronic commerce, you might have to do PCI or you want to sell under the federal government you'll have to do FedRAMP and FedRAMP has moderate, high depending on the customers you have including DOD and once you get to DOD, they'll ask for IL-4 and IL-5. So these are different compliance regimes, if you will, think of them as a journey and we want to make be the company that provides a seamless progression for customers as they're on that journey so that we can actually deliver something of value. We're not interested in nickel and diming customers and charging them by the hour. We're a platform player, we want to make sure that they use it to basically get their ROI and growth happening and we just take care of the hard part of making sure that they are in compliance, right? And similarly, we're bringing the same idea like Smartsheet had told you about to a commercial marketplace of customers who can do the same thing for commercial apps in the cloud. And so that gives us a very clean way for customers to really become not just productive but satisfy their customers quickly and hence grow their business and we celebrate that collaboration and all of that happens because of AWS and our ability to focus on those customers. Sounds like a great partnership and definite synergy there on, I know and you know as well how customer obsessed in their own words, AWS is speaking of customers. One more question for you in terms of being on that journey, that compliance journey which isn't a destination, right? It's probably a zigzaggy path. Do you work with customers that both haven't started the process to Fedrem compliance or those that maybe have with a competitor and are running into roadblocks? Are those both routes to market for you? Yeah, we interestingly enough, historically we used to see a lot of folks who have tried to do it themselves and found it hard or for a variety of reasons they just gave up and so they would come to us. We have also examples of customers who have tried to go on the consulting path and has not worked and come to us. So that it's sort of a broken project. We start from there, but a majority of our business is people who've gotten a contract from one of the agencies and they're like, oh, now what? We need to get this done before September. And so what's the quickest way to get there? And generally that's where we can help you because we are the best fastest way to get there. And so we get that mix of customers. People who have already tried, hasn't worked out. People who have tried with other folks who hasn't worked out, but a majority of the folks are people who don't even know how to go about doing it but they know they have to do it in order for them to keep the customer that they have won one of the agencies, if you will. So that has given us a very healthy perspective on how to help customers of different kinds in that journey. The other thing is, we've grown tremendously in the last couple of years. And the other thing we learned is every customer is different and we tried to bring a very common approach to addressing this problem, even though customers come in all shapes and forms. We have startup companies in early forms of maturity and we have like really iconic unicorn companies who we've helped go through FedRAMP. So the gamut is large, but we're learning a lot by doing this and I think that's the key thing for me. I want our company to be one that is growing with innovation but at the same time keeping flexibility in our approach so that we are not just learning new things, we're delivering on the harder problems our customers are facing. Because I think that's where software innovation can really play a big differentiating role and that's the reason why I always enjoyed being an Anishin and growing the business and keeping the company really fast-moving and innovative. Speaking of being fast-moving and innovative, here we are coming up on the fourth quarter of calendar year 22. What's next for Anishin? What are some of the exciting things that have you pumped up? Have your mojo going for what's next for the rest of the year? Yeah, I think a big portion of my enthusiasm for the company and the road ahead I think it's rare if you look at the industry, oftentimes you see companies that start out with a single solution and then are able to grow from there. One of the best advantages Anishin has is this platform-centric approach to do compliance on the journey I talked about. So if you think about that journey, every customer that is going to cloud has this challenge that they either have to comply to a bunch of standards one or many and then how do I do that in a platform approach in a common way so that I don't have to worry about it? I play a subscription and I am just protected by that and I actually get to marketplace. So that's a tremendous journey we're on. We've only done a few of them and we have a whole new set of compliance standards coming on our platform. So that's one way I look forward to that. The other one I'm really looking forward to is the commercial customers. There's a huge opportunity for people to really know that they're sitting on top of a very secure environment on the AWS and how do I quickly propel myself into the marketplace so that I can be differentiated. I can get to market quickly but I can also make sure my innovations are getting to the marketplace as a customer, right? So I think I'm really excited about the things we are bringing to market not just this year, but next year, early next year on the compliance side as well as the commercial side that'll actually differentiate us and make it a lasting part of a customer's journey. And that's I think the best thing you can hope for for building a lasting company where your innovations are powering the productivity of your customers in a meaningful manner. And I always feel proud of the team. You mentioned the awards but honestly more than anything else we've put together a great team and the team does a tremendous job with a very good ecosystem of partners and our humility is it's not just us it's the ecosystem together and the partnership with Amazon that helps us be the company we are able to be. We live in really story times and we're lucky to be part of this opportunity if you will. Yeah, better together that ecosystem is incredibly powerful. Thank you so much Rakesh for talking about what's going on at Amnesian how you're helping customers accelerate FedRAMP compliance, what you're doing in the commercial space and how you're helping your customers really improve their bottom line. We thank you so much for partnering with theCUBE for season two, episode four of the AWS startup showcase. My pleasure. Thank you very much. And we want to thank you for watching but keep it right here for more action on theCUBE which as you know is your leader in tech coverage. I'm Lisa Martin, see you next time.


Hello everybody, you're very welcome to this session entitled Combining Open Pedagogy and Citizen Science to Empower Learners and Educators and we are joined by a full panel of presenters David Tully, Will Cross, Erin McKinney, and Carlos Gullar. Over to you. Thank you for that wonderful introduction and welcome everyone and thank you for being with us today. I'm Will Cross, I work in the libraries in North Carolina State and I'm going to let the let the rest of my panelists introduce themselves briefly as well. Carlos, that's you, yeah. That's me, Carlos Gullar. So I'm Carlos Gullar, I'm a faculty member in the biotechnology program at NC State. I'm Erin McKinney and I'm an assistant professor in applied ecology at NC State University. And I'm David Tully and I work alongside Will at the in the libraries at North Carolina State University doing some OER and open pedagogy stuff. We're really pleased to have the opportunity to talk about the opportunity to build on these sort of natural connections between open pedagogy and public or citizen science. I know the next 15 minutes are going to really fly by so I'm going to go ahead and turn it over to my colleagues in just a minute. But I wanted to quickly introduce a resource that we're going to be sharing throughout our discussion today. This is a padlet. You can see the go link here. It's just at go.ncsu.edu slash oer21. And we'd like to take a minute or two to let people sort of find their way into that. And maybe add a comment having to do with how you currently are engaging with one or both of these areas of practice, public and citizen science or open pedagogy. So let's take a minute or so and then we'll come back into the presentation. But we hope you'll keep commenting on the padlet, adding suggestions and talking with each other, et cetera. So let's stop and take one minute to do that now and then come back and we'll jump into the discussion. I always want some elevator music in the background, right? Yes. In person, you can see people like heads down writing things but you just sort of have to take on faith that everybody isn't just dispersing. Yeah, exactly. Or open the padlet in another tab. Yeah, I'm seeing some good stuff popping up now and seeing a nice mix of specific resources, general questions and I'm totally new and excited to learn. That's awesome. Yeah, I think it's always reassuring and affirming to see that we are indeed all existing along a spectrum. So there's no right or wrong place to be. So let's give it another 20 seconds or so. And then as I say, we'll start talking but please don't stop writing. Please keep adding information as you have it now or if something that is said sort of sparks something, you can add that as well. Yeah, communal scribing as we go, right? Exactly, right. Yes. So do please keep adding comments but now we're going to get into some of the discussion we wanted to make sure to have. And I'm going to go ahead and turn it over to Carlos to introduce this concept of public or citizen science. Thank you, Will. So we use the term citizen science because it's widely used and recognized but we want to clarify here that citizen science has nothing to do with citizenship, rather citizen science engages and really empowers the public including people who may not identify as scientists. Yeah, absolutely. Citizen science efforts typically involve a partnership between the public and professional researchers. And that means that reciprocity is key. Participants are often experts in the subject being studied, right? They might be expert hobbyists. That means they not only enable data collection. They also help to inform project development and spark creativity. So from the researcher's perspective, data sharing improves science communication and relevance. So I think next David is going to walk us through kind of what are some of these attributes. What is open pedagogy? Thank you, Erin. Good question. So essentially, pedagogy is a set of practices and values that essentially looks to both engage students as creators of information rather than simply consumers of it. And it's a form of experiential learning in which students will demonstrate understanding through the acts of creation. So it essentially seeks to do a few different things. First and foremost, engage and empower learners who initially might not identify as creators of knowledge. And they're sort of empowered to do this through what we call nondisposable or renewable assignments. So in this sense, the student is both the creator and the contributor of assignments, which are openly licensed. And it allows that content to be shared, revised, and reused by future students in that course. Open pedagogy seeks to create authentic partnerships with professional researchers. So it reexamines that power dynamic that traditionally exists between educator and student. In this type of scenario, the educator adopts more of a guideline approach. And reciprocity is key. So participants enable data collection, they inform project development, and hopefully ideally spark creativity. And this idea of data sharing, it improves science communication and relevance. And it gives back to the wider community. Next slide, please. So one way in which our university libraries has sought to support open pedagogy has been through the open pedagogy incubator. I'll try and give you all the long and the short of this. The incubator is a multi semester program, which is designed at the concept level to incentivize and support faculty to move beyond what we call the first step, which is adopting open course materials, into actually implementing open enabled practices around or within their own courses. So the idea would be that you have a faculty member who is interested in the incubator, they apply, if they're successful, they're accepted in. And they're essentially sort of trained up and given knowledge, skills and support in three main areas. The first one is the potential of open pedagogy, sort of more sort of theory sort of laced things there. But the second is current and emerging models of open pedagogical practices. And the third area is this idea of being prepared to leave with a set of concrete processes for actually implementing open pedagogy within their own courses. So the incubator program is sort of based around this series of readings, discussions within the cohort and workshops. And the structure of the program is based around three cohort meetings. You have your initial meeting where you're introduced to one another, you're introduced to the folks facilitating it, so people like Will and I and some of our colleagues. The second cohort meeting is sort of this midway point where you've had a taster already, you might have attended some workshops, you would have done some readings, there would have been some discussions. And you can at this point sort of discuss with one another what's been attractive, what you're still curious about and sort of shape the program sort of menu style for what's to come. And the third and final cohort meeting is where you sort of present upon what your open intervention is going to be. So once you've been through this program, what you are going to do. We ask our cohort to attend at least four different workshops. We have a menu system which they help guide. So we have sort of random double figures in terms of workshops that are both theory and practice based. And it's our cohort that tells us where their interest lies and we shape and schedule those workshops according to those interests. And finally, as I mentioned just now, there's the open intervention piece. So they leave the program with an idea for what their specific open intervention and their course is going to look like. Next slide please. Yeah, so given the workshops and kind of the structure of the open pedagogy incubator that David just described, a number of us in the inaugural cohort had a lot of experience working with citizen science. So a natural kind of topic for one of our group discussions in workshops was just thinking about what are those parallels. You know, how does citizen science fit with open pedagogy? And so I was thinking, you know, like what better way? Clearly we had an ice cream craving.  The column in core for both of these approaches is a collaborative iterative co-creation where citizen science depends on open pedagogy via accessible information and materials, whereas open pedagogy can feature citizen science by engaging students to actually participate in large projects through individual building contributions. So then if we actually look at what this might look like in practice from project development to interpreting the data, participants in my, oh, if you go to the next slide, Will, sorry, participants in my sourdough for science project have provided crucial insights either through conversations in our public Facebook groups or during Q&A sessions in middle school classrooms. I worked with middle school students in Raleigh to grow hundreds of sourdough starters to determine how flower type affects microbial communities. We targeted flower type because it's a major question asked over and over again by thousands of members on our Facebook group. Throughout the students experiments, I wrote a series of blog posts to explain the science behind sourdough and to answer student questions in real time as they were asking them in the classroom. I also worked with the teachers to refine a graphical protocol, which you can see here, and to develop complementary lesson plans, which are actually hyperlinked in these slides that were aligned with learning objectives in science, math, and reading comprehension. So the full teaching packet is freely available. So you can see, you know, that interweaving of open pedagogy and citizen science throughout this project. And I was lucky enough that I had the opportunity to teach fantastic students molecular biology techniques. And as part of several of our lab based courses, we work on a weird microbe that's an alchemist that's able to precipitate liquid gold into gold nanoparticles. And when we moved to remote instruction, several students really wanted to continue their research experience, and we did not have access to labs. But we had this Delftia Hub website that I had started a couple of years ago. And we had fantastic students like Lauren Ramillo really interested in public science and open education. And they heard me complain for a long time that the Wikipedia page for Delftia was really short and somewhat inaccurate. And over the summer, they teamed up and created a cohort of 12 to 16 student volunteers, not for credit. They took the wiki edu course to learn how to edit wiki. And they used hypothesis to openly annotate Delftia papers, articles using some of the tags that you see on the screen. And throughout the process, they blogged about it, and they ended up editing and improving the Wikipedia page. And this for us is a really a great example of how students can, if you give them ownership and let them know where the tools are, they are empowered to do research online, learn and share with others through blog posts and Wikipedia. Thank you, Aaron and Carlos, for sharing those examples. So that's sort of the quick version of what we wanted to share with you, this sort of peanut butter and chocolate combination of these two cool things and some concrete examples of what that looked like. We'd like now to open up a conversation about whether this has sparked anything sort of interesting for you, or if you have questions about how it worked or what that might look like in different places. I saw a couple of comments in the chat calling out the incubator program. And I wanted to mention what David said, which is that there's a link to all the materials on an OSF site and a presentation that goes into more depth in terms of the what, how, and why of that program in particular. So we're happy to answer questions here about the combination or anything else. Maybe I'll start with the really burning question, which is somebody asked, what's the best flower type, Aaron? Can you answer that one? You may be muted, or at least I'm not hearing you. Thank you. There's some background noise. It depends what you want from your sourdough, we found. So in growing these sourdough starters, I found that rye flour, a whole grain flour made milled from rye kernels, it just has some extra goodness because there's a lot of Amelie's activity and more easily digestible starches and sugars. So you get a really rapid rise really quickly. But if you want certain flavor profiles, like we found that a millet starter actually goes for almost a lemony effervescent sourdough. So there are distinct microbial communities that produce distinct aromatic profiles, just depending on what you desire. Thanks very much, Aaron. Maybe just given that there's quite a number of you, how did you, and you've got different specialisms in different areas of discipline, how did you get together? How did this come about for you as a group? How did that synergy come about? Can I jump in? I thought it was amazing having such high interdisciplinarity and also different experience levels with different class sizes. The largest class that I teach is about 45 to 50 students. And then my other classes tend to be 20 to 25 students. But we had a colleague in the incubator whose classes are usually 250. So it was really great to talk about, here are the different ways that we could see that would work or not, and that might scale well or not across these different class sizes and disciplines. So I thought it kept the conversation really lively and active brainstorming all the time. And I'll jump in and say that I learned so much from the other participants. And Aaron and I now work together and connect our classes through open annotation and resources and learning from the libraries and learning from other cohort participants about what the philosophy and reading some articles through different perspectives really helped us as a cohort learn and implement. Yeah. And I think also then brainstorming ways to fine tune our pedagogical approaches to ensure we might have an intention that isn't necessarily carried out or realized by the students. So then thinking through, you know, how do we troubleshoot this together and getting those fresh perspectives has been amazing. Great. Thank you. I don't know if you've taken a chance to look back at the paddlers and see some of the things. I don't know if you've got any comments on some of the posts that participants have put up there. I now want to check out open, et cetera, if that's the way it's pronounced. As we're looking, I'll also call out Carlos, I know something you've explored in the past, and I bet you have too, Aaron, is the opportunity, especially in the online environment where we've been to start building these cohorts across sort of national and global boundaries. To say this is something that could happen in this state, in this state, in the United States or between Canada and Australia or between, you know, wherever and wherever. So I think that's true for some of the open pedagogy stuff. That's true for the citizen science stuff. And that's true for the incubator as well. So if you're looking at this and going, this looks really awesome. And I wish I had a partner who's done this before. Well, you're looking at some enthusiastic partners here on the screen as well. So we'd be happy to talk about what it means to share materials, to have conversations, or even to sort of work collaboratively in different ways as well. That's what makes the open community work so well. And we're excited to sort of live those values. Absolutely. I would say it's been very empowering to learn about these open tools that can then enable and facilitate collaborations. This spring, I'm actually next week is the last week of classes for us. So I'm wrapping up a course that my students at NC State in Raleigh, North Carolina have been collaborating all semester on research projects with students in Northern Michigan University.  But we can all be real time, you know, gaining even more from diverse perspectives across geographies, across institutions, across different conservation perspectives. And I think I have felt braver to do that sort of thing. Open pedagogy is really like the gateway for me, dipping my toes in. I totally agree. And it has made me hopefully a more transparent educator by not feeling that now I feel okay sharing what I'm telling with students in open websites or having students blog about their experiences. And I was initially confined to thinking everything we had to do was somehow lab bound. And now we can create the experiments or design the experiments in the lab, but we can share the results and have students really analyze them across state lines, borders and internationally and comment. Yeah. And I think to Ed's point in the question on the padlet, thinking about writing blog posts, the students or the citizen science's role is hugely important for informing the real world relevance. How do our research results actually play out and apply to the real world? So, I think that's been a critical viewpoint to keep in mind at every step. Absolutely. I think that authenticity is demonstrated throughout a lot of the things you've shared with us today. I'm afraid that's our time up. We've got to continue the conversation over on Discord. I know you've got resources to share there. Just want to thank you all so much and thanks for the participants and jumping in on padlet and everything. And we'll wrap it up there. Thank you.


Hi and welcome to the video courses for Windows Server 2016. My name is Patrick Loner and I'll be your instructor. Let's start with a little bit about my background. I've been in the IT industry for just about 18 years. I got my start with an MCSE on Windows NT, and have sort of worked my way up through the ranks on every version of Windows that has existed. I began my career in a position of network administration at a training center where I handled just about everything, imaging of PCs, hardware and software, troubleshooting in classroom environments, as well as for the business side of things.  I quickly got into training, some of the Windows 2000 courses and CompTIA courses, and as they say, the rest is history. And I've been working as a Microsoft certified trainer now for the better part of 18 years. I've had a couple of positions, one with the training center, another with a network consulting firm for three years where we were involved heavily in projects for upgrading to newer versions of Windows Server, upgrading and migrating to exchange. For the past 10 years I've operated as a freelance trainer and network consultant. It's my pleasure to be your instructor on these courses, and now let's get ready to get into the material. But in the first topic, we're going to just cover an overview of concepts, and I call these identity management concepts, as well as concepts and terms for Active Directory domain services. Identity management just is a term that is used for any platform that exists for the purpose of creating and managing unique identities. Identities represent users and computers and groups, and they are used within a client server domain type environment in order to ensure security. We need to provide access to resources. That's the whole point of a network. But I want to do so in a secure fashion. I need to be able to identify who's accessing. I need to be able to control who is accessing and control the level of access that they have. So we begin with those kinds of concepts. Let's talk about information protection. The concept of information protection really classifies one of the primary duties of IT personnel. Connect users to the information that they need in a secure manner. The purpose of a network is to connect computer systems so that they may share resources. Those resources can be files, folders, printers, applications, et cetera. But we don't just open them up so that anybody can gain access to them. No, we need to connect authorized users to the information that they need. That concept of authorizing a user requires that I know who they are. I have to be able to identify them and then authorize them and then determine the level of authorization that they have. There are a lot of different concepts, but they are foundational to the purpose of IT personnel. There are several approaches to this that are standardized in the industry. These are three acronyms that are probably the most widely used. Identity and Access, just IDA. This is users and other security principles like groups and computers which are given access to resources. Identity and Access as a term or a concept typically just speaks to the actual management platforms like Active Directory Domain Services. There's a database that hosts user accounts or holds, I should say user accounts and groups and computer representations of every system on the network so as to secure access to all of those entities. The AAA, Authentication, Authorization, and Accounting. Users provide their credentials, that's authentication, they're doing that to validate their identity. Then we're going to use those credentials or the system's going to use those credentials to secure access to resources. And monitoring and logging of that access is going to be provided and that would be the accounting piece. When we talk network security, probably one of the most common terms or acronyms that gets used is confidentiality, integrity, and availability. We need our information to be protected against unauthorized access, therefore it needs to be kept confidential. Only authorized users should be able to access the data. We also need to make sure that the data remains, that it keeps its integrity. It goes without being altered in an unauthorized fashion and then of course it has to be available. I've always thought that CIA, the CIA triad, as it's often called, is the best just kind of global term to what we need to do as IT personnel, right? Let's start from the back. We need to make the system available. It needs to be available to the users that need those resources. However, it should only be available to authorized users, so confidential. It shouldn't be able to be modified by unauthorized users, so it should maintain its integrity, both in storage and in transit. So these are three foundational concepts or different approaches, if you will, that we should be familiar with in the industry. So let's dig into them a little bit deeper. Identity and access first. Identity is a user account or other security principle, such as groups and computers, and then those identities will access resources like shared folders or other objects, a database, an exchange mailbox, a web application internally, et cetera. Those identities are going to be stored in a directory database and uniquely identified using what's called a SID, a security identifier. So an object SID is something that we're going to talk about frequently here within Active Directory because it's how the system uniquely identifies each identity. When we go to access, the actual shared folders or the folders on an NTFS file system are secured with a security descriptor. That security descriptor is better known as an ACL, an access control list. Now there's more to the security descriptor than the access control list, but the access control list is one of the most important parts. It is a compilation of individual entries or ACEs, and the ACEs identify an identity and the level of permission that they have on that particular resource. So the directory database like Active Directory stores the identities. The security descriptors are stored on the actual resources that those identities will need to access, but collectively the two are going to ensure that only authorized users have access to resources. Now the functions of authentication and authorization, therefore, are a part of the directory service itself. Technically authorization is part of access as well, but these are integral to Active Directory domain services and they're integral to any type of secure access to resources. The first concept is authentication. Authentication is validating the identity of an individual, the user on the network. We have to be able to identify who you are in order to be able to determine what you are able to do. And we're familiar with the concept of authentication. If I go to try to get onto, let's say, a cruise ship, I have to provide my identity. If I'm going to get on a plane, I have to provide my identity. I don't just provide the ticket, which authorizes me to get on the plane. I also have to validate who I am that my name matches the name on the ticket. And then that identity, that certificate, if you will, has to come from a trusted entity. I've often said I can't just show up with a post-it note that has my name and address on it. The TSA personnel are not going to let me through the security checkpoint. Even if I've got a valid ticket, if my only ID is a post-it note. So the ID has to come from somewhere that is valid. We'll get back to that here in a second. But the concept of authentication is simply validating who somebody is. And so this is any kind of login on a Windows network. You have interactive logon, which is sitting down in front of a computer and typing in a username and a password. That's an interactive logon. Then you have network logon, which occurs anytime you try to access something over the network. Now, the latter of the two, we often in a client-server domain environment don't even see because it's passing your interactive login credentials across the network and we're not being asked to authenticate again. So that can sort of give the impression that you just log into the system once and that's all you need, when in reality there are things going on behind the scenes all the time. But Active Directory does enable what's called single sign-on. You log on to the domain once and then you're able to access resources throughout the domain. I don't want to get ahead of myself too much. It is a necessary concept of validating the identity of the individual. Also necessary, though, is authorization. Authorization is the process of verifying whether an authenticated user has access rights that are required for a network resource. So what can you perform? Are you able to read? Are you able to write? Are you able to delete on Active Directory objects? Are you able to create, manage, delete those kinds of things? So authentication and authorization are definitely tied together, but one does not imply the other. So authentication does not imply authorization. In other words, just because you are who you say you are and that's trusted doesn't mean you can do whatever it is you're trying to do. Go back to the situation where I'm trying to get on a plane.  They're going to ask me for what? They're going to ask me for my ticket. They need the piece of documentation that doesn't identify me but validates that I'm actually supposed to be able to walk through that security checkpoint. If I show up and validate my identity to them, it is meaningless if I'm not authorized to walk through the security gate. And the same thing is true in Active Directory. You can provide a valid username and a password to the domain controller but if you don't have login rights at the computer you're sitting at you're not going to be able to log in. If you go to try to access a file or folder you can validate your identity but if you're not given the permission to access that resource you're not going to be able to access the resource. So authentication alone is not good enough. You have to have both authentication and authorization. So another way that I often say it is that authentication does not imply authorization but it must precede it.  So one final visit to my TSA analogy is just to summarize. If I show up with an ID and no ticket I don't get in. If I show up with a ticket and no ID I don't get in. You need both authentication and authorization. Now let's go back through some of the terms. We've actually mentioned a couple of these already but these are terms that I'm going to use as we go through this course and we just have to make sure everybody knows what we're talking about and we want to continually define them. A SID, an object SID is a security identifier and every user, every computer, every security group, service account, every object technically created in Active Directory has what's called an object SID and that object SID actually is going to have two parts. It's going to be made up of the domain SID, security identifier, and then a relative identifier which identifies that object uniquely but collectively the two are just referred to as the SID. Now typically I don't see the SID. We see common names of users, groups, computers. In fact if you do see the SIDs it often implies that there's a problem like on an access control list if you see a SID instead of a username in many cases that means that there's something wrong with a trust relationship or something to that effect. So we don't have to see them but the system uses them. A security principle is just another term for any object with a SID. I don't usually call it a security principle nor do I know many people who do. It's the user account but a user account's a security principle. A security group is a security principle. A computer account security principle on and on. Now I mentioned the ACL. The full name of that is actually DACL. Sometimes people will pronounce it DACL. It's discretionary access control list and this is a part of a file and folder as well as directory objects and they're the part that grants access to users, groups, and computers. This is where the authorization comes from. The individual access control entries that either grant or deny access to a particular user or group. Access tokens are something that is generated during the login process. The access token is going to be generated through kind of mutual efforts from the local security authority on the client computer as well as the LSA and KDC components on the domain controller. It's going to contain the user SID as well as SIDs of any groups that I belong to. We'll come back to how that's used here in a minute. Kerberos is the primary authentication protocol for Active Directory. Kerberos is an inherent part to any AD environment and it provides a very secure means of authenticating. Back to the access token a little bit more. The access token is a protected object that contains information about the identity and associated user rights of an individual. This is not something that you see. It's certainly behind the scenes, but it's pretty important. It actually stays attached to your user process and is used to determine access rights and your identity throughout the duration of a login session. As I said, it's generated by the LSA in conjunction with the key distribution center component of Kerberos that's hosted on a domain controller. It contains the SID of the user account. It contains the SIDs of any groups that I belong to. It also contains a list of user rights. User rights are a little different than permissions. Permissions are granted on a particular object. A folder, for instance, will have an access control list that says if you're in the marketing group, you get read-write permission. If you're in the managers group, you get modify. That's a permission. It applies to that particular object. User rights are permissions, but they're permissions for the entire system. The user right of logging on locally just simply means that on this system, this account, this group can sit down and log on interactively. Backing up the system, taking ownership of files and directories, shutting down the system, et cetera, et cetera, there are 35 to 40 different user rights. But when you log in, your access token is going to have that list of user rights. It's also going to have other access information. It's possible to restrict log-on times for users. It's possible to restrict the computers that you can log on to. Although this is not commonly done, it would be a part of the access token. So when I log in during the login process, that's when this access token is generated and it's attached to every user process that tries to access resources both locally as well as over the network. Access control is the process used when accessing protected resources. In Windows networks, pretty much every resource is protected because we typically don't see the FAT32 file system being used. All objects on an NTFS partition therefore have a security descriptor, which contains these different components and all Active Directory domain services objects will have a security descriptor as well. The security descriptor has a DACL, which contains a list of users and groups that either have access or have been denied, and that DACL is specific to each object. It also has a system access control list. The system access control list is a little bit different. It controls the auditing of specific objects. So it's determining whether or not I'm trying to track access to this particular object. In either of these cases, DACL or SACL, the individual entries are called access control entries or ACEs. They specify the SID of a single object. It could be user or group or computer. It specifies whether the permission is being allowed, denied or audited, and then it specifies the actual permission. The way that this works is if there isn't an ACE that matches the user or group, then access is implicitly denied. So if you're not on the list, then you don't get access. So the analogy that we usually use is trying to get into a private party.  That's the way it works in Active Directory and NTFS. There has to be an entry on the list that grants that particular person or group access or else it's implicitly denied. The Kerberos login process is a very involved process. I've broken it down into six steps here and just trying to get a somewhat of a general understanding. You don't need to have detailed knowledge about the Kerberos protocol. The white paper is over 100 pages long for Kerberos and it's just simply not important. But it is behind the scenes. It is what protocol is being used to authenticate so it's somewhat important for us to get just conceptually because Kerberos provides single sign-on capabilities. That's one of the biggest benefits in an Active Directory environment, at least just initially, is the ability to use the same account and access multiple systems but not have to provide that account multiple times. But behind the scenes, it's using that account to determine my level of access. The component that's used on the domain controller is called the Key Distribution Center or KDC and it's a sub-component of the local security authority, LSA. LSA is the actual service you would see if you, say, pulled up task manager and looked at the processes. Now Kerberos gets its name from Cerebrus, the three-headed dog in Greek mythology that guards the river Hades. You might think, well, that's a sort of odd point to bring out. But if you go to the Kerberos web page, it's got pictures or drawings of Cerebrus and it actually is an important point because it's a three-headed dog. We've actually got three components in a Windows network that will provide this single sign-on. You have the client and the server, the client and the file server they're trying to access, and then you have the domain controller, which is this trusted third party to both client and server. So it is kind of a three-pronged approach and that's why I think that that's an important point. So let's walk through these steps here and then we're going to use an analogy. So first off, the user account gets authenticated to a domain controller.  That username and password is sent in a secure way to the domain controller. The domain controller will then return what's called a TGT or ticket-granting ticket to the client. Now the client will immediately use the ticket-granting ticket to request or apply for access to the local workstation. Remember I have to have the ability to sit down in front of a computer and log in. Technically the workstation that I'm at is the first resource that I'm trying to access on the network. So the client will immediately use the TGT to apply access to the local workstation. The domain controller will grant access to the local workstation. And at that point, even though we don't have it listed, that's when the access token is getting created. So the access token contains the SIDS. I take that back. The access token is actually done up in step number two before I get a ticket-granting ticket. I've got an access token that's got my user SID, my group SIDS, user rights, login information because it's actually that information that's used to determine in step three if I have access to the local workstation. Okay, so now the user's logged in and now let's say I try to hit a shared folder. Well, the client behind the scenes will use the ticket-granting ticket to apply for access to a remote system. It's asking for what's called a service ticket. And assuming that I'm authenticated, the domain controller will return that service ticket to the remote system. The client will then present the service ticket to the file server. Now, the process isn't done, but that service ticket identifies to the file server that, hey, I'm a valid user. I'm an authenticated user. Here's my access token. It tells you exactly who I am. And this is information that has been given to me by this trusted third party, the domain controller. So the file server will accept those authentication credentials and then will use its own access control list to determine whether the user has access to the file. I always like to use the analogy of a county fair with the Kerberos login process, okay? And in order to explain the analogy, we have to contrast it with the analogy of an amusement park. So if you go to an amusement park and you pay, you know, whatever, $50 or $60 or more to get into the amusement park, it's sort of under the understanding that you'll be able to ride all the rides, okay? Sure, every analogy falls off. They've got a few things here or there that may cost additional money. But for the most part, in an amusement park, when you pay to get in the door, you are authorized to ride every ride in that place. That's not the case with a county fair. A county fair, you pay to get in the gate, albeit much less, but all that gives you the ability to do is what? Well, go to the ticket booth. If you want to ride rides, you've got to go to the ticket booth and you've got to buy tickets. And then you have to present those tickets to each individual ride in order to get on the ride. And that's what Kerberos is like. I get into the network. I sign in. I validate my identity. But all I've really given myself the ability to do is to go obtain tickets when I need to go access individual resources. All right? All behind the scenes. The user doesn't see any of this. The user's not asked to authenticate more than once. They are going to either have access to resources or they're not going to have access to resources. And Kerberos is behind the scenes making sure that all that happens. So far, as we've been talking about, we've sort of implied the entire time that we have a domain environment and actually active directory environments are always domain environments. But there is another kind of environment and that is a workgroup situation. And authentication and authorization will work with two different types of identity stores, either standalone or workgroup or active directory, a.k.a. domain. So standalone authentication and authorization just means that the identity store that holds the user accounts and groups is the local SAM or Security Accounts Manager database on the local system. So there is no shared central identity store. If you have a user account on this computer, then you can log on to this computer. If you need to access resources on another computer on the network, then you will need a user account on that computer. Your user account in your local SAM database does nothing for accessing resources on a separate system. So you're going to have to have multiple accounts. You can set up accounts that are shared that multiple people use. You can set up duplicate accounts on each system. And you can achieve that level of access, but you can see how that would become very cumbersome, the management of multiple accounts, the management of passwords. And so this is practically limited to very, very small environments. Now, Microsoft, by the way, in Windows 7 and later has created the concept of a home group, because this was really quite annoying to try to do this back in Windows XP, even in a home network that had three or four different systems. Clearly, their security is not that big of an issue, but still I'm just trying to enable access. So the home group really made it a lot easier, but it did not make it easier by eliminating this requirement to having accounts on each system. It instead just used a special home group user account. And so a home group user account is created and it's the account that is used when people try to access resources from one to another system in the home group. Fundamentally, behind the scenes, the concepts are exactly the same, with the SAM database, no shared identity store. It's just that Microsoft took some steps to make it easier to use in home environments. But in business environments, that's not what we're going to be doing. Even the smallest businesses will often still be utilizing a domain because of the benefits that it provides. Now, when I say that I'm talking 10-plus computers, sure, if you've got a really small business that's only got two or three computers, then you probably aren't going to have a domain because it would just be a little excessive. But anything beyond 10 computers and a domain environment is going to be very beneficial. Active Directory Domains function as a centralized identity store that's trusted by all the domain members. So everybody belongs to the domain, this group of computers that share a common Directory database. That database is hosted on domain controllers, and as we've already seen, users provide authentication services through Kerberos. They run the Active Directory Domain Services role. They provide the ability to authenticate users. They provide the ticket-graining ticket capabilities and service tickets for resources. So there's a lot of benefits to using domains. It allows you to store information centrally regarding users, groups, and computers. Because it's stored centrally, that means I only need one account. It doesn't matter if we have 500 computers in the domain, I'm still going to have one user account for each individual user. They don't need to have separate accounts on multiple systems. They're all also in the same place, so they can be centrally managed. Provides centralized authentication and single sign-on using the Kerberos authentication protocol. Centralized access control using users in groups. And also provides the ability to set up audit trails when that is required. So I suppose just to make sure everybody's on the same page, we discuss really quickly workgroup versus domain. But obviously for the duration of the course, and any time you're in a business environment, you're dealing with Active Directory Domains because of the numerous benefits that they provide. So with that definition of the Active Directory Domain behind us, let's move forward and talk about some of the components and concepts within Active Directory Domain services. We're going to start by talking about the Active Directory database. At the heart of AD is a physical database. It's a directory database that stores information about users, computers, groups, and other objects. Active Directory has both a logical and a physical structure. The logical structure controls the organization of Active Directory. The forest, the trees, the domains, the OUs, those are all part of the logical structure. The physical structure is the database itself, the partitions, the sites really represent the physical structure, global catalog servers, and the like. And we're also going to talk about the concept of trust relationships, although we won't revisit that until we start getting into your more complex Active Directory environments. So at the core, Active Directory Domain services is just a database. That database contains records and fields, but we don't usually refer to them in that way. In Active Directory, we call them objects and attributes. So each record in the Active Directory database represents an object, and an object is a user, a computer, a group, a shared folder, a printer, a domain controller, an OU, et cetera, et cetera, et cetera. These are all objects. Every object has attributes that define that object. So the attributes are unique values to identify things about the object, like login name, SID, password, et cetera. So when we talk about objects and attributes, that's what we're talking about. So let's use a user account. So here's a user object. Here's my user object. My login name is Patrick L. My SID is generated by the system. My password is whatever my password is. There are other attributes. Of course, department, office, city, state, phone numbers, manager, title, it goes on and on and on. But the objects are defined by the attributes. Active Directory also provides services and interfaces between the database. Kerberos would be the authentication protocol as we've talked about, but it is used to access the database to validate credentials. Replication is used to replicate the objects and attributes in the database. There's Windows tools, Active Directory users and computers, Active Directory administrative center, which are used to interact with the database. So in other words, we're never directly interacting with the database, adding records and fields. Now we're going into a graphical tool and clicking a button to create a user account. Or we're using Windows PowerShell and the new AD user, new AD group commands to interface with the database. So at the core, it is a database. It's actually called ntds.dit. It sits in the ntds directory on every domain controller. But never will I actually go and work with those files, save backup and recovery scenarios. We call that database the data store. It contains the database files and processes that store and manage directory information for users, services, applications. So the file name is ntds.dit. By default, it's in the Windows ntds directory. It is a transactional database. That means that changes to the database, the addition or modification of objects, are going to be recorded using transaction log files. The changes are actually made in memory. But the problem with making changes in memory for a database is that if I lose power, then I will have lost the changes and I don't have no way of recovering them. And so simultaneously, when the changes are written into memory, they're written into these log files. And then the log files are used to commit the changes into the database, but they also provide a recovery mechanism should you lose power. This is an extensible storage engine, ESE database, which is a standard type of database for many Microsoft products. Even though it's a single physical file, it is logically divided into partitions or naming context. Okay, now those are just two terms that talk about the exact same thing. And we'll talk about those partitions. This is accessible only, this database, accessible only using domain control or administrative utilities and processes, and we've described some of those already. So the partitions or naming context are important because they provide a logical division of the Active Directory database. Each of these partitions contains different kinds of information. And in many cases, I don't interact with them a great deal, but it's still important to understand that they exist. So I'm going to start right in the middle and that's on the domain partition. If you've worked with Active Directory at all, then this is the partition that you're familiar with because the domain partition is what we see when we open up tools like Active Directory users at computers or the Active Directory Administrative Center. And I'm mentioning both just because the Admin Center was introduced in 2008 R2 and so some people still don't know that it even exists. And anyway, we'll use that tool, we'll use both of them, but the domain partition is going to be the domain and all the organizational units inside of it and where the users and groups and computer objects are. And so that's where we're at 99% of the time, therefore that's the partition that we are the most familiar with. The domain partition is a portion of the Active Directory database that contains those objects and is replicated within the same domain. Now let's go up to the top, Schema Partition. The Schema Partition is a forest-wide partition. There's one Schema, regardless of how many domains you have in your Active Directory environment. It defines objects and attributes. I'm going to hold off on that one because we're going to go into it here in just a second in more detail. The configuration partition is sort of the topology of Active Directory. It's the layout, it defines sites and replication objects and it defines trust relationships. Active Directory integrated applications like Exchange would integrate and store all their information in the configuration partition. On the vast majority of days, you and I would never be going into the Schema or the configuration partition. In fact, really one of the only reasons to even go in there is just to validate information, not actually add any information. So we spend the vast majority of our time in that domain portion, but both the Schema and the Config are forest-wide partitions. In other words, there's only one of them in the entire forest. Now a global catalog is technically a separate partition. The global catalog is a domain controller that has information about multiple domains within the forest. More on that later. And the global catalog also has a partial attribute set or PAS. So the global catalog contains all objects, but it does not contain all attributes. It is primarily there for locating objects in a multi-domain environment. And you also do have application partitions, but application partitions are for the storage of application-related data and in situations where we need to limit where that data is actually going to be replicated. So, you know, in any environment we're going to use the top four, but the use of application partitions is actually far less common. Now you also have a sysfall folder structure on domain controllers. The sysfall folder structure predominantly is going to hold your group policy objects. It can also contain login scripts, but that's really a legacy setup. And so nowadays we use group policy to push out login scripts or even use group policy to eliminate the need for a login script. So the sysfall folder structure has a policies directory in it, and that's where all the group policy objects are going to be contained. And that's where clients are going to connect during login to apply those policies. So it's a single physical file, but the database is separated into these various partitions. And as I said, each partition is going to have different types of information. Now back to the schema, I just didn't want to hit it super quick. I mean, you don't have to deal with the schema that often, but it is incredibly important. The analogy that I often use is like the schema is like the registry for Active Directory. Now that's a completely inaccurate analogy because it's not the same at all. It's not storing the configuration of Active Directory like the registry is. So the only reason, that's my disclaimer, the only reason I didn't even use that statement is just to discuss the importance of the schema.  Well, you restore from a backup or you reinstall Windows. It's bad news, right? Well, that's the same thing that would happen if you corrupted the Active Directory schema. And so that's why I use that phrase. But really, the schema provides the definitions for objects and attributes that can be created in the Active Directory database. So we said you can create user accounts in Active Directory. Well, how? Well, it's because the user object class is defined in the schema. So when we create a user, we're actually creating an instance of this user object class. And that object class defines the attributes that can be provided for a user account. And it defines that some of these attributes are mandatory like a SID, a display name, a user login name, a password. These are mandatory attributes, whereas others, department, city, state, phone numbers, et cetera, those are optional attributes. And so, but it is the schema that defines that. You can't just go create a car object in Active Directory with attributes like make, model, and year in mileage because that object class doesn't exist. Okay? It's not there. Now if you wanted to create it, if you wanted to use Active Directory to store information like that, well, then you'd have to create an object class and then create attribute classes and link the two together. It's uncommon for us to do that, at least manually, but the Active Directory schema is extensible to support additional applications. And the best example of this really is Microsoft Exchange. Microsoft Exchange is the Microsoft email platform. It's been around for 20 plus years, but it is integrated with Active Directory and has been ever since Exchange 2000. Just so you know, we're on version 2016 now. That means that Exchange stores all of its information in Active Directory. So every policy that you create, every domain that's represented, every, you know, every control, everything that you would create in Exchange is an object in the Active Directory database. Not only that, but it enables a whole bunch of additional attributes for existing objects like users and groups because you can mail-enable them. So you're going to assign them a mailbox. You're going to assign policies to their account limits, et cetera, et cetera. Not meant to be an Exchange class here. I'm just a good example because the very first thing that happens every time you go to deploy Exchange in an Active Directory environment, the very first thing that happens is a schema extension. All these files get added into the schema so that all these new objects can be created and so that when you go to a properties, the properties of a user object, you have access to all these additional attributes that has to be done in order to support that particular application. Having said that, as I said, the schema is not overly relevant to day-to-day life. We don't modify the schema to create a user object. We only modify the schema if we need to create a completely new object type, which is very rare unless it's in conjunction with an application. But don't let that make you think that it's not important. It's incredibly important. It's just not something you're going to work with on a day-to-day basis. The absolute most important part of an Active Directory environment is the domain. It's the term that we just need to understand. When we use the term domain in an Active Directory environment, we're not talking about just a conceptual thing. Oh, there's a client-server domain environment. No, we're actually talking about the core unit in the logical structure of AD. A domain, a collection of Active Directory objects. This is used to group them and manage them within the organization. A domain is like a club that you belong to. You are entering the club. You are logging in to the domain. You're using a user identity that exists in the domain database, specifically in the domain partition for your particular domain. Even though I'm sitting in front of a computer, I'm no longer logging on to that computer. I'm logging on to the domain, to this collection of computers. That collection of computers has a couple of things. It's an administrative boundary. In other words, there's a built-in administrator account in the domain. There's a domain admins group in the domain. The administrative privileges of those accounts extend to and stop at the domain boundary. If I'm an admin in domain A and there's a domain B, I don't have any rights over in domain B and vice versa. It's an administrative boundary. It's also a replication boundary because each domain is represented by a unique domain partition. That partition and everything that you see in Active Directory users and computers for a particular domain would only be replicated within the domain. Just in case here, Active Directory uses a concept of multi-master replication. I just want to make sure we've used the term a couple of times here. Make sure everybody's on the same page. If you've got more than one domain controller for a domain, they both have a writable copy of the database. A user can be added in one copy and a group can be added in another copy. The process of replication is the process of making sure that all of these writable copies of the domain database are kept up to date. That's within a domain. It's a replication boundary. It's also an authentication and authorization boundary by default. In other words, your single sign-on capabilities extend to and stop at the domain boundaries. If you're a user in domain A and you've authenticated to domain A's domain controllers, then you cannot inherently access resources over in domain B. Additional components will be required in order to enable that access. It's the core unit of the Active Directory logical structure and it provides these boundaries. Domains can actually be put together. We won't talk about this a whole lot beyond this concept here until we get into the complex setups. Domains can be set up in trees and forest. A domain tree is a logical hierarchy of domains within the same Active Directory forest. It consists of parent and child domains. They have a contiguous DNS namespace, meaning that an Active Directory domains use DNS names by default. Let's say my top-level domain here is companyabc.com and then I have a support subdomain and a sales subdomain. The DNS name of the sales domain is not just sales, it's sales.companyabc.com, so it's contiguous. There are also two-way transitive trust relationships with the parent and child domains. We're not going to dig too far into that statement right now other than to say that in order for you to cross domain boundaries, administrative boundaries, authorization, authentication boundaries, that trust relationship has to exist and just a little bit more on that here upcoming. A domain tree would be a hierarchy within the same forest where you have the same namespace. A forest is often defined as a collection of Active Directory domain trees. Now, I have personally always hated that description. And here's why, because a forest is really an implementation of Active Directory. In other words, it doesn't matter if you have one domain or 100 domains, you have an Active Directory forest. And you'll see that when we go to deploy our first domain controller, because our choices are going to be a domain controller for a new domain in an existing forest, a domain controller for an existing domain, or a domain controller in a new forest. In other words, the first domain controller you set up, you're creating a forest. And if you add no other domains to it at all in the future, then it is still a forest. So it's just an implementation of Active Directory. The forest though does have a single schema, a single configuration partition, a single global catalog. And if you add multiple domains into an existing forest, then there will be transitive trust between all the domains in the forest. And the forest itself would be the ultimate security boundary. And we're not going to get too tied up in these. I'm trying to give us a good overview of Active Directory, so we need to mention domains, trees, and forest. But please don't let yourself get hung up on this. We have a whole chapter where we'll talk about some of these complex Active Directory environments, and we'll deal with them more at that time. So now we're sort of going back to the domain, because within the domain, we have another component called the OU, or simply organizational unit. And the organizational unit provides a method for organizing objects within the domain, as well as having other features. In one sense, an OU functions like subfolders in a data directory. I usually use My Documents as the example, because you've got some people whose My Documents folder is just thousands and thousands of files, and there doesn't appear to be any organization. You have other people's My Documents folders, like mine, that has at least 30 subfolders in it, and at least some level of organization. And that's kind of one of the features of the OU, is that it can just help you to organize. Could you have an Active Directory environment with 2,000 user accounts, all of which are just in the user's container? Well, yes, but it would be a little bit cumbersome trying to manage that. So it would make a little bit more sense if you had location-based OUs, or departments, or business functions, or as the last bullet point says, anything that works well for administrative purposes. So that's what the OU does. It allows us to group items within the domain to see if we create additional domains, then we need more domain controllers. And we have trust relationships and just the complexity that comes along with multiple domain environments. But to create OUs, you don't need anything. You just go into the administrative tools and create OUs. So typically, they're created to represent the organizational hierarchy to provide the consistent management of objects. And then the two major functions of the OU is to provide the delegation of administrative control and to control the application of group policy. So I can give somebody admin rights on a particular OU and all the objects that are contained within that OU. And I can point a group policy object instead of at the domain, which would affect everybody, I can point it just at an OU. And then it would only affect the objects in that OU. So much more on those two elements to come, but the organizational unit is a very integral part of an Active Directory environment. Active Directory sites are technically logical objects. I've often called them physical, but when you really get down to it, it is just an object that you're using a graphical tool or PowerShell to create. So it truly is a logical object, but they represent physical locations. So sites are logical representing a physical component in Active Directory. So as it says here, they represent IP submets that are connected by high-speed reliable links in order to do two things. One is to control replication traffic and login traffic. The sites will actually consist of subnet objects, and the subnet objects will have the IP addresses or network IDs of the subnets that are used in a physical location. So domain controllers that are set up are associated with one or another site. Clients are associated with those sites based on their IP addresses, and the sites do two things. They control the login traffic using DNS and service records. Domain controllers will register a record that says, hey, I'm a domain controller for this domain in this particular site. So it helps the client to always use a local domain controller. They also control replication. Replication within the same site between DCs happens very quick on what's called a change notification basis, and often it's within seconds. Well, when you don't have or when you have separate physical locations and maybe low-speed or unreliable WAN links, well, then you want the ability to control and schedule that replication. Sites and site links allow us to do that. Other site-aware applications like the distributed file system, Exchange Server 2007 and later would utilize sites. We can assign group policy objects to sites, although we don't typically do that. It is possible if you wanted settings just for a particular location. But Active Directory sites don't have anything to do with the logical organization of AD. They are simply for the control of replication traffic and login traffic. And replication is that process of keeping multiple copies of the Active Directory database that are stored on separate domain controllers up to date. You know, having multi-master replication is very important, or having a multi-master scenario is very important, because it means that changes can be made to any domain controller. But because those changes can be made to any domain controller, we need to also ensure that the domain controllers have the same information. And so replication is going to be used to do that. And the replication topology is going to get created automatically as domain controllers are added to the domain. There's technically nothing you have to do to make replication happen, but we can use Active Directory site objects to control that process. Now earlier we mentioned the concept of a trust relationship. The trust relationship is a mechanism that's required for external access to resources. That's anything outside of the domain. And the reason for this is because the domain was an authentication and authorization boundary, right? So a user account in domain A cannot access resources in domain B. Without a trust relationship. Now if that doesn't make any sense to you, go back to our work group scenario. We've got computer A and computer B. So a user's got an account on computer A, and they try to use that account to access computer B over the network. And computer B says, what's your username? And I say Patrick, and here's my password. And computer B looks in it's SAM, it's security accounts manager database, and says I don't have an account for Patrick. And that's where the process stops. I can't access resources on that computer because I don't have an account on that computer. That's the exact same thing that happens in a domain environment. Right? I've got a user account in domain A. I go try to use that user account against the domain B resource and the domain controller and domain B says I don't know who you are. This isn't coming from a trusted entity. And so trust relationships provide that capability. Think about it like this. The trust relationships are created, and they allow, let's go back to A and B, they allow domain B's domain controllers to say, I trust domain A, I trust their domain controllers to authenticate their users, and I'll let them access my resources. All right? So it's always pointing away, the direction of the trust is always pointing away from the resource to the user account. Because that's specifically what you're saying. You know, you're not copying accounts. I'm just saying, hey, we have a trust relationship. So you authenticate them, you know who they are, and then I'll allow them to use those identities to get authorization to my resources. Doesn't, you know, just as we said before, authentication doesn't imply authorization. So just because I have now authenticated you doesn't mean I'm going to let you use a resource, but before, we never even got past the authentication because they didn't know who you were. All right? So that's what the trust relationship does. Within an Active Directory forest, all the trust relationships are automatic. So if you've got a multi-domain Active Directory forest, you don't ever have to create trust relationships. They are required between domains, but they're two-way, they're transitive, meaning they carry over, and it's automatic. But sometimes with partner organizations, we may need to create trust relationships between external domains, okay? The point is this, in order for resources to be accessed outside the domain, a trust relationship has to exist. So you've got external, which is a domain-to-domain outside of a forest. You've got a forest trust, which is a trust relationship between the roots of two forest domains, and then you have a shortcut, and the shortcut's an odd one that's used within a forest, but it's to provide a quicker path to access those resources, and we're going to leave that one alone for now. Trust relationships really are part of complex Active Directory environments. I think it's important conceptually to understand why they're needed. That's why I put them here, but we'll be going into them in more detail in an upcoming chapter. Thank you.


Hello, everybody. Andrea Maesca here with N12 tutoring. So it is definitely happening. I posted a video last week about starting my own dental hygiene mobile business and I'm getting the show on-road. I had a lot of meetings this week. I met with the bank yesterday to secure some finances because these things are expensive to get started. I'm pumping up the advertising. I have a website. I have a page of the whole works. So if you guys would like to kind of follow along and see how this all sort of happens, please feel free to do so. I would love for you guys to like my page on Facebook. I'll put the link for you there on the bottom, but it's just simply www.facebook.com Dental L Mobile Hygiene. So let me just show you guys the link here. Let me share my page. That might be easier for you guys to see. So can everybody see this okay? So if you guys look up at the link here, so it's just as I said www.facebook.com slash dental L Mobile Hygiene. So easy, simple. If you guys could click like. So depending on sort of how this looks on your cell phone, on your computer screen, if you guys could click like, that would be so awesome to just kind of help to spread the word because I do hope to open up early 2019. So I'm hoping for January. That would be so awesome. I would appreciate it so much and especially if you are a dental hygienist now and you're thinking about possibly starting your own business in the future, I can help because I am literally going through everything. I've noticed and sorry to say this, but there's not a lot of help out there. I've contacted the CDHO, the CDHA sort of everywhere that I need to contact. Public Health, all of that. And there's just not a lot of resources out there. So I'm definitely going to be starting something to help everybody literally from step one to the last step of starting their own dental hygiene business. But yeah, so stay tuned. This is what the page looks like so far. I've been posting a little bit every single day. I've been posting some YouTube videos. I've been posting just some sort of dental knowledge overall. I started a blog as well last week. So just sort of some helpful tips and I even started to design my own business card. So I would love for you guys to like my page. I will leave the link for you on the bottom too. And thank you guys so much and stay tuned for some more to watch because I will still be uploading videos at least twice a week. And if you haven't yet, make sure to hit subscribe so then that way you can catch everything. As soon as they happen because I do plan to upload another video on Saturday. So thank you guys so much for watching and I will see you guys in the next one.