Information Technology Policy: Active Directory Architecture

Information Technology Policy
Active Directory Architecture
ITP Number Effective Date

ITP-APP030 November 20, 2009
Category Supersedes
Recommended Policy
Contact Scheduled Review
RA-itcentral@pa.gov April 2015
This Information Technology Policy

(ITP) establishes policy regarding
the commonwealth’s Microsoft
Active Directory infrastructure.
1. Purpose
The purpose of this Information Technology Policy (ITP) is to establish policy
regarding the Commonwealth's Microsoft Active Directory infrastructure.
2. Scope
This Information Technology Policy (ITP) applies to all departments, boards,
commissions and councils under the Governor’s jurisdiction. Agencies not under
the Governor’s jurisdiction are strongly encouraged to follow this ITP.
3. Policy
The commonwealth's Office of Administration/Office for Information Technology
(OA/OIT) provides Active Directory services for agencies under the governor's
jurisdiction. This ITP addresses the Active Directory infrastructure that has been
established for agency use within this environment.
OA/OIT maintains two (2) Active Directory implementations or forests:

CWOPA (or PA.LCL)
APPS (or APPS.STATE.PA.US)
• The CWOPA forest is to be used for internal resources such as, but not
limited to, employee security principles (user accounts), security and
distribution groups, workstations, servers, Exchange servers, and all objects
or services required to support the commonwealth's standard desktop
environment. Only intranet accounts will be granted access to this forest and
ITP-APP030 – Active Directory Architecture
its resources. Intranet accounts are assigned to commonwealth employees

and contractors under the governor's jurisdiction.
• The APPS forest is to be used for line-of-business and portal applications.

This forest is also to be used for applications requiring access by business
partners, constituents, or any entity that is not under the governor's
jurisdiction. Intranet, extranet, and Internet users may access resources in
this forest. Extranet accounts are business partners and other commonwealth
entities not under the governor's jurisdiction. These users are sponsored and
managed by commonwealth agencies under the governor's jurisdiction.
Internet users are self-managed, self-registered users who access
commonwealth Web sites for personal business (e.g., applying for hunting
licenses).
• All agencies under the governor's jurisdiction are to maintain their intranet
user accounts (security principles and distribution groups) and resources
(Windows workstations, Windows servers, printers, and other related
peripherals) as members of the CWOPA (PA.LCL) forest. This design is known
as the Consolidated Forest Architecture; and is illustrated in Figure 1 below.
Figure 1 - Consolidated Forest Model

Note: Technical specifications for the CWOPA forest can be found at the
Commonwealth Connect Web site under Project Documentation, Active Directory
Infrastructure, and Functional Specification. Technical specifications for the ESF
forest can be found at the OIT Web site under Enterprise Server Farm, ESF Tools
and Resources, ESF Active Directory Rules of Engagement.
Recognizing the potential need for higher levels of security than natively
inherent in the Consolidated Forest Architecture, the Resource Forest
Architecture is also supported.
Page 2 of 5
• In addition to the CWOPA and APPS Forests which OA/OIT maintains for the
Consolidated Forest Architecture, agencies may have an agency-specific
resource forest. The purpose of the resource forest is to contain all agency
resources (Windows workstations, Windows servers, printers, and other
related peripherals) and to isolate them from management or access by the
CWOPA enterprise administrators, reducing potential security breaches.
(See Figure 2.)
• All agencies with a resource forest are to maintain their intranet user
accounts (security principles and distribution groups) in the CWOPA (PA.LCL)
forest.
• As the establishment and maintenance of a resource forest requires

significant resources of time and infrastructure, the implementation of this
option is not to be taken lightly and is to only be considered in instances
when the agency is capable of implementing and supporting such an
infrastructure. Any requests to implement a resource forest will be treated
through the waiver process as described below.
Figure 2 - Resource Forest Model
4. Exemption from this Policy

OA/OIT recognizes that some agencies may have unique Active Directory
requirements that are not currently met. Establishing enterprise-wide distributed
computing standards is critical, if commonwealth agencies are to use desktop
software and collaboration tools effectively and efficiently. Therefore, OA/OIT
strongly encourages agencies not to seek exceptions from this policy.
Page 3 of 5
In the event an agency chooses to seek an exemption, for reasons such as the
need to comply with requirements for a federally mandated system, a request
for waiver may be submitted via the ITP-BUS004 – IT Waiver Review Process.
Requests are to be entered into the COPPAR Tool located at coppar.oa.pa.gov/.
Agency CIO approval is required.
If a waiver is granted, the only supported alternative to the Consolidated

Architecture is the Resource Forest Architecture as described above.
Criteria for Waivers:
Waivers will primarily be considered for legislative mandates or extreme security

concerns if:
• Requirements cannot be mitigated by other means; or,

• Cost of mitigation outweighs the cost of a separate architecture; or,
• Requirements are not addressed by ongoing or planned OIT enterprise
projects.
OA/OIT will review the request and schedule discussions with agency
representatives to further understand the request and work collaboratively with
the requesting agency to determine the best architecture for the Commonwealth
that meets all necessary requirements.
Waiver Approval:
If a waiver request has been approved, the agency will ensure the following:
• The cost of the approved alternative solution is to be the requesting agency's

responsibility, including expenses for the centralized infrastructure, agency-
specific components, initial deployment and any additional costs to future
enterprise initiatives resulting from the exception.
• The agency resource forest is to follow the technical specifications set forth
for the CWOPA forest and adhere to all enterprise standards.
• The agency resource forest is to be subject to the specifications set forth for
the commonwealth's identity management infrastructure. This includes the
provisioning and maintenance of user accounts as well as the maintenance of
authorizations assigned to those accounts.
5. Related ITPs/Other References

• ITP-BUS004 – IT Waiver Review Process
Page 4 of 5
6. Authority
• Executive Order 2011-05, Enterprise Information Technology Governance
7. Publication Version Control

It is the user’s responsibility to ensure they have the latest version of this
publication. Questions regarding this publication are to be directed to RA-
itcentral@pa.gov.
This chart contains a history of this publication’s revisions:

Version Date Purpose of Revision
Original 11/20/2009 Base Document
10/25/2010 ITB Refresh
4/2/2014 ITP Reformat
7/14/14 Removed ITP-PRO001 as waiver reference,
inserted ITP-BUS004 as waiver reference
Page 5 of 5

Information Technology Policy: Active Directory Architecture

Uploaded by

Copyright:

Available Formats

Information Technology Policy: Active Directory Architecture

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Information Technology Policy: Active Directory Architecture

Uploaded by

Copyright:

Available Formats

Information Technology Policy

Active Directory Architecture

ITP Number Effective Date

This Information Technology Policy

OA/OIT maintains two (2) Active Directory implementations or forests:

APPS (or APPS.STATE.PA.US)

its resources. Intranet accounts are assigned to commonwealth employees

• The APPS forest is to be used for line-of-business and portal applications.

Figure 1 - Consolidated Forest Model

• As the establishment and maintenance of a resource forest requires

Figure 2 - Resource Forest Model

4. Exemption from this Policy

If a waiver is granted, the only supported alternative to the Consolidated

Criteria for Waivers:

Waivers will primarily be considered for legislative mandates or extreme security

• Requirements cannot be mitigated by other means; or,

• The cost of the approved alternative solution is to be the requesting agency's

5. Related ITPs/Other References

7. Publication Version Control

This chart contains a history of this publication’s revisions:

You might also like