[{"id":405,"title":"G\u00fcvenli LDAP Servis Hesab\u0131 Olu\u015fturma","content":"<p>Bu yaz\u0131m\u0131zda, sadece LDAP do\u011frulamas\u0131 i&ccedil;in kullan\u0131lacak bir servis hesab\u0131n\u0131n nas\u0131l olu\u015fturulaca\u011f\u0131n\u0131 ve bu hesab\u0131n k&ouml;t&uuml; ama&ccedil;l\u0131 veya yanl\u0131\u015fl\u0131kla ba\u015fka i\u015flemler i&ccedil;in kullan\u0131lmas\u0131n\u0131&nbsp;<strong>Group Policy (GPO)<\/strong> &uuml;zerinden nas\u0131l engelleyece\u011fimizi ad\u0131m ad\u0131m inceleyece\u011fiz.<\/p>\n<h3>1. Ad\u0131m: Active Directory &Uuml;zerinde Servis Hesab\u0131n\u0131 Olu\u015fturma<\/h3>\n<p>\u0130lk ad\u0131m\u0131m\u0131z, sadece bu i\u015fleme &ouml;zel (&ouml;rne\u011fin <code>scv_fortigate_ldap<\/code> ad\u0131nda) bir kullan\u0131c\u0131 olu\u015fturmakt\u0131r.<\/p>\n<ul>\n<li>Kullan\u0131c\u0131n\u0131z\u0131 olu\u015ftururken parola belirleme ekran\u0131nda, servis kesintilerini &ouml;nlemek ad\u0131na parolan\u0131n zaman a\u015f\u0131m\u0131na u\u011framamas\u0131 i&ccedil;in <strong>\"Password never expires\" (Parolan\u0131n s&uuml;resi hi&ccedil;bir zaman dolmaz)<\/strong> se&ccedil;ene\u011fini i\u015faretleyebilirsiniz.<\/li>\n<li><strong>&Ouml;nemli Not:<\/strong> Kurumunuzun tabi oldu\u011fu g&uuml;venlik reg&uuml;lasyonlar\u0131nda parolalar\u0131n belirli aral\u0131klarla de\u011fi\u015ftirilmesi zorunlulu\u011fu bulunuyorsa, bu ad\u0131m\u0131 ilgili kurallara uygun \u015fekilde yap\u0131land\u0131rmal\u0131s\u0131n\u0131z.<\/li>\n<\/ul>\n<h3>2. Ad\u0131m: GPO (Group Policy Management) Konsolunu A&ccedil;ma<\/h3>\n<p>Olu\u015fturdu\u011fumuz bu hesab\u0131n <strong>hi&ccedil;bir \u015fekilde LDAP do\u011frulamas\u0131 d\u0131\u015f\u0131nda kullan\u0131lmamas\u0131<\/strong> (&ouml;rne\u011fin bilgisayarlara giri\u015f yap\u0131lamamas\u0131) gerekmektedir. Bunun i&ccedil;in bir GPO kural\u0131 olu\u015fturaca\u011f\u0131z:<\/p>\n<ul>\n<li>Klavyenizden Windows + R tu\u015flar\u0131na basarak \"&Ccedil;al\u0131\u015ft\u0131r\" penceresini a&ccedil;\u0131n ve <code>gpmc.msc<\/code> yazarak <strong>Group Policy Management<\/strong> konsolunu ba\u015flat\u0131n.<\/li>\n<li>Kar\u015f\u0131n\u0131za gelen ekranda yeni bir policy olu\u015fturun. Bu kurala &ouml;rne\u011fin <strong>\"Deny_Logon_Policy\"<\/strong> ad\u0131n\u0131 verebilir ve ard\u0131ndan kurala sa\u011f t\u0131klay\u0131p <strong>\"Edit\"<\/strong> diyerek d&uuml;zenleme ekran\u0131na ge&ccedil;ebilirsiniz.<\/li>\n<\/ul>\n<h3>3. Ad\u0131m: Yerel Oturum A&ccedil;may\u0131 (Local Logon) Engelleme<\/h3>\n<p>Bu ad\u0131mda kullan\u0131c\u0131n\u0131n herhangi bir bilgisayarda fiziksel olarak oturum a&ccedil;mas\u0131n\u0131 engelleyece\u011fiz.<\/p>\n<ul>\n<li>D&uuml;zenleme ekran\u0131nda \u015fu yolu izleyin: <strong>Computer Configuration \/ Windows Settings \/ Security Settings \/ Local Policies \/ User Rights Assignment<\/strong>.<\/li>\n<li>Sa\u011f taraftaki men&uuml;den <strong>\"Deny log on locally\" (Yerel olarak oturum a&ccedil;may\u0131 reddet)<\/strong> se&ccedil;ene\u011fine &ccedil;ift t\u0131klay\u0131n.<\/li>\n<li><strong>\"Define these policy settings\"<\/strong> kutucu\u011funu aktif hale getirin ve <strong>\"Add User or Group\"<\/strong> butonuna basarak ilk ad\u0131mda olu\u015fturdu\u011funuz servis hesab\u0131n\u0131 (&ouml;rn. <code>scv_fortigate_ldap<\/code>) buraya ekleyin.<\/li>\n<\/ul>\n<h3>4. Ad\u0131m: Uzak Masa&uuml;st&uuml; (RDP) Ba\u011flant\u0131s\u0131n\u0131 Engelleme<\/h3>\n<p>Ayn\u0131 hesab\u0131n a\u011fdaki herhangi bir cihaza Uzak Masa&uuml;st&uuml; Protokol&uuml; (RDP) ile ba\u011flanmas\u0131n\u0131 da engellememiz gerekiyor.<\/p>\n<ul>\n<li>Ayn\u0131 konsol ekran\u0131nda (User Rights Assignment alt\u0131nda) bulunan <strong>\"Deny log on through Remote Desktop Services\" (Uzak Masa&uuml;st&uuml; Hizmetleri arac\u0131l\u0131\u011f\u0131yla oturum a&ccedil;may\u0131 reddet)<\/strong> se&ccedil;ene\u011fine t\u0131klay\u0131n.<\/li>\n<li>T\u0131pk\u0131 bir &ouml;nceki ad\u0131mda oldu\u011fu gibi ilgili kullan\u0131c\u0131n\u0131z\u0131 se&ccedil;ip listeye ekleyin. Art\u0131k bu hesap ile a\u011fdaki hi&ccedil;bir cihaza RDP yap\u0131lamayacakt\u0131r.<\/li>\n<\/ul>\n<h3>5. Ad\u0131m: GPO Kural\u0131n\u0131 Ba\u011flama ve &Ouml;nemli Uyar\u0131lar<\/h3>\n<p>Haz\u0131rlad\u0131\u011f\u0131n\u0131z bu kural\u0131 t&uuml;m domaine uygulamak isterseniz, kural\u0131 <strong>Domain Controller Policy<\/strong>'ye ba\u011flayabilirsiniz. Ancak burada &ccedil;ok dikkatli olman\u0131z gereken bir nokta var:<\/p>\n<ul>\n<li><strong>Uyar\u0131:<\/strong> E\u011fer kural i&ccedil;erisine yanl\u0131\u015fl\u0131kla yetkili bir kullan\u0131c\u0131 veya kendi hesab\u0131n\u0131z\u0131 eklerseniz, o kullan\u0131c\u0131n\u0131n da sistemlere Logon olmas\u0131 veya RDP yapmas\u0131 tamamen engellenir.<\/li>\n<li><strong>Alternatif ve G&uuml;venli Y&ouml;ntem:<\/strong> T&uuml;m domaine kural basmak yerine, Active Directory &uuml;zerinde kendi <strong>OU (Organizational Unit)<\/strong> klas&ouml;r&uuml;n&uuml;z&uuml; olu\u015fturup ilgili servis hesab\u0131n\u0131 oraya ta\u015f\u0131yabilir ve yazd\u0131\u011f\u0131n\u0131z bu kural\u0131 sadece o OU'ya ba\u011flayabilirsiniz.<\/li>\n<\/ul>\n<h3>6. Ad\u0131m: Kural\u0131 Devreye Alma ve Test Etme<\/h3>\n<ul>\n<li>Kural\u0131 ba\u011flad\u0131ktan sonra, ayarlar\u0131n beklemeden an\u0131nda devreye girmesi i&ccedil;in Komut \u0130stemini (CMD) y&ouml;netici olarak a&ccedil;\u0131n ve <code>gpupdate \/force<\/code> komutunu &ccedil;al\u0131\u015ft\u0131r\u0131n.<\/li>\n<li>GPO g&uuml;ncellemesi ba\u015far\u0131yla tamamland\u0131ktan sonra (Computer Policy ve User Policy update has completed successfully mesaj\u0131n\u0131 g&ouml;receksiniz), cihaz\u0131n\u0131z\u0131n (&ouml;rne\u011fin Fortigate) LDAP entegrasyon ekran\u0131na giderek ilgili sunucu IP'si, Port, Distinguished Name ve bu k\u0131s\u0131tl\u0131 kullan\u0131c\u0131n\u0131n kimlik bilgilerini girerek <strong>ba\u011flant\u0131y\u0131 test edebilirsiniz<\/strong>.<\/li>\n<\/ul>\n<p><img src=\"..\/..\/..\/uploads\/images\/2026\/03\/69c8e1fd03e02_1774772733.png\" alt=\"\" width=\"900\" height=\"487\"><\/p>\n<pre class=\"language-markup\"><code>1. Kullan\u0131c\u0131 Olu\u015fturma: Active Directory &uuml;zerinde &ouml;rne\u011fin scv_fortigate_ldap ad\u0131nda yeni bir kullan\u0131c\u0131 olu\u015fturulmas\u0131 ve parolas\u0131n\u0131n zaman a\u015f\u0131m\u0131na u\u011framamas\u0131 i&ccedil;in \"Password never expires\" kutucu\u011funun i\u015faretlenmesi\n.\n2. GPO Konsolunun A&ccedil;\u0131lmas\u0131: &Ccedil;al\u0131\u015ft\u0131r penceresinden gpmc.msc komutu girilerek Group Policy Management konsolunun a&ccedil;\u0131lmas\u0131, \"Deny_Logon_Policy\" ad\u0131nda yeni bir kural olu\u015fturulmas\u0131 ve d&uuml;zenleme (Edit) i\u015flemine ge&ccedil;ilmesi\n.\n3. Yerel Giri\u015flerin (Logon) Engellenmesi: Computer Configuration \/ Windows Settings \/ Security Settings \/ Local Policies \/ User Rights Assignment yolu takip edilerek \"Deny log on locally\" se&ccedil;ene\u011fine ilgili servisin eklenmesi\n.\n4. Uzak Masa&uuml;st&uuml; (RDP) Eri\u015fiminin Engellenmesi: Yine ayn\u0131 men&uuml; &uuml;zerinden \"Deny log on through Remote Desktop Services\" se&ccedil;ene\u011fi a&ccedil;\u0131larak hedeflenen hesab\u0131n a\u011fdaki cihazlara RDP ile ba\u011flanmas\u0131n\u0131n k\u0131s\u0131tlanmas\u0131\n.\n5. Kural\u0131n G&uuml;venli Bir \u015eekilde Ba\u011flanmas\u0131: Haz\u0131rlanan GPO'nun yanl\u0131\u015f bir i\u015flemle admin hesaplar\u0131n\u0131 kilitlemesini &ouml;nlemek i&ccedil;in do\u011frudan Domain Controller Policy yerine, kendi olu\u015fturdu\u011funuz &ouml;zel bir OU'ya (Organizational Unit) ba\u011flanmas\u0131\n.\n6. Kural\u0131n Devreye Al\u0131nmas\u0131 ve Test Edilmesi: CMD (Komut \u0130stemi) &uuml;zerinden gpupdate \/force komutu ile kural\u0131n an\u0131nda aktif edilmesi ve ard\u0131ndan sistem &uuml;zerinde (&ouml;rn. Fortigate) LDAP sunucu IP'si, port ve k\u0131s\u0131tl\u0131 kullan\u0131c\u0131 bilgileri girilerek ba\u011flant\u0131 durumunun \"Successful\" olarak test edilmes<\/code><\/pre>\n<p>Ba\u011flant\u0131 durumunun \"Successful\" (Ba\u015far\u0131l\u0131) oldu\u011funu g&ouml;rd&uuml;\u011f&uuml;n&uuml;zde i\u015flem tamam demektir. Art\u0131k sadece LDAP sorgular\u0131 yapabilen, oturum a&ccedil;ma ve uzaktan ba\u011flanma yetkileri tamamen k\u0131s\u0131tlanm\u0131\u015f g&uuml;venli bir servis hesab\u0131n\u0131z var!<\/p>\n<p><strong>LDAP servis hesab\u0131 i&ccedil;in neden OU kullanmal\u0131y\u0131z?<\/strong><\/p>\n<p>LDAP servis hesab\u0131 i&ccedil;in &ouml;zel bir <strong>OU (Organizational Unit)<\/strong> kullanman\u0131z\u0131n temel sebebi, g&uuml;venlik amac\u0131yla olu\u015fturdu\u011funuz k\u0131s\u0131tlay\u0131c\u0131 politikalar\u0131n (GPO) yanl\u0131\u015fl\u0131kla di\u011fer kullan\u0131c\u0131lar\u0131 etkilemesini &ouml;nlemek ve olas\u0131 eri\u015fim kesintisi risklerini ortadan kald\u0131rmakt\u0131r.<\/p>\n<p>E\u011fer hesab\u0131n yerel oturum a&ccedil;mas\u0131n\u0131 veya RDP yapmas\u0131n\u0131 engelleyen GPO kural\u0131n\u0131 t&uuml;m domaine (Domain Controller Policy) uygularsan\u0131z b&uuml;y&uuml;k bir risk alm\u0131\u015f olursunuz. Kural\u0131 yap\u0131land\u0131r\u0131rken yanl\u0131\u015fl\u0131kla kendi admin hesab\u0131n\u0131z\u0131 veya yetkili ba\u015fka bir kullan\u0131c\u0131y\u0131 bu k\u0131s\u0131tlama listesine eklerseniz, o kullan\u0131c\u0131n\u0131n sistemlere giri\u015f yapmas\u0131 (logon olmas\u0131) veya Uzak Masa&uuml;st&uuml; (RDP) ile ba\u011flanmas\u0131 tamamen engellenir.<\/p>\n<p>Bu t&uuml;r kritik hatalar\u0131n &ouml;n&uuml;ne ge&ccedil;mek i&ccedil;in en g&uuml;venli y&ouml;ntem \u015fudur: Kendi OU klas&ouml;r&uuml;n&uuml;z&uuml; olu\u015fturup LDAP servis hesab\u0131n\u0131z\u0131 bu klas&ouml;r&uuml;n i&ccedil;erisine ta\u015f\u0131mak ve haz\u0131rlad\u0131\u011f\u0131n\u0131z k\u0131s\u0131tlay\u0131c\u0131 kural\u0131 t&uuml;m domaine de\u011fil, <strong>sadece bu OU'ya<\/strong> ba\u011flamakt\u0131r. B&ouml;ylece kural izole bir \u015fekilde sadece hedeflenen hesap &uuml;zerinde &ccedil;al\u0131\u015f\u0131r ve a\u011f\u0131n\u0131zdaki di\u011fer kullan\u0131c\u0131lar g&uuml;vende kal\u0131r.<\/p>\n<p><strong>LDAP servis hesab\u0131 i&ccedil;in neden OU kullanmal\u0131y\u0131z?<\/strong><\/p>\n<p>Sadece belirli bir OU'ya (Organizational Unit) GPO ba\u011flaman\u0131n en temel avantaj\u0131, uygulanan k\u0131s\u0131tlay\u0131c\u0131 g&uuml;venlik politikalar\u0131n\u0131n a\u011fdaki di\u011fer kullan\u0131c\u0131lar\u0131 yanl\u0131\u015fl\u0131kla etkilemesini &ouml;nlemektir.<\/p>\n<p>&Ouml;zellikle bir hesab\u0131n yerel oturum a&ccedil;mas\u0131n\u0131 veya Uzak Masa&uuml;st&uuml; (RDP) ba\u011flant\u0131s\u0131 yapmas\u0131n\u0131 engelleyen sert GPO kurallar\u0131n\u0131 t&uuml;m domaine uygularsan\u0131z b&uuml;y&uuml;k bir risk alm\u0131\u015f olursunuz. Kural\u0131 yap\u0131land\u0131r\u0131rken k\u0131s\u0131tlananlar listesine yanl\u0131\u015fl\u0131kla yetkili bir kullan\u0131c\u0131y\u0131 (&ouml;rne\u011fin kendi admin hesab\u0131n\u0131z\u0131) eklerseniz, o kullan\u0131c\u0131n\u0131n da sistemlere giri\u015f yapmas\u0131 tamamen engellenir.<\/p>\n<p>Kendi OU'nuzu olu\u015fturup sadece k\u0131s\u0131tlamak istedi\u011finiz hesab\u0131 bu OU i&ccedil;erisine ta\u015f\u0131d\u0131\u011f\u0131n\u0131zda ve haz\u0131rlad\u0131\u011f\u0131n\u0131z GPO kural\u0131n\u0131 yaln\u0131zca bu OU'ya ba\u011flad\u0131\u011f\u0131n\u0131zda \u015fu avantajlar\u0131 elde edersiniz:<\/p>\n<ul>\n<li><strong>\u0130zolasyon ve G&uuml;venlik:<\/strong> Politika yaln\u0131zca o OU i&ccedil;indeki hedef kullan\u0131c\u0131 &uuml;zerinde &ccedil;al\u0131\u015f\u0131r, b&ouml;ylece etki alan\u0131 daralt\u0131lm\u0131\u015f olur.<\/li>\n<li><strong>Kesinti Riskini &Ouml;nleme:<\/strong> Hatal\u0131 bir kullan\u0131c\u0131 se&ccedil;imi yapsan\u0131z bile, kural t&uuml;m domaine etki etmedi\u011fi i&ccedil;in di\u011fer kullan\u0131c\u0131lar\u0131n ve y&ouml;neticilerin Logon veya RDP yetkileri g&uuml;vende kal\u0131r.<\/li>\n<\/ul>\n<div class=\"from-user-container\">\n<div class=\"message-text-content mat-body-medium\">\n<div class=\"is-rich-chat-ui ng-star-inserted\" role=\"heading\" aria-level=\"3\">\n<p><strong>GPO ile k\u0131s\u0131tlanan bir hesab\u0131n yetkileri nas\u0131l test edilir?<\/strong><\/p>\n<p>GPO ile k\u0131s\u0131tlanan bir hesab\u0131n yetkilerini test etmek i&ccedil;in &ouml;ncelikle uygulad\u0131\u011f\u0131n\u0131z kural\u0131n sistemde an\u0131nda devreye girmesi amac\u0131yla Komut \u0130stemini (CMD) a&ccedil;arak <strong><code>gpupdate \/force<\/code><\/strong> komutunu &ccedil;al\u0131\u015ft\u0131rman\u0131z gerekir. Kural g&uuml;ncellendikten sonra, hesab\u0131n kullan\u0131laca\u011f\u0131 as\u0131l sistem &uuml;zerinde (&ouml;rne\u011fin cihaz\u0131n\u0131z\u0131n entegrasyon ekran\u0131nda) <strong>LDAP ba\u011flant\u0131s\u0131n\u0131 yap\u0131p test ederek<\/strong> i\u015flemi do\u011frulayabilirsiniz.<\/p>\n<p>\u0130lgili ekranda k\u0131s\u0131tlanm\u0131\u015f kullan\u0131c\u0131n\u0131n kimlik bilgileriyle yap\u0131lan test sonucunda ba\u011flant\u0131n\u0131n <strong>\"Successful\" (Ba\u015far\u0131l\u0131)<\/strong> olarak g&ouml;r&uuml;nmesi, hesab\u0131n hedefledi\u011finiz LDAP do\u011frulama i\u015flemini k\u0131s\u0131tlamalara ra\u011fmen sorunsuz bir \u015fekilde ger&ccedil;ekle\u015ftirebildi\u011fini g&ouml;sterir.<\/p>\n<div class=\"from-user-container\">\n<div class=\"message-text-content mat-body-medium\">\n<div class=\"is-rich-chat-ui ng-star-inserted\" role=\"heading\" aria-level=\"3\">\n<p><strong>K\u0131s\u0131tlanan hesapla RDP yapmaya &ccedil;al\u0131\u015f\u0131nca ne olur?<\/strong><\/p>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"to-user-container\">\n<div class=\"message-text-content mat-body-medium\" aria-live=\"polite\">\n<div class=\"ng-star-inserted\">\n<p>GPO &uuml;zerinden \"Deny log on through Remote Desktop Services\" kural\u0131 ile k\u0131s\u0131tlanm\u0131\u015f bir servis hesab\u0131yla RDP (Uzak Masa&uuml;st&uuml;) yapmaya &ccedil;al\u0131\u015ft\u0131\u011f\u0131n\u0131zda, kullan\u0131c\u0131n\u0131n a\u011fdaki herhangi bir cihaza <strong>ba\u011flanmas\u0131 engellenir<\/strong> ve eri\u015fim reddedilir.<\/p>\n<p>Bu g&uuml;venlik yap\u0131land\u0131rmas\u0131, hesab\u0131n yaln\u0131zca hedeflenen LDAP do\u011frulamas\u0131 amac\u0131yla kullan\u0131lmas\u0131n\u0131 sa\u011flamak ve yetkisiz bir \u015fekilde sistemlere uzaktan eri\u015fim arac\u0131 olarak kullan\u0131lmas\u0131n\u0131n &ouml;n&uuml;ne ge&ccedil;mek i&ccedil;in uygulan\u0131r.<\/p>\n<div class=\"from-user-container\">\n<div class=\"message-text-content mat-body-medium\">\n<div class=\"is-rich-chat-ui ng-star-inserted\" role=\"heading\" aria-level=\"3\">\n<p><strong>LDAP servis hesab\u0131 i&ccedil;in \u015fifre politikas\u0131 nas\u0131l olmal\u0131?<\/strong><\/p>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"to-user-container\">\n<div class=\"message-text-content mat-body-medium\" aria-live=\"polite\">\n<div class=\"ng-star-inserted\">\n<p>LDAP servis hesab\u0131 i&ccedil;in \u015fifre olu\u015ftururken, servis kesintilerini &ouml;nlemek amac\u0131yla parolan\u0131n zaman a\u015f\u0131m\u0131na u\u011framamas\u0131, yani <strong>\"Password never expires\" (Parolan\u0131n s&uuml;resi hi&ccedil;bir zaman dolmaz)<\/strong> se&ccedil;ene\u011finin se&ccedil;ilmesi &ouml;nerilir.<\/p>\n<p>Ancak, kurumunuzun tabi oldu\u011fu g&uuml;venlik reg&uuml;lasyonlar\u0131na dikkat etmeniz &ccedil;ok &ouml;nemlidir. E\u011fer reg&uuml;lasyonlar\u0131n\u0131z parolalar\u0131n belirli aral\u0131klarla de\u011fi\u015ftirilmesini zorunlu k\u0131l\u0131yorsa, uyumluluk sorunlar\u0131 ya\u015famamak ad\u0131na \u015fifre politikan\u0131z\u0131 bu kurallara uygun olacak \u015fekilde yap\u0131land\u0131rmal\u0131s\u0131n\u0131z.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"to-user-container\">\n<div class=\"message-text-content mat-body-medium\" aria-live=\"polite\">\n<div class=\"thinking-animation-container\">\n<div class=\"thinking-animation\">&nbsp;<\/div>\n<\/div>\n<\/div>\n<\/div>\n<p>&nbsp;<\/p>","excerpt":"Merhaba\u00a0 Sistem y\u00f6neticileri olarak a\u011f\u0131m\u0131zdaki cihazlar\u0131n (\u00f6rne\u011fin Fortigate Firewall) Active Directory ile entegre \u00e7al\u0131\u015fabilmesi i\u00e7in s\u0131kl\u0131kla LDAP do\u011frulamas\u0131na ihtiya\u00e7 duyar\u0131z. Ancak bu i\u015flemler i\u00e7in kullan\u0131lan servis hesaplar\u0131n\u0131n g\u00fcvenli\u011fini sa\u011flamak kritik bir \u00f6neme sahiptir.","created_at":"2026-03-29 11:18:04","updated_at":"2026-09-07 22:47:30","category_id":6,"view_count":555,"reading_time":10,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2026-03-29 08:18:04","featured_image":"\/uploads\/images\/2026\/03\/69c8dff5159f8_1774772213.png","slug":"guvenli-ldap-servis-hesabi-olusturma","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"},{"id":46,"title":"Domain Controller Kald\u0131rma Sorunu, Kal\u0131c\u0131 Metadata Temizli\u011fi","content":"<h3>Domain Controller Kald\u0131rma Sorunu, Kal\u0131c\u0131 Metadata Temizli\u011fi.<\/h3> <strong>Active Directory ortamlar\u0131nda domain controller kald\u0131rma i\u015flemi bazen beklenmedik zorluklarla kar\u015f\u0131la\u015fabilir. Bu teknik rehber, diren\u00e7li DC metadata kal\u0131nt\u0131lar\u0131n\u0131n temizlenmesi i\u00e7in ileri d\u00fczey \u00e7\u00f6z\u00fcm y\u00f6ntemlerini detayland\u0131rmaktad\u0131r.<\/strong> <h2>Problem Tan\u0131m\u0131<\/h2> Windows Server ortamlar\u0131nda eski domain controller'lar\u0131n (DC) sistemden kald\u0131r\u0131lmas\u0131 s\u0131ras\u0131nda metadata kal\u0131nt\u0131lar\u0131, replikasyon sorunlar\u0131na ve sistem karars\u0131zl\u0131\u011f\u0131na neden olabilir. Standart metadata cleanup i\u015flemleri her zaman yeterli olmayabilir ve bu durumda daha derinlemesine m\u00fcdahale gerektiren y\u00f6ntemlere ba\u015fvurmak gerekir. <h2>Senaryo Analizi<\/h2> Bu rehberdeki \u00f6rnek senaryoda, Windows Server 2016 tabanl\u0131 PDC2016 sunucusu Windows Server 2022 ile de\u011fi\u015ftirilmi\u015f, ancak eski DC'nin metadata kal\u0131nt\u0131lar\u0131 sistemde varl\u0131\u011f\u0131n\u0131 s\u00fcrd\u00fcrmeye devam etmi\u015ftir. FSMO rolleri transfer edilmi\u015f ve replikasyon do\u011frulanm\u0131\u015f olmas\u0131na ra\u011fmen: <ul> <li>Metadata cleanup i\u015flemi tamamlanm\u0131\u015f g\u00f6r\u00fcnse de objeler hala mevcut<\/li> <li>Replikasyon s\u00fcrekli eski sunucu kal\u0131nt\u0131lar\u0131n\u0131 restore ediyor<\/li> <li>ADSI Edit ile manuel silme i\u015flemleri ba\u015far\u0131s\u0131z oluyor<\/li> <li>DNS kay\u0131tlar\u0131 s\u00fcrekli yeniden olu\u015fuyor<\/li> <\/ul> <h2>\u00c7\u00f6z\u00fcm Metodolojisi<\/h2> <h3>A\u015fama 1: LDAP Seviyesinde Do\u011frudan M\u00fcdahale<\/h3> Standart ara\u00e7lar yetersiz kald\u0131\u011f\u0131nda, <code>ldp.exe<\/code> arac\u0131 ile LDAP seviyesinde do\u011frudan m\u00fcdahale gerekir. <strong>Ba\u011flant\u0131 Kurulum S\u00fcreci:<\/strong> <ol> <li><strong>LDP.exe Ba\u015flatma ve Ba\u011flant\u0131:<\/strong> <ul> <li><code>ldp.exe<\/code> uygulamas\u0131n\u0131 \u00e7al\u0131\u015ft\u0131r\u0131n<\/li> <li>Connection \u2192 Connect men\u00fcs\u00fcne gidin<\/li> <li>Sunucu: Aktif \u00e7al\u0131\u015fan DC'nin FQDN adresi<\/li> <li>Port: 389 (LDAP) veya 636 (LDAPS)<\/li> <\/ul> <\/li> <li><strong>Kimlik Do\u011frulama:<\/strong> <ul> <li>Connection \u2192 Bind se\u00e7ene\u011fini kullan\u0131n<\/li> <li>Domain Administrator yetkilerine sahip hesapla oturum a\u00e7\u0131n<\/li> <\/ul> <\/li> <li><strong>Konfig\u00fcrasyon Container'\u0131na Eri\u015fim:<\/strong> <ul> <li>View \u2192 Tree men\u00fcs\u00fcnden Base DN olarak \u015fu path'i girin:<\/li> <\/ul> <pre><code>CN=Configuration,DC=domain,DC=com <\/code><\/pre> <\/li> <\/ol> <strong>Nesne Lokalizasyonu ve Silme:<\/strong> A\u011fa\u00e7 yap\u0131s\u0131nda \u015fu hiyerar\u015fiyi takip edin: <pre><code>CN=Sites \u2192 CN=Default-First-Site-Name \u2192 CN=Servers \u2192 CN=PDC2016 <\/code><\/pre> <strong>Kritik Silme S\u0131ras\u0131:<\/strong> <ol> <li>\u00d6nce <code>CN=NTDS Settings<\/code> nesnesini silin (PDC2016 alt\u0131nda)<\/li> <li>Ard\u0131ndan <code>CN=PDC2016<\/code> ana nesnesini silin<\/li> <li>Her silme i\u015flemi sonras\u0131 replikasyon durumunu kontrol edin<\/li> <\/ol> <h3>A\u015fama 2: DNS Infrastructure Temizli\u011fi<\/h3> DNS kal\u0131nt\u0131lar\u0131 sistem performans\u0131n\u0131 d\u00fc\u015f\u00fcr\u00fcr ve gelecekteki AD i\u015flemlerinde sorun yaratabilir. <strong>DNS Management Console \u0130\u015flemleri:<\/strong> <ol> <li><strong>Forward Lookup Zones Temizli\u011fi:<\/strong> <ul> <li><code>dnsmgmt.msc<\/code> konsolunu a\u00e7\u0131n<\/li> <li>\u0130lgili domain zone'unda PDC2016 i\u00e7in t\u00fcm A ve CNAME kay\u0131tlar\u0131n\u0131 silin<\/li> <li>PTR kay\u0131tlar\u0131 i\u00e7in Reverse Lookup Zones'u da kontrol edin<\/li> <\/ul> <\/li> <li><strong>Service Location (SRV) Records Temizli\u011fi:<\/strong> <ul> <li><code>_msdcs.domain.com<\/code> alt domain'inde GUID tabanl\u0131 kay\u0131tlar\u0131 silin<\/li> <li><code>_sites<\/code> alt\u0131nda Default-First-Site-Name i\u00e7indeki PDC2016 referanslar\u0131n\u0131 temizleyin<\/li> <li><code>_tcp<\/code> ve <code>_udp<\/code> protokol kay\u0131tlar\u0131n\u0131 g\u00f6zden ge\u00e7irin<\/li> <\/ul> <\/li> <\/ol> <h3>A\u015fama 3: Replikasyon Do\u011frulama ve Senkronizasyon<\/h3> <strong>Sistem Geneli Replikasyon Tetikleme:<\/strong> <pre><code >repadmin \/syncall \/AdeP <\/code><\/pre> Bu komut t\u00fcm domain controller'lar aras\u0131nda tam senkronizasyon ba\u015flat\u0131r. <strong>Replikasyon Durumu Kontrol\u00fc:<\/strong> <pre><code >repadmin \/showrepl * <\/code><\/pre> PDC2016 referanslar\u0131n\u0131n tamamen temizlendi\u011fini do\u011frulay\u0131n. <strong>Topology Kontrolleri:<\/strong> <pre><code >repadmin \/kcc repadmin \/showconn <\/code><\/pre> <h3>A\u015fama 4: Sistem B\u00fct\u00fcnl\u00fc\u011f\u00fc Kontrol\u00fc<\/h3> <strong>Active Directory Database Kontrol\u00fc:<\/strong> <pre><code >dcdiag \/v dcdiag \/test:replications <\/code><\/pre> <strong>Forest\/Domain Functional Level Kontrol\u00fc:<\/strong> <pre><code >netdom query fsmo <\/code><\/pre> FSMO rollerinin do\u011fru sunucularda oldu\u011funu do\u011frulay\u0131n. <h2>Alternatif \u00c7\u00f6z\u00fcm Y\u00f6ntemleri<\/h2> <h3>Method 1: Authoritative Restore Yakla\u015f\u0131m\u0131<\/h3> Kritik durumlarda, authoritative restore i\u015flemi ile belirli objeler silinebilir: <pre><code >ntdsutil authoritative restore restore object \"CN=PDC2016,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=domain,DC=com\" <\/code><\/pre> <h3>Method 2: PowerShell AD Module Kullan\u0131m\u0131<\/h3> <pre><code >Get-ADObject -Filter 'Name -like \"*PDC2016*\"' -SearchBase \"CN=Configuration,DC=domain,DC=com\" -IncludeDeletedObjects Remove-ADObject -Identity \"CN=PDC2016,...\" -Confirm:$false <\/code><\/pre> <h2>\u00d6nleme Stratejileri<\/h2> <h3>Planlama A\u015famas\u0131 Kontrolleri:<\/h3> <ul> <li>DC kald\u0131rma \u00f6ncesi t\u00fcm FSMO rollerinin ba\u015fka sunuculara transfer edilmesi<\/li> <li>Global Catalog rol\u00fcn\u00fcn kontrol edilmesi<\/li> <li>Replikasyon sa\u011fl\u0131\u011f\u0131n\u0131n do\u011frulanmas\u0131<\/li> <\/ul> <h3>Monitoring ve Alerting:<\/h3> <ul> <li>Replikasyon hatalar\u0131n\u0131n s\u00fcrekli izlenmesi<\/li> <li>DNS zone health kontrollerinin otomatikle\u015ftirilmesi<\/li> <li>AD database consistency check'lerinin d\u00fczenli \u00e7al\u0131\u015ft\u0131r\u0131lmas\u0131<\/li> <\/ul> <h2>Troubleshooting \u0130pu\u00e7lar\u0131<\/h2> <strong>Yayg\u0131n Hatalar ve \u00c7\u00f6z\u00fcmleri:<\/strong> <ol> <li><strong>\"Access Denied\" Hatalar\u0131:<\/strong> <ul> <li>Schema Admin veya Enterprise Admin yetkilerini kontrol edin<\/li> <li>PDC Emulator rol\u00fcn\u00fcn eri\u015filebilir oldu\u011funu do\u011frulay\u0131n<\/li> <\/ul> <\/li> <li><strong>Replikasyon S\u00fcrekli Geri Getirme:<\/strong> <ul> <li>T\u00fcm DC'lerde ayn\u0131 i\u015flemleri ger\u00e7ekle\u015ftirin<\/li> <li>Bridgehead server konfig\u00fcrasyonunu kontrol edin<\/li> <\/ul> <\/li> <li><strong>DNS Resolution Sorunlar\u0131:<\/strong> <ul> <li>Forwarders ve root hints ayarlar\u0131n\u0131 g\u00f6zden ge\u00e7irin<\/li> <li>Cache temizli\u011fi yap\u0131n: <code>ipconfig \/flushdns<\/code><\/li> <\/ul> <\/li> <\/ol> <h2>Sonu\u00e7 ve \u00d6neriler<\/h2> Domain Controller metadata temizli\u011fi, Active Directory altyap\u0131s\u0131n\u0131n sa\u011fl\u0131\u011f\u0131 i\u00e7in kritik bir i\u015flemdir. Standart ara\u00e7lar\u0131n yetersiz kald\u0131\u011f\u0131 durumlarda, LDAP seviyesinde m\u00fcdahale ve kapsaml\u0131 DNS temizli\u011fi ile sorunlar \u00e7\u00f6z\u00fclebilir. <strong>Best Practices:<\/strong> <ul> <li>Her zaman test ortam\u0131nda deneme yap\u0131n<\/li> <li>De\u011fi\u015fiklikleri a\u015famal\u0131 olarak uygulay\u0131n<\/li> <li>T\u00fcm i\u015flemleri dok\u00fcmante edin<\/li> <li>Rollback plan\u0131 haz\u0131rlay\u0131n<\/li> <\/ul> Bu metodoloji, enterprise Active Directory ortamlar\u0131nda g\u00fcvenli ve etkili DC kald\u0131rma i\u015flemleri i\u00e7in referans te\u015fkil edebilir. <hr \/> <em>Bu rehber Windows Server 2016\/2019\/2022 ortamlar\u0131nda test edilmi\u015f ve do\u011frulanm\u0131\u015f y\u00f6ntemleri i\u00e7ermektedir. Production ortam\u0131nda uygulamadan \u00f6nce test edilmesi \u00f6nerilir.<\/em>","excerpt":"Domain Controller Kald\u0131rma Sorunu, Kal\u0131c\u0131 Metadata Temizli\u011fi. Active Directory ortamlar\u0131nda domain controller kald\u0131rma i\u015flemi bazen...","created_at":"2025-06-22 21:13:13","updated_at":"2026-09-07 17:14:37","category_id":8,"view_count":928,"reading_time":5,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-06-22 21:13:13","featured_image":"resimyok.jpg","slug":"metadata-cleanup","category_name":"Active Directory \/Azure","category_slug":"active-directory-azure","category_color":"#f59e0b"},{"id":88,"title":"Active Directory Ortam\u0131nda LDAP ve Kerberos Entegrasyonu AD LDS","content":"Modern BT altyap\u0131lar\u0131nda farkl\u0131 dizin hizmetlerinin entegrasyonu, kullan\u0131c\u0131 y\u00f6netimi, kimlik do\u011frulama ve uygulama yap\u0131land\u0131rmas\u0131 gibi kritik g\u00f6revleri yerine getirir. Ancak, t\u00fcm bu s\u00fcre\u00e7lerde tam bir Active Directory Domain Services (AD DS) ortam\u0131 kurmak her zaman gerekli de\u011fildir. \u00d6zellikle LDAP uyumlu d\u0131\u015f dizin hizmetleriyle entegrasyon veya Kerberos kimlik do\u011frulamas\u0131n\u0131 destekleyen hafif \u00e7\u00f6z\u00fcmler aray\u0131\u015f\u0131nda olanlar i\u00e7in Active Directory Lightweight Directory Services (AD LDS) , ideal bir \u00e7\u00f6z\u00fcm sunar. Bu yaz\u0131da AD LDS'nin \u00f6zellikleri, kullan\u0131m alanlar\u0131 ve di\u011fer Active Directory bile\u015fenleriyle kar\u015f\u0131la\u015ft\u0131r\u0131lmas\u0131 \u00fczerinden detayl\u0131 bir analiz yapaca\u011f\u0131z. <strong>AD LDS Nedir?<\/strong> AD LDS (eski ad\u0131yla ADAM - Active Directory Application Mode), Microsoft'un hafif, LDAP uyumlu bir dizin hizmetidir. Tam bir etki alan\u0131 denetleyicisi (Domain Controller) olmadan \u00e7al\u0131\u015fabilen bu \u00e7\u00f6z\u00fcm, \u00f6zellikle LDAP tabanl\u0131 uygulamalar\u0131n Active Directory ortam\u0131na entegre edilmesi gerekti\u011finde tercih edilir. <ul> <li><strong>LDAP Protokol\u00fcn\u00fc Destekler:<\/strong> <ul> <li>LDAP v3 standard\u0131n\u0131 destekler ve d\u0131\u015f LDAP dizinleriyle (\u00f6rne\u011fin OpenLDAP) veri al\u0131\u015fveri\u015fi sa\u011flar.<\/li> <\/ul> <\/li> <li><strong>Domain Controller Gereksinimi Yok:<\/strong> <ul> <li>AD DS gibi etki alan\u0131 denetleyicisi kurulumu gerektirmez. Bu sayede var olan sunuculara ekstra y\u00fck bindirmeden \u00e7al\u0131\u015ft\u0131r\u0131labilir.<\/li> <\/ul> <\/li> <li><strong>\u00c7oklu \u00d6rnek Deste\u011fi:<\/strong> <ul> <li>Tek bir sunucuda birden fazla AD LDS \u00f6rne\u011fi \u00e7al\u0131\u015ft\u0131r\u0131labilir. Her \u00f6rnek ba\u011f\u0131ms\u0131z yap\u0131land\u0131r\u0131lm\u0131\u015f olur, bu da izolasyon ve \u00e7ok kirac\u0131l\u0131 (multi-tenant) senaryolar i\u00e7in idealdir.<\/li> <\/ul> <\/li> <li><strong>\u00d6zelle\u015ftirilebilir \u015eema:<\/strong> <ul> <li>Uygulamaya \u00f6zel nesne s\u0131n\u0131flar\u0131 ve \u00f6znitelikler tan\u0131mlanabilir. Bu, sabit \u015femaya sahip AD DS'e g\u00f6re daha esnek bir yap\u0131 sunar.<\/li> <\/ul> <\/li> <li><strong>Kerberos Kimlik Do\u011frulamas\u0131yla Uyum:<\/strong> <ul> <li>AD LDS, Kerberos protokol\u00fcn\u00fc do\u011frudan desteklemez ancak AD DS ile entegre olarak Kerberos tabanl\u0131 kimlik do\u011frulama i\u015flemlerini ger\u00e7ekle\u015ftirebilir.<\/li> <\/ul> <\/li> <\/ul> <h3><strong data-spm-anchor->Neden AD LDS? LDAP ve Kerberos Entegrasyonu \u0130\u00e7in Avantajlar\u0131<\/strong><\/h3> AD LDS, a\u015fa\u011f\u0131daki senaryolarda di\u011fer Active Directory bile\u015fenlerinden ayr\u0131\u015f\u0131r: <h4><strong>A. Harici LDAP Dizinleriyle Entegrasyon<\/strong><\/h4> <ul> <li>\u00d6rne\u011fin, bir \u015firketin mevcut bir OpenLDAP sunucusunda kullan\u0131c\u0131 verileri varsa ve bu verilere eri\u015fen uygulamalar\u0131 AD ortam\u0131na entegre etmek istiyorsa, AD LDS arac\u0131 olarak kullan\u0131labilir.<\/li> <li>AD LDS, LDAP verilerini AD DS'e do\u011frudan aktarmadan, ge\u00e7ici bir k\u00f6pr\u00fc g\u00f6revi g\u00f6r\u00fcr.<\/li> <\/ul> <h4><strong>B. Kimlik Do\u011frulama Esnekli\u011fi<\/strong><\/h4> <ul> <li>AD LDS, Windows kimlik do\u011frulamas\u0131 (NTLM\/Kerberos) veya basit LDAP bind (\u00f6rne\u011fin kullan\u0131c\u0131 ad\u0131\/\u015fifre) y\u00f6ntemlerini destekler.<\/li> <li>AD DS ile entegre oldu\u011funda, Kerberos kimlik do\u011frulamas\u0131 i\u00e7in Hizmet Tan\u0131mlama Ad\u0131 (SPN) kay\u0131tlar\u0131 yap\u0131larak g\u00fcvenli kimlik do\u011frulama sa\u011flanabilir.<\/li> <\/ul> <h4><strong>C. K\u00fc\u00e7\u00fck ve Orta \u00d6l\u00e7ekli Uygulamalar \u0130\u00e7in Uygunluk<\/strong><\/h4> <ul> <li>Tam bir AD DS ortam\u0131 kurmak istemeyen veya sadece belirli uygulamalar i\u00e7in dizin hizmeti ihtiya\u00e7 duyan kurumlar i\u00e7in AD LDS, h\u0131zl\u0131 ve maliyet-etkin bir \u00e7\u00f6z\u00fcmd\u00fcr.<\/li> <\/ul> <h4><strong>D. \u00c7ok Kirac\u0131l\u0131 Yap\u0131lar<\/strong><\/h4> <ul> <li>Tek bir sunucuda \u00e7al\u0131\u015fan farkl\u0131 AD LDS \u00f6rnekleri, SaaS sa\u011flay\u0131c\u0131lar\u0131n m\u00fc\u015fteriye \u00f6zel dizin yap\u0131land\u0131rmas\u0131 yapmas\u0131na olanak tan\u0131r.<\/li> <\/ul> <div ><\/div> <div > <div > <table > <thead > <tr > <th  scope=\"col\"> <div ><strong>Bile\u015fen<\/strong><\/div><\/th> <th  scope=\"col\"> <div ><strong>Temel G\u00f6rev<\/strong><\/div><\/th> <th  scope=\"col\"> <div ><strong>AD LDS ile Kar\u015f\u0131la\u015ft\u0131rma<\/strong><\/div><\/th> <\/tr> <\/thead> <tbody> <tr > <td > <div ><strong>Global Catalog (GC)<\/strong><\/div><\/td> <td > <div >Etki alan\u0131 \u00e7ap\u0131nda nesne arama<\/div><\/td> <td > <div >GC, AD DS mimarisinin bir par\u00e7as\u0131d\u0131r ve LDAP entegrasyonu i\u00e7in de\u011fil, \u00e7apraz etki alan\u0131 sorgulama i\u00e7in kullan\u0131l\u0131r.<\/div><\/td> <\/tr> <tr > <td > <div ><strong>Active Directory Federation Services (AD FS)<\/strong><\/div><\/td> <td > <div >Federasyon ve SSO \u00e7\u00f6z\u00fcmleri<\/div><\/td> <td > <div >AD FS, kimlik sa\u011flay\u0131c\u0131s\u0131 rol\u00fcndedir ve LDAP entegrasyonu do\u011frudan desteklemez.<\/div><\/td> <\/tr> <tr > <td > <div ><strong>Active Directory Certificate Services (AD CS)<\/strong><\/div><\/td> <td > <div >Sertifika y\u00f6netimi<\/div><\/td> <td > <div >Sertifika da\u011f\u0131t\u0131m\u0131nda kullan\u0131l\u0131r; dizin hizmetleriyle do\u011frudan ilgili de\u011fildir.<\/div><\/td> <\/tr> <tr > <td > <div ><strong>Active Directory Domain Services (AD DS)<\/strong><\/div><\/td> <td > <div >Merkezi kimlik ve politika y\u00f6netimi<\/div><\/td> <td > <div >AD DS, tam bir dizin hizmetidir ancak \u00f6zelle\u015ftirilebilir \u015fema veya \u00e7oklu \u00f6rnek deste\u011fi yoktur.<\/div><\/td> <\/tr> <\/tbody> <\/table> <\/div> <h3><strong data-spm-anchor->AD LDS Kullan\u0131m Senaryolar\u0131<\/strong><\/h3> <ul> <li><strong>Uygulama Spesifik Dizin Hizmeti:<\/strong> <ul> <li>CRM veya ERP sistemleri gibi uygulamalar, AD LDS \u00fczerinde \u00f6zel \u015femalarla kullan\u0131c\u0131 ve rol bilgilerini saklayabilir.<\/li> <\/ul> <div ><\/div><\/li> <li><strong>Ge\u00e7ici Veri Eri\u015fimi:<\/strong> <ul> <li>Eski sistemlerle entegrasyon s\u0131ras\u0131nda AD LDS, veri ge\u00e7i\u015fini kolayla\u015ft\u0131r\u0131r.<\/li> <\/ul> <div ><\/div><\/li> <li><strong>Test ve Geli\u015ftirme Ortamlar\u0131:<\/strong> <ul> <li>Geli\u015ftiriciler, AD DS'e ba\u011f\u0131ml\u0131 kalmadan LDAP tabanl\u0131 uygulamalar\u0131 test edebilir.<\/li> <\/ul> <\/li> <\/ul> <h3><strong data-spm-anchor->AD LDS Kurulum ve Yap\u0131land\u0131rma \u0130\u00e7in En \u0130yi Uygulamalar<\/strong><\/h3> <ul> <li data-spm-anchor-><strong>G\u00fcvenlik Ayarlar\u0131n\u0131 G\u00fc\u00e7lendirin:<\/strong> <ul> <li>LDAP trafi\u011fini \u015fifrelemek i\u00e7in LDAPS (SSL\/TLS) yap\u0131land\u0131rmas\u0131 yap\u0131n.<\/li> <\/ul> <div ><\/div><\/li> <li><strong>\u015eema \u00d6zelle\u015ftirmesinde Dikkatli Olun:<\/strong> <ul> <li>\u015eema de\u011fi\u015fiklikleri geri al\u0131namaz olabilir. Test ortam\u0131nda deneyin ve belgeleyin.<\/li> <\/ul> <div ><\/div><\/li> <li><strong>\u00c7oklu \u00d6rnek Y\u00f6netimi:<\/strong> <ul> <li>Farkl\u0131 \u00f6rnekler i\u00e7in ayr\u0131 port numaralar\u0131 ve hizmet hesaplar\u0131 tan\u0131mlayarak \u00e7ak\u0131\u015fmalar\u0131 \u00f6nleyin.<\/li> <\/ul> <div ><\/div><\/li> <li><strong>Kerberos Entegrasyonu \u0130\u00e7in AD DS ile Ba\u011flant\u0131:<\/strong> <ul> <li>AD LDS'de Kerberos kullanmak istiyorsan\u0131z, SPN kay\u0131tlar\u0131n\u0131 AD DS \u00fczerinde yap\u0131land\u0131r\u0131n.<\/li> <\/ul> <\/li> <\/ul> <p data-spm-anchor->Active Directory Lightweight Directory Services (AD LDS), LDAP ve Kerberos entegrasyonu i\u00e7in esnek ve hafif bir \u00e7\u00f6z\u00fcm sunar. \u00d6zellikle tam bir AD DS ortam\u0131 kurmak istemeyen veya \u00f6zel uygulamalar i\u00e7in \u00f6zelle\u015ftirilmi\u015f dizin hizmetleri gereken kurumlar i\u00e7in AD LDS, ideal bir se\u00e7imdir. Ancak, g\u00fcvenlik yap\u0131land\u0131rmas\u0131 ve \u015fema y\u00f6netimi gibi alanlarda dikkatli ad\u0131mlar at\u0131lmas\u0131, uzun vadeli sorunsuz bir kullan\u0131m i\u00e7in kritiktir.<strong>\u00a0<\/strong>AD LDS'nin s\u0131n\u0131rlar\u0131n\u0131 anlamak \u00f6nemlidir. \u00d6rne\u011fin, grup politalar\u0131 (GPO) veya \u00e7o\u011faltma gibi AD DS \u00f6zelliklerini desteklemez. Bu nedenle kullan\u0131m senaryosunu net belirlemek gerekir.<\/p> <\/div>","excerpt":"Modern BT altyap\u0131lar\u0131nda farkl\u0131 dizin hizmetlerinin entegrasyonu, kullan\u0131c\u0131 y\u00f6netimi, kimlik do\u011frulama ve uygulama yap\u0131land\u0131rmas\u0131 gibi...","created_at":"2025-05-01 11:33:26","updated_at":"2026-09-08 02:17:59","category_id":6,"view_count":637,"reading_time":5,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-05-01 11:33:26","featured_image":"resimyok.jpg","slug":"ad-ldap-ve-kerberos-entegrasyonu-ad-lds","category_name":"Sistem","category_slug":"sistem","category_color":"#3b82f6"}]