Managed Service for Microsoft Active Directory (Managed Microsoft AD) 提供由 Google Cloud託管且可用性高的強化版 Microsoft Active Directory 網域。這項服務可協助您減少管理 Active Directory 時需要執行的重要但繁瑣的管理工作，同時將 Active Directory 的使用範圍擴大至雲端。
透過 Managed Microsoft AD，您可以透過樹系層級信任關係 Google Cloud 連線至現有的內部部署 Active Directory 基礎架構，方便安全存取貴機構的資料。
代管 Microsoft AD 的運作方式
Managed Microsoft AD 會在 Windows 虛擬機器上執行實際的 Microsoft Active Directory 網域控制站，確保應用程式相容性。這項服務會為您建立及維護網域控制器，減少您需要管理的維護工作。
多區域支援
當 Managed Microsoft AD 與 Google Cloud的全球低延遲虛擬私有雲 (VPC) 配對時，可支援多個區域的 Active Directory 樹狀結構部署。在 VPC 中，您可以將 Managed Microsoft AD 擴充至多個區域，而不需要在區域之間建立 VPC 互連或混合式連線。這項彈性功能表示您不必在基礎架構所在的區域部署 Managed Microsoft AD，也不必為每個區域建立個別網域。您可以將網域擴展至最多四個支援的區域，以便在區域服務中斷時恢復正常，並視需要在其他區域部署網域控制站，輕鬆進行水平擴充。為維持高可用性並提高容錯能力，Managed Microsoft AD 會在非重疊的 Google Cloud 區域中，為每個區域部署兩個網域控制站。
森林設計模型
Managed Microsoft AD 支援下列 Active Directory 樹狀結構設計模式：
Managed Microsoft AD 與傳統的 Active Directory 部署方式有許多不同之處。
實作傳統的 Active Directory 部署時，您必須：
手動設計及部署貴機構的高可用性 AD 拓樸。
手動執行 AD 診斷工具，確保網域運作正常，包括追蹤 DNS、複寫、驗證、CPU 負載等。
手動建立備份計畫，並驗證貴機構的災難復原回應。
手動為代管 AD 網域的網路定義防火牆規則。
請特別注意，確保在同一個網路上執行的其他伺服器不會危害您的 AD 網域。
手動為 AD 網域控制站套用修正程式。
盡力設計及實施安全性最佳做法，例如對網域管理員帳戶設定時間限制。
請確保只有受信任的使用者能對執行 AD 網域控制站的資源擁有管理員存取權。
透過自動化本節先前列出的部分工作，代管 Microsoft AD 可協助您減少設定及維護 Active Directory 網域所需的作業。
開始使用 Managed Microsoft AD
如要開始使用 Managed Microsoft AD，請指定 Managed Microsoft AD 網域的名稱，以及 Managed Microsoft AD 網域可使用的 Google Cloud 虛擬私有雲網路。您可以使用已授權的 Google Cloud VPC 網路中的虛擬機器，或透過透過 VPN 或 Cloud Interconnect 連線至 Google Cloud的內部部署基礎架構和其他雲端產品，存取 Managed Microsoft AD 網域。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Managed Microsoft AD overview\n\nManaged Service for Microsoft Active Directory (Managed Microsoft AD) offers highly available,\nhardened Microsoft Active Directory domains hosted by Google Cloud.\nThis service helps reduce the important but mundane administrative tasks\nrequired to manage Active Directory, while also extending your Active Directory\nfootprint into the cloud.\n\nManaged Microsoft AD allows connecting to your existing, on-premises\nActive Directory infrastructure from Google Cloud through a forest-level trust,\nfacilitating secure access to your organization's data.\n\nHow Managed Microsoft AD works\n------------------------------\n\nManaged Microsoft AD runs actual Microsoft Active Directory domain controllers\non Windows virtual machines to ensure application\ncompatibility. The service creates and maintains the domain controllers for you,\nreducing the maintenance tasks you need to manage.\n\n### Multi-regional support\n\nManaged Microsoft AD supports multi-regional deployment of Active Directory\nforests when peered with Google Cloud's global low-latency\nVirtual Private Cloud (VPC). Within VPC, you can\nextend Managed Microsoft AD to multiple regions, without requiring VPC peering\nor hybrid connectivity between the regions. This flexibility means that you\nneither need to deploy Managed Microsoft AD in the same region as the\ninfrastructure, nor create a separate domain for each region. You can extend the\ndomain to up to four [supported\nregions](/managed-microsoft-ad/docs/add-remove-regions#regions-list) to be\n[resilient to regional\noutages](/architecture/deployment-archetypes/multiregional)\nand easily horizontally scale, by [deploying domain controllers in additional\nregions](/managed-microsoft-ad/docs/add-remove-regions) as needed. To maintain\nhigh availability and improve [fault\ntolerance](/solutions/deploy-fault-tolerant-active-directory-environment),\nManaged Microsoft AD deploys two domain controllers to each region in\nnon-overlapping Google Cloud zones.\n\n### Forest design models\n\nManaged Microsoft AD supports the following Active Directory forest design\nmodels:\n\n- **Organizational forest**: The same forest contains both user accounts and\n resources, which are managed independently.\n\n- **Resource forest**: A separate forest is used to manage resources.\n\n- **Restricted access forest**: A separate forest contains user\n accounts and data that must be isolated from the rest of the organization.\n\nLearn more about\n[AD forest design models](https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/forest-design-models)\nand\n[how to choose the right one for your organization](/compute/docs/instances/windows/best-practices#architecture).\n\nHow Managed Microsoft AD is different\n-------------------------------------\n\nManaged Microsoft AD differs from a traditional deployment of Active\nDirectory in a number of ways.\n\nWhen implementing a traditional deployment of Active Directory, you must:\n\n- Manually design and deploy your organization's highly-available AD\n topology.\n\n- Run AD diagnostics manually to ensure your domain is healthy, including\n tracking DNS, replication, authentication, CPU load, and more.\n\n- Manually create backup plans and verify your organization's disaster\n recovery response.\n\n- Manually define firewall rules for the network that hosts your AD domain.\n\n- Take special care to ensure other servers running on the same network\n cannot compromise your AD domain.\n\n- Manually patch your AD domain controllers.\n\n- Make effort to design and implement security best practices, such as\n time-bound access to the domain administrator account.\n\n- Ensure only trusted users have administrative access to the resources\n that run your AD domain controllers.\n\nThe Managed Microsoft AD helps mitigate the effort required to set up and maintain\nyour Active Directory domains by automating a number of the tasks listed earlier\nin this section.\n\nGetting started with Managed Microsoft AD\n-----------------------------------------\n\nTo get started with using Managed Microsoft AD, specify the name of the\nManaged Microsoft AD domain and the Google Cloud VPC networks where\nthe Managed Microsoft AD domain is authorized to be available. You can access\nthe Managed Microsoft AD domain using virtual machines in your\nauthorized Google Cloud VPC networks, or via on-premises\ninfrastructure and other cloud products that connect to Google Cloud\nvia VPN or Cloud Interconnect.\n\nManaged Microsoft AD provides the following AD objects:\n\n- A [delegated administrator account](/managed-microsoft-ad/docs/how-to-use-delegated-admin). Use the\n account to manage your Active Directory domain.\n\n- The `Cloud` organizational unit (OU). Use the `Cloud` OU to create your Active\n Directory objects, such as users, service accounts, and groups, as well as\n additional OUs. You can apply Group Policy Objects (GPO) to the OUs you\n create under the `Cloud` OU.\n\nFor more information, see [Default Active Directory objects in Managed Microsoft AD](/managed-microsoft-ad/docs/objects).\n\nLearn more\n----------\n\n- [Create a domain](/managed-microsoft-ad/docs/quickstart-create-domain)\n\n- [Deploy an Active Directory resource forest](/managed-microsoft-ad/docs/part-1-deploy-active-directory)"]]
