Windows 2000 Active Directory

by Lowe-Norris, Alistair G.

• ISBN13: 9781565926387
• ISBN10: 1565926382
• Format: Paperback
• Copyright: 2000-01-01
• Publisher: Oreilly & Associates Inc

Summary

The most important change in Windows 2000 is the inclusion of Active Directory, a fully qualified directory service. It's so important that if you're a systems administrator, you're likely to find coming to grips with Active Directory to be one of your biggest headaches. But it doesn't have to be that way, thanks to Windows 2000 Active Directory. Written by a participant in the Windows 2000 Rapid Deployment Program, Windows 2000 Active Directorydelivers the practical, hands-on information you need to manage your site. Instead of filling pages with a screen-by-screen description of the graphical user interface, it focuses on the tasks you need to perform to manage your organization's directory effectively. The heavy emphasis on scripting with the ADSI will help you automate tasks to achieve greater reliability and save time. Windows 2000 Active Directoryis divided into three sections: The Basics, which provides an overview of the Active Directory technology and a detailed introduction to AD features. Design, which describes mapping your organization's typology into the Active Directory schema; specific topics include the AD namespace and DNS, AD objects such as sites and domains, replication, group policies, and migration issues. Scripting, which covers the powerful capabilities of the Active Directory Services Interface (ADSI), including ADSI's use with ActiveX Data Objects (ADO), Active Server Pages (ASP), and Visual Basic (VB). Windows 2000 Active Directoryis a practical guide to the new technology for the overworked system or network administrator. Whether you're working regularly in the Windows 2000 environment or just evaluating Windows 2000 in order to understand the design issues involved, this book builds the solid foundation you need to understand Active Directory and use it effectively.

Table of Contents

Preface	xiii
I. The Basics	1	(102)
A Brief Introduction	3	(6)
Major Features	4	(1)
How Objects Are Stored in Active Directory	5	(1)
Uniquely Identifying Objects	5	(3)
Summary	8	(1)
Active Directory Overview	9	(25)
A Simple View of How It All Works	9	(4)
A More Detailed View of How It All Works	13	(16)
Windows NT Versus Windows 2000	29	(4)
Summary	33	(1)
Active Directory Schema	34	(25)
The Structure of the Schema	34	(8)
Attribute Classes (Attribute-Schema Objects)	42	(5)
The Syntax of Attributes	47	(2)
Object Classes (Class-Schema Objects)	49	(8)
Summary	57	(2)
Active Directory Replication	59	(20)
Sites	59	(3)
Data Replication	62	(16)
Summary	78	(1)
TCP/IP and DDNS	79	(24)
How TCP/IP and DDNS Are Used	79	(10)
How You Already Use TCP/IP and DNS	89	(8)
Integrated DNS	97	(2)
How DNS Affects Design	99	(2)
Summary	101	(2)
II. Designing the Directory Hierarchy	103	(232)
Designing the Namespace	105	(45)
The Complexities of a Design	107	(1)
Where to Start	108	(1)
Overview of the Design Process	109	(1)
Domain Namespace Design	109	(11)
Design of the Internal Domain Structure	120	(13)
Other Design Considerations	133	(1)
Design Examples	134	(9)
Designing for the Real World	143	(5)
Summary	148	(2)
Sites and Replication Topologies	150	(26)
Intrasite and Intersite Topologies	150	(13)
Designing Sites and Links for Replication	163	(7)
Examples	170	(5)
Summary	175	(1)
Profiles and Group Policy Primer	176	(23)
A Profile Primer	178	(6)
Capabilities of GPOs	184	(14)
Summary	198	(1)
Designing Organization-Wide Policies	199	(47)
How Windows 2000 GPOs Work	199	(25)
Using the Group Policy Editor Tool	224	(3)
Using GPOs to Help Design the Organizational Unit Structure	227	(16)
Debugging Group Policies	243	(1)
Summary	244	(2)
Active Directory Security: Permissions and Auditing	246	(32)
Using Windows 2000's GUI to Examine Permissions	248	(9)
Using Windows 2000's GUI to Examine Auditing	257	(1)
Designing Permission Schemes	258	(12)
Designing Auditing Schemes	270	(1)
Real-World Examples	271	(6)
Summary	277	(1)
Designing Schema Changes	278	(18)
Nominating Responsible People in Your Organization	279	(1)
Thinking of Changing the Schema	280	(5)
Managing and Modifying the Schema	285	(7)
Wreaking Havoc with Your Schema	292	(2)
Summary	294	(2)
Windows NT 4.0 Migration	296	(16)
Consolidating, Migrating, and Upgrading from NT	296	(2)
The Principles of Upgrading Windows NT Domains	298	(13)
Summary	311	(1)
Directory Interoperability	312	(23)
Background to Interoperability with Other Directory Services	313	(2)
Solutions for Interoperability with Other Directory Services	315	(4)
Exchange and the Active Directory Connector	319	(14)
A Word About Windows 2000 and Unix	333	(1)
Summary	334	(1)
III. Scripting the Active Directory with ADSI	335	(252)
Scripting with ADSI	337	(34)
What Are All These Buzzwords?	337	(8)
Writing and Running ADSI Scripts Under Windows 2000	345	(4)
ADSI	349	(9)
Simple Manipulation of ADSI Objects	358	(12)
Summary	370	(1)
IADs and the Property Cache	371	(32)
The IADs Properties	371	(10)
Manipulating the Property Cache	381	(19)
Checking For Errors in VBScript	400	(2)
Summary	402	(1)
Users	403	(23)
Creating a Standard User Account	403	(1)
Creating a Fully Featured User Account	404	(10)
Creating Many User Accounts	414	(3)
Creating an Account Unlocker Utility	417	(5)
Automatically Creating Exchange Mailboxes for Users	422	(3)
Summary	425	(1)
Manipulating Persistent and Dynamic Objects	426	(39)
The Interface Methods and Properties	427	(1)
Manipulating Services with ADSI	427	(13)
Creating and Manipulating Shares with ADSI	440	(2)
Enumerating Sessions and Resources	442	(13)
Manipulating Print Queues and Print Jobs	455	(9)
Summary	464	(1)
Permissions and Auditing	465	(36)
How to Create an ACE Using ADSI	466	(11)
A Simple ADSI Example	477	(2)
A Complex ACE Example	479	(5)
Creating Security Descriptors	484	(5)
Listing ACEs to a File for All Objects in an OU and Below	489	(9)
Adding Many USER Groups to DRUP Groups	498	(2)
Summary	500	(1)
Extending the Schema and the GUI	501	(20)
Modifying the Schema with ADSI	501	(11)
Extending Active Directory GUI to Meet Business and Organizational Needs	512	(8)
Summary	520	(1)
Enhancing ADSI via an ASP or VB Interface	521	(28)
VBScript Limitations and Solutions	522	(1)
How to Avoid Problems When Using ADSI and ASP	523	(1)
Combining VBScript and HTML	524	(5)
Binding to Objects via Authentication	529	(11)
Migrating Your ADSI Scripts from VBScript to VB	540	(8)
Summary	548	(1)
Scripting Fast Searches Using ADO	549	(38)
The First Search	550	(6)
Other Ways of Connecting and Retrieving Results	556	(3)
Understanding Search Filters	559	(7)
Incorporating Searches into Active Server Pages	566	(14)
A Significant Problem	580	(2)
A More Advanced Search Function---SearchAD	582	(3)
Summary	585	(2)
Index	587