Windows 2000 Active Directory 2E

by Syngress

• ISBN13: 9781928994602
• ISBN10: 1928994601
• Edition: 2nd
• Format: Paperback
• Copyright: 2001-10-24
• Publisher: Syngress Media Inc

Summary

Updated coverage of the most confusing Windows 2000 component in this new edition of a Syngress bestseller. Active Directory Services dramatically changes the way IT professionals design, plan, configure and administer their Windows NT networks. The primary benefits of Active Directory Services are its extensibility, scalability, and ease of management as compared to prior generations of Windows NT. Systems Engineers will probably spend much of their time over the next several years planning for and deploying Active Directory Services in many different environments. Windows 2000 Active Directory, Second Edition gives IT professionals a head start; it provides updated coverage of everything they will need to succeed. Many Windows 2000 administrators are struggling with Active Directory and need a comprehensive book on the subject The first completely updated book on Active Directory to hit the market

Table of Contents

Preface	xxv
Part I: Getting Started	1	(96)
Introduction to Active Directory	3	(38)
Introduction	4	(1)
Introduction to Directory Services	4	(11)
Directory Enabled Networks	5	(1)
History of the Directory Service	6	(5)
What Is in a Directory Service?	11	(2)
The Directory Database	13	(2)
Directory Service Domino Effect	15	(1)
Introduction to Active Directory	15	(5)
NET	16	(1)
Protocol Interoperability	17	(1)
Single Point of Administration	18	(2)
Active Directory Architecture	20	(12)
Namespace	23	(1)
Forests	24	(1)
Scope	24	(1)
Distinguished Name	25	(1)
User Principle Name	26	(1)
Partitions	27	(1)
Global Catalog	28	(1)
Object	29	(1)
Container	29	(1)
Domains	30	(1)
Domain Trees	30	(1)
Viewing Trust Relationships	30	(1)
Viewing the Namespace	31	(1)
Sites	32	(1)
Architecture	33	(3)
Data Model	33	(1)
Schema	33	(1)
Security Model	34	(1)
Administration Model	35	(1)
Summary	36	(1)
Solutions Fast Track	37	(2)
Frequently Asked Questions	39	(2)
Assessing Your Environment	41	(32)
Introduction	42	(1)
Defining Your Business Objectives	43	(9)
Matching Business Objectives to Technology	45	(2)
Business Objectives That Active Directory Will Meet	47	(3)
Costs and Benefits	50	(1)
Project Costs	50	(1)
Benefits	51	(1)
Assessing Your Current Environment	52	(7)
Network Infrastructure	55	(1)
Servers	56	(1)
Desktops	57	(1)
Peripherals and Mobile Devices	57	(1)
Locations	58	(1)
Gathering Information for Your Active Directory Planning and Design	59	(2)
Objects and OUs	59	(1)
Organizational and Network Infrastructures That Impact Active Directory Planning and Design	59	(2)
Planning for Your Implementation	61	(7)
Project Timeline	61	(2)
Setting Milestones	63	(1)
Setting a Budget	63	(1)
Communications	64	(1)
Gap Analysis of Business Objectives and Current Environment	65	(1)
Risk Analysis	66	(2)
Summary	68	(1)
Solutions Fast Track	68	(2)
Frequently Asked Questions	70	(3)
Active Directory for Windows 2000 JumpStart Tutorial	73	(24)
Introduction	74	(1)
What Active Directory Is, and Why You Need to Know About It	74	(3)
Demote a DC	75	(1)
Policy-Based Administration	76	(1)
Decentralized Administration	76	(1)
Improved Security	77	(1)
Important Features	77	(10)
Scalability of Forests, Domains, Organizational Units, and Sites	78	(2)
Extensibility of the Schema	80	(2)
Multi-Master Domain Controllers	82	(1)
Intellimirror	82	(2)
Kerberos Trusts	84	(1)
Use of Standard Protocols	85	(1)
Accessibility of Resources	86	(1)
Industries and Companies Affected by Windows 2000	87	(3)
Technology Vendors and Partners	88	(1)
Competitors	88	(1)
Customers	89	(1)
And. . . Microsoft Itself	90	(1)
Advantages and Disadvantages of Active Directory	90	(3)
Advantages with Active Directory	90	(1)
Problems with Active Directory	91	(2)
Summary	93	(1)
Solutions Fast Track	93	(2)
Frequently Asked Questions	95	(2)
Part II: Designing the Active Directory	97	(134)
DNS and Naming Strategies	99	(36)
Introduction	100	(1)
What Is DNS?	101	(5)
How DNS Zones Function	104	(2)
Active Directory's Integration with DNS	106	(7)
How Active Directory Uses DNS	108	(4)
Dynamic DNS	112	(1)
Planning Active Directory and DNS	113	(10)
Forest Plan	114	(2)
Domain and DNS Strategy	116	(1)
DNS Sizing	117	(1)
Domain Divisions	117	(1)
Requirements	118	(1)
Root Domain	119	(1)
About Domains	120	(1)
DNS Servers	120	(1)
Organizational Units	121	(1)
Site Topology	122	(1)
Naming Conventions	123	(8)
Defining DNS Names	125	(2)
Defining DNS Zones	127	(1)
Naming Conventions for Active Directory	127	(2)
Migrating an Existing Exchange Server Design	129	(1)
Migrating an Existing Novell Directory Services Design	129	(2)
Summary	131	(1)
Solutions Fast Track	132	(1)
Frequently Asked Questions	133	(2)
Designing the Basic Structure	135	(30)
Introduction	136	(4)
Case Studies	136	(1)
About Tekkietech.com	136	(2)
About Insurance, Inc.	138	(2)
Designing a Forest	140	(3)
Tekkietech.com	141	(1)
Insurance, Inc.	142	(1)
Designing a Domain Tree	143	(5)
Tekkietech.com	145	(1)
Insurance, Inc.	146	(2)
Designing an Organizational Unit Structure	148	(2)
Tekkietech.com	148	(2)
Insurance, Inc.	150	(1)
Designing a Site Topology	150	(4)
Tekkietech.com	152	(1)
Insurance, Inc.	152	(2)
Using OUs for Delegating Administration	154	(6)
OU Objects in Active Directory	155	(1)
Group Policy and OUs	155	(1)
Delegating Administration	155	(5)
Summary	160	(1)
Solutions Fast Track	161	(2)
Frequently Asked Questions	163	(2)
Designing a Site Structure	165	(32)
Introduction	166	(1)
The Function of Sites in Active Directory	167	(4)
Default-First-Site-Name	170	(1)
Replicated Active Directory Components	171	(3)
Domain Partitions	171	(1)
Global Catalog	171	(2)
Schema and Configuration Containers	173	(1)
Site Replication Components	174	(6)
Site Objects	174	(1)
Knowledge Consistency Checker	174	(1)
Connection Objects	175	(1)
Site Links	176	(1)
Site Link Bridges	177	(2)
Replication Protocols	179	(1)
Replication in Active Directory	180	(7)
Replication Topology	181	(6)
Planning a Site Structure	187	(5)
Placing Domain Controllers	190	(1)
Where to Place Global Catalog Servers	191	(1)
Summary	192	(1)
Solutions Fast Track	193	(1)
Frequently Asked Questions	194	(3)
Designing: A Case Study	197	(34)
Introduction	198	(2)
Case Study Overview	198	(2)
Assessing a Corporate Network	200	(8)
Determining the Business Objectives	200	(1)
Kings Vineyard's Business Objectives	201	(2)
Current Environment	203	(1)
Network Infrastructure	204	(2)
Servers	206	(1)
Desktops and End-Users	207	(1)
Designing the Forests	208	(2)
Determining Domain and Tree Structure	210	(4)
Planning the OU Structure	214	(8)
Administrative Structure	214	(1)
Hidden OUs	215	(2)
Group Policies	217	(5)
Inheritance	222	(1)
Establishing the Initial Sites	222	(5)
Site Links	223	(1)
Placing Servers	224	(1)
Domain Controllers	224	(2)
Global Catalog Servers	226	(1)
DNS Servers	226	(1)
Summary	227	(1)
Solutions Fast Track	227	(2)
Frequently Asked Questions	229	(2)
Part III: Installing Active Directory	231	(160)
Migrating from NT 3.51 or NT 4 to Active Directory	233	(42)
Introduction	234	(1)
Server Migration Strategies	235	(14)
Primary Domain Controllers	243	(2)
Changes Required When Upgrading a Domain Controller	245	(1)
Backup Domain Controllers	246	(2)
Member Servers	248	(1)
Promoting Member Servers with Dcpromo	248	(1)
Upgrading with the Windows 2000 Setup Wizard	249	(2)
Installing Active Directory Services	251	(6)
Interim Mixed Domains	255	(1)
Mixed Mode	255	(1)
Native Mode	256	(1)
Migrating Components	257	(7)
Using Organizational Units to Create a Hierarchical Structure	258	(2)
User Accounts	260	(1)
ClonePrincipal	261	(1)
Active Directory Migration Tool	261	(1)
Machine Accounts	262	(1)
Nested Groups	263	(1)
Global Groups	264	(1)
Delegating Administrative Authority	264	(1)
Insert into the Replication Topology	265	(1)
Upgrading Clients to Windows 2000 Professional	266	(3)
Summary	269	(2)
Solutions Fast Track	271	(2)
Frequently Asked Questions	273	(2)
Implementing a Domain	275	(42)
Introduction	276	(1)
Installing DNS	277	(7)
Verifying Compatibility	277	(2)
Windows 2000 DNS Installation	279	(1)
Delegating a Subdomain	279	(2)
Configuring DNS	281	(1)
About Zones	282	(2)
Service Resource Record Registration	284	(1)
Installing Domains in Active Directory	284	(14)
Active Directory Sizer Tool	285	(1)
The First Domain Controller	285	(4)
Active Directory Wizard	289	(9)
Integrating DNS into Active Directory	298	(2)
Active Directory Integrated Zones	299	(1)
Managing Objects in Active Directory	300	(8)
Creating Organizational Units	300	(1)
Managing User Accounts	301	(2)
Managing Groups	303	(2)
Nesting Groups	305	(1)
Managing Computers	306	(2)
Common Object Management	308	(1)
Role-Based Administration	308	(3)
Microsoft Management Console	308	(1)
Administrative Roles	309	(2)
Summary	311	(1)
Solutions Fast Track	312	(2)
Frequently Asked Questions	314	(3)
Building Trees and Forests	317	(30)
Introduction	318	(1)
Understanding the Characteristics of an Active Directory Forest	319	(10)
Common Schema	320	(1)
Common Configuration	320	(1)
Global Catalog	320	(2)
Contiguous Namespace	322	(1)
Trust Relationships	323	(1)
Transitive Bidirectional Trust	323	(1)
Trusts That Cross Forests	324	(1)
Trust Utilities	325	(4)
Implementing the Forest Structure	329	(5)
The Domain Tree Structure	331	(2)
Adding a Child Domain	333	(1)
Right-Sizing the Active Directory Storage Space	334	(4)
Managing the Forest	338	(4)
Summary	342	(1)
Solutions Fast Track	343	(2)
Frequently Asked Questions	345	(2)
Implementing Sites	347	(22)
Introduction	348	(1)
Creating Site Components	348	(8)
Creating Sites	348	(2)
Creating Connection Objects	350	(1)
Creating IP Subnets	351	(1)
Creating Site Links	352	(3)
Creating Site Link Bridges	355	(1)
The Knowledge Consistency Checker	356	(1)
Implementing a Site Structure in Active Directory	356	(5)
Replication Utilities	361	(1)
Replication Monitor	361	(1)
Replication Administrator	362	(1)
DSASTAT	362	(1)
Understanding Time Synchronization	362	(2)
Summary	364	(1)
Solutions Fast Track	365	(2)
Frequently Asked Questions	367	(2)
Implementing Active Directory: A Case Study	369	(22)
Introduction	370	(5)
Case Study Overview	370	(1)
Forest Plan	370	(1)
DNS and Domain Plan	370	(3)
Organizational Units	373	(1)
Site Topology Plan	373	(2)
Implementing DNS	375	(2)
Implementing the First Domain Controller	377	(5)
Migrating	377	(1)
Upgrading	378	(1)
Adding New Domains	379	(2)
Creating an Explicit Trust	381	(1)
Establishing the OUs	382	(2)
Moving Upgraded Users	382	(1)
Creating New Users	383	(1)
Adding Computer Objects	383	(1)
Setting Up Sites	384	(2)
Summary	386	(1)
Solutions Fast Track	386	(2)
Frequently Asked Questions	388	(3)
Part IV: Migrating Active Directory	391	(130)
Intellimirror	393	(56)
Introduction	394	(1)
What Are Group Policies?	394	(6)
How Group Policies Are Applied	397	(1)
Refresh Interval	397	(1)
Blocking and Enforcing	398	(2)
Group Policy Information Storage and Settings	400	(5)
Administrative Templates	400	(2)
Registry.pol	402	(1)
Group Policy Settings	402	(1)
Computer Configuration	403	(1)
User Configuration	403	(2)
Designing a Group Policy Strategy	405	(3)
Group Policy in WAN Environments	406	(2)
Implementing a Group Policy Strategy	408	(8)
Configuring Group Policy Objects	409	(3)
Link a Group Policy Object to a Container	412	(1)
Adding Scripts	413	(3)
Deploying Applications with Group Policies	416	(10)
Folder Redirection	420	(3)
Keeping Groups from Growing Over Time	423	(1)
Troubleshooting Group Policies	424	(1)
Policy that Does Not Execute	424	(1)
A Policy that Executes in the Wrong Way	425	(1)
Logging On Takes a Long Time	426	(1)
Understanding Security	426	(17)
Groups	427	(2)
Domain Security Console	429	(1)
Account Policies	430	(4)
Local Policies	434	(1)
Event Log	434	(1)
Restricted Groups	434	(1)
System Services	435	(1)
Registry	435	(1)
File System	435	(1)
Public Key Policies	436	(1)
IP Security Policies on Active Directory	436	(1)
Security Templates	436	(1)
Object Protection	436	(1)
Access Control Lists	436	(1)
Access Control Entries	437	(1)
Security Descriptor	438	(1)
Security Identifier	439	(1)
Security Model	439	(1)
Kerberos	440	(1)
Public Key Infrastructure	440	(1)
Smart Cards	441	(1)
IP Security	441	(1)
Secondary Logons	441	(2)
Summary	443	(1)
Solutions Fast Track	444	(2)
Frequently Asked Questions	446	(3)
Publishing	449	(24)
Introduction	450	(1)
Publishing Resources	450	(10)
Sharing Folders	451	(1)
Publishing a Folder in Active Directory	452	(2)
Browsing and Querying for Shared Folders	454	(3)
Overview of Dfs and EFS	457	(1)
Dfs	457	(1)
EFS	458	(1)
Publishing a Printer in Active Directory	459	(1)
Interfacing with Active Directory	460	(9)
ADSI	460	(2)
RPC	462	(1)
Windows Sockets	463	(1)
DCOM	463	(1)
Exchange Server 5.5 Active Directory Connector	463	(2)
Exchange Server 2000	465	(4)
Summary	469	(1)
Solutions Fast Track	469	(2)
Frequently Asked Questions	471	(2)
Modifying the Schema	473	(28)
Introduction	474	(1)
About Objects and Attributes	474	(1)
Planning Schema Modifications	475	(6)
Why Modify the Schema?	475	(1)
When to Modify the Schema	476	(1)
Who Should Modify the Schema?	476	(2)
Schema Management Console	478	(1)
Flexible Single Master Operation	479	(2)
How to Modify the Schema	481	(10)
Class	481	(7)
Attributes	488	(2)
System Checks after Schema Modification	490	(1)
Schema Container	491	(5)
The Cache	491	(1)
Schema Utilities	492	(2)
Querying Active Directory	494	(1)
Display Specifiers	494	(2)
Summary	496	(1)
Solutions Fast Track	497	(2)
Frequently Asked Questions	499	(2)
Using Active Directory: A Case Study	501	(20)
Introduction	502	(2)
Case Study Overview	502	(2)
Planning the Group Policy Solution	504	(3)
Creating New OUs	505	(1)
Deciding Group Policy Application	506	(1)
Determining What Group Policies Are Needed	507	(1)
Implementing the Group Policy	507	(7)
Computer Node	508	(1)
User Node	509	(4)
Creating the Group Policy for an OU	513	(1)
Creating Logon/Logoff Scripts	514	(2)
Summary	516	(1)
Solutions Fast Track	516	(2)
Frequently Asked Questions	518	(3)
Part V: Integrating with Active Directory	521	(50)
Plugging into Active Directory	523	(26)
Introduction	524	(1)
Microsoft's Metadirectory	524	(5)
MMS Architecture	528	(1)
Obtaining MMS	529	(1)
Microsoft's Active Directory Deployment Tools	529	(3)
Mission Critical's Active Directory Migration Tool	530	(1)
Deploying Active Directory-Enabled Clients	530	(1)
Best Practices	530	(1)
Deploying DSClient	531	(1)
Quest's FastLane Technologies	532	(5)
FastLane Reporter	533	(1)
FastLane Administrator	534	(1)
FastLane Migrator	535	(2)
FastLane Developer	537	(1)
FastLane Consolidator	537	(1)
Cisco	537	(4)
CNS/AD	538	(2)
What CNS/AD Does	540	(1)
Other Applications	541	(3)
SAP	542	(1)
Mobile Information Server	542	(1)
SQL Server 2000	543	(1)
Summary	544	(1)
Solutions Fast Track	545	(2)
Frequently Asked Questions	547	(2)
Disaster Recovery for Active Directory	549	(22)
Introduction	550	(1)
Modeling Sites with Disaster Recovery in Mind	550	(4)
Avoiding Disasters	554	(4)
Uninterruptible Power Source	554	(1)
RAID	555	(1)
Clustering	556	(1)
File Replication Service	557	(1)
Distributed File Service	558	(1)
The Active Directory Database File Structure	558	(2)
Backup	560	(2)
Creating an Emergency Repair Disk	562	(1)
Recovering a Failed Domain Controller	562	(5)
Non-Authoritative Restore versus Authoritative Restore	563	(1)
Authoritative Restore of Deleted Objects	563	(1)
Startup Options	564	(2)
The Recovery Console	566	(1)
Summary	567	(1)
Solutions Fast Track	568	(2)
Frequently Asked Questions	570	(1)
Appendix A Migrating from Novell NetWare	571	(4)
Migrating from Novell Directory Services	572	(2)
Other Utilities	574	(1)
Appendix B Secrets	575	(20)
Lesser-Known Management Shortcuts	576	(3)
Upgrading DNS and Supporting DNS Dynamic Update Protocol	576	(1)
Creating a Custom Microsoft Management Console	576	(1)
PDC Emulation and Native Mode	577	(1)
How Active Directory Prevents Unnecessary Replication	578	(1)
Under-Documented Functions and Procedures	579	(7)
How an LDAP Query Accesses Active Directory	579	(1)
Software Installation	580	(2)
How to Create and Configure a Dfs Root	582	(1)
Informational Message	583	(1)
Renaming	583	(1)
Quick Application of an Updated Group Policy	583	(1)
DNS Migrations	584	(1)
DNS Best Practices	585	(1)
For Experienced Users	586	(6)
Add a Server to Two Different Sites Simultaneously	586	(1)
Removing Phantom Objects	586	(1)
Phantom Domains	587	(1)
Transferring FSMO Roles	588	(4)
Troubleshooting Tips	592	(3)
Avoiding Errors When Migrating a Domain	592	(1)
Remote Procedure Call Errors	592	(3)
Index	595