Active directory bible

Active Directory

5. ABOUT IDG BOOKS WORLDWIDE

6. Bator

Media Development €
Marisa Pearman

11. Preface Xi

16. xvi Content

17. coments xvii

18. | xVii Contents |

19. Contents

xix

21. contents xxi

23. CHARTER

In This Chapter

Exploring directory

Examining he Active
Dieciory feanxes

Understanding th
sve Directory
cal anıchre

Parsing forthe
ve Diecory

24. Part! + Planning an Active Directory Deployme

25. Chapter 1 + Introduction to Active Directory Technology and Deployment Planning

26. Part! + Planning an Active Directory Deployme

27. 1 + Introduction to Active Directory Technology and Deployment

28. Part! + Planning an Active Directory Deployme

1 you have worked in a multple domain NT network you know a thing or two about trust
jonships Tut relationships enable a user in Doman Ato access resourcesin Domain

Windows NT, you had to configure each side of the trust—determining who was

and it gure and manage

ru relationships in Windows 2000. In Windows 2000
ments hat need more than one dom, automatic Kerberos transtve trust are established
hen you crece new domansin the ore ro. Keberosis the seu protocol n Windows
00, replacing NTLM in Windows NT. Kerberos provides superior secu technology and
‘many new socurty features, ke transe rst retionshipa A transtive trust simply means
that Domain A wuss Domain 8, and Domain Brute Domain C then Domain A automalı
ly tuss Domain Ce trantive nut rlaonsnis are automatically configured witha
‘other domains and domain tres within the forest. The forest sores as your boundary and

29. Chapter 1 + Introduction to Active Directory Technology and Deployment Planning

30. Part! + Planning an Active Directory Deployme

31. Chapter 1 + Introduction to Active Directory Technology and Deployment Planning 11

32. 12 Pat + Panning an Active Di

33. Chapter 1 + Introduction to Active Directory Technology and Deployment Planning 13

34. 14 Pat + Planningan Active Di

35. Chapter 1 + Introduction to Active Directory Technology and Deployment Planning 15

36. 16 Pati + Planning an Active Directory Deployme

37. Chapter 1 + Introduction to Active Directory Technology and Deployment Planning 17

38. 18 Part + Planning an Active Directory Deployme

39. cHarfer

In This Chapter

Descibing a
namespace

Exploring the
ONShierarchy

arcing and
signing fe forest
domain ro

40. 20 Pati + Planning an Active Directory Deploymer

42. 22 Pati + Planning an Active Directory Deploymer

43. Chapter 2 + The Active Directory

44. 24 Pat! + Planning an Active Directory Deploymer

45. Directory Namespace 25

46. 26 Pat! + Planningan Active D)

48. 28 Pati + Planning an Active Directory Deploymer

49. fetve Directory. Suppose your company, Wison Dog Colas
but now wants to change

annot change the root domain thout comple aaling the Active
Directory is a great dire

50. Pat | + Planning an Active Directory Deploym

SEEN

When designing your Av Directory ro ¡gpesion isto use a name that is

representave 0! and encompasess your ente company and one ha is valable or oser
teme, Even i your company do n À presen
Inthe future, stil recommend thal ou pay the annual fee and ro

‘The nte is il evolving and changing the way we do business Lit because a company
‘means your Internet name and Active Directory names will have tobe diferent. So, my su
pesto 11 reger the name. I's rather insspensiv and can avoid many potenti eves
and problems in he future

51. Directory Namespace 31

52. 32 Pati + Planning an Active Directory Deploymer

53. Chapter 2 + The Active Directory

54. 34 Parti + Planning an Active Directory Deploymer

55. charter

In This Chapter

Understanding Act
Directory domains

Developing a
domain sucio

Organizasonal
Unit sucre

56. 36 Pati + Planning an Active Directory Deploymer

57. rectory Structure,

59. Directory Srucure 39

61. ectory Sruaure 41

62. 42 Pati + Panning an Active Directory Deÿ

63. ectorySruaure 43

68. 48 Pati + Panning an Active D

69. ectory Sruaure 49

70. 50 Pati + Planning an Activo D

71. ctor Sure 51

72. 52 Pari + Planning an Active Directory Deploymer

73. lanning an Active Directory Structure

hile were on the subject of NT domain limitations, a more serious limit
aM database limit isthe POC. In Windows NT domains, only tne PDC ha

ofthe databace ll BDOS have a read-only copy of the database. This

uses two prob

1. Changes: Only the POC has a witble copy ofthe dtabase. Changes must
made on the PDC, or on BDC thal connecte with the PDC and makes the
the POC database. In large domain spread

several diferent bulléngs.r even

2. Load: The domain can grow only o large because the PO

load. ni can quickly become 100 a

Windows 2000 leaves this legacy behind wi

sole the implementation with your row, whieh soles alto! potential problems!

53

74. 54 Par + Planning an Activo D

75. ectory Srudure 55

76. 56 Pati + Planning an Active Directory Deploym

77. ectory Srudure 57

78. 58 Pari + Planning an Active Directory Deploymer

79. ctor Sruaure 59

80. 60 Pati + Planning an Active Directory Deploymer

81. curler

In This Chapter

pared
NT dora

Migrating to the
sve Diecory

82. 62 Pati + Planning an Active Directory Deploymer

83. The POC Emulator prior
atabase, but NT BDOs have no cono 4

ory dea to BOE a ala tre and em using LAN
Manager Replication Seve. (Wind

& funtion a PDG performed, the POC Emultor perorms as well
However, to other Windows 2000 doman controllers, the POC Emulator appears and lune
tions as jus another domain controller. You use the POC Emula her
omain controler to crete, mod. or delete Active Dir sin ac, Ine POC
Emulator role is invisible k a Sees

84. 64

Part! + Planning an Active Directory Deployme

What you have a POC that is geting ld? You do not want to replace 1
ator upgrading 2000, you want Ja PDG as a emple Wi
Because your POC contains your user and group accounts

< thal 1 becomes a simple member server. Beca ory peer

86. ‘computers
Xénon
Exchange 2000

90. 70 Pat! + Planning an Active Directory De

92. 72 Pari + Planing an Active Directory Deploymer

94. 74

Part + Planning an Active Di

96. 76 Pari + Planning an Active Directory Deploymer

98. 78 Pari + Planning an Active Directory Deploymer

99. CHAPTER

In This Chapter

Understanding Act
Directory ates

Exploring the
necessity of ses

Understanding the
bridgehead

sidering the final
‘ite planning seps

100. 80 Pati + Planning an Active Directory Deploymer

101. + Planning Act

102. 82 Pati + Planning an Active Directory Deploym

103. 5 + Planning Act

108. 88 Pati + Planning an Active Directory Deploymer

110. 90 Pati + Planning an Active D)

114. 94 Pat! + Planning an Active D)

115. 5 + Planning Act

116. 96 Pati + Planning an Active Directory Deploymer

117. CHAPTER

In This Chapter

Examining domain
controles

Understanding the
root domain

Exploring insalation
requirements

saling the root
domain

120. Directory

121. Chapter 6 + Installing the Root Domai

Ale system is ike a folder in ag cabinet. Te fe sytem provides a way for your
Operating system to ore daa in à logical, organized manner. Without à fle sytem, your
support FAT FAT, and NTFS

FAT (Fle Alocation Table) isan older le system. FAT was around when hard disks were
rather small In fat FAT should not be used on dicks larger than MB. (When was the at
time you saw a drive hat small You can use ton dvesup lo 4G but FAT does ot make

so of orage space once you move away tam the 51 ¡MB colin. an guess,
Fas provided in Windows 2000 for backward compatiblity,

Windows 95 OSF2 indows 98. FAT32 can make good use of space on larger
Windows 2000 senices and options will ot work on FAT or FAT, he FAT, RTS is pro

Finally the new NTFS with Windows 2000 makes excallent use of storage space and sup
of choice in Windows 2000 and is required for an Active Directory installation. |

134. Directory

135. enafren

In This Chapter

bostaling adaitonal
domain controles

Creating child
domains

Forming grandes

Consrucing a

Managing opera

Uninsaling the
Director

140. the Active Directory

146. 128

the Active Directory

148. Directory

160. 142

the Active Directory

163. charter

In This Chapter

domain mixed lo

Contguring must
relationships

Configuring ste links
and se link bridges

165. 8 + Configuring Active Directory Domains and Sites 147

166. Directory

167. 8 + Configuring Active Directory Domains and tes 149

168. Part I + Im the Active Directory

169. 8 + Configuring Active Directory Domains and Sites

172. 154

ing the Active Directory

173. 8 + Configuring Active Directory Domains and Sites

=

175. 8 + Configuring Active Directory Domains and Sites 157

Canale Window Y

177. + Configuring Active Directory Dom:

179. 8 + Configuring Active Directory Domains and Sites

180. Directory

181. 8 + Configuring Active Directory Domains and Sites 163

183. 8 + Configuring Active Directory Domains and Sites 165

184. 166

the Active Directory

185. charter

In This Chapter

Creating and
‘managing user

managing group

186. a the Active Directory

187. ‘hepter9 + Setting Up Users, Groups, and Computers 169

189. apler 9 + Setting Up Users, Groups, and Computers 171

190. Directory

191. Chapter 9 + Setting Up Users, Groups, and Computers

Seat new unts with the Adive Directory Users and Computers

The rt ut ma Separ DD wie pecto the
Acive Directory using a tet ile that can be imported tothe Atve Directory However, you
(an only create accounts with CSVDE—not deat or change the

The second utity is Lightweight Directory Access Protocol Interchange Format (LDIFD
hich enables to ou to create, delete, and manage bulk impor ao

Tolan more about either uty, just ype CSVDEor LDIFDE a the command prompt and

173

192. the Active Directory

193. Up Users, Groups, and Computers

194. H

196. Directory

197. apter 9 + Setting Up Users, Groups, and Computers

198. 180

the Active Directory

199. aptor9 + Setting Up Users, Groups, and Computers 181

201. apter 8 + Setting Up Users, Groups, and Computers 183

202. Table 9-1
Windows 2000 Group Scopes

203. apler 9 + Setting Up Users, Groups, and Computers 185

204. a the Active Directory

205. apier9 + Setting Up Users, Groups, and Computers 187