1 YEAR UPGRADE BUYER PROTECTION PLAN Windows 2000 Active Directory Second Edition Your Complete Guide to the Active Directory Architecture • Step-by-Step Instructions for an NT4 to Active Directory Migration • Hundreds of Configuring & Implementing,Designing & Planning Sidebars, Security Alerts,and FAQs • Complete Coverage of Network Resources,Services,and Users and Groups Melissa C. Craft Thomas Llewellyn Technical Editor 180_Act_2nd_FC 9/20/01 9:37 AM Page 1 solutions@syngress.com With more than 1,500,000 copies of our MCSE, MCSD, CompTIA, and Cisco study guides in print, we continue to look for ways we can better serve the information needs of our readers. One way we do that is by listening. Readers like yourself have been telling us they want an Internet-based ser- vice that would extend and enhance the value of our books. Based on reader feedback and our own strategic plan, we have created a Web site that we hope will exceed your expectations. Solutions@syngress.com is an interactive treasure trove of useful infor- mation focusing on our book topics and related technologies. The site offers the following features: ■ One-year warranty against content obsolescence due to vendor product upgrades. You can access online updates for any affected chapters. ■ “Ask the Author”™ customer query forms that enable you to post questions to our authors and editors. ■ Exclusive monthly mailings in which our experts provide answers to reader queries and clear explanations of complex material. ■ Regularly updated links to sites specially selected by our editors for readers desiring additional reliable information on key topics. Best of all, the book you’re now holding is your key to this amazing site. Just go to www.syngress.com/solutions, and keep this book handy when you register to verify your purchase. Thank you for giving us the opportunity to serve your needs. And be sure to let us know if there’s anything else we can do to help you get the maximum value from your investment. We’re listening. www.syngress.com/solutions 180_AD2e_FM 8/31/01 1:29 PM Page i 180_AD2e_FM 8/31/01 1:29 PM Page ii 1 YEAR UPGRADE BUYER PROTECTION PLAN Windows 2000 Active Directory Second Edition Melissa Craft Thomas D. Llewellyn Jr. Technical Editor 180_AD2e_FM 8/31/01 1:30 PM Page iii Syngress Publishing, Inc., the author(s), and any person or firm involved in the writing, editing, or production (collectively “Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from the Work. There is no guarantee of any kind, expressed or implied, regarding the Work or its contents.The Work is sold AS IS and WITHOUT WARRANTY.You may have other legal rights, which vary from state to state. In no event will Makers be liable to you for damages, including any loss of profits, lost savings, or other incidental or consequential damages arising out from the Work or its contents. Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you. You should always use reasonable case, including backup and other appropriate precautions, when working with computers, networks, data, and files. Syngress Media®, Syngress®, and “Career Advancement Through Skill Enhancement®,”are registered trademarks of Syngress Media, Inc. “Ask the Author™,”“Ask the Author UPDATE™,”“Mission Critical™,” “Hack Proofing™,” and “The Only Way to Stop a Hacker is to Think Like One™” are trademarks of Syngress Publishing, Inc. Brands and product names mentioned in this book are trademarks or service marks of their respective companies. KEY SERIAL NUMBER 001 UH7F9MKA5F 002 Q3F3KMV9JX 003 BV7KDFL4W9 004 MN9XVE5ALM 005 CF59K5YPFG 006 ALKEQ34TMG 007 28K7Y4NFNA 008 EMRZP46MGH 009 MS6DREHAWR 010 XZEPA4TMBM PUBLISHED BY Syngress Publishing, Inc. 800 Hingham Street Rockland, MA 02370 Windows 2000 Active Directory, Second Edition Copyright © 2001 by Syngress Publishing, Inc.All rights reserved. Printed in the United States of America. Except as permitted under the Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the prior written permission of the publisher, with the exception that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for publication. Printed in the United States of America 1 2 3 4 5 6 7 8 9 0 ISBN: 1-928994-60-1 Technical Editor:Thomas D. Llewellyn Jr. Freelance Editorial Manager: Maribeth Corona-Evans Technical Reviewer: Norris L. Johnson, Jr. Cover Designer: Michael Kavish Co-Publisher: Richard Kristof Page Layout and Art by: Shannon Tozier Acquisitions Editor: Catherine B. Nolan Copy Editors:Adrienne Rebello and Beth A. Roberts Developmental Editor: Jonathan Babcock Indexer: Jennifer Coker Distributed by Publishers Group West in the United States and Jaguar Book Group in Canada. 180_AD2e_FM 8/31/01 1:30 PM Page iv v Acknowledgments v We would like to acknowledge the following people for their kindness and support in making this book possible. Richard Kristof and Duncan Anderson of Global Knowledge, for their generous access to the IT industry’s best courses, instructors, and training facilities. Ralph Troupe, Rhonda St. John, and the team at Callisma for their invaluable insight into the challenges of designing, deploying and supporting world-class enterprise networks. Karen Cross, Lance Tilford, Meaghan Cunningham, Kim Wylie, Harry Kirchner, Kevin Votel, Kent Anderson, Eric Green, Dave Dahl, Elise Cannon, Chris Barnard, John Hofstetter, and Frida Yara of Publishers Group West for sharing their incredible marketing experience and expertise. In addition, a special thanks to Janis Carpenter and Kimberly Vanderheiden for help on recent projects. Mary Ging, Caroline Hird, Simon Beale, Caroline Wheeler,Victoria Fuller, Jonathan Bunkell, and Klaus Beran of Harcourt International for making certain that our vision remains worldwide in scope. Anneke Baeten and Annabel Dent of Harcourt Australia for all their help. David Buckland,Wendi Wong, Daniel Loh, Marie Chieng, Lucy Chong, Leslie Lim, Audrey Gan, and Joseph Chan of Transquest Publishers for the enthusiasm with which they receive our books. Kwon Sung June at Acorn Publishing for his support. Ethan Atkin at Cranbury International for his help in expanding the Syngress program. Rick Bizzozero and Carolyn Gifford at GIG Communications for their help with packaging. Joe Pisco, Helen Moyer, Paul Zanoli,Alan Steele, and the great folks at Graphic Services/InterCity Press for all their help. 180_AD2e_FM 8/31/01 1:30 PM Page v vi About the Author Melissa Craft (CCNA, MCNE, MCSE, Network+, CNE-3, CNE-4, CNE-GW, CNE-5, CCA) worked with computers during high school, developing computer programs and testing hardware solutions as a summer job.After graduating from the University of Michigan, Melissa designed business solutions for an insurance group using technology to automate processes and using business process reengineering techniques. This position grew into engineering a wide area network, which subse- quently turned into a career move permanently into engineering. After making the jump to network engineering, Melissa threw herself at the task of truly understanding network engineering, gaining a myriad of technology certifications and, at the same time, deploying projects for clients. Over the years, she has successfully designed, implemented, and integrated networks ranging in size from a few nodes to over 100,000 nodes. Her consulting experience incorporated extensive project manage- ment, operational analysis, LAN and WAN design, deployment, and ongoing network management. In 1997, Melissa began writing magazine articles on networking and the technology industry. In 1998, Syngress hired Melissa to contribute to an MCSE certification guide. Since then, Melissa has continued to write about various technology and certification subjects. Currently, Melissa is a Principal Consultant for CompuCom Systems, Inc.As such, she develops enterprise-wide technology solutions and methodologies focused on client organizations.These technology solu- tions touch every part of a system’s lifecycle, from assessing the need, determining the return on investment, network design, testing, and imple- mentation to operational management and strategic planning. CompuCom Systems, Inc. is a leading digital infrastructure solutions provider whose clients include Fortune 1000 enterprises, vertical industry leaders, major technology equipment providers, leading-edge systems inte- grators and wireless technology providers. CompuCom’s technology solu- tions help companies master complex technologies. CompuCom leverages people, process and technology to offer best in class solutions that enable, 180_AD2e_FM 8/31/01 1:30 PM Page vi vii optimize and operate the digital technology infrastructure. CompuCom is accessible via the Internet at www.compucom.com. Melissa holds a bachelor’s degree from the University of Michigan and is a member of the IEEE, the Society of Women Engineers, and American MENSA, Ltd. Melissa currently resides in Glendale,AZ with her family, Dan, Justine, and Taylor. Thomas D. Llewellyn Jr. (MCSE, MCT, and A+) works as a Senior System Engineer/Project Manager for Integra Business Center headquar- tered in Allentown, PA. Integra is a Value Added Reseller that provides IT design, project management, and various Information Technology services for small- to medium-sized businesses.Tom has a degree in Computer Science and Technology with a concentration in Computer Programming; he brings over 10 years of real-world IT enterprise experience to Integra that spans the development, networking design, implementation, and on- going management and support of Information Technology business solu- tions. He has a vast amount of experience with the Enterprise Deployment of Microsoft Systems Management Server and other Windows NT/2000 based Technologies.Tom has served as Technical Editor on other Syngress books and was previously employed as a Senior Consultant by CoreTech Consulting Group Inc. He lives in Gilbertsville, PA. Technical Editor 180_AD2e_FM 8/31/01 1:30 PM Page vii viii Technical Reviewer Norris L. Johnson, Jr. (MCSE, MCT, CTT,A+, Network +) is a Technology Trainer and Owner of a consulting company in the Seattle- Tacoma area. His consultancies have included deployments and security planning for local firms and public agencies, as well as providing services to other local computer firms in need of problem solving and solutions for their clients. He specializes in Windows NT 4.0 and Windows 2000 issues, providing planning and implementation and integration services. In addi- tion to consulting work, Norris trains extensively in the AATP program at Highline Community College’s Federal Way,WA campus, and has taught in the vocational education arena at Bates Technical College in Tacoma,WA. Norris holds a bachelor’s degree from Washington State University. He is deeply appreciative of the guidance and support offered by his parents and wife Cindy during the years of transition and education to make the career change that has been so wonderful to be involved in. 180_AD2e_FM 8/31/01 1:30 PM Page viii Contents ix Preface xxv Part I: Getting Started 1 Chapter 1 Introduction to Active Directory 3 Introduction 4 Introduction to Directory Services 4 Directory Enabled Networks 5 History of the Directory Service 6 What Is in a Directory Service? 11 The Directory Database 13 Directory Service Domino Effect 15 Introduction to Active Directory 15 .NET 16 Protocol Interoperability 17 Single Point of Administration 18 Active Directory Architecture 20 Namespace 23 Forests 24 Scope 24 Distinguished Name 25 User Principle Name 26 Partitions 27 Global Catalog 28 Object 29 Container 29 Domains 30 Domain Trees 30 Understand What Is in a Directory Service A directory is a place to store information. The type of information that is stored in a directory falls into three basic categories: ■ Resources ■ Services ■ Accounts 180_AD2e_TOC 8/31/01 2:09 PM Page ix [...]... about the same time as the gold code for Windows 2000 Server was released It was timely for first-time explorers of the Windows 2000 Active Directory. This edition answers questions for both first-time Active Directory administrators as well as those who have been using Active Directory since it’s pre-release days This book will cover Windows 2000 Server Active Directory, in detail It will discuss the... PM Page xxv Preface Active Directory is the directory service that comes with Windows 2000 Server and extends to be the directory service for other servers, such as Exchange Server 2000 and Mobile Information Server Prior to the release of Windows 2000, many people speculated on how Active Directory could help them reduce costs or increase services to end-users.To some, Active Directory provided a... speculation took place before Active Directory was available to the public Now, many organizations are realizing the business objectives made possible by deploying Active Directory Windows 2000 Active Directory, Second Edition has been carefully updated and expanded from the first edition taking into account over a year’s worth or enterprise-wide deployments of Windows 2000 and Active Directory This book will... implement Active Directory? A: No Active Directory relies on SRV RRs in order to locate domain controllers (DCs) All DNS servers for the namespaces that Active Directory encompasses must also support the SRV RRs 97 Chapter 4 DNS and Naming Strategies Introduction What Is DNS? How DNS Zones Function Active Directory s Integration with DNS How Active Directory Uses DNS Dynamic DNS Planning Active Directory. .. 8/31/01 1:41 PM Page xxviii Preface Configuring ISA Server 2000: Building Firewalls for Windows 2000, ISBN 1-928994-29-6 Configuring Exchange Server 2000, ISBN 1-928994-25-3 Configuring Citrix MetaFrame for Windows 2000 Terminal Services, ISBN 1-928994-18-0 Configuring Windows 2000 WITHOUT Active Directory, ISBN 1-928994-54-7 Designing SQL Server 2000 Databases for NET Enterprise Servers, ISBN 1-928994-19-9... Introduction to Active Directory Solutions in this chapter: s Introduction to Directory Services s Introduction to Active Directory s Active Directory Architecture Summary Solutions Fast Track Frequently Asked Questions 3 180_AD2e_01P1 4 8/30/01 10:39 AM Page 4 Chapter 1 • Introduction to Active Directory Introduction In November 1996, Microsoft delivered the first preview of Active Directory for developers... Transactions might not have been written to disk, but were written to log files for Active Directory s Data in the Active Directory databases on other DCs might have had additional changes since the failure Microsoft’s Active Directory Deployment Tools Mission Critical’s Active Directory Migration Tool Deploying Active Directory- Enabled Clients Best Practices Deploying DSClient Quest’s FastLane Technologies... the Windows 2000 Active Directory Domain Installation 1 Run the Windows 2000 Server installation command (You have the option of running WINNT from a DOS prompt, booting directly into the installation from the CD-ROM, or running WINNT32 from a 32-bit Windows operating system.) 2 Configure DNS (Domain Name System) as a client to another DNS server or as a service on the Windows 2000 Server 3 Run the Active. .. Introduction Publishing Resources Sharing Folders Publishing a Folder in Active Directory Browsing and Querying for Shared Folders Overview of Dfs and EFS Dfs EFS Publishing a Printer in Active Directory Interfacing with Active Directory ADSI RPC Windows Sockets DCOM Exchange Server 5.5 Active Directory Connector Exchange Server 2000 Summary Solutions Fast Track Frequently Asked Questions 449 450 450... just the directory service that was shipped with Windows NT 5.0, and the preview included many of other Windows NT 5.0 features A lot of changes have taken place since then For one ,Windows NT 5.0 was renamed Windows 2000, and then it was released to the public officially in February 2000, four years after its original preview to developers The change of the name from Windows NT 5.0 to Windows 2000 was . Domains in Active Directory 284 Active Directory Sizer Tool 285 The First Domain Controller 285 Active Directory Wizard 289 Integrating DNS into Active Directory. Characteristics of an Active Directory Forest 319 Learn the Three Basic Steps for the Windows 2000 Active Directory Domain Installation 1. Run the Windows 2000 Server