# Presentation: 820334

## Build and Customize Windows 2000 Desktops through the power of Windows 2000 Active DirectoryKevin DwyerSystems EngineerMicrosoft Corporation

## Session Prerequisites

**This session assumes that you understand the fundamentals of:**
**Basic knowledge of network ****operating systems**
**General knowledge of ****Windows NT 4.0**
**General familiarity with Windows 2000 and the Walkthrough Documents**
**This is a level 200 session**

**Notes:**
To get the most from this session, you should have a basic understanding of these topics:
General knowledge of Windows NT 4.0 domains
Network operating systems
Familiar with DNS
Familiarity with Windows 2000 and CPP

## What You Will Learn Today

**When and how to create Group Policies in Sites, Domains and Organizational Units**
**Become familiar with new administration controls with  Group Policies **
**How to create Group Policies to customize Windows 2000 Professional Desktops**

**Notes:**
We have a lot to show you today. We will present the techniques you need to plan and implement Active Directory in Windows 2000.  The topics we will cover are:
<Read the slide>

## Driving Costs For Desktop TCO

**Reality not all users are “Knowledge Users”**
**From Gardner, in the enterprise there are:**
**High-Performance Users (highly technical like Dev)**
**Knowledge users**
**Mobile users **
**Process Users (Task)**
**Data entry Users**
**Computers for most users are tools to get another job done**
**Users spend to much time in supporting themselves or “futzing” in areas they do not need to get job done**

## Change And Configuration Management

**One “image” for everyone does ****not work**
**In most cases there is additive functionality to a Standard Managed Environment (S.M.E.)**
**AKA - C.O.E, S.O.E.**
**Windows 2000 enables the Administrator to customize the desktop based on the users role**

## Change And Configuration Management

**Software Installation**

**User Settings Management**

**Increased protection and availability of people’s data.**
**“****My Documents follow me!”**

**Increased availability of the applications that people need.**
**“****My Applications follow me!”**

**Increased computer availability -- no lost time due to futzing around.**
**“****My Personal Settings follow me!”**

**IntelliMirror**

**Remote OS Installation**

**Fast recovery, setup, and (re)configuration of the computer and operating system/S.O.E.**
**“****Get me back up, on this new machine”**

**Features**

**Benefits**

**Change And ****Configuration Management**

## Demonstration Group Policy Client Enhancements

**Notes:**
Now I’d like to demonstrate how to create users and groups using the Administrative Tools in Windows 2000.

## Active Directory Concepts

**Logical Concepts**
**Domains**
**Organizational Units**
**Tree**
**Forest**
**DNS Integration**
**Physical Concepts**
**Sites**
**Global Catalog**
**Replication**

**Notes:**
There are several core components to Windows 2000 Active Directory.  They can be divided into logical and physical concepts.  You can view these areas as separate layers.  These 2 layers are orthogonal to one another.  These Logical and Physical Concepts are covered in detail in the following slides.  

Note to presenter: These are some other terms that you might be presented with, you do NOT have to address these topics/terms now
An object is a distinct item that represents something concrete, such as a User, Printer, Computer, Application and so forth. Every object consists of a set of named attributes and belongs to an object class.
Attributes (or properties) are named categories of information that define the characteristics of objects. Each attribute of every object has an associated value (or values or null). For example, a User object might have an attribute named “First Name”.
An object class is a logical grouping of objects in which all of the objects share the same set of attributes. Examples of object classes include Users, Printers, Computers, and Applications.
The schema is the formal definition for all Active Directory objects, including the object classes and object attributes. The schema also defines things such as whether attributes are required for particular object classes and the relationship between object classes. The schema is stored within the Active Directory and is extensible, meaning that new object classes and attributes can be added to the Active Directory.
A container is any object that can hold other objects.  For example, a Printers container can hold Printer objects. Containers are used in the Active Directory to logically group objects that meet particular business criteria. Note that containers in the Active Directory are not limited to holding a single class of object.

## Sites

**What is a Site?**
**A set of well connected IP subnets**
**Site Usage**
**Locating Services (e.g. Logon, DFS)**
**Replication**
**Group Policy Application**
**Sites are connected with Site Links**
**Connects two or more sites**

**Tip: A site is a group of subnets where each has LAN speed connectivity to one another.**

**Notes:**
Now that we’ve covered some logical concepts let’s talk about some physical aspects of Windows 2000...
What is a site? An Active Directory Site is a set of TCP/IP subnets that are considered to be “well-connected”. Well-connected generally implies high-bandwidth LAN (10MB Minimum) connectivity, possibly involving several hops through routers. Sites are used in the Active Directory as follows:
Sites (a physical construct) are not part of the Active Directory namespace (a logical construct).  Sites may span multiple Domains. Similarly, Domains may span multiple Sites. 
Sites serve three main purposes. Sites are used to locate services such as logon and DFS services.  When a client requests a connection to a DC (& Global Catalog for Universal Group membership info) Login, sites are used to preferentially allow the client to connect to a Domain Controller within the same site. If there are no Domain Controllers in a site with clients, then another site that does have Domain Controllers can provide “coverage” for the client site. Site links each have a logical cost assigned to them.  If a user is searching for the closest DC to logon, he will first look for a DC (& GC) in his site.  If none exists, he will search for a DC in the site with the lowest logical cost assigned to the site link. When a client requests a connection to a Service, such as a Dfs Replica, sites are used to preferentially allow the client to locate and connect to a Replica within the same site.
Sites are also used to control and replication throughout an enterprise.  The Active Directory automatically creates more replication connections between Domain Controllers in the same site than between Domain Controllers in different sites. This results in lower replication latency within a site, and lower replication bandwidth between sites.
Replication between Domain Controllers in different sites is compressed 10-15%, resulting in less network bandwidth utilization over the slower links between sites. 
Finally, Policy objects can be applied to Sites (or, more specifically, to Computer objects that reside in Sites) as a group.
Sites are connected using Site Links. Active Directory Site Links are used to define connections between Sites and together they represent the physical network. A Site Link represents a set of Sites that can communicate with one another. For example, two Sites that are connected with one another with a point to point T1 might be represented by a single Site Link. On the other hand, a set of buildings (each in their own Site) that are connected to each other over an ATM backbone might be represented by a Site Link that contains all of those buildings (i.e. Sites). Similarly, a full mesh Frame Relay network might be represented with a single Site Link, assuming each of the Sites had equal cost connectivity to every other Site.  

## Domains

**Boundary of Security**
**Boundary of Authentication**
**Boundary of Replication**
**Domain NC Replication**
**Boundary of DNS Namespace**
**Boundary of Administration**

**COMPANY**

**Tip: Design your new domain structure as the perfect environment, then integrate with the existing structure**

**Notes:**
A domain is the core unit of logical structure in Active Directory.  Domains represent a logical partition within the Active Directory for both security and directory replication.  Each domain stores information only about the objects it contains. Theoretically, a domain directory can contain up to 10 million objects, but one million objects per domain is the supported (tested) limit.  Domains function in several capacities.  They serve as boundaries of authentication, replication, namespace, and security policies.  Domains are manifested from DCs.  There is also a 1-to-1 correspondence between Active Directory Domains and DNS Domains. Since all users in a domain must logon to a domain controller for that domain, domains are also:
Boundaries of authentication. Domain controllers are responsible for authenticating users and groups.
Boundary of security policies. Certain security policies are applied exclusively at the domain level, including Password Length, Account Lockout and Kerberos Ticket Lifetime. Security policies that are defined in one Domain are not extended to any other Domain.  In addition, access to domain objects is controlled by Access Control Lists (ACLs), which are populated with Access Control Entries (ACEs). All security polices and settings, such as administrative rights and Access Control Lists (ACLs), do not cross from one domain to another. The domain administrator has the right to set policies only within that domain. So, domains are also boundaries of administration because privileges that are granted in one Domain do not extend to any other Domain.
Boundary of replication. All objects that reside in a Domain are fully replicated to all Domain Controllers for that Domain. The Domain Controllers for a Domain each have a complete writeable replica of that Active Directory Partition (i.e. Domain).
Unique Namespace. An Active Directory Domain is identified by a unique DNS domain name, as well as a downlevel NetBIOS name for downlevel client and server access.
Boundary of administration. Administrative privileges that are granted in one Domain do not extend to any other Domain.
Domains are manifested in the form of a domain controllers.  In Windows 2000 there are no longer PDCs and BDCs instead every DC maintains a writeable copy of the domain database (directory information tree - .dit)
There are 2 modes that a domain can operate in, native or mixed mode.
Mixed Mode. When a Domain is in mixed mode, the Active Directory Domain Controllers in the Domain can coexist and replicate with Domain Controllers in the same Domain that are running previous versions of Windows NT Server (downlevel domain controllers). When a Domain is in mixed mode, it is subject to the restriction of the downlevel SAM (40MB size, 40,000 users limitation).
Native Mode. When all domain controllers in the domain are running Windows 2000, and there are no downlevel domain controllers in the domain, you can switch the Domain mode from mixed mode to native mode. 
To take full advantage of Windows 2000 you want to begin operating in Native mode a soon as possible.

## Slide 11

**Notes:**
If you do the demo live, you don't use this slide.  Either way, please use the demo script

## Organizational Units

**Containers within Domains**
**Distinct Units of Administration**
**Unique to Domains**

**Tip: ****Find elements common to more than one division, & set the OU structure to provide consistency.**** **

**Notes:**
Organizational Units – or OUs – are containers that are used to organize objects within a Domain. For example, OUs can contain Users, Computers, Groups, Printers, Applications, File Shares and other OUs. OUs can be logically structured into a hierarchy that models the business. 
They are distinct logical administrative units that can be used to:
	1.)  delegate administration within a domain. 
	2.) OUs are also used to apply policy to objects (such as Users or Computers) 	as a group.
The OU hierarchy within a particular Domain is independent of the OU hierarchy in any other Domain. Each Domain can implement it’s own OU hierarchy. OUs are represented by circles within a Domain.

## Reasons To Create OUs

**Enhance Administrative Delegation**
**Group Policy Application**
**3 Common Structures:**

**Tip: ****OU restructuring is trivial.  You do not have to get it right the first time.**** **

**Europe**

**Geographical**

**Organizational**

**Users**

**Printers**

**Task**

**Computers**

**Notes:**
Unlike domain creation, OUs can be created and deleted more trivially.  However, there are still reasons to create OUs.  They should not be created for the sake of structure, they should server a specific purpose.  Valid reasons for creating OUs are as follows:
Enhancing administrative control.  The administration of an OU can be delegated, and the groups and users that have access to the OU can be limited.  OUs allow you to control visibility of objects, such as printers, users, and so on.  OUs also make resource administration more efficient (for example, assign permissions once for an OU with many shares rather than multiple times for each share).
Policy Application. OUs help control policy application so that it applies to a distinct group of users or computers. Policies can be scoped such that they apply to a Site, a Domain or an Organizational Unit. 
Migration from Windows 2000. In Windows NT 4.0, delegation of administration was achieved through resource domains. This was expensive, requiring additional management and hardware. Windows 2000 enables you to collapse resource domains into a hierarchy of OUs. 
Limiting Number of Objects in View. While there is no practical limitation to the number of objects that may exist in an OU, for end user browsing purposes it may make sense to limit the number of objects in an OU.
There are 3 common structures that OUs can be based on.  The Geographical Model contains users, groups, and computers by geographical location.  The Functional Model categorizes users, groups, and computers by their function within the organization.  For example, all of the IT Staff would be placed in an OU and administration would be delegated to it accordingly.  The last model reflects the Business Hierarchy.  This means that different divisions or companies within an organization are reflected in the OU structure.  This example shows 2 companies, the first is a manufacturing company that has production and design divisions.  The second company is a chain of retail stores that may (or may not) sell what the manufacturing company produces.
The decision to use a particular structure is determined by the administrative needs of the enterprise.

## Security And Administration

**Delegation**
**Group Policy **

**Notes:**
The final concepts we will cover today pertain to security and administration.  The ability to assign rights and permissions and delegate control has improved immensely in Windows 2000.  

## Delegation

**Permissions can be applied to specific Objects, Object Classes and Attributes**
**Variables of Delegation**
**By Geography:  Admins in New York**
**By Organization: Admins in Accounting**
**By Role/Task:  Printer Admins**

**Tip: You can delegate specific permissions to users and/or groups (i.e. resetting passwords).**

**Notes:**
Delegation is a very powerful feature in Active Directory that allows a higher administrative authority to assign specific permissions and administrative rights for container and sub tree access to individual users and groups. Permissions and Rights are delegated for specific objects, classes or attributes. Delegation provides the flexibility in allowing an organization to determine specifically which users and groups have administrative rights to which objects in a Domain.
There are 158 individual permission choices, which results in many millions of combinations. While it is a good idea to know the types of delegable permissions available, nonetheless you should keep permissions at a high enough level as to make them manageable. You should delegate an entire container (domain, site, or OU) when:
The scope of administration for the delegated group will be all of the objects within the container.
When passing authority of a sub-tree in a decentralized IT environment.
This type of delegation is appropriate for departmental OU delegation.
Delegate partial container objects when:
Assigning administrative authority based on task, such as when creating Printer Admins, or User Admins, etc.
Depending on your OU hierarchy, you can implement one or more variables of delegation.
By Location. Objects in these OUs are divided based on geographical location.  Computers, users, printers, etc.. In New York are placed in the New York OU.
By Organization. Objects in these OUs are placed based on their placement in a corporation.  Typical OUs would be – accounting, legal, advertising, etc...
By Role/Task. Finally, objects can be organized according to their function.
You can create OUs based on a combination of 1, 2 or 3 of the variables.  For example you can have an OU for the (2 combination) Accounting Admins in New York, or (3 combination) even the Printer Admins for Accounting in New York

## Group Policy

**GPO (Group Policy Object) is a collection ****of settings that will affect a given user ****or computer**
**Group Policy affects subjects regardless of physical location**
**A single GPO may contain hundreds of ****individual settings**
**A GPO is made up of a GPT stored on SYSVOL and a GPC stored in the Active Directory**
**Group Policy may be associated with the Local computer, Site(s), Domain(s), or Organizational Unit(s)**

**Notes:**
When we talk about group policy, it is important to note that policy and profiles are completely different animals. Profiles in Windows 2000 are almost identical to NT 4 profiles and consist of a users environment settings.
Group Policy in Windows 2000 really has no equivalent. While GP can control most environment settings, they are strictly administrative in nature and maintained only within the realm of the AD.
Group Policy can be associated with a Site, Domain or OU, but also to the local machine itself.
LSDOU is the order in which GP is applied.
By default, GP is applied to all authenticated users or computers as applicable.
GP has many features which allow organizations to develop completely customizable polices and apply them to suit requirements.
GPO itself - this is the DS object that corresponds to the group policy and has certain properties/attributes (e.g., friendly name, version # etc).  Written and maintained by the framework not directly written to by the individual extensions.  Doesn't have any GP data in it.  The GPO along with GPC is replicated by the DS.
GPC - Group Policy container a DS object associated with the GPO.  This is one of the stores available to the MMC extensions for storing data.  We don't legislate what gets stored in the GPC.
GPT - This is the other store (a directory in the DC's sysvol) available to the MMC extensions for storing data.  We don't legislate what gets stored in the GPT.  It is a directory and subdirectories and files can be created by the extensions for storing data.  GPT (the entire directory along with sub-directories and files) is replicated by FRS as part of replicating sysvol.

## Group Policy Usage

**Computer and User Settings**
**Software Policies**
**Software Management**
**User Documents and Settings**
**Security Settings**
**Scripts**

***Tip: Group Policies are applied to sites, domains or OUs and can be filtered by groups.***

**Notes:**
Group Policies define the various components of the user’s environment that system administrators need to manage, and include software settings, application deployment options, scripts, user settings and document options, and security settings. The Group Policy settings you specify are contained in a Group Policy Object that is in turn associated with selected Active Directory objects (site, domain, or organizational unit).  By default, Group Policy affects all computers and users in a selected Active Directory container. However, you can filter the effects of Group Policy based on users or computers’ membership in a Windows 2000 Security Group.  With the Group Policy editor you can specify settings for:
Computer & User Settings. Computer Settings include policies that specify operating system behavior, desktop appearance, application settings, assigned applications, file deployment options, security settings, and computer startup and shutdown scripts. Computer-related Group Policies are applied when the operating system initializes.   User Settings include all user-specific information such as operating system behavior, desktop settings, application settings, assigned and published applications, file deployment options, security settings, and user logon and logoff scripts. User-related Group Policy is applied when users log on to the computer.
Software Policies. You use Software Policies to mandate registry settings on the desktop, including operating system components and applications. Software Policies settings include Group Policy for the Windows 2000 operating system and its components, and for applications. 
Software management options You can install, assign, publish, update, repair, and remove software for groups of users and computers. 
User documents and settings (for file deployment and redirecting special folders). You use the User Documents and Settings extension to add files, shortcuts, or  folders to special folders that represent the user’s desktop. Special folders are those located under the %Windir%\Profiles folder (where %Windir% is the Windows NT folder), and they include folders such as My Documents, Start menu, Desktop, Favorites, and so on. 
Security settings A security configuration consists of settings applied to each security area supported for the Windows NT Workstation or Server. This configuration is included within a Group Policy Object. Security areas that con be configured are:
Account Policies. The term refers to computer security settings for password policy, lockout policy, and Kerberos policy in Windows NT domains.  
Local Policies. These include security settings for audit policy, user rights assignment, and security options. Local policy allows you to configure who has local or network access to the computer and whether or how local events are audited. 
Event Log. This controls security settings for the Application, Security, and System event logs. You can access these logs using the Event Viewer. 
Restricted Groups. This refers to computer security settings for built-in groups that have certain predefined capabilities. Restricted Group Policies affect the membership of these groups. Examples of restricted groups are local groups (such as administrators, power users, print operators, and server operators), as well as global groups (such as domain administrators).
System Services. These control configuration settings and security options (ACLs) for system services such as network services, file and print services, telephone and fax services, and Internet/intranet services, and so on.
Registry. This is used to configure and analyze settings for security descriptors (including object ownership), the ACL, and auditing information for each registry key.
File System. This is used to configure and analyze settings for security descriptors (including object ownership), the ACL, and auditing information for each object (volume, directory, or file) in the local file system. 
Scripts With the Scripts extensions you can assign scripts to run when the computer starts or shuts down, or when users log on or off their computers. For this purpose, you can use Windows® Scripting Host to include both Visual Basic®, Scripting Edition (VBScript) and JScriptTM script types. 

## When Does Group Policy Get Applied?

**Computer**** Starts**

**User Logs On**

**...****and at periodic intervals**

**When Does Group ****Policy Get Applied?**

**Windows 2000:**
**Applies Computer Settings from ****Group Policies**

**Windows 2000:**
**Applies User Settings from ****Group Policies**

## Where Does My Policy Come From?

**Domain**

**OU**

**2**

**3**

**1**

**Where Does My Policy ****Come From?**

**Only for user/computer, not groups**
**Policy is inherited**
**“****Closer” settings override “farther” ones**

## Why Policies are Good

**Policies don’t “tattoo...” when a GPO no longer applies, these registry settings are removed**
**Policies refresh locally (unless the GPO changes)**

## Delegating Control Of Group Policy

**If OU administrators have trouble managing group policy, check their permissions**
**Managing GPO links on a SDOU**
**Creating GPOs**
**Editing GPOs**

## Group Policy Reference

## Modifying Inheritance

**No Override**** prevents child containers from overriding policies set at higher levels**
**Block Inheritance**** prevents inheritance ****of all policies from parent containers**
**Highest ****No Override**** takes precedence ****over lower ****No Overrides**
**No Override**** takes precedence ****over ****Block Inheritance**

## What If An SDOU Is Linked To Multiple GPOs?

**What If An SDOU Is Linked To Multiple GPOs?**

**Higher GPOs override lower GPOs**
**GPOs are processed in the reverse order listed ****on the tab**

## What If I Don’t Want Everyone InAn OU To Be Affected By A GPO?

**You *****cannot***** link a GPO to a security group**
**You can “filter” GPOs by changing the default permissions on the GPO, using security groups**
**You need the Read ****and**** Apply Group Policy ACEs to have a GPO apply**
**You need Read and Write in order to ****read**** or modify a GPO**

## Demonstration Active Directory Users & Computers Management ConsoleDelegation of AdministrationGroup Policy 

**Notes:**
Now I’d like to demonstrate how to create users and groups using the Administrative Tools in Windows 2000.

## Group Policy Results 

**Gpresult.exe command-line tool displays general info on**
**OS Type, Build, and Terminal Services status**
**User name, AD location, domain name/type, profile type/location, security group membership**
**Computer name, AD location, domain name/type, site**

## Group Policy Results 

**Gpresult.exe command-line tool displays detailed info on**
**Last time policy applied for user and computer**
**Detailed list of applied GPOs and included extensions**
**Detailed list of registry settings applied (with preferences warning)**
**Detailed list of redirected folders, published and assigned apps, scripts and IPSec settings**

## Group Policy Results 

**Gpresult.exe command-line tool displays no info on**
**Security policies (use SCE)**
**Internet Explorer Maintenance policies**
**EFS Recovery policies**
**Ships with Windows 2000 Resource Kit**

## Gpresult Syntax 

**Gpresult [/v] [/d] [/m] [/u] [/?]**
**/v = verbose mode (GPO, registry settings, redirected folder details)**
**/d = darn verbose (includes binary registry values)**
**/m = machine settings only**
**/u = user settings only**
**/s = software in Add/Remove Programs**
**/? = help**

## Resource Kit Support Tools

**ADSIEDIT****	****	****MMC snap-in for all naming contexts**
**DNSCMD****	****	****Manage DNS, create zones, RRs**
**DSACLS****	****	****Set ACLs on DS objects****	**
**DSASTAT****	****	****Compare directory data**
**LDP****	****	****Graphical LDAP tool**
**MOVETREE****	****Move objects between domains**
**NETDOM****	****	****Manage trusts, join computers **
**NETTEST****	****	****Test end to end network connectivity**
**NLTEST****	****	****Test Secure channel, DC presence**
**NTDSUTIL****	****	****Database, DSA management**
**REPADMIN****	****Check and modify replication**
**REPLMON****	****	****Graphical management of  replication**

**Notes:**
Here’s a list of tools that will help with the upgrade and migration scenarios

## For Additional Information

**Group Policy Whitepaper**
_**[http://www.microsoft.com/windows2000/library/howitworks/management/grouppolicyintro.asp](http://www.microsoft.com/windows2000/library/howitworks/management/grouppolicyintro.asp)**__** **_
**Group Policy Walkthrough**
_**[http://www.microsoft.com/windows2000/library/planning/management/groupsteps.asp](http://www.microsoft.com/windows2000/library/planning/management/groupsteps.asp)**_
**Microsoft Official Curriculum course 1563A: Designing a Change and Configuration Management Infrastructure for Microsoft Windows 2000 Professional**

## For More Information...

**Microsoft****®**** Official Curriculum**
**1264C: Microsoft Windows 2000 First Look**
**1265: Installing and Administering Microsoft Windows 2000**
**1266: Supporting Microsoft Windows 2000**
**1267: Planning and Implementing Active Directory**
**1556: Administering Microsoft Windows 2000**
**1557: Installing and Configuring Microsoft Windows 2000 **
**1558: Advanced Administration for Microsoft Windows 2000**
**1560: Upgrading Support Skills From Microsoft Windows NT Server 4.0 to Windows 2000**
**1561: Designing a Microsoft Windows 2000 Directory Services Infrastructure**

## Questions and Answers