Windows 2000 Server Architecture and Planning, 2nd edition
Authors: Morten Strunge Nielsen
Venue:  (2000)

From the Book:Not Just Any Revolution You don't have to be an avid Web surfer of the Microsoft Web pages, or a technophile to have heard about Windows 2000 Server. And no, the declarations by Microsoft and a large proportion of the IT press that Windows 2000 is a revolutionary improvement on the Windows NT technology aren't just shallow promotional talk. Windows 2000 Server will be a revolutionary experience for you if you fully exploit its Active Directory features. And, as evidenced by history, revolutions should not be taken lightly if you want to keep your head-or, in today's pacifist environment, your job. Why Active Directory Is so Important If you're used to working with Windows NT Server-style domains, directory services will indeed turn your world upside down-and will most certainly cost you an obscene amount of time to put everything back into place. But all your efforts should pay off quite handsomely, because you will have prepared your organization for the directory services future. In fact, the future has been headed in the direction of directory services ever since X.500, NDS, and Exchange Server. I still feel that everybody was right to call Novell's NDS a breakthrough for computing when it was released back in 1993. There was just one precious thing missing from Novell's directory services: the unequivocal backing from a fair percentage of their customers, as well as Independent Software Vendors (ISVs) and hardware manufacturers. The whole point of a directory service is to ease the management and integration of all kinds of corporate applications and platforms. Unfortunately, Novell never managed to persuade the major application developers and operating system providers to build the necessary NDS hooks into their products, which is what makes the whole directory services notion shine. This is exactly why I feel confident that Active Directory-and Windows 2000 Server-will become a much bigger success than you can currently see from the sales figures. Microsoft is firmly in control of the client platforms, and it has already hooked up with so many different application developers and suppliers of different hardware components, that a very broad support of Active Directory will develop inside the next few years. And just as support from third-parties proved to be one of the reasons for Novell's relative fiasco with NDS, it will likely prove to be the basis of the success of Windows 2000. So, please do not be narrow-minded when you look at the concept of directory services, which I will introduce in Chapter 3. Actually, easier user management is only the tip of the iceberg when it comes to the wide-ranging benefits of directory services. I am quite certain that we all will be amazed by the power and potential of directory services, when a significant percentage of the current NT Server 4 installations have migrated to Windows 2000 Server. Knowledge Counts, but Experience Is Everything Right now, chances are fairly good that you will prove almost as lacking in knowledge and experience with regard to Active Directory, as I was when I set out to implement my first large directory services-based network. I had been reading a lot about Novell's NDS and directory services in general, but nothing had actually prepared me for the real thing. You are pretty much left in the same situation as I once was, no matter how experienced you may be with Windows NT Server, because your NT experience simply doesn't apply to Active Directory. Your current NT know-how will primarily help you ease the transition when part of your environment is still running on NT 4. In fact, in moving from a current NT environment to Active Directory, the only useful knowledge is that which you've acquired in your experience with Exchange (or Novell's NDS or Banyan's StreetTalk). However, the skill set used with Exchange Server 5.5 is still a far cry from what you will need for Active Directory. So, please, take some advice from a man who has been there before. You need to understand Active Directory and get all the experience you can before venturing into the world of directory services. Second, you should not underestimate the time and complexity of doing it-which is exactly why Windows 2000 Server has been off to a relatively slow start (sales-wise), and why you should get started today, in order to get finished not too many years from now. I can't advise strongly enough to plan for Active Directory today. When you get into the planning phase, it might be necessary to carry out some fairly radical adjustments or changes within the IT organization. It's advisable to address-and tackle-these issues from the outset, because it won't get any easier later on. By ensuring that all decisions starting today take the Active Directory fundamentals into account, you might be able to avoid some of the worst migration woes, and reap all the directory services rewards for your company. Getting the Most Out of this Book Anyone who has a working knowledge of Windows NT will be able to profit from the information delivered in this book. But do not be mistaken. This book is written with computer professionals in mind. IT strategists, IT planners, IT designers, and current administrators with a working knowledge of Windows NT-or a wish to achieve this knowledge-are the ones who will get the most from the book. This book can also help maximize your returns if you are planning to become a Microsoft Certified Systems Engineer (MCSE), because it covers the full curriculum for the Microsoft Certified Professional exams "Designing a Microsoft Windows 2000 Directory Services Infrastructure" (70-219), and "Upgrading from Microsoft Windows NT 4.0 to Microsoft Windows 2000" (70-222). The courses for passing MCP exams 70-219 and 70-222 are Designing a Microsoft Windows 2000 Directory Services Infrastructure (MOC 1561), and Designing a Microsoft Windows 2000 Upgrade Strategy (MOC 2010), respectively. However, you should understand that the overriding focus of this book is to provide you with all the theoretical and real-life experiences needed to get safely through the planning and designing of Active Directory. Thus, it's quite likely that you'll be able to pass the two above-mentioned tests just from studying this book carefully. But you might want to supplement this book with the applicable Exam Crams in order to be on the safe side, because Microsoft does tend to refine their MCP exams over time-and the Exam Crams will allow you to check out the exact curriculum, and pit yourself against a fair number of the probable questions. Also, this book actually goes well beyond the curriculum for the two exams, which together represent five course days-it's really only the base information provided here that will prove of relevance to passing the exams, as all the tiny details seem to be too practical to be covered by a curriculum. So chances are that you will be able to pass the two tests without understanding every little detail covered in this book. But I would like to stress that you will do well to heed all of the advice provided throughout this book, because it's based on my experience with putting Active Directory solutions into life, and as such should prove to be very useful when you need to put your own Active Directory knowledge to work afterwards. As any MCP will know: It's one thing to pass the exams, but it's quite another thing to accomplish a successful design and implementation of a complex infrastructure solution. Understanding the Book The aim of this book is to give you a thorough understanding of Microsoft Windows 2000 Server from a design and planning perspective. The implication of this is that virtually everything I will explore in deeper detail is seen from the perspective of Active Directory. This book is divided into five parts: Part I, "Overview"-Chapters 1 and 2 give a rundown on all the major capabilities and features of Windows 2000 (all editions from Professional to Datacenter Server), and some marketplace background relevant to Windows 2000. Part II, "Planning"-Chapters 3 through 13 initiate a very thorough discussion of all the major new Active Directory features of Windows 2000 Server that are of interest to a reader who needs to understand the finer points of Windows 2000 Server architecture. You should also take a look at Appendix B that provides you with a couple of Active Directory design cases. Part III, "Advanced Planning Topics"-Chapters 14 through 16 include a discussion of the advanced planning tasks that will be of interest to enterprise planners and security specialists, among others. Part IV, "Testing"-Chapters 17 through 20 provide an introduction to installing Windows 2000 Server and implementing Active Directory for testing purposes. And believe me: You will definitely want to take a look at Chapter 20, which includes a lot of advice on how to optimize your design for just about any situation. Part V, "Fitting into a Current Infrastructure"-Chapters 21 through 23 (including Appendix B) frame an advanced discussion on how to plan for Windows 2000 Server today, integrating with Windows 2000 Server, and doing full or partial migration to Windows 2000. This part is rounded off with an appendix, which describes the Windows 2000 Server migration project basics. Guiding You through the Book As I pointed out already, the book starts out with two chapters that supply you with a broader view of the marketplace in which Windows 2000 is introduced. The first chapter focuses on the market situation-today and in the years to come-which will prove to be of great consequence to Windows 2000 Server and all IT professionals. The next chapter provides a full-fledged introduction to all the features and capabilities of Windows 2000 Server. After that, you have reached the "introduction" to the very heart of the book. That is, while Chapter 6 through 12 really constitute the heart of the book, which will provide you with all necessary knowledge about the finer details of Active Directory, Chapters 3 through 5 will prove invaluable for getting an overview of all the Active Directory constituents, and thus getting more in-depth with the planning of the major properties of the directory. Chapter 3 gives an introduction to directory services in general; Chapters 4 and 5 will start you off by introducing the key features and building blocks of Active Directory. You should be able to skip Chapters 3 through 5 if you already have been introduced to Active Directory on several occasions, because these chapters are only there to provide you with an overview before you head into each of the areas. Also, you might want to note that Chapters 4 and 5 will prove fairly tough reading: They represent an Active Directory crash-course, so please don't get turned off by reading those two chapters. Everything will get so much better (and easier to understand) after them. With Chapter 6, you get some of the "real" planning know-how intertwined with the presentation of Active Directory. Chapter 6 is about analyzing the organizational and physical settings for Active Directory, which will be the lifeblood of any successful implementation of directory services. Chapter 7 delves into DDNS and DHCP (and WINS), which are crucial prerequisites of a working Active Directory. The fact that I have yet to meet a person with a PC-only background, that really is very hardcore in the DNS area, has caused this chapter to grow rather large. Chapter 8 is about the planning of the domain structure (including OUs and delegation of administration); Chapter 9 puts the planning of user accounts and groups into play. And Chapter 10 delves deep into the intricacies of the new Delegation of Administration and Group Policies features. Chapter 11 focuses on planning directories that have more than one domain (that is, directories that include several domains or domain trees). Chapter 12 looks at the planning of the physical infrastructure, which will ensure that Active Directory does not run amok on the network. And then the whole Active Directory "base" planning section is sealed off with Chapter 13, which provides a very brief review of the most important lessons and best practices from the different parts of the planning phase. Chapter 14 goes on to tackle the many new security features and challenges, including a discussion on Active Directory security, Kerberos, IPSEC, EFS, and Certificate Services. Chapter 15 provides you with the lowdown on how to get Exchange Server 5.5 integrated into your Active Directory-and how to move from this point to Exchange 2000 Server. Chapter 16 gives insight into the subject of Active Directory-aware applications. Although much more can-and will-be said on this important subject, this chapter should put you in a great position to delve further into this topic with your enterprise's own mission-critical applications. Now you've come to the testing phase. Chapter 17 gives the necessary information for installing Windows 2000 Server and implementing a single Active Directory domain with OUs (Organizational Units) and the most common objects. And in Chapter 18 you get a crash course on the most useful "advanced" Active Directory topics, such as creating sites, implementing Group Policies and administrative delegation, and much more. In Chapter 19 you learn how to plan for, prepare, and ultimately modify the directory schema. Chapter 20 teaches you how to assess the database size and replication load generated in your Active Directory environment, as well as how to optimize Active Directory for just about any LAN or WAN scenario. The last three chapters (21 through 23) focus on how to fit Active Directory into your current infrastructure. Chapter 21 details how you can implement new platform solutions today with your sights set on Windows 2000 Server and Active Directory. Chapter 22 provides you with detailed insight into how to migrate your current NT Server platforms to Active Directory. Chapter 23 lays out your possibilities for short-term or long-term coexistence with regard to today's most prevalent legacy server platforms and client platforms, with special emphasis on DNS and other networking issues. Finally, Appendix A supplies you with the outline of a project plan for pre-planning, design, prototyping, building, testing, and implementing for Windows 2000 Server/Active Directory, and Appendix B presents you with a small handful of educative Active Directory design cases from the real world-which hopefully will work to give you a bit of inspiration for your own designs. Appendix C provides a quick glimpse into the next release of Windows 2000 Server, the Whistler version. I Already Have the Book: What's New? The fact that this is a second edition means that I've fixed a number of small errors and omissions from the original book. And I've also had the privilege of updating things that did change from the beta version of Windows 2000 to the finalized version of Windows 2000 (including Service Pack 1). But that's not all: This book also includes a host of new material-much of it based on my practical experiences with Active Directory-that has mostly been integrated into the existing chapters. And it's not just window dressing: This new material has made the book more than one-third larger than the original. In order to make it easier on all of you who have purchased the first edition, here is a rundown on the major changes and additions found in the second edition of Windows 2000 Server Architecture and Planning: Chapter 7-Includes a lot more practical advice for getting the DNS structure in place (including information on how to handle Active Directory-integrated DDNS, as well as WINS). Chapter 9 and 10-Expand on the former Chapter 9, including more information on the Windows 2000 security fundamentals, as well as more planning and practical advice on Group Policies. Chapter 12-Includes more information on the rather crucial File Replication Service (FRS), adds a section on Distributed File System (DFS), and provides a much more in-depth treatment of Active Directory replication, with a keen eye to the minor details that tend to grow quite crucial in practice. Chapter 14-A new chapter that presents you with an in-depth treatment of all the advanced security options (such as Kerberos, PKI, EFS, and IPSEC) introduced with Windows 2000 Server. Chapter 15-A new chapter that gives you the information needed for how to integrate with Exchange Server 5.5, and the consequences of migrating to Exchange 2000 Server. Chapter 16-A new chapter that provides a treatment of the possibilities brought forward by implementing Active Directory-aware applications. This includes a treatment of Microsoft Metadirectory Services (MMS), which seems destined to become an integral part of Windows 2000 in the next couple of years. Chapter 20-Features a new and very unique section focused on improving your understanding of Windows 2000's network behavior, which provides a lot of suggestions for improving upon the default settings. Chapter 22-Includes a lot of new information on how to migrate from Windows NT Server to Windows 2000 Server. This includes an in-depth treatment of the crucial Active Directory Migration Tool (ADMT), available for free from Microsoft. Chapter 23-Includes new information on migration and coexistence with non-Microsoft environments, especially Unix and Novell. Appendix B-A new appendix that provides you with some very interesting examples of Active Directory designs for companies of very different sizes. Appendix C-A short preview of what type of changes you should expect to Active Directory, when moving forward to the next release of Windows 2000 Server (this being the Whistler version). With the rather large improvements in depth, as well as breadth of treatment, I feel fully confident that this book does represent the "bible" to design and planning for Windows 2000 Server-and as such, most of you probably won't be able to find any other books that will get close to the completeness and quality of this one. But, well, enough about that. Let's all get started on the actual book. The Very Last Words In case you should come across any errors or shortcomings in this book, please let me know. I can be reached at morten@strunge.com. My new Web presence can be found at www.strunge.com. To all of you sitting out there, I hope you will enjoy reading this book just as much as I've (mostly) enjoyed writing it. Morten Strunge Nielsen December 3rd, 2000 The ACM Portal is published by the Association for Computing Machinery. Copyright © 2010 ACM, Inc. Terms of Usage Privacy Policy Code of Ethics Contact Us Useful downloads: Adobe Acrobat QuickTime Windows Media Player Real Player