Windows 2000 Active Directory is a notably authoritative and engaging guide to Microsoft's Active Directory (AD). This book can serve as a trustworthy guide for any administrator or developer planning to make the move to the new Windows and this powerful directory standard.

Articulate and technically astute, the author adopts the role of a trusted advisor on the best ways to handle the move from Windows NT 4.0 to Windows 2000, with an expert's view of designing the layout of your company's Active Directory schema. In realistic terms, he shows you how AD can coexist with UNIX directories. The book not only provides a collection of screenshots (though there are hands-on tutorials for specific tasks), but also a nicely in-depth tour of what Internet directories are and what advantages Active Directory offers. The author's case studies on sample domains and organisation units (OUs) for sample companies, including a model global corporation, will help any network administrator cope with the design of even the most complex directories. His hints for limiting "domains" and favouring the more flexible "organisational units" (OUs) will also help administrators think in Windows 2000 terms.

Later sections of the book delve into Active Directory Services Interface (ASDI) scripting using Windows Script Host (WSH), Visual Basic, and even ASPs for browser-based administration. Assuming very little programming background, the author provides tips and sample scripts for a variety of common administrative tasks, such as adding new users, changing passwords and the like. This focus on the practical side of administration rounds out an extremely useful guide to Windows 2000. This technically savvy book can definitely simplify the life of any administrator, manager, or developer upgrading to the latest Windows and who needs to understand and use AD effectively. --Richard Dragan, Amazon.com

At this price, this book will save you hundreds of times its value down the road by helping you plan, implement and use Active Directory properly.

Working with Microsoft's network directory service for the first time can be a headache for system and network administrators, IT professionals, technical project managers, and programmers alike. This authoritative guide is meant to relieve that pain. Instead of going through the graphical user interface screen by screen, O'Reilly's bestselling Active Directory tells you how to design, manage, and maintain a small, medium, or enterprise Active Directory infrastructure.

Fully updated to cover Active Directory for Windows Server 2003 SP1 and R2, this third edition is full of important updates and corrections. It's perfect for all Active Directory administrators, whether you manage a single server or a global multinational with thousands of servers.

Active Directory, 3rd Edition is divided into three parts. Part I introduces much of how Active Directory works, giving you a thorough grounding in its concepts. Some of the topics include Active Directory replication, the schema, application partitions, group policies, and interaction with DNS. Part II details the issues around properly designing the directory infrastructure. Topics include designing the namespace, creating a site topology, designing group policies for locking down client settings, auditing, permissions, backup and recovery, and a look at Microsoft's future direction with Directory Services. Part III covers how to create and manipulate users, groups, printers, and other objects that you may need in your everyday management of Active Directory.

If you want a book that lays bare the design and management of an enterprise or departmental Active Directory, then look no further. Active Directory, 3rd Edition will quickly earn its place among the books you don't want to be without.

Working with Microsoft's network directory service for the first time can be a headache for system and network administrators, IT professionals, technical project managers, and programmers alike. This authoritative guide is meant to relieve that pain. Instead of going through the graphical user interface screen by screen, O'Reilly's bestselling "Active Directory" tells you how to design, manage, and maintain a small, medium, or enterprise Active Directory infrastructure. Fully updated to cover Active Directory for Windows Server 2003 SP1 and R2, this third edition is full of important updates and corrections. It's perfect for all Active Directory administrators, whether you manage a single server or a global multinational with thousands of servers. "Active Directory, 3rd Edition" is divided into three parts. Part I introduces much of how Active Directory works, giving you a thorough grounding in its concepts. Some of the topics include Active Directory replication, the schema, application partitions, group policies, and interaction with DNS. Part II details the issues around properly designing the directory infrastructure.

Topics include designing the namespace, creating a site topology, designing group policies for locking down client settings, auditing, permissions, backup and recovery, and a look at Microsoft's future direction with Directory Services. Part III covers how to create and manipulate users, groups, printers, and other objects that you may need in your everyday management of Active Directory. If you want a book that lays bare the design and management of an enterprise or departmental Active Directory, then look no further. Active Directory, 3rd Edition will quickly earn its place among the books you don't want to be without.

Fully updated to cover Active Directory for Windows Server 2003 SP1 and R2, this third edition is full of important updates and corrections. Discover how to design, manage, and maintain a small, medium, or enterprise Active Directory infrastructure. It's perfect for all Active Directory administrators, whether you manage a single server or a global multinational with thousands of servers.

Joe Richards is a consultant / admin / tool writer who happens to have a secret identity as a Microsoft MVP for Windows Server Directory Services. . His specialty is Directory Services but has "minors" in Security and Active Directory programming. By day he works for a large services/consulting/manufacturing company. He takes time to chat with people on listservs and newsgroups, write about stuff he knows, and whips up various fairly useful tools.

Robbie Allen is a technical leader at Cisco Systems, where he has been involved in the deployment of Active Directory, DNS, DHCP, and several network management solutions. Robbie was named a Windows Server MVP in 2004 and 2005 for his contributions to the Windows community and the publication of several popular O'Reilly books. Robbie is currently studying at MIT in its system design and management program. For more information, see Robbie's web site at www.rallenhome.com.

Alistair G. Lowe-Norris is an Architectural Enterprise Strategy Consultant for Microsoft UK. He worked for Leicester University as the project manager and technical lead of the Rapid Deployment Program for Windows 2000, responsible for rolling out one of the world's largest deployments of Windows 2000 preceding release of the final product. Since 1998 he has been the technical editor and a monthly columnist for the Windows Scripting Solutions magazine and a technical editor and author for Windows & .NET Magazine (previously Windows NT Magazine and Windows 2000 Magazine).

Chapter 14 - Upgrading to Windows Server 2003

The first version of Active Directory with Windows 2000 was surprisingly stable and robust. Microsoft does not have the best track record for initial releases of products, but they must be commended for Windows 2000 Active Directory in terms of its feature rich-ness and reliability. That said, since Active Directory is such a complex and broad technology, there was still much room for improvement. There were some issues with scalability, such as the infamous 5,000-member limit with groups or the 300-site limit, which may have imposed artificial limitations on how you implemented Active Directory. Both of these issues have been resolved in Windows Server 2003. The default security setup with Windows 2000 Active Directory out-of-thebox was not as secure as it should have been. Signed LDAP traffic and other security enhancements have since been added into service packs, but they are provided by default with Windows Server 2003. Finally, manageability was another area that needed work in Active Directory, and in Windows Server 2003 numerous commandline utilities have been added along with some significant improvements to the AD Administrative snap-ins.

We have highlighted a few key areas where Active Directory has been improved in Windows Server 2003, and we?ll describe more new features in the next section. If you already have a Windows 2000 Active Directory infrastructure deployed, your next big decision will be whether and when to upgrade to Windows Server 2003.

Fortunately, the transition to Windows Server 2003 is evolutionary, not revolutionary, as with the migration from Windows NT to Active Directory. In fact, Microsoft?s goal was to make the move to Windows Server 2003 as seamless as possible, and for the most part they have accomplished this. You can introduce Windows Server 2003 domain controllers at any rate you wish into your existing Active Directory environment; they are fully compatible with Windows 2000 domain controllers.

Before you can introduce Windows Server 2003 domain controllers, you must prepare the forest and domains with the ADPrep utility, which primes the forest for new features that will be available once you raise the functional level of the domain or forest.

Functional levels are similar in nature to domain modes in Windows 2000 ActiveDirectory. They allow you to configure different levels of functionality that will be available in the domain or forest based on which operating systems are running on the domain controllers.

Before we cover the upgrade process to Windows Server 2003, we?ll first discuss
some of the major new features in Windows Server 2003 and some of the functionality
differences with Windows 2000. Based on this information, you should be able to prioritize the importance of how quickly you should start migrating.

New Features in Windows Server 2003
While the release of Windows Server 2003 is viewed as evolutionary, there are quite a few new features that make the upgrade attractive.

By "feature" we mean new functionality that is not just a modification of the way it worked in Windows 2000. In this sense, a feature is something you have to use or implement explicitly. Functionality differences with Windows 2000 are covered in the next section.

We suggest you carefully review each of these features and rate them according to the following categories:

1. You would use the feature immediately.
2. You would use the feature eventually.
3. You would never use the feature or it is not important.

Rating each feature will help you determine how much you could benefit from the upgrade. The following is the list of new features, in no particular order:

Application partitions
You can create partitions that can replicate to any domain controller in the forest.

Concurrent LDAP binds
Concurrent LDAP binds do not generate a Kerberos ticket and security token and are therefore much faster than a simple LDAP bind.

Cross-forest trust
This is a transitive trust that allows all the domains in two different forests to trust each other via a single trust defined between two forest root domains.

Domain controller rename
The rename procedure for domain controllers requires a single reboot.

Domain rename
Domains can now be renamed, but not without significant impact to the user base (e.g. all member computers must be rebooted twice.

Dynamic auxiliary classes
There is now support for the standards-based implementation of dynamic auxiliary classes. Under Windows 2000, auxiliary classes are considered "static" because they are statically defined in the schema. With dynamic auxiliary classes, you can link one when creating an object without it being defined in the schema as an auxiliary class for the object?s objectClass.

Dynamic objects
Traditionally, objects are stored in Active Directory until they are explicitly deleted. With dynamic objects, you can create objects that have a time to live (TTL) value that dictates when they will be automatically deleted unless refreshed.

Install from media
A much-needed feature allows replica domain controllers to be promoted into a forest using a backup from another domain controller. This can greatly decrease the amount of time it takes to promote domain controllers in large domains.

MMC and CLI enhancements
The Active Directory Users and Computers (ADUC) tool has been enhanced to allow multiselect of objects; other tools such as repadmin and netdom have new options.

New DS CLI tools
A new set of CLI tools provides greater flexibility with managing Active Directory from a commandline. These tools include dsadd, dsmod, dsrm, dsget and dsquery.

New GPO settings
Over 100 new GPO settings have been added, providing greater flexibility in managing Active Directory clients.

GPO RSoP
Resultant Set of Policy (RSoP) has been built into ADUC and can be fully utilized with the Group Policy Management Console (GPMC). RSoP allows administrators to determine what settings of GPOs will be applied to end users and computers.

TLS support
With Windows 2000, only SSL was supported to encrypt traffic over the wire. TLS, the latest standards-based approach for encrypting LDAP traffic, is now also supported.

2005-10-03 O'Reilly does it again.

As a departmental administrator in a global multinational system with many servers, I found this book useful to get you off the ground and keep going. The concept of Windows 2000 Active directory is not intuitive and requires the use of this book or similar material to understand and maintain the system properly. IBM can supply sufficient training and training material; there comes a time when you need to see the information from a different perspective. This different perspective is given in this book.
If windows 2000 Active Directory is totally new to you or if you are used to NT, Novell, or Unix systems then you may want to read "Active Directory for Dummies" ISBN: 0764506595 first for the over all changes that use the same vocabulary to mean completely different concepts.