Active Directory Bible

Contents

Part I: Planning an Active Directory Deployment 1

Chapter 1: Introduction to Active Directory Technology and
Deployment Planning 3
What Is a Directory? 3
What Is a Directory Service? 4
What Does the Active Directory Do? 4
Active Directory Logical Structure 6
DNS and LDAP 9
Windows 2000 Domain Controllers 11
Global catalog servers 12
Multimaster roles 13
The Active Directory Schema 14
Planning an Active Directory Deployment 15
Gather business data 16
Consider IT management structure 17
Examine your physical locations 17
Examine employee distribution 17
Gather network topology data 17
Study network services 17
Explore protocol usage 18
Consider computer hardware 18

Chapter 2: The Active Directory Namespace 19
What Is a Namespace? 19
Exploring the DNS Namespace 20
Issues with DNS Planning 24
Service Location Records 24
Dynamic Update Protocol 25
DHCP updates 25
Incremental zone transfers 25
The Active Directory Domain Hierarchy 26
Designing the Root Domain 26
Permanent considerations with the root domain 27
Options and considerations with the Internet 29
Planning Summary 34

Chapter 3: Planning an Active Directory Structure 35
Active Directory Domains 35
Domains under Windows NT 35
Building domain trees 36
Using multiple domain trees 41
Using multiple forests 43
Understanding transitive trusts 43
Revisiting domain controllers 48
Planning Your Domain Structure 52
Understanding Organizational Unit Structure 55
Understanding the OU hierarchy 55
OU administrative functions 57
Problems with nested OUs 57
Planning Your Organizational Unit Structure 58

Chapter 4: Upgrading and Migrating to the Active Directory 61
Upgrading to the Active Directory 61
Upgrading NT to 2000 62
Getting ready to upgrade the PDC to 2000 63
Using the Active Directory Sizer 64
Considering domain consolidation 65
Migrating to the Active Directory 77

Chapter 5: Planning Active Directory Sites 79
What Is a Site? 79
Sites and Domains 80
Why Are Sites Necessary? 82
User traffic 83
Replication traffic 84
Understanding Site Links 88
Cost 89
Frequency 90
Schedule 91
Understanding the Bridgehead Server 91
Understanding Site Link Bridges 93
Sites and Server Placement 94
Final Planning Considerations 95

Part II: Implementing the Active Directory 97

Chapter 6: Installing the Root Domain 99
Examining Domain Controllers 99
How Do I Install the Root Domain? 101
Installation Requirements 102
Installing the Root Domain 106

Chapter 7: Setting Up Resources 117
Installing Additional Domain Controllers 117
Creating Child Domains 120
Creating Grandchild Domains 124
Creating a New Tree in an Existing Forest 125
Operations Master Placement 128
Global catalog server 129
Domain naming master 131
Infrastructure master 133
RID master 135
PDC Emulator 136
Uninstalling the Active Directory 138

Chapter 8: Configuring Active Directory Domains and Sites 145
Configuring Domains and Trusts 145
Managing a domain 146
Changing from mixed to native mode 146
Trust relationships 149
Adding UPN suffixes 152
Configuring Active Directory Sites and Services 152
Creating a new site 153
Defining a site subnet 155
Moving domain controllers into a site 156
Selecting a licensing computer for a site 157
Configuring site links 158
Assigning a bridgehead server 163
Configuring site link bridges 164

Chapter 9: Setting Up Users, Groups, and Computers 167
Creating and Managing User Accounts 167
Creating user accounts 170
Configuring user account properties 173
Other user account management options 183
Creating and Managing Group Accounts 184
Creating a new group account 186
Configuring group account properties 187
Other management tasks 189
Examining Computer Accounts 189

Chapter 10: Publishing Resources 191
Setting Up Organizational Units 191
Creating a new OU 192
Configuring OU properties 194
Publishing Contact Objects 196
Creating a contact 197
Configuring contact properties 198
Publishing Printer Objects 201
Publishing printers connected to Windows 2000 computers 202
Publishing printers from downlevel computers 203
Publishing Shared Folders 206
Publishing a shared folder 206
Configuring shared folder properties 207

Chapter 11: Implementing Active Directory Security Features 211
Security Overview 211
Windows Security 212
Advanced permissions 215
Auditing 218
Owner 219
Delegation of Control 220
Configuring Class and Attribute Security 227
Installing the AdminPak 228
Opening the Schema Manager 229
Setting class security 230

Part III: Active Directory Management 233

Chapter 12: Maintaining the Active Directory 235
Backing Up the Active Directory 235
Windows disk fault-tolerant solutions 236
Windows backup strategies 238
Understanding System State Data 239
Performing a Backup 240
Restoring Active Directory Data 246
Performing an Authoritative Restore 249
Using the Recovery Console 251
Common Maintenance Issues 253
Checking the LostAndFound container 255
Online and offline defragmentation 256
Removing ghost objects 256

Chapter 13: Managing Active Directory Replication 259
How Replication Works 259
Replication concepts 260
The Replication process 265
Solving replication problems 265
Examining Intrasite Replication 267
Examining Intersite Replication 268
Forcing replication 270
Manual connection creation 271
Using Replication Monitor 274
Adding a monitored server 275
Domain controller replication errors 277
Server monitoring 277
Server properties 279
Replication Monitor options 282

Chapter 14: Active Directory Schema 285
Schema Overview 285
Planning for Schema Modification 288
Protection process 289
Issues with inheritance 290
Schema Modification Tools 290
Using the Schema Manager 290
Using ADSI 298

Part IV: Integrating Supporting Technologies 301

Chapter 15: Implementing IntelliMirror and Group Policy 303
Understanding IntelliMirror 303
Offline files 305
Synchronization Manager 306
Windows Installer 308
Disk quotas 308
Remote Installation Services 311
Installing RIS 312
Setting up RIS 312
RIS server properties 314
Prestaging RIS clients 316
Creating a client boot floppy 317
Group Policy 318
Group Policy basics 318
Group Policy objects 320
Accessing a Group Policy 320
Configuring a Group Policy 324
Computer Configuration 324
User Configuration 329

Chapter 16: Implementing Distributed File System and
Indexing Service 331
Understanding Distributed File System (Dfs) 331
Standalone Dfs 335
Adding Dfs links 338
Creating a replica 339
Active Directory Integrated Dfs 340
Indexing Service 341
Installing Indexing Service 342
Indexing Service catalogs 343
Managing the Indexing Service 346

Chapter 17: Connecting Exchange Server and the Active Directory 349
Exchange and the Active Directory 349
Exchange 5.5 and the Active Directory 350
Exchange 2000 and the Active Directory 351
Installing the Active Directory Connector 353
Configuring Connector Management Properties 356
Creating and Configuring Connection Agreements 357
ADC Properties 364
Using Multiple ADC Servers 365
Synchronizaton with the ADC 366

Chapter 18: Implementing Microsoft DNS 369
Understanding DNS 369
The DNS namespace 370
How name resolution works 372
Understanding DNS zones 376
Understanding Dynamic DNS 377
Installing DNS 378
Creating Forward and Reverse Lookup Zones 379
Creating a new forward lookup zone 379
Creating a reverse lookup zone 381
Managing the DNS Server 382
Interfaces tab 383
Forwarders tab 384
Advanced tab 384
Root Hints tab 386
Logging tab 386
Monitoring tab 386
Managing DNS Zones 388
Host records 388
Alias records 389
Mail Exchanger records 389
Other records 390
Zone properties 392
Final DNS Tips 396

Appendix A: What's on the CD-ROM 399

Appendix B: Microsoft Management Console Tutorial 401

Appendix C: Additional Administrative Tools 417

Appendix D: PDC and BDC Upgrade Reference 449

Appendix E: Windows 2000 Deployment Strategies 459

Appendix F: Schema Class and Attribute Reference 491

Index 549

End-User License Agreement 574

CD-ROM Installation Instructions 578