Windows 2000 Active Directory

The book addresses systems administrators, both those who are evaluating Windows 2000 trying to understand the design issues involved as well as those who will be using Windows 2000 on a daily basis. As Active Directory is a new technology for Windows, Windows 2000 Active Directory provides a solid foundation in AD basics and it describes how to use it effectively.

This book is divided into three sections:

• The Basics, which provides an overview of the Active Directory technology and a detailed introduction to AD features.
• Design, which describes mapping your organization's typology into the Active Directory schema; specific topics include the AD namespace and DNS, AD objects such as sites and domains, replication, group policies, and migration issues.
• Scripting, which covers the powerful capabilities of the Active Directory Services Interface (ADSI), including ADSI's use with ActiveX Data Objects (ADO),Active Server Pages (ASP), and Visual Basic (VB).

Written by a participant in the Windows 2000 Rapid Deployment Program, Windows 2000 Active Directory focuses on the practical, hands-on information you need to manage your site. Instead of a screen-by-screen description of the graphical user interface, this book focuses on the tasks you need to perform to manage your organization's directory effectively. The heavy emphasis on scripting with the ADSI will help you automate tasks to achieve greater reliability and save time. Windows 2000 Active Directory is a practical guide to the new technology for the overworked system or network administrator.

Table of contents

Preface

I: The Basics

1: A Brief Introduction

Major Features

How Objects Are Stored in Active Directory

Uniquely Identifying Objects

Summary

2: Active Directory Overview

A Simple View of How It All Works

A More Detailed View of How It All Works

Windows NT Versus Windows 2000

Summary

3: Active Directory Schema

The Structure of the Schema

Attribute Classes (Attribute-Schema Objects)

The Syntax of Attributes

Object Classes (Class-Schema Objects)

Summary

4: Active Directory Replication

Sites

Data Replication

Summary

5: TCP/IP and DDNS

How TCP/IP and DDNS Are Used

How You Already Use TCP/IP and DNS

Integrated DNS

How DNS Affects Design

Summary

II: Designing the Directory Hierarchy

6: Designing the Namespace

The Complexities of a Design

Where to Start

Overview of the Design Process

Domain Namespace Design

Design of the Internal Domain Structure

Other Design Considerations

Design Examples

Designing for the Real World

Summary

7: Sites and Replication Topologies

Intrasite and Intersite Topologies

Designing Sites and Links for Replication

Examples

Summary

8: Profiles and Group Policy Primer

A Profile Primer

Capabilities of GPOs

Summary

9: Designing Organization-Wide Policies

How Windows 2000 GPOs Work

Using the Group Policy Editor Tool

Using GPOs to Help Design the Organizational Unit Structure

Debugging Group Policies

Summary

10: Active Directory Security: Permissions and Auditing

Using Windows 2000's GUI to Examine Permissions

Using Windows 2000's GUI to Examine Auditing

Designing Permission Schemes

Designing Auditing Schemes

Real-World Examples

Summary

11: Designing Schema Changes

Nominating Responsible People in Your Organization

Thinking of Changing the Schema

Managing and Modifying the Schema

Wreaking Havoc with Your Schema

Summary

12: Windows NT 4.0 Migration

Consolidating, Migrating, and Upgrading from NT

The Principles of Upgrading Windows NT Domains

Summary

13: Directory Interoperability

Background to Interoperability with Other Directory Services

Solutions for Interoperability with Other Directory Services

Exchange and the Active Directory Connector

A Word About Windows 2000 and Unix

Summary

III: Scripting the Active Directory with ADSI

14: Scripting with ADSI

What Are All These Buzzwords?

Writing and Running ADSI Scripts Under Windows 2000

ADSI

Simple Manipulation of ADSI Objects

Summary

15: IADs and the Property Cache

The IADs Properties

Manipulating the Property Cache

Checking For Errors in VBScript

Summary

16: Users

Creating a Standard User Account

Creating a Fully Featured User Account

Creating Many User Accounts

Creating an Account Unlocker Utility

Automatically Creating Exchange Mailboxes for Users

Summary

17: Manipulating Persistent and Dynamic Objects

The Interface Methods and Properties

Manipulating Services with ADSI

Creating and Manipulating Shares with ADSI

Enumerating Sessions and Resources

Manipulating Print Queues and Print Jobs

Summary

18: Permissions and Auditing

How to Create an ACE Using ADSI

A Simple ADSI Example

A Complex ACE Example

Creating Security Descriptors

Listing ACEs to a File for All Objects in an OU and Below

Adding Many USER Groups to DRUP Groups

Summary

19: Extending the Schema and the GUI

Modifying the Schema with ADSI

Extending Active Directory GUI to Meet Business and

Organizational Needs

Summary

20: Enhancing ADSI via an ASP or VB Interface

VBScript Limitations and Solutions

How to Avoid Problems When Using ADSI and ASP

Combining VBScript and HTML

Binding to Objects via Authentication

Migrating Your ADSI Scripts from VBScript to VB

Summary

21: Scripting Fast Searches Using ADO

The First Search

Other Ways of Connecting and Retrieving Results

Understanding Search Filters

Incorporating Searches into Active Server Pages

A Significant Problem

A More Advanced Search Function-SearchAD

Summary

Index