Cover Page

Cover
Copyright © 2002 by Microsoft Corporation


LOC

PUBLISHED BY
Microsoft Press
A Division of Microsoft Corporation
One Microsoft Way
Redmond, Washington 98052-6399

Copyright © 2002 by Microsoft Corporation.

All rights reserved. No part of the contents of this book may be reproduced or transmitted in any form or by any means without the written permission of the publisher.

Library of Congress Cataloging-in-Publication Data
MCSA Training Kit : Managing a Microsoft Windows 2000 Network Environment (Exam
70-218) / Microsoft Corporation.
p. cm.
Includes index.
ISBN 0-7356-1581-0
1. Electronic data processing personnel--Certification. 2. Microsoft
software--Examinations--Study guides. 3. Microsoft Windows (Computer file). I.
Microsoft Corporation.

QA76.3 .M3266 2002
005.4'4769--dc21 2001057971

Printed and bound in the United States of America.

1 2 3 4 5 6 7 8 9 QWT 7 6 5 4 3 2

Distributed in Canada by Penguin Books Canada Limited.

A CIP catalogue record for this book is available from the British Library.

Microsoft Press books are available through booksellers and distributors worldwide. For further informa-tion about international editions, contact your local Microsoft Corporation office or contact Microsoft Press International directly at fax (425) 936-7329. Visit our Web site at www.microsoft.com/mspress. Send comments to tkinput@microsoft.com.

ActiveDirectory, ActiveX, FrontPage, JScript, Microsoft, Microsoft Press, MS-DOS, MSDN, NetMeeting, PowerPoint, Visual InterDev, Visual Studio, Windows, and Windows NT are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Other product and company names mentioned herein may be the trademarks of their respective owners.

The example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious. No association with any real company, organiza-tion, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred.

Acquisitions Editor: Thomas Pohlmann
Project Editor: Karen Szall
Author: Craig Zacker

Body Part No. X08-56867


About This Book

Welcome to the MCSA Training Kit: Managing a Microsoft Windows 2000 Network Environment (Exam 70-218).

For more information about becoming a Microsoft Certified Systems Administrator, see the section titled "The Microsoft Certified Professional Program" later in this chapter.

Each chapter in this book is divided into lessons. Most lessons include hands-on procedures that allow you to practice or demonstrate a particular concept or skill. Each lesson ends with a set of review questions to test your knowledge of the lesson material and a short summary of the major points covered in the lesson.

The "Getting Started" section of this introduction provides important setup instructions that describe the hardware and software requirements to complete the procedures in this course. It also provides information about the networking configuration necessary to complete some of the hands-on procedures. Read through this section thoroughly before you start the lessons.


Intended Audience

This book was developed for information technology (IT) professionals who need to design, plan, implement and support a Windows 2000 network environment or who plan to take the related Microsoft Certified Professional exam 70-218, Managing a Microsoft Windows 2000 Network Environment.


Prerequisites

This course has no prerequisites other than a basic knowledge of the Windows 2000 user interface and elementary networking concepts.


About The CD-ROM

The CD-ROM contains a 120-day evaluation edition of Microsoft Windows 2000 Advanced Server.


Features of This Book

Each chapter contains sections that are designed to help you get the most education value from the chapter:

  • Each chapter opens with a "Before You Begin" section, which prepares you for completing the chapter.
  • The chapters are then divided into lessons. Whenever possible, lessons contain exercises (step-by-step procedures) that give you an opportunity to use the skills being presented or explore the part of the application being described.
  • At the end of each lesson is the "Review" section, which allows you to test what you have learned.
  • The review is followed by the "Summary" section, which identifies the key concepts from the lesson.

The Appendix, "Questions and Answers," contains all of the questions asked in each chapter and the corresponding answers.

Notes

Several types of Notes appear throughout the lessons.

  • Notes marked Tip contain explanations of possible results or alternative methods for performing tasks.
  • Notes marked Important contain information that is essential to completing a task.
  • Notes marked Note contain supplemental information.
  • Notes marked Caution contain warnings about possible loss of data.

Conventions

The following conventions are used throughout this book.

Notational Conventions

  • Characters or commands that you type appear in bold type.
  • Italic in syntax statements indicates placeholders for variable information. Italic is also used for book titles.
  • Names of files and folders appear in initial capital letters, except when you are to type them directly. Unless otherwise indicated, you can use lowercase letters when you type a file name in a dialog box or at a command prompt.
  • File name extensions, when they appear without a file name, are in lowercase letters.
  • Acronyms appear in all uppercase letters.
  • Monospace type represents code samples, examples of screen text, or entries that you might type at a command prompt or in initialization files.
  • Square brackets [ ] are used in syntax statements to enclose optional items. For example, [filename] in command syntax indicates that you can choose to type a file name with the command. Type only the information within the brackets, not the brackets themselves.
  • Braces { } are used in syntax statements to enclose required items. Type only the information within the braces, not the braces themselves.
  • Icons represent specific sections in the book as follows:

Icon | Represents
 | A hands-on exercise. You should perform the exercise to give yourself an opportunity to use the skills being presented in the lesson.
 | Lesson review questions. These questions at the end of each lesson allow you to test what you have learned in the lessons. You will find the answers to the review questions in the Appendix, "Questions and Answers," at the end of the book.

Keyboard Conventions

  • A plus sign (+) between two key names means that you must press those keys at the same time. For example, "Press Alt+Tab" means that you hold down Alt while you press Tab.
  • A comma ( , ) between two or more key names means that you must press each of the keys consecutively, not together. For example, "Press Alt, F, X" means that you press and release each key in sequence. "Press Alt+W, L" means that you first press Alt and W at the same time, and then release them and press L.
  • You can choose menu commands with the keyboard. Press the Alt key to activate the menu bar, and then sequentially press the keys that correspond to the highlighted or underlined letter of the menu name and the command name. For some commands, you can also press a key combination listed in the menu.
  • You can select or clear check boxes or option buttons in dialog boxes with the keyboard. Press the Alt key, and then press the key that corresponds to the underlined letter of the option name. Or you can press Tab until the option is highlighted, and then press the spacebar to select or clear the check box or option button.
  • You can cancel the display of a dialog box by pressing the Esc key.


Chapter and Appendix Overview

This self-paced training course combines notes, hands-on procedures, and review questions to give you the skills you need to manage your Windows 2000 network environment. It is designed to be completed from beginning to end, but you can choose a customized track and complete only the sections that interest you. (See the next section, "Where to Find Specific Skills in This Book," for more information.) If you choose the customized track option, see the "Before You Begin" section in each chapter. Any hands-on procedures that require preliminary work from preceding chapters refer to the appropriate chapters.

The book is divided into the following sections and chapters:

  • The "About This Book" section contains a self-paced training overview and introduces the components of this training. Read this section thoroughly to get the greatest educational value from this self-paced training and to plan which lessons you will complete.
  • Chapter 1, "Networking with Windows 2000," describes the Windows 2000 networking architecture and introduces the primary Windows 2000 network administration tool, Microsoft Management Console.
  • Chapter 2, "Managing Client and Server Computers," examines the procedures for installing new hardware on a Windows 2000 computer, updating the operating system, obtaining and managing client access licenses, and troubleshooting problems that prevent the system from booting.
  • Chapter 3, "Managing Storage Resources," describes how to use the Windows 2000 storage subsystem, including basic and dynamic disks, and the various types of data storage techniques the operating system provides. You also learn how to manage your server disk space by imposing storage quotas on your network users and managing the compression and encryption of files and folders.
  • Chapter 4, "Managing NTFS Permissions," examines how to protect the files stored on your server drives using the permissions provided by the NTFS file system.
  • Chapter 5, "Sharing Drives and Printers," contains procedures for sharing drives and printers with network users and describes how to use permissions to control access to those shared resources.
  • Chapter 6, "Monitoring Server Health and Security," describes how to use Windows 2000 tools such as the Performance console and Event Viewer to monitor the continued operation of your servers and your users' activities.
  • Chapter 7, "Managing Active Directory User and Computer Objects," contains procedures describing how to create and maintain user objects in Active Directory, as well as create the various types of user profiles.
  • Chapter 8, "Managing Active Directory Group Objects," examines the theory and practice behind the use of group objects to organize your users and simplify the process of assigning access permissions.
  • Chapter 9, "Using Group Policies," describes how to use group policies to control the users and computers on your network.
  • Chapter 10, "Managing Resources with Active Directory Service," examines the process of publishing shared folders and printers in Active Directory, redirecting special folders, and using group policies to deploy software on your network.
  • Chapter 11, "Replicating Active Directory," contains information about the Active Directory replication process and how to create and configure site objects and their replication policies.
  • Chapter 12, "Active Directory Service Administration," teaches how to work with Active Directory objects by searching for them, moving them around the directory tree, and delegating control of specific objects to other administrators.
  • Chapter 13, "TCP/IP Administration," introduces the basics of TCP/IP communications and describes how to configure a Microsoft TCP/IP client and use the utilities included with it.
  • Chapter 14, "Dynamic Host Configuration Protocol," explores the theory and practice of using DHCP to automatically assign TCP/IP configuration parameters to the computers on your network.
  • Chapter 15, "Windows Name Resolution," describes the various mechanisms that Windows systems use to resolve computer names into IP addresses, including the Windows Internet Naming System (WINS).
  • Chapter 16, "Domain Name System," introduces the underlying principles of the Domain Name System (DNS) and describes the procedures for deploying Microsoft DNS Server on your network.
  • Chapter 17, "Managing Internet Information Services," describes how to create Web and FTP sites for your intranet or the Internet using Internet Information Services.
  • Chapter 18, "Remote Client Access," examines various alternative methods for connecting users to your network from long distances and with additional security.
  • Chapter 19, "Disaster Recovery and Prevention," describes backing up your network to prevent data loss due to natural disasters, drive failures, viruses, and so on.
  • Appendix, "Questions and Answers," lists all of the exercise questions and review questions from the book, showing the page number where the question appears and the suggested answer.
  • The Glossary provides definitions for many of the terms and concepts presented in this training kit.

Where to Find Specific Skills in This Book

The following tables provide a list of the skills measured on certification exam 70-218, Managing a Microsoft Windows 2000 Network Environment. The table identifies the skill, and where in this book you will find the lesson relating to that skill.

Exam skills are subject to change without prior notice and at the sole discretion of Microsoft.

Creating, Configuring, Managing, Securing, and Troubleshooting File, Print, and Web Resources

Skill Being Measured Location in Book

Publish resources in Active Directory including printers and shared folders.

Chapter 10, Lesson 1;

Chapter 12, Lesson 2

Manage data storage. Considerations include file systems, permissions, and quotas.

Chapter 3, Lessons 1-4;

Chapter 4, Lessons 1-3

Create shared resources and configure access rights. Shared resources include printers, shared folders, and Web folders.

Chapter 5, Lessons 1-5;

Chapter 17, Lesson 2

Configure and troubleshoot Internet Information Services (IIS).

  • Configure virtual directories and virtual servers.
  • Troubleshoot Internet browsing from client computers.
  • Configure authentication and SSL for Web sites.
  • Configure FTP services.

Chapter 17, Lessons 1-4

Monitor and manage network security. Actions include auditing and detecting security breaches.

Chapter 6, Lessons 1-3;

Chapter 9, Lesson 3

Configuring, Administering, and Troubleshooting the Network Infrastructure

Skill Being Measured Location in Book

Troubleshoot routing. Diagnostic utilities include the tracert command, the ping command, and the ipconfig command.

Chapter 13, Lessons 1 and 3

Configure and troubleshoot TCP/IP on servers and client computers. Considerations include subnet masks, default gateways, network Ids, and broadcast addresses.

Chapter 13, Lessons 1-3

Configure, administer, and troubleshoot DHCP on servers and client computers.

  • Detect unauthorized DHCP servers on a network.
  • Configure authorization of DHCP servers.

Chapter 14, Lessons 1-3

Configure, administer, and troubleshoot DNS.

Chapter 16, Lessons 1-4

Troubleshoot name resolution on client computers. Considerations include WINS, DNS, NetBIOS, the Hosts file, and the Lmhosts file.

Chapter 13, Lesson 3;

Chapter 15, Lessons 1-2

Managing, Securing, and Troubleshooting Servers and Client Computers

Skill Being Measured | Location in Book
Install and configure server and client computer hardware. | Chapter 2, Lesson 1
Troubleshoot starting servers and client computers. Tools and methodologies include Safe Mode, Recovery Console, and parallel installations. | Chapter 2, Lesson 4; Chapter 19, Lessons 1-2
Monitor and troubleshoot server health and performance. Tools include System Monitor, Event Viewer, and Task Manager. | Chapter 6, Lessons 1-2
Install and manage Windows 2000 updates. Updates include service packs, hot fixes, and security hot fixes. | Chapter 2, Lesson 2

Configuring, Managing, Securing, and Troubleshooting Active Directory Organizational Units and Group Policy

Skill Being Measured Location in Book

Create, manage, and troubleshoot User and Group objects in Active Directory.

  • Create and configure accounts for new and existing users. Types of accounts include user and computer.
  • Troubleshoot groups. Considerations include nesting, scope, and type.

Chapter 7, Lessons 1-3;

Chapter 8, Lessons 1-4

Manage object and container permissions.

Chapter 12, Lesson 1

Diagnose Active Directory replication problems.

Chapter 11, Lessons 1-3

Deploy software by using Group Policy. Types of software include user applications, antivirus software, line-of-business applications, and software updates.

Chapter 10, Lesson 3

Troubleshoot end-user Group Policy.

Chapter 9, Lessons 3-4

Implement and manage security policies by using Group Policy.

Chapter 9, Lessons 1-3

Configuring, Securing, and Troubleshooting Remote Access

Skill Being Measured | Location in Book
Configure and troubleshoot remote access and virtual private network (VPN) connections. | Chapter 18, Lessons 1-2
Troubleshoot Routing and Remote Access policy. | Chapter 18, Lesson 1
Implement and troubleshoot Terminal Services for remote access. | Chapter 18, Lesson 4
Configure and troubleshoot Network Address Translation (NAT) and Internet Connection Sharing. | Chapter 18, Lesson 3


Getting Started

This self-paced training course contains hands-on procedures to help you learn about managing a Microsoft Windows 2000 Network environment. To complete some of these procedures, you must have two networked computers or be connected to a larger network. Both computers must be capable of running Windows 2000; one of the two must be running Windows 2000 Server or Advanced Server and be capable of functioning as an Active Directory domain controller. The other computer can be running Windows 2000 Professional, Server, or Advanced Server.

Several exercises might require you to make changes to your servers. This might cause undesirable results if you are connected to a larger network. Check with your Network Administrator before attempting these exercises.

Hardware Requirements

Each computer must have the following minimum configuration. All hardware should be on the Microsoft Windows 2000 Hardware Compatibility List.

  • 133 MHz or higher Pentium-compatible CPU
  • 2 GB hard disk
  • 128 MB of RAM
  • VGA monitor (800 x 600 resolution or better recommended)
  • CD-ROM drive
  • Microsoft Mouse or compatible pointing device
  • Modem and telephone line

Software Requirements

You must have two computers. The first computer must be a domain controller and can run Windows 2000 Server or Windows 2000 Advanced Server. The second computer can be running Windows 2000 Server or Windows 2000 Advanced Server.

The following software is required to complete the procedures in this course:

  • Windows 2000 operating system on both computers
  • Windows 2000 Server or Windows 2000 Advanced Server, or Windows 2000 Advanced Server Evaluation Edition

A 120-day evaluation copy of Microsoft Windows 2000 Advanced Server is included on the CD-ROMs in this training kit.

The 120-day Evaluation Edition provided with this training kit is not the full retail product and is provided only for the purposes of training and evaluation. Microsoft Technical Support does not support these evaluation editions. For additional support information regarding this book and the CD-ROMs (including answers to commonly asked questions about installation and use), visit the Microsoft Press Technical Support web site at http://www.microsoft.com/mspress/support/. You can also email TKINPUT@MICROSOFT.COM, or send a letter to Microsoft Press, Attn: Microsoft Press Technical Support, One Microsoft Way, Redmond, WA 98502-6399.

Setup Instructions

Set up your computer according to the manufacturer's instructions.

For the exercises that require networked computers, you need to make sure the computers can communicate with each other. The first computer will be configured as a domain controller.

The second computer will provide the server environment for the procedures.

If your computers are part of a larger network, you must verify with your network administrator that the computer names, domain name, and other information do not conflict with network operations. If they conflict, ask your network administrator to provide alternative values and use those values throughout all of the exercises in this book.


The Microsoft Certified Professional Program

The Microsoft Certified Professional (MCP) program provides the best method to prove your command of current Microsoft products and technologies. Microsoft, an industry leader in certification, is on the forefront of testing methodology. Our exams and corresponding certifications are developed to validate your mastery of critical competencies as you design and develop, or implement and support, solutions with Microsoft products and technologies. Computer professionals who become Microsoft certified are recognized as experts and are sought after industrywide.

The Microsoft Certified Professional program offers multiple certifications, based on specific areas of technical expertise, including:

  • Microsoft Certified Professional (MCP) on Windows 2000. Demonstrated in-depth knowledge of at least one Microsoft Windows operating system or architecturally significant platform. An MCP is qualified to implement a Microsoft product or technology as part of a business solution for an organization.
  • Microsoft Certified Systems Administrator (MCSA) on Microsoft Windows 2000. Individuals who implement, manage, and troubleshoot existing network and system environments based on the Microsoft Windows 2000 and Windows .NET Server operating systems.
  • Microsoft Certified Systems Engineer (MCSE) on Microsoft Windows 2000. Qualified to effectively analyze the business requirements, and design and implement the infrastructure for business solutions based on the Microsoft Windows 2000 platform and Microsoft .NET Enterprise Servers.
  • Microsoft Certified Database Administrator (MCDBA) on Microsoft SQL Server 2000. Individuals who derive physical database designs, develop logical data models, create physical databases, create data services by using Transact-SQL, manage and maintain databases, configure and manage security, monitor and optimize databases, and install and configure Microsoft SQL Server.
  • Microsoft Certified Solution Developer (MCSD). Qualified to design and develop custom business solutions with Microsoft development tools, technologies, and platforms, including Microsoft Windows architecture.
  • Microsoft Certified Trainer (MCT). Instructionally and technically qualified to deliver Microsoft Official Curriculum (MOC) through a Microsoft Certified Technical Education Center (CTEC).

Microsoft Certification Benefits

Microsoft certification, one of the most comprehensive certification programs available for assessing and maintaining software-related skills, is a valuable measure of an individual's knowledge and expertise. Microsoft certification is awarded to individuals who have successfully demonstrated their ability to perform specific tasks and implement solutions with Microsoft products. Not only does this provide an objective measure for employers to consider; it also provides guidance for what an individual should know to be proficient. And as with any skills-assessment and benchmarking measure, certification brings a variety of benefits: to the individual, and to employers and organizations.

Microsoft Certification Benefits for Individuals

As a Microsoft Certified Professional, you receive many benefits:

  • Industry recognition of your knowledge and proficiency with Microsoft products and technologies.
  • A Microsoft Developer Network (MSDN) subscription. MCPs receive rebates or discounts on a one-year subscription to the Microsoft Developer Network (http://msdn.microsoft.com/subscriptions/) during the first year of certification. (Fulfullment details will vary, depending on your location; please see your Welcome Kit.)
  • Access to technical and product information direct from Microsoft through a secured area of the MCP Web site (go to http://www.microsoft.com/traincert/mcp/mcpsecure.asp).
  • Access to exclusive discounts on products and services from selected companies. Individuals who are currently certified can learn more by visiting the MCP secured Web site (go to http://www.microsoft.com/traincert/mcp/mccpsecure.asp and select the "Other Benefits" link).
  • MCP logo, certificate, transcript, wallet card, and lapel pin to identify you as a Microsoft Certified Professional (MCP) to colleagues and clients. Electronic files of logos and transcript may be downloaded from the MCP secured Web site (go to http://www.microsoft.com/traincert/mcp/mcpsecure.asp) upon certification.
  • Invitations to Microsoft conferences, technical training sessions, and special events.
  • Free access to Microsoft Certified Professional Magazine Online, a career and professional development magazine. Secured content on the Microsoft Certified Professional Magazine Online Web site includes the current issue (available only to MCPs), additional online-only content and columns, an MCP-only database, and regular chats with Microsoft and other technical experts.
  • Discount on membership to PASS (for MCPs only), the Professional Association for SQL Server. In addition to playing a key role in the only worldwide, user-run SQL Server user group endorsed by Microsoft, members enjoy unique access to a world of educational opportunities (go to http://www.microsoft.com/traincert/mcp/mcpsecure.asp).

An additional benefit is received by Microsoft Certified System Engineers (MCSEs):

  • A 50 percent rebate or discount off the estimated retail price of a one-year subscription to TechNet or TechNet Plus during the first year of certification. (Fulfillment details will vary, depending on your location. Please see your Welcome Kit.) In addition, about 95 percent of the CD-ROM content is available free online at the TechNet web site (http://www.microsoft.com/technet/).

An additional benefit is received by Microsoft Certified System Database Administrators (MCDBAs):

  • A 50 percent rebate or discount off the estimated retail price of a one-year subscription to TechNet or TechNet Plus during the first year of certification. (Fulfillment details will vary, depending on your location. Please see your Welcome Kit.) In addition, about 95 percent of the CD-ROM content is available free online at the TechNet web site (http://www.microsoft.com/technet/).
  • A one-year subscription to SQL Server Magazine. Written by industry experts, the magazine contains technical and how-to tips and advice-a must for anyone working with SQL Server.

A list of benefits for Microsoft Certified Trainers (MCTs) can be found at http://www.microsoft.com/traincert/mcp/mct/benefits.asp.

Microsoft Certification Benefits for Employers and Organizations

Through certification, computer professionals can maximize the return on investment in Microsoft technology. Research shows that Microsoft certification provides organizations with:

  • Excellent return on training and certification investments by providing a standard method of determining training needs and measuring results.
  • Increased customer satisfaction and decreased support costs through improved service, increased productivity, and greater technical self-sufficiency.
  • Reliable benchmark for hiring, promoting, and career planning.
  • Recognition and rewards for productive employees by validating their expertise.
  • Retraining options for existing employees so they can work effectively with new technologies.
  • Assurance of quality when outsourcing computer services.

Requirements for Becoming a Microsoft Certified Professional

The certification requirements differ for each certification and are specific to the products and job functions addressed by the certification.

To become a Microsoft Certified Professional, you must pass rigorous certification exams that provide a valid and reliable measure of technical proficiency and expertise. These exams are designed to test your expertise and ability to perform a role or task with a product, and are developed with the input of professionals in the industry. Questions in the exams reflect how Microsoft products are used in actual organizations, giving them "real-world" relevance.

  • Microsoft Certified Product candidates are required to pass one operating system exam. Candidates may pass additional Microsoft certification exams to further qualify their skills with other Microsoft products, development tools, or desktop applications.
  • Microsoft Certified Systems Engineers are required to pass five core exams and two elective exams.
  • Microsoft Certified Systems Administrators are required to pass three core exams and one elective exam that provide a valid and reliable measure of technical proficiency and expertise.
  • Microsoft Certified Database Administrators are required to pass three core exams and one elective exam that provide a valid and reliable measure of technical proficiency and expertise.
  • Microsoft Certified Solution Developers are required to pass three core Microsoft Windows operating system technology exams and one elective exam that provide a valid and reliable measure of competency and expertise.
  • Microsoft Certified Trainers are required to meet instructional and technical requirements specific to each Microsoft Official Curriculum course they are certified to deliver. The MCT program requires on-going training to meet the requirements for the annual renewal of the certification. For more information about becoming a Microsoft Certified Trainer, visit http://www.microsoft.com/traincert/mcp/mct/ or contact a regional service center near you.

Technical Training for Computer Professionals

Technical training is available in a variety of ways, with instructor-led classes, online instruction, or self-paced training available at thousands of locations worldwide.

Self-Paced Training

For motivated learners who are ready for the challenge, self-paced instruction is the most flexible, cost-effective way to increase your knowledge and skills.

A full-line of self-paced print and computer-based training materials is available direct from the source-Microsoft Press. Microsoft Official Curriculum courseware kits from Microsoft Press are designed for advanced computer system professionals and are available from Microsoft Press and the Microsoft Developer Division. Self-paced training kits from Microsoft Press feature print-based instructional materials, along with CD-ROM based product software, multimedia presentations, lab exercises, and practice files. The Mastering Series provides in-depth, interactive training on CD-ROM for experienced developers. They're both great ways to prepare for Microsoft Certified Professional (MCP) exams.

Online Training

For a more flexible alternative to instructor-led classes, turn to online instruction. It's as near as the Internet and it's ready whenever you are. Learn at your own pace and on your own schedule in a virtual classroom, often with easy access to an online instructor. Without ever leaving your desk, you can gain the expertise you need. Online instruction covers a variety of Microsoft products and technologies. It includes options ranging from Microsoft Official Curriculum to choices available nowhere else. It's training on demand, with access to learning resources 24 hours a day. Online training is available through Microsoft Certified Technical Education Centers.

Microsoft Certified Technical Education Centers

Microsoft Certified Technical Education Centers (CTECs) are the best source for instructor-led training that can help you prepare to become a Microsoft Certified Professional. The Microsoft CTEC program is a worldwide network of qualified technical training organizations that provide authorized delivery of Microsoft Official Curriculum courses by Microsoft Certified Trainers to computer professionals.

For a listing of CTEC locations in the United States and Canada, visit http://www.microsoft.com/CTEC/.


Technical Support

Every effort has been made to ensure the accuracy of this book and the contents of the companion disc. If you have comments, questions, or ideas regarding this book or the companion disc, please send them to Microsoft Press using either of the following methods:

E-mail

TKINPUT@MICROSOFT.COM

Postal Mail

Microsoft Press
Attn: MCSA Training Kit Series Editor
One Microsoft Way
Redmond, WA 98052-6399

Microsoft Press provides corrections for books through the World Wide Web at the following address:

http://www.microsoft.com/mspress/support/

Please note that product support is not offered through the above mail addresses. For further information regarding Microsoft software support options, please connect to http://www.microsoft.com/support/ or call Microsoft Support Network Sales at (800) 936-3500.


Evaluation Edition Software Support

The Evaluation Edition of Microsoft Windows 2000 Advanced Server included with this book is unsupported by both Microsoft and Microsoft Press, and should not be used on a primary work computer. For online support information relating to the full version of Microsoft Windows 2000 Advanced Server that might also apply to the Evaluation Edition, you can connect to

http://www.microsoft.com/windows2000/advancedserver/default.asp

Information about any issues relating to the use of this evaluation edition with this training kit is posted to the Support section of the Microsoft Press Web site (http://www.microsoft.com/mspress/support/).

For information about ordering the full version of any Microsoft software, please call Microsoft Sales at (800) 426-9400 or visit http://www.microsoft.com.


Networking with Microsoft Windows 2000

About This Chapter

In this chapter, you learn how to manage a Microsoft Windows 2000 network. You begin with a basic knowledge of the operating system's networking architecture and where various components fit into that architecture. Then you learn how to use the Windows 2000 networking tools, including the primary network administration application, called Microsoft Management Console (MMC), to monitor, configure, and manage the operating system's various networking services.

Before You Begin

To perform the exercises in this chapter, you need a computer connected to a local area network (LAN) with Microsoft Windows 2000 Server properly installed and operating.


Lesson 1: Understanding the Windows 2000 Networking Architecture

Networking is one of the primary functions of Windows 2000, and much of the operating system is designed around its networking architecture. When you install the operating system, the Windows setup program can detect the network interface adapter (also called a network interface card, or NIC)-if there is one in the computer-and install a basic network software configuration consisting of a network interface adapter driver, the Client for Microsoft Networks, the File and Printer Sharing for Microsoft Networks service, and the Internet Protocol (TCP/IP) protocol module. These components make up the default configuration that provides basic local area network (LAN) connectivity in Windows 2000.

After this lesson, you will be able to

  • Understand the Windows 2000 networking architecture in relation to the Open Systems Interconnection (OSI) reference model
  • Describe the functions of the four basic types of Windows 2000 networking components
  • Install Windows 2000 networking components

Estimated lesson time: 15 minutes

Windows Networking Components

The client, protocol, and network interface adapter driver modules together form a networking protocol stack that is roughly analogous to the Open Systems Interconnection (OSI) reference model, as shown in Figure 1.1. The network interface adapter and its driver form the physical and data-link layers, the protocol module provides the network and transport layers, and the client module operates at the application layer.

It must be stressed that neither the Windows 2000 networking architecture nor the existing protocols, such as Ethernet and TCP/IP, were designed to conform exactly to the OSI model. The functions provided by the networking components often carry over into other layers. The OSI model is strictly a teaching and reference tool that provides a general idea of the protocol structure on a networked computer; it is not a precise map of its architecture.

The following sections examine each of these types of Windows 2000 networking components in more detail.

Figure 1.1 The OSI reference model and the Windows 2000 networking protocol stack

Client for Microsoft Networks

A Windows 2000 client module provides the computer with connectivity to a specific type of network, enabling applications to access shared resources such as files and printers on other computers. All versions of Windows 2000 include the Client for Microsoft Networks module and install it by default whenever the installation program detects a network interface adapter in the computer. The Client for Microsoft Networks provides the capability to log on to a Windows domain and enables the applications on the computer to view and access resources shared by other Windows computers on the network.

The primary functions of the Client for Microsoft Networks are network file and printer access. Windows 2000 uses the client module when you use My Network Places in Microsoft Windows Explorer to browse the computers on the network or when you use an application such as a word processor to open a file stored on a network drive.

Windows 2000 does not use this type of client module when you use a TCP/IP client application, such as a Web browser, to access a server application, such as a Web or File Transfer Protocol (FTP) server.

The client module integrates network connectivity into the standard Windows file system and printer interfaces. On a stand-alone computer, you can use a word processor to open a file on a local hard drive. When you are connected to a network with a computer that has the Client for Microsoft Networks installed, you can open files on either local or network drives in exactly the same way. This is made possible by a component called a redirector. The redirector is a file system driver, just like those for the NT file system (NTFS) and file allocation table (FAT) file systems that Windows 2000 uses on its local drives, and the Windows Input/Output (I/O) Manager treats it no differently. When the file you are trying to open or the printer you are trying to access is located on the network instead of on the local computer, the I/O Manager sends it to the redirector, which, as the name implies, forwards the file or printer access request to the appropriate network resource. Apart from the slightly different interface you use to browse the network and the slightly slower speed at which the computer might access network resources, the redirection process is invisible to the user.

Microsoft Clients for Novell NetWare

In addition to the Client for Microsoft Networks module, Windows 2000 includes a second client module that is used to access Novell NetWare resources. In Windows 2000 Professional, this module is called the Client Service for NetWare. In Microsoft Windows 2000 Server and Advanced Server, the module is called Gateway Services for NetWare (GSNW). Even though NetWare includes client software for the Windows operating systems, Microsoft supplies its own NetWare client. Client Service for NetWare provides Windows 2000 Professional with basic NetWare file and printer connectivity.

Gateway Services for NetWare not only enables a Windows 2000 Server computer to access NetWare resources but it also enables other Windows network clients to access NetWare resources through the Windows 2000 server, without installing NetWare clients of their own. When you install and enable GSNW, you can create Windows shares out of shared NetWare drives. A computer running Client for Microsoft Networks sees only Windows shares on the Windows 2000 server and can access them as it would any other Windows shares. GSNW is responsible for accessing the NetWare resources using its own client and then furnishing them to the Windows client.

File and Printer Sharing for Microsoft Networks

By itself, the Client for Microsoft Networks module enables the computer to access shared resources on other Windows systems, but it does not enable the computer to share its own resources. To do this requires the installation of the File and Printer Sharing for Microsoft Networks module. By default, Windows 2000 installs this module on a computer with a network interface adapter, but you can remove it if you want to prevent users from accessing shared resources on the computer.

The File and Printer Sharing module is a type of networking component called a service. Services are not essential components of the Windows 2000 networking stack, as clients, protocols, and network interface adapters are. A service, in Windows 2000, is a program that loads early in the system startup process and runs continuously until the computer is shut down or the service is manually stopped. Unlike most applications that load after the user has logged on to the computer, services load before the user logs on. This is why clients can access the shared resources on Windows servers before a user has logged on to the server.

Windows 2000, particularly in its server versions, includes a large number of services that you can install during system setup or any time after system setup. You will learn about many of these services as you work through the lessons in this training kit.

In most cases, you install services using the Windows Components Wizard, which is accessible through Add/Remove Programs on the Control Panel. The File and Printer Sharing for Microsoft Networks service is unusual in that you install it through the Network and Dial-up Connections Control Panel.

TCP/IP

The Windows 2000 protocol modules are primarily responsible for the network and transport layer functions in the OSI model, although they do stretch into the upper layers as well. Although Windows 2000 implements protocols such as TCP/IP as a single module, as shown in Figure 1.2, TCP/IP is actually a suite of protocols that provide a variety of functions ranging from the network to the application layer. In Windows 2000, the Network and Dial-up Connections Control Panel includes an icon for every network connection to a local area network (LAN) or a wide area network (WAN), such as a dial-up modem connection. Networking components such as client and protocol modules are listed in the Properties dialog box for each connection.

Figure 1.2 The Windows 2000 Local Area Connection Properties dialog box

The primary protocols in the TCP/IP suite are the Internet Protocol (IP), which operates at the network layer, and two transport layer protocols: the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP). IP is the protocol responsible for carrying almost all TCP/IP traffic over the network. The two transport layer protocols both work with IP to provide different types of communication services.

Generally speaking, the computer uses the TCP/IP combination to send large amounts of data that have to be broken into many small segments for transmission over a packet switching network, such as an Ethernet LAN. TCP includes functions (for example, guaranteed delivery and flow control) that make this type of communication possible with the precision and reliability needed to transmit program and data files over the network. The computer uses the UDP/IP combination for brief request/response transactions that typically consist of only one packet traveling in each direction, or transactions that do error checking at a higher level in the OSI model.

In addition to TCP, UDP, and IP, the Windows 2000 TCP/IP protocol module also includes a number of application layer protocols, such as FTP and Telnet clients, and a variety of diagnostic utilities, such as Ping and Tracert, that you can use to troubleshoot network communication problems. You will learn more about configuring and troubleshooting TCP/IP in Chapter 13, "TCP/IP Administration."

NetBEUI

TCP/IP is the default protocol module that the Windows 2000 setup program installs automatically when it detects a network interface adapter in the computer. However, this has not always been the case with Microsoft Windows operating systems, and TCP/IP is not the only protocol module supplied with the Windows 2000 operating system. Microsoft Windows NT 3.1 used a protocol called NetBEUI (NetBIOS Extended User Interface) as its default protocol. At the time, networking had only recently been introduced into the Windows product line, and the intention was to support basic functions like file and printer sharing on small LANs.

NetBEUI is an excellent protocol for these purposes; it provides good performance, is self-adjusting, and requires no manual configuration whatsoever. Compared with TCP/IP, NetBEUI is quite simple. However, NetBEUI lacks some of the important features that are needed on most LANs today. First, the Internet is based on the TCP/IP protocols, and a computer running only NetBEUI cannot access Internet services. Second, NetBEUI relies on the NetBIOS (Network Basic Input/Output System) name space to identify the computers on the network. The name that you assign to each computer during the Windows installation is actually a NetBIOS name and this is the only identifier for the computer that NetBEUI uses. NetBEUI also has no means of identifying the network on which a computer is located. This means that the protocol is not routable and is therefore not suitable to use on an internetwork.

IPX

Prior to version 5, Novell NetWare required the use of its own proprietary protocol suite, named after its network layer protocol, Internetwork Packet Exchange (IPX). IPX is a suite of protocols like TCP/IP, but it is designed for use on LANs only, not on the Internet. Unlike TCP/IP, which is based on open standards, the IPX protocol standards are wholly owned by Novell, which has not made them available to other companies. The Windows clients included with the NetWare product contain Novell's implementation of the IPX protocols.

To include the Microsoft clients for NetWare with the Windows operating systems, Microsoft had to provide the IPX protocols as well. To do this, Microsoft created its own version of the IPX protocols, called the NWLink IPX/SPX/NetBIOS Compatible Transport Protocol, which is completely compatible with NetWare networks. While it's possible to use IPX with the Client for Microsoft Networks, this is rare. Windows 2000 typically uses IPX only to communicate with NetWare servers and, now that NetWare 5 contains native support for TCP/IP, Novell is phasing out the IPX protocols.

Transport Driver Interface

As you have seen, Windows 2000 includes three primary protocol modules supporting TCP/IP, NetBEUI, and IPX. You can use any one of these protocol modules for Windows network communications. If you want your network users to have access to the Internet or Internet services on your network, use TCP/IP. If you have Novell NetWare servers on your network, use IPX (unless you are running NetWare 5 in TCP/IP mode). Installing Microsoft Services for Macintosh adds a fourth module for the AppleTalk protocols. You can elect to run any one, two, three, or all four of these protocols on your Windows 2000 Server computer. The component that makes it possible to use multiple protocols on the computer is called the Transport Driver Interface (TDI).

The TDI is the boundary layer between the protocol modules at the top of the transport layer and the clients and application programming interfaces (APIs) operating above the transport layer, as shown in Figure 1.3. Boundary layers standardize the software development process by enabling programmers to create modules with a consistent interface. All of the protocol modules are written to the TDI at the top, and all of the clients and APIs are written to the same TDI at the bottom. Any module above the TDI can send data to and receive data from any protocol module below the TDI, and any protocol module can use any client or API.

Figure 1.3 The Windows 2000 networking architecture

Network Interface Adapter Drivers

The network interface adapter drivers, located below the protocol modules, are written to a boundary layer that functions much like the TDI. Called the Network Device Interface Specification (NDIS), this boundary layer provides the interface between the protocol modules and the network interface hardware that forms the physical layer of the OSI model. As with the TDI, the NDIS layer enables any protocol module installed on the computer to use any installed network interface adapter. A Windows 2000 computer that is functioning as a router, for example, must have two network interfaces. In some cases the computer has two NICs installed, whereas other computers use one NIC and a dial-up or other WAN connection, which also functions as a network interface. Installing a protocol module in a computer in this way automatically binds the protocol to both of the network interfaces using the NDIS layer.

Bindings

Bindings are the connections between the components that make up the networking stack. Windows 2000 automatically binds all of the installed components together so that any client can use any protocol and any protocol can use any network interface adapter. However, situations can occur in which you want to disable certain bindings. For example, you might want to enable a computer to use TCP/IP for its dial-up connection to the Internet but use only NetBEUI for LAN communications with other Windows systems. To do this, open the Properties dialog box for the Local Area Connection in the Network and Dial-up Connections Control Panel, clear the check box for the Internet Protocol (TCP/IP) component, as shown in Figure 1.4, and click the OK button.

Figure 1.4 Clearing the check box next to a networking component unbinds it from the networking stack

Although the Internet Protocol (TCP/IP) component still remains in the list, the open check box indicates that it is not bound to the network interface adapter and cannot be used. If no other protocol module is installed when you unbind TCP/IP, all communication over this particular network connection ceases because the networking stack is severed. Therefore, ensure that NetBEUI or another protocol module is installed and functioning before you disable TCP/IP by unbinding it.

Exercise 1.1: Installing Networking Components

In this exercise, you open the Properties dialog box for a network connection and install a new protocol module. The procedure is the same for the installation of any protocol or client.

  1. Click Start, point to Settings, and click Control Panel.
  2. Double-click the Network and Dial-up Connections icon to open the Network and Dial-up Connections window.
  3. Right-click the Local Area Connection icon and select Properties to display the Local Area Connection Properties dialog box. At the top of the dialog box, the network interface adapter used by the connection is displayed in the Connect Using text box and the other currently installed components are listed below it. In a default Windows 2000 network installation, the components list should contain Client for Microsoft Networks, File and Printer Sharing for Microsoft Networks, and Internet Protocol (TCP/IP).
  4. Click Install to display the Select Network Component Type dialog box.
  5. Select the Protocol list and click Add to display the Select Network Protocol dialog box.
  6. Select NetBEUI Protocol in the Network Protocol list and click OK. The NetBEUI Protocol module is added to the components list in the Local Area Connection Properties dialog box.
  7. Click Close. The NetBEUI protocol module is now active.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Which component enables the Client for Microsoft Networks to use any installed protocol?
    1. NDIS
    2. NetBEUI
    3. TDI
    4. UDP
  2. How do you prevent a network interface adapter from using one of the protocol modules installed on the computer?
  3. Which type of component enables an application running on a Windows 2000 computer to open a file on a shared network drive?
    1. A service
    2. A redirector
    3. A boundary layer
    4. An API
  4. Give two reasons why NetBEUI was replaced by TCP/IP as the Windows default networking protocol.

Lesson Summary

  • The basic building blocks of the Windows 2000 networking architecture are software components called clients, services, protocols, and network interface adapter drivers.
  • Windows 2000 Server includes two client modules: Client for Microsoft Networks and Gateway Services for NetWare. These modules enable the computer to access shared resources on Windows and NetWare servers, respectively.
  • The Windows 2000 package includes three protocol modules: Internet Protocol (TCP/IP), NetBEUI, and NWLink IPX/SPS/NetBIOS Compatible Transport Protocol. Windows 2000 Server also includes Microsoft Services for Macintosh, which provides support for the AppleTalk protocols.
  • The client and protocol modules are separated by a boundary layer called the Transport Driver Interface (TDI), which enables any client module to use any protocol. The Network Device Interface Specification (NDIS) provides the same type of boundary layer between the protocol modules and the network interface adapter drivers.


Lesson 2: Using Microsoft Management Console

Windows 2000 includes a tool called Microsoft Management Console (MMC) that you use to administer many of the operating system's functions, including most of the networking services examined in this book. MMC provides a standardized interface that you can use to open, combine, and save administrative tools. When you look at the Administrative Tools program group in the Windows 2000 Start menu, the programs that you find there are actually MMC snap-ins.

After this lesson, you will be able to

  • Describe the function and components of MMC, including snap-ins and console modes
  • Create a custom MMC console

Estimated lesson time: 45 minutes

The MMC Environment

MMC is a shell program; it does not provide any management functions. Instead, MMC provides a common console framework for management applications. You use MMC to open management applications called snap-ins, which perform one or more administrative tasks. There are distinct advantages to this arrangement. First, you can use MMC to open multiple snap-ins at once and combine them into a single, multiple-purpose console. Second, third-party software developers can create their own administrative tools in the form of snap-ins that use the same basic interface and can be combined with the Windows snap-ins. Another advantage is the support for remote management included in many snap-ins. For example, when you open the Domain Name System (DNS) console, it manages the DNS server on the local computer by default, and you can also connect to any other DNS server on your network and manage it as well.

Snap-ins

Snap-ins are the fundamental units of extension that you use to create MMC consoles. Every MMC console is made up of one or more snap-ins that run within the MMC shell. Snap-ins can perform a variety of administrative tasks and come in two basic types: stand-alone and extension.

Stand-alone snap-ins are usually referred to simply as snap-ins. These are the primary tools used to administer Windows 2000 services. Each snap-in provides one function or a related set of functions.

Extension snap-ins, usually referred to simply as extensions, provide additional administrative functionality to another snap-in. Extensions are designed to work with one or more stand-alone snap-ins, based on the functions provided by the stand-alone snap-in. Extensions can provide a variety of functionality. Some actually extend the console name space. For example, a snap-in that provides system information about computers would add that system information to the name space under each computer in the name space. Other extensions simply extend context menus or specific wizards.

A good example of how extension snap-ins work with stand-alone snap-ins is the Group Policy module. You can define group policies for a variety of different Active Directory objects, such as sites and organizational units. When you open the Properties dialog box for an organizational unit object in the Active Directory Users and Computers console and edit its group policy, MMC opens a separate Group Policy window containing the configuration interface. In this case, the Active Directory Users and Computers console is a stand-alone snap-in, and the Group Policy console is an extension snap-in that is associated with it.

Note, however, that you can also configure group policies for site objects, which you access using the Active Directory Sites and Services console. The Sites and Services console is another stand-alone snap-in, but when you open the Group Policy console for a site object, use the same extension snap-in as Active Directory Users and Computers. This is one of the primary benefits of having two types of snap-ins: MMC can use the same extension snap-in with more than one stand-alone snap-in to provide similar functions without duplicating large amounts of programming.

Some snap-ins offer stand-alone functionality while extending the functionality of other snap-ins. For example, the Event Log snap-in reads the event logs on Windows computers. If the Computer Management object exists in a console, the Event Log snap-in automatically extends each instance of a Computer Management object and provides the event logs for the computer. Optionally, the Event Log snap-in can also operate in stand-alone mode, in which case it does not appear below the Computer Management object.

MMC Consoles

When you launch the MMC shell without specifying a snap-in (by opening the Run dialog box from the Start menu and running Mmc.exe), you see an empty console screen like that shown in Figure 1.5. A console is a window containing the functions of one or more snap-ins, which you can save as a file with an .msc extension. The main console window contains menus and tool buttons that you can use to open console files or snap-ins. The child window, here called Console Root, has its own menus and tool buttons and demonstrates the basic structure of a console, which looks something like the Window Explorer display, with a scope pane on the left and a result pane on the right.

Figure 1.5 The MMC shell window

When you open one of the Windows 2000 preconfigured snap-ins, the snap-in appears maximized in the MMC window, as shown in Figure 1.6. Opening MMC in this way creates a console dedicated to a single snap-in. You can minimize the snap-in in the MMC window, but you can't open other snap-ins in the same instance of the program.

Figure 1.6 Opening a preconfigured snap-in dedicates MMC to a single tool

When you open a console file, for example, the Computer Management console, found in the Start menu's Administrative Tools group, you see a collection of snap-ins grouped into a single interface, as shown in Figure 1.7. The tree-like display in the scope pane lists the snap-ins in three categories (System Tools, Storage, and Services and Applications).

It's possible to open each of these snap-ins individually in a dedicated MMC window, but the console provides access to a variety of tools at once. The Computer Management console is a good example of what you can do with console files. You can create your own consoles containing any snap-ins you want, including those provided with Windows or with third-party products.

Figure 1.7 The Computer Management console

There are two types of MMC consoles: preconfigured and customized.

Preconfigured MMC Consoles

When you install Windows 2000, a large number of preconfigured MMC consoles are included. Many of these are listed in the Start menu's Administrative Tools program group. These MMC consoles contain commonly used snap-ins that are used to perform administrative tasks. You cannot modify a preconfigured MMC console or add snap-ins to it. The preconfigured consoles contain only one snap-in that provides the functionality to perform a related set of administrative tasks.

The preconfigured MMC consoles that are installed on a computer vary depending on which Windows 2000 operating system is running and which Windows 2000 components you installed. A Windows 2000 Server computer that is configured to act as a domain controller, for example, has several additional preconfigured consoles that you use for Active Directory administration. When you install additional components on the computer, Windows 2000 often installs additional consoles that you can use to manage those components as well. Table 1.1 lists the preconfigured MMC consoles installed by default on a Windows 2000 Server computer.

Windows 2000 Professional does not include the preconfigured consoles used to manage the networking services provided with Windows 2000 Server. However, the Windows 2000 Professional operating system is capable of running these tools to administer the server services remotely. To install the Windows 2000 Server consoles on a Windows 2000 Professional computer (or to install consoles for services not present on a Windows 2000 Server computer), run the Adminpak.msi file found in the \I386 directory of the Windows 2000 Server installation CD-ROM.

Table 1.1 Windows 2000 Server Preconfigured MMC Consoles

Preconfigured MMC | Function
Active Directory Domains and Trusts | Manages the trust relationships between domains (domain controllers only)
Active Directory Sites and Services | Creates sites to manage the replication of Active Directory information (domain controllers only)
Active Directory Users and Computers | Manages users, computers, security groups, and other objects in Active Directory (domain controllers only)
Component Services | Configures and manages COM+ applications
Computer Management | Manages disks and provides access to other tools to manage local and remote computers
Configure Your Server | Sets up and configures Windows services for your network
Data Sources (ODBC) | Adds, removes, and configures Open Database Connectivity (ODBC) data sources and drivers
DHCP | Used to configure and manage the Dynamic Host Configuration Protocol (DHCP) service
Distributed File System | Creates and manages the Microsoft Dfs service that connects shared folders from different computers
DNS | Manages the DNS service, which translates DNS computer names to IP addresses
Domain Controller Security Policy | Used to view and modify security policy for the Domain Controllers organizational unit (domain controllers only)
Domain Security Policy | Used to view and modify security policy for the domain, such as user rights and audit policies (domain controllers only)
Event Viewer | Displays monitoring and troubleshooting messages from Windows and other programs
Internet Services Manager | Manages Internet Information Services (IIS), the Web server for Internet and intranet Web sites
Licensing | Manages client access licensing for a server product
Local Security Policy | Used to view and modify local security policy, such as user rights and audit policies (stand-alone servers only)
Performance | Displays graphs of system performance and configures data logs and alerts
Routing and Remote Access | Used to configure and manage the Routing and Remote Access service
Server Extensions Administrator | Used to administer Microsoft FrontPage Server Extensions and FrontPage extended webs
Services | Starts and stops services
Telnet Server Administration | Used to view and modify telnet server settings and connections

Customized Consoles

Customized consoles are consoles that you create yourself out of MMC snap-ins. You can combine one or more snap-ins or parts of snap-ins to create customized MMC consoles, which you can then use to centralize and combine administrative tasks. Customized MMC consoles enable administrators to perform the following tasks:

  • Save customized MMC consoles to use again
  • Distribute the customized MMC consoles to and share them with other administrators
  • Use customized MMC consoles from any computer to centralize and unify administrative tasks

Although you can use many of the preconfigured MMC consoles for administrative tasks, you might want to create your own custom MMC consoles. You can combine multiple preconfigured snap-ins with third-party snap-ins to create personalized MMC consoles. By creating a custom MMC console, you do not have to switch between different programs or different preconfigured MMC consoles because all the necessary snap-ins are located in one place.

Console Modes

Custom MMC consoles can operate in different modes, which you can use to regulate what tasks other people are able to perform when using the console. There are two available console modes: author mode and user mode.

When you save an MMC console in author mode, you enable full access to all MMC functionality, which includes modifying the MMC console. By default, all new MMC consoles are saved in author mode. An MMC console that has been saved in author mode enables users to perform any of the following tasks:

  • Add or remove snap-ins
  • Create new windows
  • View all portions of the console tree
  • Save MMC consoles

If you plan to distribute an MMC console to other administrators, save the MMC console in user mode. When you set an MMC console to user mode, users cannot add snap-ins to, remove snap-ins from, or save the MMC console. User mode operation is indicated by the absence of the MMC console pull-down menus (Console, Window, and Help) and the absence of the MMC toolbar objects, as shown in Figure 1.6. There are three user-mode types. Each type provides a different level of access and functionality. The following table describes when to use each user mode.

Table 1.2 User Mode Types

User Mode Type | Description
Full Access | Allows users to navigate between snap-ins, open new windows, and gain access to all portions of the console tree
Limited Access, Multiple Windows | Prevents users from opening new windows or gaining access to a portion of the console tree but allows them to view multiple windows in the console
Limited Access, Single Window | Prevents users from opening new windows or gaining access to a portion of the console tree and allows them to view only one window in the console

Exercise 1.2: Creating a Custom MMC Console

In this exercise, you create a new customized MMC console and then remove selected extension-snap-ins to restrict the console's functionality.

  1. Click Start, and then click Run.
  2. In the Open box, type mmc, and then click OK.
  3. On the Console menu, click Add/Remove Snap-in. The Add/Remove Snap-in dialog box appears with the Standalone tab active.
  4. Click Add. All of the snap-ins listed here are stand-alone snap-ins.
  5. In the Add Standalone Snap-in dialog box, select Computer Management in the Available Standalone Snap-ins list and then click Add. The Computer Management dialog box appears.
  6. In the Computer Management dialog box, verify that the Local Computer option is selected and then click Finish.
  7. In the Add Standalone Snap-in dialog box, click Close; in the Add/Remove Snap-in dialog box, click OK. Computer Management (Local) now appears in the console tree of the main MMC window.
  8. Expand the Computer Management node, review the available functions, and then expand the System Tools node. Notice that several extensions are available, including System Information and Device Manager. You can restrict the functionality of a snap-in by removing extensions.
  9. On the Console menu, click Add/Remove Snap-in. The Add/Remove Snap-in dialog box appears.
  10. Click Computer Management (Local), and then click the Extensions tab. A list of available extensions contained in the Computer Management snap-in appears.
  11. Clear the Add All Extensions check box. In the Available Extensions list, clear the Device Manager Extension and System Information Extension check boxes. Click OK.
  12. In the console window, expand Computer Management, and then expand System Tools. Confirm that Device Manager and System Information have been removed from the display.
  13. On the Console menu, click Options. The Options dialog box appears.
  14. From the Console Mode drop-down list box, select User Mode - Limited Access, Single Window.
  15. Select the Do Not Save Changes To This Console check box, and then click OK.
  16. On the Console menu, click Exit. MMC displays a message prompting for confirmation to save the console settings.
  17. Click Yes. The Save As dialog box appears.
  18. In the File Name text box, type ComputerMgmt Restricted, and then click Save.
  19. On the Start menu, point to Programs, point to Administrative Tools, and then click ComputerMgmt Restricted. Notice that the custom console opens in a single window with no Console, Window, and Help menus, indicating the console is running in user mode.
  20. Close the custom console. Notice that the Save This Console message box does not appear.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next chapter. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. When you use the Administrative Tools program group to open an MMC console provided with Windows 2000 Server, can you add snap-ins to it? Why or why not?
  2. The MMC consoles accessible through the Administrative Tools program group are of which type?
    1. Custom
    2. Extension
    3. Stand-alone
    4. Preconfigured
  3. What can you do to limit the functions provided by a stand-alone snap-in?

Lesson Summary

  • Microsoft Management Console (MMC) is the Windows 2000 primary system and network administration tool. MMC is a shell program that uses individual applications called snap-ins to perform a wide variety of administration and management tasks.
  • There are two types of snap-ins: stand-alone, which provide a single function or group of functions, and extension, which provide additional functions to stand-alone snap-ins.
  • MMC can display multiple snap-ins in a single interface called a console. Windows 2000 includes a variety of preconfigured consoles, and you can create custom consoles containing collections of any snap-ins you care to select.
  • Custom consoles can be configured to use two different modes: author mode, which provides the user with full access to all of the MMC controls, and user mode, which prevents the user from modifying the console configuration.


Managing Client and Server Computers

About This Chapter

A Microsoft Windows 2000 computer can function on a network as both a client and a server, and many of the computer-specific maintenance and troubleshooting tasks that you perform while managing a Windows 2000 network are the same for clients and servers, or indeed for stand-alone computers. This chapter covers some of the basic system maintenance tasks you are likely to perform on the Windows 2000 clients and servers that make up your network.

Before You Begin

To perform the exercises in this chapter, you need a computer with Microsoft Windows 2000 Server properly installed and operating.


Lesson 1: Installing New Hardware

From a hardware standpoint, the element that differentiates a stand-alone Windows 2000 computer from a network workstation is a network interface adapter, more commonly known as a network interface card (NIC). To prepare a new Windows 2000 computer to connect to a local area network (LAN), you must install a NIC and its accompanying driver before you install or configure any of the other networking components. To do this, use the Windows 2000 Add/Remove Hardware Wizard, accessible through Control Panel. The procedure for installing a NIC is the same as that for many of the other hardware components in a computer, so you can adapt these procedures to install storage devices, audio hardware, and other peripherals.

After this lesson, you will be able to

  • Understand Plug and Play
  • Use the Add/Remove Hardware Wizard to install a new hardware device
  • Manually configure hardware resources

Estimated lesson time: 20 minutes

Understanding the Hardware Installation Process

For a computer to use a new piece of peripheral hardware, you must also install a device driver on the computer. A device driver is a software component that provides the interface between a piece of hardware and the operating system. In essence, the driver tells the operating system how to communicate with the hardware device. The new hardware communicates with the computer using specific system resources, like those listed in Table 2.1. For this communication to take place, the hardware device and the device driver must both be configured to use the same hardware resources. The arrangement is similar to that of two-way radio communications: if both transceivers are not tuned to the same frequency, they cannot communicate.

Table 2.1 Hardware Resource Types

Resource | Description
Interrupt requests (IRQs) | Hardware devices use interrupts to send messages. The microprocessor recognizes one of these messages as an interrupt request (IRQ). The microprocessor uses this information to determine which device needs its attention and what type of attention it needs. A PC provides 16 IRQs, numbered 0-15. Several of these IRQs are permanently assigned to standard computer components, such as the keyboard, so not all are available for assignment to new hardware devices.
Input/output (I/O) port addresses | I/O ports are a section of memory that a hardware device uses to communicate with the operating system. When a microprocessor receives an IRQ, the operating system checks the I/O port address to retrieve additional information about what the hardware device wants it to do. An I/O port is represented as a hexadecimal number.
Direct memory access (DMA) channels | DMA channels enable a hardware device, such as a floppy disk drive, to access memory directly, without interrupting the microprocessor. DMA channels speed up access to memory. A PC has eight DMA channels, numbered 0-7.
Memory addresses | Some hardware devices use areas of onboard memory or reserve system memory, which is referenced using hexadecimal addresses. This reserved memory is unavailable for use by other devices or Windows 2000.

The process of adding new hardware to a Windows 2000 computer, apart from the physical installation of the device, consists of supplying an appropriate driver and configuring both the driver and the hardware. This configuration process can be difficult, because the hardware resources provided by the computer are limited, as are the settings supported by the device and the driver. In addition, many other devices in the computer use the same type of resources, and a resource conflict between two pieces of hardware can cause both devices to malfunction.

Using Plug and Play

In most cases, Windows 2000 can recognize any new hardware that you have installed on the computer, launch the Add/Remove Hardware Wizard automatically, and configure the hardware and device driver without user intervention. At most, you might have to supply a CD-ROM or floppy disk containing the device driver files for the hardware. This capability is called Plug and Play. Plug and Play is a hardware autoconfiguration standard that requires support from the operating system, the computer's basic input/output system (BIOS), and the hard-ware device itself. Plug and Play works by detecting the new hardware, taking stock of the devices already installed on the computer and the resources they use, and configuring both the hardware device and the driver to use resources that are currently free.

In the event that Windows 2000 fails to detect the new hardware that you've physically installed, you can force Plug and Play to scan the computer for new devices by running the Add/Remove Hardware Wizard and selecting Add/Troubleshoot A Device. Sometimes, this procedure can trigger a successful Plug and Play installation that the operating system did not initiate itself.

In some cases, Plug and Play has to reconfigure other devices and their drivers to accommodate the new hardware. For example, if you are installing a NIC that supports only three IRQs, and all of those IRQs are already in use by other devices, Plug and Play can usually modify the configuration of another device to free up one of the three IRQs that the new NIC is capable of using. In some cases, however, the system resources might not be available for Plug and Play to install a new device. In a case like this, the only alternatives are to remove or disable another device to free up resources or to try to configure the new device manually.

Installing Non-Plug and Play Hardware

When the hardware you want to install on your computer does not support Plug and Play, you can perform a manual installation with the Add/Remove Hardware Wizard that includes an automatic hardware detection procedure. In this type of installation, the wizard detects the hardware and its current resource configuration settings, installs a device driver, and configures the driver to use the hardware's settings.

To begin the hardware installation process, use the following procedure:

  1. Open Control Panel and double-click the Add/Remove Hardware tool to launch the Add/Remove Hardware Wizard.
  2. Click Next to bypass the Welcome page.
  3. On the Choose A Hardware Task page, select Add/Troubleshoot A Device, as shown in Figure 2.1. Then click Next. At this point, the wizard searches for new Plug and Play hardware. If Plug and Play successfully detects the device, the wizard proceeds to the next step.

    Figure 2.1 The Choose A Hardware Task page
  4. On the Choose A Hardware Device page (shown in Figure 2.2), select Add A New Device, and click Next.

    Figure 2.2 The Choose A Hardware Device page
  5. On the Find New Hardware page, click Yes, Search For New Hardware, and click Next. The wizard begins the process of detecting new non-Plug and Play hardware in the computer. If the wizard locates new hardware, it displays the devices on the Detected Hardware page.
  6. From the list on the Detected Hardware page, select the device you want to install, and click Next. If the wizard detects no new hardware, click Next to choose a specific device to install.
  7. On the Hardware Type page (shown in Figure 2.3), select the type of device you want to install, and click Next.

    Figure 2.3 The Hardware Type page
  8. On the Select A Device Driver page, select the manufacturer and model of the device you want to install, and click Next. (See Figure 2.4.) You might have to supply your Windows 2000 distribution CD-ROM or a disk containing driver files for the device you've selected. If your hardware is not listed on the Select A Device Driver page, click Have Disk and browse to the disk or folder where the device driver files are located.

    Figure 2.4 The Select A Device Driver page

If the wizard is capable of detecting the device you have specified, it installs the appropriate device driver and configures it to use the same system resources that the hardware is configured to use. If not, you must manually specify the resources that the driver uses. The difference between this type of installation and a Plug and Play installation is that the wizard cannot reconfigure the resource settings of the hardware itself, only of the device driver. If the hardware is configured to use resources that are not (and cannot be made) available, the installation fails.

In this case, you must reconfigure the hardware device itself to use different resources, with a utility provided by the manufacturer. The hardware manufacturer might supply a Windows wizard-style utility for detecting and configuring the device's resource settings, or possibly a program that you run from an MS-DOS prompt. After you modify the hardware settings, you must then reconfigure the device driver you have installed to use those same settings.

Configuring System Resource Settings

When you manually install a hardware device, you might have to modify the configuration parameters specifying the system resources used by the device driver, either during the installation or afterwards. To do this, use the Windows 2000 Device Manager utility. To launch Device Manager and view the settings for a particular hardware device, use the following procedure:

  1. Open Control Panel and double-click the System tool to display the System Properties dialog box.
  2. In the System Properties dialog box, click the Hardware tab, and then click Device Manager, to display a window like that shown in Figure 2.5.

    Figure 2.5 The Windows 2000 Device Manager
  3. Expand the Device Manager tree entry for the appropriate hardware type to display a list of the devices installed in the computer.
  4. Select one of the installed devices, and then from the Action menu, select Properties to display the Properties dialog box for the device.
  5. In the Properties dialog box, click the Resources tab, as shown in Figure 2.6.

    Figure 2.6 The resource configuration interface for a hardware device

The Device Manager utility does not actually scan the computer for hardware devices. The display shows only the devices for which drivers have been installed. The status indicator icon to the left of each device name indicates whether the device is functioning properly. The possible icons are listed in Table 2.2.

Table 2.2 Device Manager Hardware Status

Icon | Hardware Status
Normal icon | The hardware device is operating properly.
Icon with exclamation point | The hardware device is incorrectly configured or its drivers are not functioning properly.
Icon with stop sign | Windows 2000 has disabled the hardware device because of resource conflicts.

Using the controls in the Properties dialog box for the hardware device, you can view the device driver's current resource settings and modify those settings as needed. As you cycle through the possible resource settings for the driver, the Conflicting Device List in the dialog box specifies whether a particular setting is already in use and which device is using it.

Configuring, Monitoring, and Troubleshooting Driver Signing

Windows 2000 drivers and operating system files are digitally signed by Microsoft to ensure that they have not been modified. In Device Manager, you can look at the Driver tab to verify that the digital signer of the installed driver is correct. Some applications overwrite existing operating files as part of their installation process. These files can cause system errors that are difficult to troubleshoot. Microsoft has greatly simplified the tracking and troubleshooting of altered files by signing the original operating system files and enabling you to easily verify these signatures.

Configuring Driver Signing

You can configure how the computer system responds to unsigned files by double clicking the System icon in Control Panel and clicking the Hardware tab. In the Hardware tab, in the Device Manager box, click Driver Signing to display the Driver Signing Options dialog box. This dialog box provides the following three file signature verification settings you can use to configure driver signing:

  • Ignore. This option enables any files to be installed regardless of their digital signature or lack thereof.
  • Warn. This option displays a warning message before allowing the installation of an unsigned file. This is the default option.
  • Block. This option prevents the installation of unsigned files.

If you are logged on as Administrator or as a member of the Administrators group, you can select Apply Setting As System Default to apply the driver signing configuration you set up to all users who log on to this computer.

Monitoring and Troubleshooting Driver Signing

In addition to using Device Manager to track the digital signature of files, Windows 2000 also provides System File Checker (SFC), a command-line utility that you can use to check the digital signature of files. The syntax of the SFC utility is as follows:

Sfc [/scannow] [/scanonce] [/scanboot] [/cancel] [/quiet] [/enable]
[/purgecache] [/cachesize=x]

Table 2.3 explains SFC's optional parameters.

Table 2.3 System File Checker's Command-Line Parameters

Parameter | Description
/scannow | Causes the SFC utility to scan all protected system files immediately
/scanonce | Causes the SFC utility to scan all protected system files at the next system restart
/scanboot | Causes the SFC utility to scan all protected system files every time the system restarts
/cancel | Cancels all pending scans of protected system files
/quiet | Replaces all incorrect system file versions without prompting the user
/enable | Returns Windows File Protection to default operation, prompting the user to restore protected system files when files with incorrect versions are detected
/purgecache | Purges the file cache and scans all protected system files immediately
/cachesize=x | Sets the file cache size

Using the File Signature Verification Utility

Windows 2000 also provides a File Signature Verification utility. To use it, click Start, point to Run, type sigverif, and press Enter. Once the File Signature Verification utility starts, you can click Advanced to configure it. The File Signature Verification utility enables you to view the file's name, its location, its modification date, its type, and its version number.

To monitor and troubleshoot driver signing on your system with the File Signature Verification utility, use the following procedure:

  1. Click Start, point to Run, type sigverif, and then press Enter.

    The File Signature Verification dialog box appears.

  2. Click Advanced.

    The Advanced File Signature Verification Settings dialog box appears with the Search tab active. By default, you are notified if any system files are not signed. Notice that you can select Look For Other Files That Are Not Digitally Signed. This setting causes the File Signature Verification utility to verify nonsystem files to see whether they are digitally signed. If you select this option, you can specify the search parameters for the files you want checked.

  3. Leave the default setting, Notify Me If Any System Files Are Not Signed, selected and then click the Logging tab.

    By default, the File Signature Verification utility saves the file signature verification to a log file named Sigverif.txt.

  4. Leave the default settings and click OK to close the Advanced File Signature Verification Settings dialog box.
  5. Click Start.

    When the File Signature Verification utility completes its check, a Signature Verification Results window appears if there are files that are not signed. Otherwise, you will see a message box telling you that your files have been scanned and verified as being digitally signed.

  6. If you get a Signature Verification Results window, review the results and then click Close to close this window. Otherwise, click OK to close the message box.
  7. Click Close to exit the File Signature Verification utility.

Exercise 2.1: Determining Available Hardware Resources

When you are forced to install a hardware device that does not support Plug and Play, it must be configured to use system resources that are not occupied by other devices. You therefore might have to reconfigure the hardware before installing the device driver, but to do so, you must know which resources are available. You can use Device Manager to display a list of the computer's hardware resources and their availability, as shown in Figure 2.7.

Figure 2.7 The Device Manager window showing resources listed by connection

To view the hardware resources lists, complete the following steps:

  1. Open Control Panel and double-click the System tool to display the System Properties dialog box.
  2. In the System Properties dialog box, click the Hardware tab, and then click Device Manager.
  3. In the Device Manager window, from the View menu, select Resources By Connection to display a list of system resource types.
  4. Double-click one of the resource types to display a list of the resources and the devices using them.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. What is the name of the software component that enables the operatingsystem to communicate with a hardware device?
    1. An interrupt
    2. A DMA channel
    3. A device driver
    4. A device manager
  2. How does Plug and Play automate the hardware installation process?
  3. Which of the following tasks can the Windows 2000 Add/Remove Hardware Wizard never perform for a hardware device that doesn't support Plug and Play?
    1. Detect a new hardware device
    2. Install device driver software
    3. Modify the system resource configuration for the device driver
    4. Modify the system resource configuration for the hardware device

Lesson Summary

  • It is usually necessary to install a network interface adapter into a computer before you can connect it to a network, and Windows 2000 supports Plug and Play, a standard that simplifies the hardware installation process.
  • The Windows 2000 Add/Remove Hardware Wizard enables you to install hardware automatically or manually.
  • When manually installing hardware, you must be certain that both the hardware device and the device driver are configured to use the same system resources.
  • You can view system resources and configure a device driver to use specific resources with the Windows 2000 Device Manager utility.


Lesson 2: Installing Updates

Part of the job of a Windows 2000 network administrator is to keep the software on the computers updated, particularly the operating system. Microsoft has developed the update process for its operating systems to the point that the actual deployment of Windows software updates is quite simple. Although updating a large number of computers in a network environment can be time-consuming, you have a variety of ways available to avoid performing individual updates on every computer.

After this lesson, you will be able to

  • Install Windows 2000 service packs
  • Incorporate a service pack release into the Windows 2000 distribution files
  • Install hotfixes
  • Verify update installations

Estimated lesson time: 15 minutes

Installing Windows 2000 Service Packs

It is natural for software developers to continue working on products that they have already released to the public, and the result is typically a large number of software modifications that address particular problems and add or enhance features. However, releasing these modifications in the form of many individual patches is impractical for several reasons, including the following:

  • It is difficult to keep track of which updates are installed on a particular computer when many different patches are available, complicating the technical support process.
  • A large number of update releases can result in situations in which various combinations of patches are installed on a single computer. Testing all of these combinations to ensure their stability is difficult for the developers.
  • In some cases, multiple update releases might contain revised versions of the same files, and unless the patches are installed in a particular order, it is difficult to know which version of a particular file a computer is using.

To address these problems, Microsoft began releasing Windows operating sys-tem updates in the form of service packs. A service pack is simply a compen-dium of software patches with a single installation program that have been tested together and found to be stable. Installing a service pack on a Windows 2000 computer applies all of the patch releases developed up to the time of the service pack's release.

Microsoft provides service packs on its various Internet services free of charge and also makes them available on CD-ROM for a nominal fee. You can find the latest service pack release for Windows 2000 at http://www.microsoft.com/windows2000/downloads/servicepacks.

Microsoft releases only one version of each service pack, which can update any of the Windows 2000 products (Professional, Server, or Advanced Server). Microsoft service packs are also cumulative, meaning that the Service Pack 2 release for Windows 2000 contains all of the updates found in Service Pack 1, so it is unnecessary to install both on a new computer. Even though this practice is a convenience for the installer, it also produces some exceptionally large service pack releases. For example, the full Service Pack 2 release for Windows 2000 is over 100 megabytes.

To streamline the service pack installation process, Microsoft's Internet sites enable you to download only the software you need for your Windows 2000 computer. This is called an express installation. The computer downloads an application from the Web site that determines which files your computer needs and creates a customized download that is usually substantially smaller than the full service pack release. However, in a network environment, this approach is not practical, because each computer performs a separate, multimegabyte download from the Internet, resulting in the use of extensive amounts of bandwidth.

For this reason, Microsoft also makes a full version of the service pack available, which it calls a network download. The network download version contains all of the service pack files, enabling it to update any Windows 2000 computer with any combination of features installed. By downloading this version, the network administrator can update all of the computers on the network without overburdening the Internet connection.

One of the problems with the service pack releases for Microsoft Windows NT is that only the operating system components currently installed on the computer can be upgraded. For example, if you apply a service pack to a Windows NT Server 4.0 computer that does not have Internet Information Services (IIS) installed and you then add IIS, you must reinstall the service pack to update the IIS files to the latest versions. Windows 2000 eliminates the need to reinstall service packs by storing the update files on the computer and supplying the latest version of each file when you install a new component.

Testing and Evaluating Service Packs

No network administrator worthy of the name blindly installs every software update that becomes available without researching them first; the Microsoft service pack releases are no exception. Examine the documentation that is supplied with the service pack to familiarize yourself with the issues that the update is designed to address. Then test the release before deploying it on your network.

In the case of a major update release like a Windows 2000 service pack, one of the simplest methods of evaluating the software is simply to wait for a few weeks and keep an eye on the trade publications and online computer news sources. If major problems arise, you will read about them. Even if you don't go to the trouble of setting up an isolated lab network for the purpose of testing service packs and other software updates, you should take the precaution of installing a new release on only one computer (which you have recently backed up) and monitoring it for a few days, before you deploy it throughout the network.

Slipstreaming

To install a service pack on a single computer, run the executable distribution file. The program extracts the service pack files from the archive and automatically initiates the installation process. However, deploying a service pack to a large fleet of networked computers can be difficult and time-consuming. One method of streamlining the service pack installation process for new network workstation deployments is to integrate the service pack into the Windows 2000 distribution files, a process called slipstreaming.

Slipstreaming replaces the original distribution files copied from the Windows 2000 CD-ROM with the newer versions provided in the service pack, creating an integrated product that you can store on a network distribution share and use to install Windows 2000 on new computers. When you install Windows 2000 on a new computer from a slipstreamed distribution share, you incorporate the service pack into the operating system installation and eliminate the need for the separate update procedure.

To slipstream a service pack into a Windows 2000 distribution share, you must first extract the individual service pack files from the archive in which they are distributed. To do this, run the executable archive file from a Windows 2000 command prompt with the -x parameter. For Windows 2000 Service Pack 2, the command is as follows:

w2ksp2.exe -x

The program then prompts you to choose a directory in which to place the extracted files and subfolders. The service pack release files include an application file called Update.exe in a subfolder called \I386\Update. From a command prompt, run Update.exe with the -s parameter and the name of the folder where the Windows 2000 distribution share is located, as follows:

update.exe -s:f:\win2kdist
You can also slipstream hotfix releases into a Windows 2000 distribution share, eliminating the need for other separate update installations, as well.

Deploying Service Packs

Although slipstreaming can eliminate the need for separate service pack installation on new computer installations, it does nothing to help deploy service packs to existing Windows 2000 computers. Deploying a service pack release to a large fleet of Windows 2000 PCs can take considerable time and effort if you plan to perform a manual installation on every computer. Instead, use different methods to automate the deployment process, including the following:

  • Microsoft Windows Installer Service. The Windows 2000 service pack releases include a package file called Update.msi to automate the installation of a service pack on all of your networked computers using the Windows Installer Service. To update these systems, create a software installation package as part of an Active Directory group policy object associated with a particular site, domain, or organizational unit, as shown in Figure 2.8. The group policy object causes every computer in that site, domain, or organizational unit to execute the software installation procedure outlined in the package as the computer starts.
    For more information about using group policies to perform software installations, see Lesson 3 in Chapter 10, "Managing Resources with Active Directory."
    Figure 2.8 A software installation package in a group policy object
  • Microsoft Systems Management Server (SMS). SMS is a network management product that, among other features, enables you to distribute software to client computers anywhere on the network. Using SMS, you can create a different type of software package out of the service pack distribution files, complete with instructions that specify how to install the software on the SMS client computers. After deploying the package to your SMS distribution sites, you create an advertisement that signals the SMS clients on the network that the package is available. You can configure the package so that users can install it at their leisure or schedule it to run automatically at a specified time with no user intervention.

Applying Hotfixes

Hotfix is the term that Microsoft uses to refer to a software update released between major service pack releases. A hotfix typically addresses a single issue occurring under specific circumstances, one that can't wait until the next service pack release to be fixed. In many cases, hotfixes are related to security issues that present a potential danger and must therefore be addressed as quickly as possible.

Service packs contain software modifications that are fully tested and considered to be safe for installation on all computers running the product. The same is not true of hotfixes, however, and you should be even more careful in examining the documentation included with the releases before installing them than with service packs. In some cases, a particular hotfix is intended only for computers experiencing a specific problem, so you should not install it if your computers are not experiencing that problem.

Microsoft hotfix releases are named using the format Q#####_XXX_YYY_ZZZ_LL.EXE, where:

  • Q##### refers to the number of the article in the Microsoft Knowledge Base that explains the need for the hotfix and the problem it is designed to address.
  • XXX specifies the operating system for which the hotfix is intended (such as W2K for Windows 2000).
  • YYY identifies the service pack in which the hotfix is or will be included. For example, hotfixes released after Service Pack 2 have the value SP3 because they are included in the next service pack release.
  • ZZZ identifies the hardware platform for which the hotfix is intended (such as x86 for the Intel processor platform).
  • LL specifies the language of the operating system release for which the hotfix is intended (such as en for English).

For example, a typical hotfix release has a name like the following: Q304135_W2K_SP3_x86_EN.EXE. Like with service packs, Microsoft releases its hotfixes as executable files that contain an integrated installation program. Install the file by running the executable from the Run dialog box or a command prompt and following the instructions displayed by the program.

Using Windows Update

Another method for keeping Windows 2000 computers updated is to use the Windows Update Web site (see Figure 2.9) maintained by Microsoft at http://www.microsoft.com/windowsupdate. At this site, you can download an applet that scans the local computer and customizes the Product Updates page on the site to display only the available updates that have not been installed on that computer. You can then select the updates that you want to install, download them all at once, and install them in a single, automated procedure. When you use Windows Update to download hotfixes, for example, you don't have to worry about filenames; the updates are downloaded and installed automatically.

Figure 2.9 The Windows Update Web site

The downside of using Windows Update in a network environment is that it is designed to update only the computer on which you access the site. With Windows Update, you cannot download the updates as files for use on other computers, which is generally preferable for network installations. The main advantage of Windows Update, however, is that it is simple enough for anyone to use, and reasonably reliable, in terms of the updates that it advises be installed. On a relatively small, relatively informal network, you can conceivably leave the task of updating your network workstations to the individual users, perhaps notifying them with an e-mail when a pertinent update becomes available.

To download hotfixes and other updates as executable files suitable for mass deployment on a network, see http://www.microsoft.com/downloads/search.asp.

Verifying Update Installations

In some cases, you might have to determine whether a particular computer on your network has already had a service pack or hotfix installed, and there are several ways to do this. The simplest way to find out the version of the operating system and the latest service pack installed is to run from the Run dialog box the Winver.exe program included with Windows 2000. Winver.exe is a simple program that does nothing but display an About Windows dialog box, like that shown in Figure 2.10. You can also display the same information by opening the System tool in Control Panel or by right-clicking the My Computer icon and selecting Properties from the context menu, to display the System Properties dialog box.

Figure 2.10 The About Windows dialog box

Hotfixes are not referenced in either of these dialog boxes, but they do appear in the Add/Remove Programs tool in Control Panel, as shown in Figure 2.11. Here, you can see a list of all the hotfixes that have been installed on the computer, and you can uninstall them as well.

Figure 2.11 The Add/Remove Programs tool in Control Panel

Removing Service Packs and Hotfixes

Windows 2000 service packs contain an uninstall feature that you can use to restore the computer to its previous state. When you run the Update.exe program to install the service pack, the program creates a subfolder called $ntservicepackuninstall$ in the computer's systemroot folder (typically C:\Winnt), which contains the earlier versions of the operating system files that the service pack replaces. You can uninstall the service pack by using Add/Remove Programs in Control Panel or by running the service pack's uninstall program (Spuninst.exe) from the command prompt.

The uninstall capabilities of a service pack are limited in several ways, including the following:

  • You cannot uninstall a service pack that you installed using an integrated installation.
  • If you install any programs or services that require the service pack, uninstalling the service pack can adversely affect those programs.
  • If you installed any applications after the service pack was installed, you should not uninstall the service pack.
  • If you turn off the automatic backup option for Update.exe, you cannot use the uninstall Service Pack 2 mechanism and, therefore, cannot uninstall Service Pack 2.

Windows 2000 hotfixes also contain uninstall capabilities. The installation program for each hotfix creates an uninstall folder in the systemroot folder and lists the hotfix in the Add/Remove Programs control panel. You can uninstall any hotfix from the control panel as needed.

Exercise 2.2: Update Deployment Technologies

Match the technology in the numbered list with the correct definition.

  1. Slipstreaming
  2. SMS
  3. Hotfix
  4. Group policies
  5. WINVER.EXE
  1. Schedules an automated service pack installation to occur at a specific time
  2. Determines which service pack has most recently been installed
  3. Installs Windows 2000 and a service pack at the same time
  4. Installs a single software patch
  5. Installs a service pack during the next system startup
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Which of the following commands do you use to extract the files from a service pack release called W2ksp2.exe?
    1. W2ksp2
    2. W2ksp2 -s
    3. W2ksp2 -x
    4. Update -s
  2. Which of the following service pack installation tools or techniques can you use only on a new Windows 2000 operating system installation?
    1. Active Directory group policy objects
    2. SMS
    3. Windows Update
    4. Slipstreaming
  3. What are two advantages of releasing operating system updates in the form of service packs, instead of individual patch releases?

Lesson Summary

  • Microsoft releases major updates to its operating systems in the form of service packs, which contain a large collection of software modifications with a single installation program.
  • Service packs are cumulative, meaning that they include the changes from all previous service pack releases for that product and can be incorporated into the Windows 2000 distribution files, for a single, integrated installation.
  • In a network environment, you can deploy service packs to a large fleet of computers using group policies or Systems Management Server (SMS).
  • Hotfixes are small software patches, intended to address a single issue, which are released between service packs.


Lesson 3: Managing Client Access Licenses

For a user at a client workstation to access a Windows 2000 server requires a license, and part of the network administrator's job is to ensure that the organization has a sufficient number of licenses to support the users on the network. This lesson examines the licensing requirements for Windows 2000 and the tools you can use to manage the licensing environment on your network.

After this lesson, you will be able to

  • Understand the Windows licensing modes
  • Change the licensing mode
  • Use the Windows 2000 licensing tools

Estimated lesson time: 20 minutes

Understanding Windows 2000 Licensing Modes

When you purchase the operating system for your client workstations, whether it's a version of Windows or something else, you receive a license to run that operating system on one computer. However, a license for the computer to access Windows 2000 servers as a client is not included in that package. You also get a license to run the operating system on a single computer when you purchase the Windows 2000 Server product, and the package might include a number of client access licenses as well. A client access license (CAL) is a third type of license that enables a computer running any operating system to access the services provided by the Windows 2000 server. A CAL is required to access the file and print services provided by the Windows 2000 server or Windows-based NetWare services such as those provided by Gateway Services for NetWare (GSNW), whether the connection is through a LAN or a remote connection (such as a dial-up).

You can configure Windows 2000 Server to use client access licenses in two modes: Per Server or Per Seat. The licenses themselves are the same; you specify which mode to use when you configure licensing on the server. The differences between the two modes are as follows:

  • Per Server licensing. In Per Server licensing, the CALs you purchase are assigned to a particular server and can be used by any client. The server permits only as many simultaneous connections to the server as it has licenses. When all the licenses are in use, the server denies any further connections from users until some of the existing connections are broken. Administrators are always permitted access to the server, despite all of the licenses being in use. Per Server licensing is best suited to single-server networks or servers that are infrequently used. This is because with Per Server licensing, a user connecting to two Windows 2000 servers at the same time uses two licenses. However, if you have 100 users on your network and you maintain a server that is used for remote access by only 10-20 users at a time, it is far more economical to purchase 20 CALs and use them in Per Server mode than to purchase the 100 CALs required for Per Seat mode.
  • Per Seat licensing. In Per Seat licensing, the CALs are assigned to the clients and enable them to access any number of servers. A client computer in Per Seat mode can connect to 1, 2, or 12 Windows servers and still use only 1 CAL. This mode is therefore better suited to networks with multiple servers. However, a client with a valid CAL is only guaranteed a connection to servers that are using Per Seat licensing. If some of your servers are running in Per Server mode, a client with a Per Seat CAL also uses an additional license for each one of the Per Server computers it connects to.

Choosing a Licensing Mode

You specify the licensing mode you want to use when you install Windows 2000 Server on a computer. As noted in the previous section, Per Server licensing is preferable for a single-server network. On a network with multiple Windows 2000 servers, you determine which mode to use by estimating the number of concurrent connections you need per server, adding them up, and comparing that sum to the number of clients that connect to any server. If the number of concurrent connections for all of the servers is lower than the number of clients, you should use Per Server mode. Otherwise, use Per Seat mode.

For example, if you have a 50-node network with three Windows 2000 servers and all 50 clients must connect to all three servers, running in Per Server mode requires you to purchase 150 licenses, whereas with Per Seat mode, you need only 50 licenses. In this case, Per Seat licensing is clearly preferable. If you are unsure which mode to use, it is best to chose Per Server mode, because even though you can switch the licensing mode from Per Server to Per Seat, you cannot change from Per Seat to Per Server.

You can change the licensing mode for a Windows 2000 server from Per Server to Per Seat using either the Licensing tool in Control Panel or the Licensing Manager, but you can change it only once. Be sure you are familiar with the full implications of using Per Seat mode before you make the change.

Using the Windows 2000 Licensing Tools

When you run your Windows 2000 servers in Per Server mode, you manage the licensing for each server individually, using the Licensing tool in Control Panel. If you purchase Windows 2000 Server with a specific number of licenses, you specify how many when you install the operating system and choose your licensing mode. If you purchase additional Microsoft License Packs (MLPs) later, you use the Licensing tool in Control Panel to add the new licenses to whichever server you want. It doesn't matter where you use the licenses you purchase, as long as you use them only once. For example, you can purchase 50 licenses and allocate 10 to each of five servers or use all 50 on a single server.

An MLP is a product that consists only of additional licenses to use with another Microsoft product. The MLP does not include any software, just the serial numbers and documentation affirming the purchase of a specific number of licenses.

If you run your servers in Per Seat mode, the licenses you purchase all go into a common pool that is stored on a site license server and shared by all of the Per Seat servers in the enterprise. When a user accesses a Windows 2000 server for the first time after logging on, the site license server assigns a license to the user from the pool with which the user can access any Windows 2000 server on the network. To manage these licenses, use the Licensing Manager, accessed from the Administrative Tools program group.

Using the Licensing Tool in Control Panel

You use the Licensing tool in Control Panel, as shown in Figure 2.12, to manage the licenses for a single Windows 2000 server operating in Per Server mode. With this tool, you can perform the following tasks:

  • Add or remove client access licenses for the local server while in Per Server mode.
  • Configure the replication of the licensing information from the local server to the site license server.
  • Change the licensing mode from Per Server to Per Seat.
Figure 2.12 The Windows 2000 Licensing tool in Control Panel

Some of the tasks that you cannot perform using the Licensing tool in Control Panel are as follows:

  • Manage licenses for other servers running in Per Server mode.
  • Add or remove client access licenses used in Per Seat mode.
  • Change the licensing mode from Per Seat to Per Server.

You typically use the Licensing tool in Control Panel to add CALs to a server when you purchase an MLP for Windows 2000, as demonstrated in Exercise 2.3. However, you can also use it to change the licensing mode on the local server from Per Server to Per Seat mode using the following procedure:

  1. Open Control Panel and double-click the Licensing tool to display the Choose Licensing Mode dialog box.
  2. In the Product list, choose the product for which you want to change the licensing mode. In this case, Windows Server should appear by default.
  3. Click Per Seat and then click OK.

Once you've changed the licensing mode to Per Seat, you can add the licenses that were previously allocated to the server to the Per Seat pool. However, now that Windows 2000 is running in Per Seat mode, you can no longer use the Licensing tool in Control Panel to manage licenses. You must use the Licensing Manager instead.

Using the Licensing Manager

The Licensing Manager, as shown in Figure 2.13, is a much more comprehensive utility than the Licensing tool in Control panel, one that you can use to perform virtually all licensing-related tasks for an entire enterprise, including the following:

  • View the Per Server and Per Seat licenses for the site.
  • View usage statistics for each network user.
  • Add or remove Per Seat client access licenses on any site license server on the network.
  • Add and remove Per Server client access licenses for any server on the network.
  • Change the licensing mode of any server on the network from Per Server to Per Seat.
  • Configure the replication of the licensing information for the entire network.
Figure 2.13 The Windows 2000 Licensing Manager

Even though you can use the Licensing tool in Control Panel to manage the licenses for the local server only when it's running in Per Server mode, the Licensing Manager enables you to manage both Per Seat and Per Server licenses for the entire network. Practice adding and removing licenses using the License Manager in Exercise 2.3. You can also change the licensing mode for any server on the network from Per Server to Per Seat, but like with the Licensing tool in Control Panel, you cannot change the mode from Per Seat to Per Server. To change the licensing mode for a server using the Licensing Manager, use the following procedure:

  1. From the Administrative Tools program group, select Licensing to open the Licensing Manager for the current domain.
  2. Click the Server Browser tab and expand the domain name.
  3. Select the site license server in the domain and then from the License menu, select Properties.
  4. In the Products View tab, click Edit to display the Choose Licensing Mode dialog box.
  5. Click Per Seat.
  6. Click OK and read the information in the Per Site Licensing window.
  7. Select the check box to agree to be bound by the license agreements for the product and click OK.

Exercise 2.3: Adding Client Access Licenses

You can add recently purchased CALs using either the Licensing tool in Control Panel or the Licensing Manager. In this exercise, you add and remove client access licenses using both methods.

Procedure 1: Adding Per Server Licenses

In this procedure, you add Per Server client access licenses on the local server, using the Licensing tool in Control Panel.

  1. Open Control Panel and double-click the Licensing tool to display the Choose Licensing Mode dialog box.
  2. Click Add Licenses to display the New Client Access License dialog box.
  3. In the Product drop-down list box, choose the product for which you want to add licenses, in this case, Windows Server.
  4. In the Quantity drop-down list box, specify the quantity of licenses you have purchased.
  5. Click OK.

Procedure 2: Removing Per Server Licenses

In this procedure, you remove Per Server client access licenses on the local server, using the Licensing tool in Control Panel.

  1. Open Control Panel and double-click the Licensing tool to display the Choose Licensing Mode dialog box.
  2. Click Remove Licenses to display the Select Certificate To Remove Licenses dialog box.
  3. In the Installed Certificates box, select the certificate for the licenses that you want to remove.
  4. In the Number Of Licenses To Remove drop-down list box, specify the quantity of licenses you want to remove.
  5. Click Remove.
  6. Click Cancel to close the dialog box.

Procedure 3: Adding Per Seat Licenses

In this procedure, you add Per Seat client access licenses on the site license server, using the Licensing Manager.

  1. From the Administrative Tools program group, select Licensing to open the Licensing Manager for the current domain.
  2. From the License menu, select New License.
  3. In the Product drop-down list box, choose the product for which you want to add licenses, in this case, Windows Server.
  4. In the Quantity drop-down list box, specify the quantity of licenses you have purchased.
  5. Click OK.

Procedure 4: Removing Per Seat Licenses

In this procedure, you remove Per Seat client access licenses on the site license server, using the Licensing Manager.

  1. From the Administrative Tools program group, select Licensing to open the Licensing Manager for the current domain.
  2. In the Products View tab, select the product from which you want to delete licenses.
  3. From the License menu, select Delete to display the Select Certificate To Remove Licenses dialog box.
  4. In the Installed Certificates box, select the certificate for the licenses that you want to remove.
  5. In the Number Of Licenses To Remove drop-down list box, specify the quantity of licenses you want to remove.
  6. Click Remove.
  7. Click Cancel to close the dialog box.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Which of the following tasks can you not perform using the Licensing tool in Control Panel? (Choose all that apply.)
    1. Add Per Server licenses to the local server.
    2. Add Per Server licenses to a remote server.
    3. Change the licensing mode for the local server from Per Seat to Per Server.
    4. Change the licensing mode for the local server from Per Server to Per Seat.
  2. On a network with 250 users and 12 Windows 2000 servers, each of the servers has a maximum of 30 users connected to it at any given time. Which of the two licensing modes would enable the network to operate with fewer CALs, Per Seat or Per Server?
  3. Which of the following tasks does a Windows 2000 CAL not permit you to perform? (Choose all that apply).
    1. Print documents on a Windows 2000 printer
    2. Access a file on a Novell NetWare server
    3. Access a page on a Windows 2000 IIS Web server
    4. Access a shared folder on a Windows 2000 server

Lesson Summary

  • In addition to the license to run the operating system, Windows 2000 Server requires you to have a client access license (CAL) for every client computer that accesses the server's resources.
  • Windows 2000 servers can use CALs in Per Server mode or Per Seat mode. Per Server mode assigns the licenses to a particular server, which assigns one to each client connection. Per Seat mode assigns licenses to individual users, enabling them to access any Windows 2000 server on the network.
  • The Licensing tool in Control Panel enables you to manage the licenses for a single computer running in Per Server mode.
  • The Licensing Manager application enables you to manage Per Seat and Per Server licenses for an entire enterprise network.


Lesson 4: Troubleshooting Boot Problems

The problems that you might encounter while booting a Windows 2000 system are the same on a networked computer as on a stand-alone one, but the consequences of a boot failure on a network can be much more serious, especially if the computer is a server. This lesson examines some of the tools Windows 2000 provides that you can use to troubleshoot problems that prevent the computer from booting properly.

After this lesson, you will be able to

  • Boot a Windows 2000 computer into Safe mode
  • Use the advanced boot options
  • Create a parallel installation
  • Use the Recovery Console

Estimated lesson time: 25 minutes

Using Safe Mode

One of the common causes of boot failures is driver problems that prevent crucial components from operating properly. For example, if you install a new video driver that does not function properly, the computer's display might be garbled to the point of incoherence after you reboot the system. To bypass the malfunctioning driver, you can restart the computer and boot into Safe mode. Safe mode is a minimal system configuration that is intended to provide basic access to the computer. When Windows 2000 boots into Safe mode, it loads only the essential operating system files and drivers, such as keyboard, mouse, and mass storage drivers, plus a simple Video Graphics Array (VGA) video driver that provides only 640colors. Safe mode provides an operational environment that you can use to replace the malfunctioning video driver or make other repairs.

A Windows 2000 computer in Safe mode has a black background, with the words "Safe Mode" in the four corners of the screen, as shown in Figure 2.14. This is a visual reminder that the computer is not operating in its normal mode.

To boot a Windows 2000 computer into Safe mode, press the F8 key during the operating system selection phase of the boot sequence to display the Boot menu. By selecting an entry on the Boot menu, you can start the system with any one of several advanced boot options, including Safe Mode. In addition to the basic Safe Mode option, which does not include networking support, you can also select Safe Mode With Networking, which adds basic network connectivity. Another option, Safe Mode With Command Prompt, boots to a command prompt without loading the Windows 2000 graphical user interface.

Figure 2.14 Windows 2000 in Safe mode

Using Advanced Boot Options

Apart from the Safe mode options, the Boot menu also contains other advanced boot options, including the following:

  • Enable Boot Logging. This option logs the loading and initialization of drivers and services for troubleshooting boot problems. All drivers and services that Windows 2000 loads and initializes or that it does not load in a file are logged. By examining this log, you can sometimes trace the cause of a system malfunction to a driver or service load failure, and address the problem by replacing or reinstalling the offending module. The log file, Ntbtlog.txt, is located in the system folder (C:\Winnt, by default). All three versions of Safe mode automatically create this boot log file.
  • Enable VGA Mode. This option loads Windows 2000 in the normal manner, except that a basic VGA video driver is substituted for the previously installed driver.
  • Last Known Good Configuration. This option starts Windows 2000 using the registry information Windows 2000 saved during the previous system shutdown.
  • Directory Services Restore Mode. This option boots the computer into a state that permits the restoration of the Active Directory database from an external storage medium, such as magnetic tape backup. This option is functional only on computers running Windows 2000 Server that are functioning as domain controllers.
  • Debugging Mode. This option turns on debugging, an advanced feature that administrators can use to attempt to track down problems in programming code. This option is provided only on computers running Windows 2000 Server.
  • Boot Normally. This option, although listed with the other advanced boot options, enables you to exit the Advanced Boot Options menu and proceed with a normal boot.

Creating a Parallel Installation

Another technique for gaining access to a computer running the Windows 2000 operating system that fails to boot properly is to create a parallel installation. A parallel installation is a second copy of the operating system, installed into a different folder, or preferably a different partition. Performing a parallel installation adds a second instance of Windows 2000 to the Boot menu, enabling you to select either one as you start the computer.

To create a parallel installation, install Windows 2000 all over again in the normal manner, specifying a different partition in which to place the operating system. If your computer has only one partition, you can conceivably install the second copy in the same partition, using a system directory other than C:\Winnt. However, this presents some danger, because both copies of Windows 2000 try to store files in the Program Files folder and the Documents and Settings folder, possibly overwriting each other.

One of the main advantages of having a parallel installation is that it enables you to access drives formatted using the NTFS file system. If your primary Windows 2000 installation fails to boot because some of the operating system files have been corrupted, you can try to repair the system by replacing the damaged files with new copies. If your computer uses the file allocation table (FAT) file system on its drives, you can replace the files by booting the computer using a standard DOS boot disk. However, if your drives use NTFS, you can't access them using DOS. By booting into your secondary copy of the operating system, you can access all of your NTFS drives and overwrite the damaged files with new copies as needed.

Using the Recovery Console

The Windows 2000 Recovery Console is a command-line interface with a limited set of administrative commands that perform a variety of troubleshooting and recovery tasks, including the following:

  • Starts and stops services
  • Reads and writes data on a local drive (including drives that are formatted with the NTFS file system)
  • Formats hard disks

Installing and Starting the Recovery Console

To install the Recovery Console, you must have access to the Windows 2000 Server distribution files, either on CD-ROM or on a network distribution share. Use the following procedure to perform the installation:

  1. Click Start and select Run to open the Run dialog box.
  2. Click Browse and navigate to the \I386 directory on the Windows 2000 Server CD_ROM or network distribution share.
  3. Select the Winnt32.exe program file and click Open. The path to the program file appears in the Run dialog box.
  4. Add the /cmdcons parameter to the Winnt32.exe command line and click OK. A Windows 2000 Setup box appears, prompting you to confirm that you want to install the Recovery Console.
  5. Click Yes. The Windows 2000 Setup installs the software and displays a final Microsoft Windows 2000 Server Setup box.
  6. Click OK.

After you install the Recovery Console, you can access it from the Please Select The Operating System To Start menu displayed during the system boot process. After you start the Recovery Console, you must specify which installation of Windows 2000 you want to log on to (if you have a dual-boot or multiple-boot configuration), and then you must supply the password for the (local) Administrator user account.

Running the Recovery Console from CD-ROM

If you encounter a problem booting a Windows 2000 computer that does not have the Recovery Console already installed on it, you can also run it directly from the Windows 2000 CD-ROM, using the following procedure:

  1. Insert the Windows 2000 Server CD-ROM into the CD-ROM drive and restart the computer. If your computer or the workstation you want to repair does not have a bootable CD-ROM drive, insert your Windows 2000 Setup Boot disk into your floppy disk drive, and then insert the additional Windows 2000 Setup disks when you are prompted to do so.
  2. On the Windows 2000 Server Setup screen, type R to repair a Windows 2000 installation. The Windows 2000 Repair Options screen appears. Notice that you can repair a Windows 2000 installation using either the Recovery Console or the Emergency Repair Process.
  3. Type C to start the Recovery Console. The computer displays the Microsoft Windows 2000 Recovery Console screen, which contains a list of the Windows 2000 installations found on the computer.
  4. Type the number corresponding to the Windows 2000 installation you want to repair, and then press Enter. If there is only one installation, type 1 and press Enter.
  5. Type the (local) Administrator password for the installation you selected and then press Enter. A command prompt then appears. You can now enter Recovery Console commands. Type help and press Enter for a list of the available commands.

Using the Recovery Console

The Recovery Console takes the appearance of a standard Windows 2000 command prompt, with many of the same commands. Table 2.4 describes the functions of some of these commands.

Table 2.4 Windows 2000 Recovery Console Commands

Command | Description
Chdir (cd) | Displays the name of the current folder or changes the current folder
Chkdsk | Checks a disk and displays a status report
Cls | Clears the screen
Copy | Copies a single file to another location
Delete (del) | Deletes one or more files
Dir | Displays a list of files and subfolders in a folder
Disable | Disables a system service or a device driver
Enable | Starts or enables a system service or a device driver
Exit | Exits the Recovery Console and restarts the computer
Fdisk | Manages partitions on the computer's hard disks
Fixboot | Writes a new partition boot sector onto the system partition
Fixmbr | Repairs the master boot record of the partition boot sector
Format | Formats a disk
Help | Lists the commands that you can use in the Recovery Console
Logon | Logs on to a Windows 2000 installation
Map | Displays the drive letter mappings
Mkdir (md) | Creates a folder
More | Displays a text file
Rmdir (rd) | Deletes a folder
Rename (ren) | Renames a single file
Systemroot | Sets the current folder to the system root folder
Type | Displays a text file

After you have finished using the Recovery Console, type exit at the command prompt and press Enter. Windows 2000 then closes the console and reboots the computer.

Exercise 2.4: Using the Windows 2000 Recovery Console

In this exercise, you use the Windows 2000 Recovery Console to troubleshoot a Windows 2000 installation that does not boot. You also use the Listsvc command to view the services running on the computer and then use the Disable command to disable the Alerter service.

Procedure 1: Creating a System Boot Failure

In this procedure, you sabotage a Windows 2000 installation to prevent it from booting properly so that you can repair the problem using the Recovery Console.

Do not perform this procedure on a production computer. Use a lab computer that you can safely use for experimentation.
  1. Open Windows Explorer.
  2. Browse to the root of the C drive and locate a file called Ntldr.
  3. Rename the Ntldr file to Oldntldr.
  4. Restart the computer and note how it fails to fully load Windows 2000.

Procedure 2: Using the Recovery Console to Repair the Installation

In this procedure, you boot the computer from the Windows 2000 Server CD-ROM and use the Recovery Console to correct the problem that is preventing Windows 2000 from loading.

  1. Insert the Windows 2000 Server distribution CD into the CD-ROM drive and restart the computer.
  2. Type R to repair a Windows 2000 installation. The Windows 2000 Repair Options screen appears.
  3. Type C to start the Recovery Console.
  4. Type 1 and then press Enter.
  5. Enter the Administrator password and press Enter. A C:\Winnt command prompt appears.
  6. Type cd .. and press Enter to change to the root folder (C:\). (Be sure to include a space between the "cd" and the ".." characters in the command.)
  7. Type copy oldntldr ntldr and press Enter.
  8. Remove the CD-ROM from the drive.
  9. Type exit and press Enter. The computer reboots and should start normally.

Procedure 3: Using the Windows 2000 Recovery Console

In this procedure, you use the Recovery Console's Help command to view the available commands. You then use the Listsvc and Disable commands to display the services running on the computer and disable the Alerter service. This procedure assumes that you have already installed the Recovery Console on the computer, using the procedure outlined earlier in this lesson.

  1. Restart the computer.
  2. From the Boot Loader menu, select Microsoft Windows 2000 Recovery Console. The Windows 2000 Recovery Console starts up and prompts you to select which Windows 2000 installation you want to log on to.
  3. Type 1 and then press Enter.
  4. Enter the password for the Administrator account and press Enter.
  5. Type help and then press Enter to see the list of available commands. Notice the Listsvc command. You can use this command to view all available services.
  6. Scroll through the list of commands, type listsvc, and press Enter. Then scroll through the list of available services.
  7. Press Esc to stop.
  8. Type disable /? and then press Enter. The Disable command allows you to disable a Windows service or driver.
  9. Type disable alerter and then press Enter. The Recovery Console displays several lines of text describing how the registry entry for the Alerter service has been modified. The Alerter service is now disabled.
  10. Type exit and then press Enter to restart your computer.

Procedure 4: Restarting the Alerter Service

In this procedure, you confirm that the Alerter service has been disabled and then restart it.

  1. Start the computer in the usual manner and log on as Administrator.
  2. From the Administrative Tools program group, open the Computer Management window.
  3. Expand Services And Applications, and then click Services. Notice that the Startup Type value for the Alerter service is disabled.
  4. Double-click Alerter, change the Startup Type option to Automatic, and then click OK.
  5. Right-click Alerter, and then click Start.
  6. Close the Computer Management window.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next chapter. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Which of the following advanced boot options is functional only on a Windows 2000 Server domain controller?
    1. Enable Boot Logging
    2. Last Known Good Configuration
    3. Directory Services Restore Mode
    4. Debugging Mode
  2. Which of the following is the primary advantage of having a parallel installation?
    1. You can enable and disable services from the command prompt.
    2. You can access NTFS drives when Windows 2000 fails to boot.
    3. You can bypass the system's video driver.
    4. You can access FAT file system drives.

Lesson Summary

  • Safe mode is a Windows 2000 boot option that enables you to load the operating system with a basic set of drivers that provides access to the system, while bypassing the more advanced features that might be causing a problem.
  • Windows 2000 includes a variety of advanced boot options that enable you to start the computer in various configurations suited to particular types of maintenance and troubleshooting tasks.
  • A parallel installation is a second copy of Windows 2000 installed on the same computer in a different folder or partition. The parallel installation provides the ability to access the system drives in the event that the primary copy of the operating system fails to boot.
  • The Windows 2000 Recovery Console is a command-line interface to the computer that enables you to perform basic system maintenance and troubleshooting tasks without loading the complete operating system.


Managing Storage Resources

About This Chapter

Data storage is one of the primary functions of a data network, and one of the most important jobs of the network administrator is to ensure that users and applications have sufficient space to store their data and to keep that data available at all times. In this chapter, you learn about the types of data storage provided by Microsoft Windows 2000 and how you can use them in a network environment.

Before You Begin

To perform the exercises in this chapter, you need a computer with Microsoft Windows 2000 Server properly installed and operating.


Lesson 1: Managing Data Storage

Windows 2000 supports two types of disk storage: basic storage and dynamic storage. Each of the hard disk drives in a Windows 2000 computer must be either basic or dynamic; you cannot use both storage types on one drive. In a computer with more than one drive, however, you can use either basic or dynamic storage on each one. This lesson examines the characteristics of basic storage, the tools you use to manage basic disks, and the most common tasks you perform as a part of installing and maintaining disk drives on Windows 2000 computers.

After this lesson, you will be able to

  • Understand how basic storage works
  • Use the Disk Management console
  • Initialize, partition, and format a basic disk drive

Estimated lesson time: 50 minutes

Using Basic Storage

Basic storage is the traditional industry standard for hard disk drive management. All versions of Windows, along with MS-DOS, support basic storage. A disk that is initialized for basic storage is called a basic disk. For Windows 2000, basic storage is the default, so all disks are basic disks until you convert them to dynamic storage. In basic storage, a hard disk is divided into units called partitions (see Figure 3.1). A partition is a portion of the disk that functions as a physically separate unit of storage.

Windows 2000 recognizes two types of partitions: primary and extended. After you create a partition, you must format it with a specific file system-NT file system (NTFS), file allocation table (FAT), or file allocation table 32 (FAT32). The file system that you choose affects disk operations, such as how you control user access to data, how you store data, how much hard disk capacity you have, and which operating systems can gain access to the data on the hard disk.

Whether you are allocating the remaining free space on the hard disk drive where you installed Windows 2000 or installing a new hard disk drive, you must be aware of the tasks that are required to prepare a basic disk before you can store data on it. These tasks are as follows:

  1. Initialize the disk to use the basic storage type. Initialization defines the fundamental structure of a hard disk.
  2. Create partitions on the disk.
  3. Format the partitions on the disk.
Figure 3.1 Basic storage
Newly installed disks are basic disks by default. The only time you have to perform an initialization to create a basic disk is when you are converting an existing dynamic disk.

Understanding Partition Types

You can divide a basic disk into primary and extended partitions. Partitions function as physically separate storage units. This kind of storage allows you to separate different types of information, such as user data on one partition and applications on another. You can also install different operating systems on each partition (or multiple copies of the same operating system) to create a dual-boot or multiboot system. A basic disk can contain up to four primary partitions, or up to three primary partitions and one extended partition, for a maximum of four partitions. Only one of the partitions on a basic disk can be an extended partition, as shown in Figure 3.2.

Figure 3.2 Basic disk partition types

Primary Partitions

Windows 2000 can use the parts of a disk called primary partitions to start the computer. Only a primary partition can be marked as the active partition. The active partition is where the hardware looks for the boot files to start the operating system. Only one partition on a single hard disk can be active at a time. Multiple primary partitions allow you to isolate different operating systems or types of data.

The Windows 2000 system partition is the active partition that contains the hardware-specific files required to load the operating system. The Windows 2000 boot partition is the primary partition or logical drive where the operating system files are installed. The boot partition and the system partition can be the same partition. However, the system partition must be on the active partition, typically drive C, whereas the boot partition could be on another primary partition or on an extended partition.

Extended Partitions

An extended partition is created from whatever free space remains on the disk after the creation of the primary partitions. Only one extended partition can exist on a hard disk, so you should include all of the remaining free space when you create an extended partition. Unlike primary partitions, you don't format extended partitions or assign drive letters to them. Instead, you divide the extended partition into segments called logical drives. Each logical drive is assigned a drive letter and formatted with a file system.

Removable storage devices contain only primary partitions. Furthermore, you cannot create extended partitions or logical drives on removable storage devices. You also can't mark as active a primary partition on a removable storage device.

Selecting a File System

Windows 2000 supports three file systems on hard disks: NTFS, FAT, and FAT32. NTFS is the file system to use when you require a partition to have file-level and folder-level security, disk compression, disk quotas, or encryption. However, only Windows 2000 and Windows NT can access data on a local hard disk that is formatted with NTFS. If you plan to use a Windows 2000 server as a domain controller, you must create at least one NTFS partition to store the Active Directory database.

FAT and FAT32 allow access by, and compatibility with, other operating systems. To dual boot Windows 2000 with another operating system, you must format the active partition using a file system that is compatible with both. For example, if you format the active partition using the NTFS file system, you cannot dual boot with Microsoft Windows 98, because it does not support NTFS. Therefore, you must format the system partition with either FAT or FAT32. FAT and FAT32 do not offer many of the features that NTFS supports, such as file-level security. Therefore, in most situations, you should format the hard disk with NTFS. FAT or FAT32 works well only when you anticipate the need to access the disk with another operating system, such as in a dual-boot environment.

Using the Disk Management Snap-In

The Windows 2000 tool that you use to perform most storage management tasks is a snap-in module for the Microsoft Management Console (MMC) called Disk Management. The Disk Management snap-in can display listings of the disks and volumes in the computer, as well as a graphical view, as shown in Figure 3.3. You can access the Disk Management snap-in by using the Computer Management console found in the Administrative Tools program group, or make it part of a custom console.

For more information about using MMC, snap-ins, and custom consoles, see Lesson 2 in Chapter 1, "Networking with Microsoft Windows 2000."
Figure 3.3 The Disk Management snap-in

The following sections examine some of the most common disk management tasks.

Viewing and Updating Information

The Properties dialog box for a selected disk or volume provides a concise view of all of its parameters, as detailed in the following sections.

Disk Properties

To view the properties of a disk in the Disk Management snap-in, in the Graphical View window, right-click the name of a disk (do not click one of its volumes). From the pop-up menu, select Properties. Table 3.1 describes the information displayed in the Properties dialog box for a disk.

Table 3.1 Information Found in the Properties Dialog Box for a Disk

Category | Description
Disk | The number of the disk as referenced by the operating system, beginning with Disk 0
Type | The type of storage used by the disk: basic, dynamic, or removable
Status | The current status of the disk: online, offline, foreign, or unknown
Capacity | The total storage capacity of the disk
Unallocated Space | The amount of available free space on the disk
Device Type | The type of disk device: Integrated Device Electronics (IDE) or Small Computer System Interface (SCSI)
Hardware Vendor | The name of the disk's manufacturer and its model number
Adapter Name | The type of host adapter to which the disk is attached
Volumes Contained On This Disk | A list of the volumes on the disk and their capacities

Refresh and Rescan

When you are working with the Disk Management snap-in, you might need to update the information in the display. The two commands for updating the display are Refresh and Rescan. Refresh updates drive letter, file system, volume, and removable media information, and determines whether unreadable volumes are now readable. To update this information, from the Action menu, select Refresh.

Rescan Disks updates hardware information. When Disk Management rescans disks, it scans all attached disks for configuration changes. It also updates information on removable media, CD-ROM drives, basic partitions, logical drives, file systems, and drive letters. Rescanning disks can take several minutes, depending on the number of hardware devices installed. To perform a rescan, from the Action menu, select Rescan Disks.

Managing Disks on a Remote Computer

In addition to managing the disks on the local computer, you can also use the Disk Management snap-in to work with disks on other Windows 2000 computers. To use remote management, the user on the client computer (the computer running the snap-in) must be a member of the Administrators or Server Operators group on the remote computer. The user account must also be in the same domain (or a trusted domain) as the remote computer, or in the case of a workgroup, have an account with the same logon name and password on both computers.

To have a domain requires that at least one computer running one of the Windows 2000 Server products be configured as a domain controller on your network.

If you are in a workgroup, you can also manage disks on a remote computer running Windows 2000, if you have an account with the exact same username and password set up on both the local and remote computers. The passwords must match or the service fails, and you are unable to manage the disks on the remote computer. When these requirements are met, administering disks on a remote computer is no different from working with local disks.

To manage one computer from another computer-remote management-open the Computer Management console, at the top of the scope pane, right-click the Computer Management (Local) heading, and from the pop-up menu, select Connect To Another Computer. Browse to the computer you want to manage and click OK. After the console connects to the remote computer, you can open the Disk Management snap-in and work with the disks.

Creating Partitions

When using basic storage, the first step in readying a disk for use is to create one or more partitions on it. If you start the Windows 2000 installation process with a clean disk drive, the setup program creates the first partition on the disk for you. When the program displays a list of the drives in the computer, select one and specify the size of the partition you want to create. The partition that the setup program creates during the installation is a primary partition, and it is also an active partition so that the computer can access the Windows 2000 boot files from it.

After you have completed the Windows 2000 installation, you can proceed to create additional partitions (assuming that the active partition you created during the installation does not occupy the entire disk). When you run the Disk Administrator snap-in for the first time, in the graphical disk display, you see that the disk you chose for the installation contains one partition, and any remaining space is unallocated, as shown in Figure 3.4.

Figure 3.4 Disk 0, containing unallocated space that you can use to create partitions

To create a partition out of the unallocated space, use the following procedure:

  1. From the Administrative Tools program group on the Start menu, select Computer Management.
  2. In the scope pane (on the left), expand the Storage heading and select Disk Management.
  3. Right-click the Unallocated area of the disk and from the pop-up menu, choose Create Partition to launch the Create Partition Wizard.
  4. Click Next to bypass the Welcome page and proceed to the Select Partition Type page (see Figure 3.5).

    Figure 3.5 The Select Partition Type page
  5. Click the option button for the type of partition you want to create, primary or extended, and click Next to proceed to the Specify Partition Size page (see Figure 3.6).

    Figure 3.6 The Specify Partition Size page
  6. Specify the size of the partition you want to create (in megabytes), and click Next. If you elected to create an extended partition, the wizard displays the Completing The Create Partition Wizard page. Click Finish to close the wizard and create the partition. If you chose to create a primary partition, click Next to advance the wizard to the Assign Drive Letter Or Path page (see Figure 3.7).

    Figure 3.7 The Assign Drive Letter Or Path page
  7. Click the option button that specifies whether you want to assign a drive letter to the partition (and select a drive letter), mount the partition as a folder on another volume in the computer (and select a volume), or do neither, and click Next to proceed to the Format Partition page (see Figure 3.8).

    Figure 3.8 The Format Partition page
  8. Click the option button specifying whether you want to format the partition. If you elect to format the partition, use the controls in the Formatting box to specify the file system you want to use, the allocation unit size, the volume label, and whether you want to perform a quick format, enable file and folder compression, or both. Click Next to proceed to the Completing The Create Partition Wizard page.
  9. Click Finish to create the partition and format the drive (if you elected to do so). When the process is completed, the new partition appears in the Disk Management display, as shown in Figure 3.9.
    After you create a partition on a basic disk, you cannot modify its size or convert between primary and extended partitions other than to delete it completely (erasing all data stored there) and recreate it.
    Figure 3.9 The Disk Management snap-in, displaying a newly created and formatted primary partition

Creating Logical Drives

If you choose to create an extended partition on a disk, the Create Partition Wizard does nothing more than create the partition and display it as Free Space in the Disk Management snap-in, as shown in Figure 3.10.

Figure 3.10 The Disk Management snap-in, displaying a newly created extended partition

Notice that the new partition does not appear in the volume list at the top of the display like the primary partition did. The reason is because the new extended partition has no volumes yet and has not been formatted. Before you can use the extended partition, you must create one or more logical drives out of the allocated space by completing the following Disk Management steps:

  1. Right-click the extended partition and, from the pop-up menu, select Create Logical Drive to launch the Create Partition Wizard.
  2. Click Next to bypass the Welcome page and proceed to the Select Partition Type page.
  3. Notice that, in this case, the Select Partition Type page (see Figure 3.11) has a third partition type option, Logical Drive, which is already selected, and that Primary Partition and Extended Partition are unavailable. Click Next to proceed to the Specify Partition Size page.

    Figure 3.11 The Select Partition Type page, displaying the only possible option when creating a logical drive
  4. Specify the size of the logical drive you want to create, in megabytes, and click Next to proceed to the Assign Drive Letter Or Path page.
  5. Click the option button that specifies whether you want to assign a drive letter to the logical drive (and select a drive letter), mount the logical drive as a folder on another volume in the computer (and select a volume), or do neither, and click Next to proceed to the Format Partition page.
  6. Click the appropriate option button specifying whether you want to format the logical drive. If you elect to format the logical drive, use the controls in the Formatting box to specify the file system you want to use, the allocation unit size, the volume label, and whether you want to perform a quick format, enable file and folder compression, or both. Click Next to proceed to the Completing The Create Partition Wizard page.
  7. Click Finish to create the logical drive and format it (if you elected to do so). When the process is completed, the new logical drive appears as a volume in the Disk Management display.

If the logical drive you created is smaller than the extended partition, the Disk Management snap-in displays both the new volume and the remaining Free Space in the partition, as shown in Figure 3.12. You can continue to create the logical drive using the remaining free space until all of it has been allocated.

Figure 3.12 The Disk Management snap-in, displaying each logical drive you create as a separate volume

Formatting

If you create a primary partition or a logical drive and you do not format it, it appears as a volume in the Disk Management snap-in. However, as you can see in the volume listing for drive H in Figure 3.13, no file system is specified for the volume.

Figure 3.13 The Disk Management snap-in, displaying no file system for an unformatted volume

Before you can store data on the volume, you must format it by completing the following Disk Management steps. You can also use this procedure to reformat an existing volume using the same or a different file system.

  1. Right-click the logical drive and, from the pop-up menu, select Format to display the Format dialog box, as shown in Figure 3.14.

    Figure 3.14 The Format dialog box
  2. Specify a volume label for the drive to be formatted, select the file system you want to use, the allocation unit size, and whether you want to perform a quick format, enable file and folder compression, or both.
  3. Click OK.
  4. Click OK again to confirm that you want to format the volume, erasing all data currently stored there.

Converting FAT to NTFS

If you have a volume that is formatted with FAT or FAT32, Windows 2000 provides a command-line program called Convert.exe that enables you to convert it to NTFS without having to reformat the volume or erase the data. To perform this task, you run Convert.exe from a command prompt using the following syntax:

Convert volume /FS:NTFS /V

Note that volume is replaced by the drive letter of the volume you want to convert, followed by a colon. The /V parameter indicates that the program should run in Verbose mode. For example, if you wanted to convert drive C from FAT to NTFS, you would type the following command:

Convert C: /FS:NTFS /V

If you run the Convert.exe command on the system volume, that is, the volume where the Windows 2000 operating system files are stored, the program cannot perform the conversion immediately without interrupting vital system functions. Instead, Convert.exe performs the file system conversion the next time you restart the computer and load Windows 2000.

Exercise 3.1: Understanding Windows 2000 Storage Terminology

Match the terms in the left column with the statements in the right column.

  1. Extended partition
  2. Logical drive
  3. Primary partition
  4. System partition
  5. Unallocated space
  1. Can be made active
  2. Contains the operating system files
  3. The unpartitioned part of a disk
  4. Only one permitted per basic disk
  5. Part of an extended partition
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Which of the following steps is not required when installing a new basic disk in a Windows 2000 computer?
    1. Specify a storage type (basic or dynamic).
    2. Create a partition.
    3. Create logical drives.
    4. Format the volumes.
  2. What is the maximum number of primary partitions permitted on a basic disk?
    1. None
    2. One
    3. Three
    4. Four
  3. Why doesn't Windows 2000 format all of its drives using the NTFS file system?

Lesson Summary

  • Windows 2000 supports two storage types: basic storage and dynamic storage. All drives use basic storage by default.
  • To store data on a basic disk, you must first partition it. Two types of partitions exist: primary and extended. You can create up to four primary partitions on a basic disk, or three primary partitions plus one extended partition. You can then create multiple logical drives out of the extended partition.
  • You use the Windows 2000 Disk Management snap-in to perform most storage management tasks on both basic and dynamic disks.


Lesson 2: Creating Dynamic Disks

In addition to basic storage, Windows 2000 also includes a new feature called dynamic storage that provides you with greater storage management flexibility. With dynamic storage, instead of creating multiple partitions like on a basic disk, you create a single partition that includes the entire disk. A disk that you initialize for dynamic storage is a dynamic disk. Once the partition is created on a dynamic disk, divide the disk into volumes, which can consist of a portion or portions of one or more physical disks. On a dynamic disk, you can create simple volumes, spanned volumes, and striped volumes.

After this lesson, you will be able to

  • Convert a basic disk to a dynamic disk
  • Understand the dynamic volume types
  • Create and manage dynamic volumes

Estimated lesson time: 50 minutes

Dynamic storage eliminates the primary partitions, extended partitions, and logical drives used in basic storage. The volumes that replace them are more flexible in that you can extend them to include more space without reformatting them or restarting Windows 2000, as well as create spanned volumes and stripe sets that encompass multiple disks. You create a dynamic disk by upgrading a basic disk.

Dynamic disks are accessible only by Windows 2000, no matter which file system you use to format the volumes.

Changing the Storage Type

You can upgrade a disk from basic storage to dynamic storage at any time, with no loss of data. When you upgrade a basic disk to a dynamic disk, any existing primary partitions on the basic disk become simple volumes on the dynamic disk. If an extended partition is on the basic disk, each logical drive becomes a separate simple volume, as does any remaining space that is left unallocated. Existing striped or spanned volume sets created with Windows NT 4 become dynamic striped or spanned volumes, respectively. Table 3.2 summarizes the results of converting a disk from basic storage to dynamic storage.

Table 3.2 Basic Disk to Dynamic Disk Conversion Parameters

Basic Disk Organization | Dynamic Disk Organization
System partition | Simple volume
Boot partition | Simple volume
Primary partition | Simple volume
Extended partition | Simple volume for each logical drive and any remaining unallocated space
Logical drive | Simple volume
Volume set | Spanned volume
Stripe set | Striped volume

Upgrading Basic Disks to Dynamic Disks

To upgrade a disk to dynamic storage, it must contain at least 1 MB of free space for the upgrade to succeed. Before you upgrade disks, close any programs that are running on those disks.

Always back up the data on a disk before converting the storage type.

To upgrade a basic disk to a dynamic disk, complete the following steps:

  1. Log on to the computer as Administrator.
  2. From the Administrative Tools program group on the Start menu, select Computer Management.
  3. In the scope pane (on the left), expand the Storage heading and select Disk Management. Notice that the storage type for Disk 0 is Basic.
    If the Upgrade Disk Wizard starts automatically, click Cancel. This wizard might start if your computer contains a disk configured for basic storage that does not contain the Windows 2000 boot partition.
  4. In the Disk Management snap-in's graphical disk display (in the lower-right pane of the Computer Management window), right-click Disk 0, and then from the pop-up menu, select Upgrade to Dynamic Disk to display the Upgrade to Dynamic Disk dialog box, as shown in Figure 3.15.

    Figure 3.15 The Upgrade To Dynamic Disk dialog box
  5. Ensure that Disk 0 is the only disk selected for upgrade, and then click OK to display the Disks To Upgrade dialog box (see Figure 3.16).

    Figure 3.16 The Disks To Upgrade dialog box
  6. Click Upgrade. A Disk Management dialog box appears, warning that after this upgrade, you cannot start previous versions of Windows from any volumes on this disk.
    If you are dual booting with another operating system, such as Windows 98 loaded on drive C, this operating system will no longer run after the conversion to dynamic storage. Only Windows 2000 can access a dynamic disk.
  7. Click Yes. An Upgrade Disks dialog box appears, notifying you that file systems on any of the disks to be upgraded are forced to dismount.
  8. Click Yes. A Confirm message box appears notifying you that a reboot will occur to complete the upgrade process.
  9. Click OK to restart the computer and perform the conversion.
If a System Settings Change dialog box appears after the computer reboots, prompting you to restart your computer again, click Yes. After the computer restarts and you log on as Administrator, if you see this same System Settings Change message box again prompting you to restart your computer, click No. Restarting the computer again is not necessary.

To confirm that the upgrade has occurred, open the Disk Management snap-in after the computer has restarted. Note that Disk 0 is now listed as a dynamic disk, and that the existing partitions and logical drives have been converted to simple volumes, as shown in Figure 3.17. Now that you have upgraded a basic disk to a dynamic disk, you can create and work with its volumes.

Figure 3.17 The Disk Management snap-in, showing a newly created dynamic disk

Reverting to a Basic Disk from a Dynamic Disk

You can also change a dynamic disk back to a basic disk, but to do so, you must first remove all of the volumes from the dynamic disk, which causes all of the data on them to be lost. After the volumes are deleted, to change the dynamic disk back to a basic disk, right-click the dynamic disk that you want to change and, from the pop-up menu, select Revert To Basic Disk.

If you have converted the system drive to a dynamic disk, then the Revert To Basic Disk option is not present, because you cannot delete the Windows 2000 system volume. The only way to return to a basic storage configuration on the system disk is to completely reinstall the operating system and create a new partition.

Understanding Volume Types

After you have converted basic disks to dynamic storage, you can create Windows 2000 volumes. Creating multiple volumes on a single hard disk allows you to efficiently organize data for tasks such as backing up. For example, you can create three volumes on a disk, each consisting of one third of the space, and use one volume for the operating system, one for applications, and one for data. Then, when you back up your data, you can back up the entire volume instead of just a specific folder. You can create three types of volumes on dynamic disks:

  • Simple volumes. A simple volume contains disk space from a single disk and provides no fault tolerance.
  • Spanned volumes. A spanned volume includes disk space from multiple disks (up to 32). Windows 2000 writes data to a spanned volume on the first disk, completely filling the space, and continues in this manner through each disk that you include in the spanned volume. A spanned volume is not fault tolerant. If any disk in a spanned volume fails, the data in the entire volume is lost.
  • Striped volumes. A striped volume combines areas of free space from multiple hard disks, up to 32, into one logical volume. In a striped volume, Windows 2000 optimizes performance by adding data to all of the disks at the same rate. If a disk in a striped volume fails, the data in the entire volume is lost.

The following sections examine these volume types more fully.

Working with Simple Volumes

A simple volume consists of part or all of the disk space from a single hard disk. After you create a simple volume, you can format it with the NTFS, FAT, or FAT32 file system, just like a primary partition or logical drive on a basic disk. The main advantage of a simple volume on a dynamic disk is that, when the volume is formatted using NTFS, you can extend it to include unallocated space on the same disk without losing data or restarting the computer.

Creating a Simple Volume

To create a simple volume, use the following procedure:

  1. From the Administrative Tools program group on the Start menu, select Computer Management.
  2. In the scope pane (on the left), expand the Storage heading and select Disk Management.
  3. Right-click the Unallocated area of the disk and from the pop-up menu, choose Create Volume to launch the Create Volume Wizard.
  4. Click Next to bypass the Welcome page and proceed to the Select Volume Type page (see Figure 3.18).
    The options presented on the Select Volume Type page depend on the number and type of disks installed in the computer. On a system with a single hard disk, for example, only the Simple Volume option is active, because at least two disk drives are needed to create a spanned or striped volume.
    Figure 3.18 The Select Volume Type page
  5. Select Simple Volume and then click Next to proceed to the Select Disks page (see Figure 3.19).

    Figure 3.19 The Select Disks page
  6. Specify the size of the simple volume you want to create in the Size box and click Next to proceed to the Assign Drive Letter Or Path page.
    You use the other controls on the Select Disks page only when creating spanned or striped volumes.
  7. Click the option button that specifies whether you want to assign a drive letter to the volume (and select a drive letter), mount the volume as a folder on another volume in the computer (and select a volume), or do neither, and click Next to proceed to the Format Volume page.
  8. Click the appropriate option button specifying whether you want to format the volume. If you elect to format the volume, use the controls in the Formatting box to specify the file system you want to use, the allocation unit size, the volume label, and whether you want to perform a quick format, enable file and folder compression, or both. Click Next to proceed to the Completing The Create Volume Wizard page.
  9. Click Finish to create the volume and format it, if you elected to do so.

Extending a Simple Volume

After you've created a simple volume and formatted it with NTFS, you can extend it to increase its size if unallocated space is still available on the disk. If you extend a volume into another disk, you convert the simple volume to a spanned volume. To extend a simple volume, complete the following steps:

  1. From the Administrative Tools program group on the Start menu, select Computer Management.
  2. In the scope pane (on the left), expand the Storage heading and select Disk Management.
  3. Right-click a simple volume on a dynamic disk with some unallocated space available, and from the pop-up menu, choose Extend Volume to launch the Extend Volume Wizard.
  4. Click Next to bypass the Welcome page and proceed to the Select Disks page.
  5. In the Size box, specify the amount of disk space you want to add to the volume, in megabytes, and click Next to proceed to the Completing The Extend Volume page.
  6. Click Finish to add to the volume the amount of unallocated space you specified.

Note that the new area of the disk you allocated to the volume appears as a separate unit in the Disk Management plug-in's graphical view, as shown in Figure 3.20, but both the original volume and the new addition have the same volume name and drive letter, indicating that they are a single entity. The Volume column contains a list entry only for the entire volume, and if you look at the drive in Windows Explorer, you see that it appears as a single drive with a capacity equal to the sum of the original drive and new addition sizes.

Figure 3.20 An extended volume on a dynamic disk, appearing as two segments

Working with Spanned Volumes

A spanned volume consists of disk space from multiple dynamic disks, joined together into a single data storage unit; spanned volumes enable you to use the total available free space on multiple disk drives more effectively. By deleting smaller volumes and combining them into one spanned volume, you can free drive letters for other uses and create a large volume for file system use. A spanned volume must consist of space from a minimum of two disks and can include space from as many as 32 disks. Spanned volumes can't be part of a striped volume and do not provide any fault tolerance.

You create spanned volumes by combining various-sized areas of free space from 2 to 32 disks into one large, logical volume. The areas of free space that make up a spanned volume can be different sizes and can be located anywhere on the disks. Windows 2000 writes data to spanned volumes by filling up all of the allocated space on one disk before proceeding to the next one. Windows 2000 continues this process in the same way on each subsequent disk until all of the space allocated to the spanned volume is filled.

Creating a Spanned Volume

To create a spanned volume, complete the following steps:

  1. From the Administrative Tools program group on the Start menu, select Computer Management.
  2. In the scope pane (on the left), expand the Storage heading and select Disk Management.
  3. Right-click the Unallocated area of the disk, and from the pop-up menu, choose Create Volume to launch the Create Volume Wizard.
  4. Click Next to bypass the Welcome page and proceed to the Select Volume Type page.
  5. Select Spanned Volume and then click Next to proceed to the Select Disks page.
  6. In the All Available Dynamic Disks list, select the disks that you want to add to the spanned volume, and click Add to insert them into the Selected Dynamic Disks list, as shown in Figure 3.21.

    Figure 3.21 On the Select Disks page, specifying which disks you want to add to the spanned volume
  7. In the Selected Dynamic Disks list, select each one of the disks. In the Size box, specify the amount of disk space, in megabytes, that you want to allocate to the volume. The Total Volume Size indicator specifies what the total capacity of the volume is. Click Next to proceed to the Assign Drive Letter Or Path page.
  8. Click the option button that specifies whether you want to assign a drive letter to the volume (and select a drive letter), mount the volume as a folder on another volume in the computer (and select a volume), or do neither, and click Next to proceed to the Format Volume page.
  9. Click the appropriate option button specifying whether you want to format the volume. If you elect to format the volume, use the controls in the Formatting box to specify the file system you want to use, the allocation unit size, the volume label, and whether you want to perform a quick format, enable file and folder compression, or both. Click Next to proceed to the Completing The Create Volume Wizard page.
  10. Click Finish to create the volume and format it, if you elected to do so.

Extending and Deleting Spanned Volumes

You can extend any spanned volume formatted with NTFS (except for the system volume or the boot volume) by adding free disk space, just like with a simple volume. You can't extend volumes formatted with FAT or FAT32. Disk Management formats the new area and adds it to the volume without affecting any of the existing files. You can also extend a simple volume onto another disk, turning it into a spanned volume in the process. After you extend a volume onto multiple disks (converting it into a spanned volume), it can no longer be part of a striped volume. In addition, after extending a spanned volume, you cannot delete any portion of it without deleting the entire spanned volume.

Working with Striped Volumes

Striped volumes offer better performance than the other Windows 2000 disk management strategies. In a striped volume, Windows 2000 writes data evenly across all of the selected disks in 64 KB units, as shown in Figure 3.22. Because all of the hard disks that make up the striped volume perform the same functions as a single hard disk, Windows 2000 can issue and process concurrent I/O commands simultaneously on all of the disks.

Figure 3.22 A striped volume, which combines the available space on multiple disks while providing superior performance

After writing a 64 KB unit (called a stripe) to the first disk drive, Windows then writes a stripe to the second disk, then the third, and so on. While one drive is physically writing its stripe, the next drive can be moving its heads to the proper location for its upcoming disk write. The process of writing successive stripes can therefore occur with little or no latency caused by drive-head seeking. This process increases the overall speed of system I/O and the overall efficiency of the storage subsystem. Like spanned volumes, however, striped volumes don't provide fault tolerance, and if a disk in a striped volume fails, the entire volume's data is lost. You also cannot extend striped volumes.

To create a striped volume, complete the following steps:

  1. From the Administrative Tools program group on the Start menu, select Computer Management.
  2. In the scope pane (on the left), expand the Storage heading and select Disk Management.
  3. Right-click the Unallocated area of the disk and from the pop-up menu, choose Create Volume to launch the Create Volume Wizard.
  4. Click Next to bypass the Welcome page and proceed to the Select Volume Type page.
  5. Select Striped Volume and then click Next to proceed to the Select Disks page.
  6. In the All Available Dynamic Disks list, select the disks that you want to add to the spanned volume and click Add to insert them into the Selected Dynamic Disks list.
  7. In the Selected Dynamic Disks list, select one of the disks. In the Size box, specify the amount of disk space, in megabytes, that you want to allocate to the volume. A striped volume must use exactly the same amount of space on each of the disks you select, so in the Size box, the maximum amount available for each disk is equal to the space available on the drive with the smallest amount of unallocated space. Click Next to proceed to the Assign Drive Letter Or Path page.
  8. Click the option button that specifies whether you want to assign a drive letter to the volume (and select a drive letter), mount the volume as a folder on another volume in the computer (and select a volume), or do neither, and click Next to proceed to the Format Volume page.
  9. Click the appropriate option button specifying whether you want to format the volume. If you elect to format the volume, use the controls in the Formatting box to specify the file system you want to use, the allocation unit size, the volume label, and whether you want to perform a quick format, enable file and folder compression, or both. Click Next to proceed to the Completing The Create Volume Wizard page.
  10. Click Finish to create the volume and format it, if you elected to do so.

When the striped volume is created and formatted, it appears in the Disk Management snap-in's graphical view as two drives with the same volume name and drive letter, but the volume list shows it as a single entry.

Exercise 3.2: Creating and Mounting a Volume

In this exercise, you use Disk Management to create a new simple volume and then mount the new volume into an existing folder on another volume. To perform this exercise, you need a computer with at least one NTFS volume on a dynamic disk and a dynamic disk drive with some unallocated space in which you can create a volume.

To create and mount a volume, complete the following steps:

  1. In the root folder of an existing NTFS drive, create a new folder called Mount.
  2. From the Administrative Tools program group on the Start menu, select Computer Management.
  3. In the scope pane (on the left), expand the Storage heading and select Disk Management.
  4. Right-click an Unallocated area on one of your disks and from the pop-up menu, choose Create Volume to launch the Create Volume Wizard.
  5. Click Next to bypass the Welcome page and proceed to the Select Volume Type page.

    Notice that Simple Volume is the only available option. Why is this?

  6. Select Simple Volume and then click Next to proceed to the Select Disks page.
  7. In the Size box, specify the amount of disk space, in megabytes, that you want to allocate to the volume. Then click Next to proceed to the Assign Drive Letter Or Path page.
  8. Select Mount This Volume At An Empty Folder That Supports Drive Paths.
  9. Click Browse and browse to the Mount folder you created earlier. Click Next to proceed to the Format Volume page.
  10. Select Format This Volume As Follows and select NTFS in the File System To Use drop-down list. Leave the Allocation Unit Size setting at Default.
  11. Type Mounted Vol in the Volume Label box.
  12. Select Perform A Quick Format, and then click Next to proceed to the Completing The Create Volume Wizard page.
  13. Click Finish to create, format, and mount the volume.
  14. Open Windows Explorer and browse to the Mount folder you created.
  15. Right-click the Mount folder and from the pop-up menu, select Properties to display the Mount Properties dialog box. Notice that the Type indicator specifies that the folder is a mounted volume.
  16. Click Properties to display the Mounted Vol Properties dialog box.

    How much free space is available on the volume?

  17. Click OK to close the Mounted Vol Properties dialog box, and click OK again to close the Mount Properties dialog box.
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Why does a striped volume provide better performance than a spanned volume?
  2. Which of the following conditions is not required to extend a spanned volume?
    1. The volume to be extended must not be the boot volume.
    2. The volume to be extended must use the NTFS file system.
    3. The volume to be extended must be located on a disk with unallocated space.
    4. The volume to be extended must not be the system volume.
  3. How does mounting a simple volume as a folder on another volume affect the capacity of the disk containing the folder?

Lesson Summary

  • Dynamic storage creates a single partition on a disk, after which you can create as many volumes as needed.
  • A simple volume is one that uses space on only one disk. Simple volumes that use NTFS can be extended without reformatting them or restarting the computer.
  • A spanned volume uses disk space on two or more disks to create a single storage entity with the combined capacity of all of the fragments.
  • A striped volume uses disk space on two or more disks to write data in 64 KB stripes on one disk at a time, improving I/O performance.


Lesson 3: Implementing Storage Quotas

One of the features that Windows NT users requested for many years, and which is included in Windows 2000, is the ability to assign and enforce disk quotas for individual users. Network administrators use disk quotas to manage the allocation of storage space in a network environment. A disk quota is a limitation on the amount of disk space that a particular user can occupy on a server volume. Disk quotas are based on the files and folders that users own. You can set quota limits and warning levels for all users and for individual users. You can also monitor the amount of hard disk space that users currently occupy and the amount that they have left before they reach their quotas.

After this lesson, you will be able to

  • Understand the function of disk quotas
  • Create a general disk quota for all users
  • Create disk quotas for individual users

Estimated lesson time: 20 minutes

Understanding Windows 2000 Disk Quota Management

Windows 2000 disk quotas track and control disk usage on a per user, per volume basis, even if the volumes are on the same hard disk. Because Windows 2000 tracks quotas on a per user basis, every user's disk space is accounted for, regardless of the folder in which the user stores files. Table 3.3 describes the characteristics of Windows 2000 disk quotas.

Table 3.3 Disk Quota Characteristics and Descriptions

Characteristic | Description
Disk usage is based on file and folder ownership. | Windows 2000 calculates disk space usage based on the files and folders that users own. When a user copies or saves a new file to an NTFS volume or takes ownership of a file on an NTFS volume, Windows 2000 charges the disk space required to store that file against the user's quota limit.
Disk quotas do not use compression. | Windows 2000 ignores compression when it calculates hard disk space usage. Users are charged for each uncompressed byte, regardless of how much hard disk space is actually used. This way of calculating usage is done partially because file compression produces different degrees of compression for different types of files. Different uncompressed file types that are the same size might become different sizes when they are compressed.
Free space for applications is based on quota limit. | When you enable disk quotas, the free space that Windows 2000 reports to applications for the volume is the amount of space remaining in the user's disk quota limit.
You can apply disk quotas only to Windows 2000 NTFS volumes.

As part of implementing and managing disk quotas, administrators typically perform tasks like the following:

  • Set disk quota limits to specify the amount of disk space that each user can occupy.
  • Set a disk quota warning that specifies when Windows 2000 should create event log entries indicating that users are approaching their quota limits.
  • Specify whether Windows 2000 should enforce disk quota limits by denying users access to additional storage if they exceed their quota, or enable them to continue working normally.
  • Configure Windows 2000 to log an event when a user exceeds a specified disk space threshold. The threshold could be when users exceed their quota limits or when they exceed their quota warning level.

After you enable disk quotas for a volume, Windows 2000 collects disk usage data for all users who own files and folders on the volume. This data enables you to monitor volume usage on a per user basis. By default, only members of the Administrators group can view and change quota settings, but administrators can enable users to view quota settings. In addition, while administrators can have their volume usage monitored, their quotas are never enforced.

Setting Disk Quotas

You can enable disk quotas and create disk quota warnings and limits for all users at once or for specific individual users. To enable disk quotas, right-click an NTFS disk in Windows Explorer and from the pop-up menu, select Properties to open the Properties dialog box. Then click the Quota tab, as shown in Figure 3.23.

Figure 3.23 The Quota tab in the Properties dialog box for a disk

Table 3.4 describes the functions of the options in the Quota tab.

Table 3.4 Disk Quota Options

Option | Description
Enable Quota Management | Select this check box to enable quota management for the disk.
Deny Disk Space To Users Exceeding Quota Limit | Select this check box to prevent users from occupying more disk space than their quota provides. When this option is enabled and users exceed their hard disk space allocation, they receive an Out Of Disk Space message and cannot write to the volume.
Do Not Limit Disk Usage | Select this option when you don't want to impose limits on the amount of hard disk space that users can occupy. Despite the absence of quota limits, however, Windows 2000 still tracks the disk space usage for each user on each volume.
Limit Disk Space To | Select this option to specify the amount of disk space that users can occupy.
Set Warning Level To | Select this option to specify the amount of disk space that users can occupy before Windows 2000 generates a warning, indicating that the users are nearing their limits.
Log Event When A User Exceeds Their Quota Limit | Select this check box to have Windows 2000 generate an event log entry whenever users exceed their quota limits.
Log Event When A User Exceeds Their Warning Level | Select this check box to have Windows 2000 generate an event log entry whenever users exceed their warning levels.
Quota Entries | Click this button to open the Quota Entries dialog box for the selected disk. The Limit Disk Space To and Set Warning Level To options in this tab apply to all users equally. Open the Quota Entries dialog box to create quota limits and warning levels for specific users.

Setting the same quota limit and warning level for all users simple: click the Quota tab of a disk's Properties dialog box, select the Enable Quota Management check box, and specify appropriate amounts of disk space in the Limit Disk Space To box and the Set Warning Level To box. To create different quota limits for multiple users, complete the following steps:

  1. Open the Properties dialog box for an NTFS disk and click the Quota tab.
  2. Select Enable Quota Management.
  3. Click Quota Entries to display the Quota Entries dialog box for the disk you selected, as shown in Figure 3.24.

    Figure 3.24 The Quota Entries dialog box
  4. From the Quota menu, select New Quota Entry to open a Select Users dialog box.
  5. Select a user account and click Add.
  6. Click OK to display the add New Quota Entry dialog box.
  7. Specify the disk space limit and the warning level for the user, and click OK to create the entry.
  8. From the Quota menu, select Close to close the Quota Entries dialog box.
  9. Click OK to close the Properties dialog box and apply your changes.

Determining the Status of Disk Quotas

In the Properties dialog box for a disk, you can determine the status of disk quotas by checking the traffic light icon and by reading the status message to its right:

  • A red traffic light indicates that disk quotas are disabled.
  • A yellow traffic light indicates that Windows 2000 is rebuilding disk quota information.
  • A green traffic light indicates that the disk quota system is active.

Monitoring Disk Quotas

In addition to creating entries, you can also use the Quota Entries dialog box to monitor the amount of disk space occupied by all users who have copied, saved, or taken ownership of files and folders on the volume. Windows 2000 scans the volume and monitors the amount of disk space that each user occupies and then displays the following information in the Quota Entries dialog box:

  • The amount of hard disk space that each user occupies
  • The warning threshold and the disk quota limit for each user
  • Users who are over their quota-warning threshold, which is signified by a yellow triangle
  • Users who are over their quota limit, which is signified by a red circle

Exercise 3.3: Configuring Quota Management Settings

In this exercise, you configure the quota management settings for drive C to limit the data that users can store on the volume. To perform this exercise, you must have a Windows 2000 computer in which C is an NTFS drive.

To configure the quota management settings, complete the following steps:

  1. In Windows Explorer, right-click drive C and from the pop-up menu, select Properties to display the Properties dialog box for the disk.
  2. Click the Quota tab.
  3. Select Enable Quota Management.

    What is the default disk space limit for new users?

  4. Select Deny Disk Space To Users Exceeding Quota Limit.
  5. Click Limit Disk Space To.
  6. Specify a value of 10 MB in the Limit Disk Space To box and 6 MB in the Set Warning Level To box.
  7. Click Apply.

    What happens?

  8. Click OK to enable disk quotas.
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Which file systems must a Windows 2000 drive use to enable disk quota management?
    1. FAT or FAT32
    2. NTFS only
    3. NTFS or FAT32
    4. FAT32 only
  2. When quota management is enabled, how does Windows 2000 track disk space usage?
    1. Per user
    2. Per volume
    3. Per user and per volume
    4. Per user, per volume, and per file system
  3. How do Windows 2000 quotas compensate for data stored compressed volumes?

Lesson Summary

  • Disk quotas are limits that you can impose on the amount of disk space users are allowed to occupy on a particular volume.
  • You can impose disk quotas for all users at once or for each user individually.
  • When quota management is enabled, Windows 2000 monitors the disk space usage for all users, whether or not you choose to enforce the quotas by denying access to users who exceed their designated storage capacity.


Lesson 4: Managing Compression and Encryption

The NTFS file system included with Windows 2000 includes capabilities that enable you to compress or encrypt the files and folders stored on a computer's drives. NTFS compression uses a mathematical algorithm to remove redundant information from files and folders, causing them to occupy less space on the disk drive. Each file and folder on an NTFS volume has a compression state, which is either compressed or uncompressed.

The Microsoft Encrypting File System (EFS) provides encryption for data in NTFS files stored on disk. EFS encryption is public key-based and runs as an integrated system service, making it easy to manage, difficult to attack, and transparent to the file owner. If a user who attempts to access an encrypted NTFS file has the private key to that file, the file can be decrypted so that the user can open the file and work with it transparently as a normal document. A user without the private key is denied access.

Windows 2000 also includes the Cipher command-line utility, which enables you to encrypt and decrypt files and folders from a command prompt. Windows 2000 also provides a recovery agent so that if the owner loses the private key, the recovery agent can still recover the encrypted file.

After this lesson, you will be able to

  • Manage disk compression
  • Compress and uncompress files and folders
  • Encrypt folders and files
  • Decrypt folders and files

Estimated lesson time: 30 minutes

Using Compressed Files and Folders

NTFS compression automatically compresses files and dynamically uncom-presses them as needed. Compressed files can be read and written to by any Microsoft Windows-based or MS-DOS-based application without being manually uncompressed by another program. When an application, such as Microsoft Word, or an operating system command, such as Copy, requests access to a compressed file, NTFS automatically uncompresses the file before making it available. When you close or explicitly save a file, NTFS compresses it again before storing it. This enables you to store more data on a given volume, and the compression processes remain invisible to the end users.

NTFS allocates disk space based on the uncompressed file size. If you copy a compressed file to an NTFS volume with enough space for the compressed file but not enough space for the uncompressed file, you might get an error message indicating that there is not enough disk space for the file. The file is not copied to the volume.

Compressing Files and Folders

To set the compression state of a folder or file, right-click the folder or file in Windows Explorer, select Properties, and then click Advanced. In the Advanced Attributes dialog box, select the Compress Contents To Save Disk Space check box. Click OK, and then in the Properties dialog box, click Apply.

NTFS encryption and compression are mutually exclusive. Therefore, if you select the Encrypt Contents To Secure Data check box, you can't compress the folder or file.
To change the compression state for a file or folder, you must have Write permission for that file or folder.

The compression state for a folder doesn't reflect the compression state of the files and subfolders in that folder. A folder can be compressed, yet all of the files in that folder can be uncompressed. Alternatively, an uncompressed folder can contain compressed files. When you compress a folder, Windows 2000 displays the Confirm Attribute Changes dialog box, which provides the following two additional options:

  • Apply Changes To This Folder Only. This option compresses only the folder that you have selected.
  • Apply Changes To This Folder, Subfolder, And Files. This option compresses the folder and all subfolders and files that are contained within it and those that are added to it subsequently.
Windows 2000 doesn't support NTFS compression for cluster sizes larger than 4 KB because compression on large clusters causes performance degradation. If you select a larger cluster size when you format an NTFS volume, compression isn't available for that volume.

Copying and Moving Compressed Files and Folders

Specific rules determine whether the compression state of files and folders is retained when you copy or move them within and between NTFS and FAT volumes. The following list describes how Windows 2000 treats the compression state of a file or folder when you copy or move a compressed file or folder within or between NTFS volumes or between NTFS and FAT volumes:

  • Copying a file within an NTFS volume. When you copy a file within an NTFS volume, the file inherits the compression state of the target folder. For example, if you copy a compressed file to an uncompressed folder, the file is automatically uncompressed.
  • Moving a file or folder within an NTFS volume. When you move a file or folder within an NTFS volume, the file or folder retains its original compression state. For example, if you move a compressed file to an uncompressed folder, the file remains compressed.
  • Copying a file or folder between NTFS volumes. When you copy a file or folder between NTFS volumes, the file or folder inherits the compression state of the target folder.
  • Moving a file or folder between NTFS volumes. When you move a file or folder between NTFS volumes, the file or folder inherits the compression state of the target folder. Because Windows 2000 treats a move as a copy and then a delete, the files inherit the compression state of the target folder.
  • Moving or copying a file or folder to a FAT volume. Windows 2000 supports compression only for NTFS files. Because of this, when you move or copy a compressed NTFS file or folder to a FAT volume, Windows 2000 automatically uncompresses the file or folder.
  • Moving or copying a compressed file or folder to a floppy disk. When you move or copy a compressed NTFS file or folder to a floppy disk, Windows 2000 automatically uncompresses the file or folder.
When you copy a compressed NTFS file, Windows 2000 uncompresses the file, copies the file, and then compresses the file again as a new file. This might cause performance degradation.

Using NTFS Compression

The following list provides best practices for using compression on NTFS volumes:

  • Because some file types compress more than others, select file types to compress based on the anticipated resulting file size. For example, because Windows bitmap files contain more redundant data than application executable files, this file type compresses to a smaller size. Bitmaps often compress to less than 50 percent of the original file size, whereas application files rarely compress to less than 75 percent of the original size.
  • Do not store compressed files, such as PKZIP files, in a compressed folder. Files can only be compressed once, and Windows 2000's attempt to compress the file again wastes system time and yields no additional disk space.
  • To make it easier to locate compressed data, use a different display color for compressed folders and files.
  • Compress static data rather than data that changes frequently. Compressing and uncompressing files uses system resources. By choosing to compress files that are infrequently accessed, you minimize the amount of system time that is dedicated to compression and uncompression activities.
  • NTFS compression can cause performance degradation when you copy and move files. When a compressed file is copied, it is uncompressed, copied, and then compressed again as a new file. Compress static data rather than data that changes frequently or is copied or moved frequently.

Understanding EFS

EFS enables users to encrypt NTFS files by using a strong public key-based cryptographic algorithm that encrypts all of the files in a folder. As with NTFS compression, EFS works automatically by encrypting files as they are stored on a volume and decrypting them when they are needed by an authorized user. No administrative effort is needed to begin using EFS, and most operations are transparent. Backups and copies of encrypted files remain encrypted, as long as they are in NTFS volumes. Files remain encrypted if you move or rename them, and encryption isn't defeated by temporary files created during editing or by data left unencrypted in the paging file.

You can set policies to recover EFS-encrypted data when necessary. The recovery policy is integrated with overall Windows 2000 security policy. Control of this policy can be delegated to individuals with recovery authority, and different recovery policies can be configured for different parts of the enterprise. Data recovery discloses only the recovered data, not the key that was used to encrypt the file. Several protections are in place to ensure that data recovery is possible and that no data is lost in the event of total system failure.

You can implement EFS either from Windows Explorer or from the command line, and you can also use group policies to enable or disable EFS for a computer, domain, or OU.

To set group policy for the domain or for an OU, your computer must be part of a Windows 2000 domain.

One important factor to consider regarding EFS is that it is stictly for encrypting data as it is stored on an NTFS volume. EFS cannot encrypt data for transmission over a network. To do this, you must use a protocol specifically designed for this purpose, such as Internet Protocol Security (IPsec) or Secure Sockets Layer (SSL).

Some of the key features of EFS are as follows:

  • Transparent encryption. In EFS, file encryption doesn't require the file owner to decrypt and re-encrypt the file on each use. Decryption and encryption happen transparently on file reads and writes to disk.
  • Strong protection of encryption keys. Public-key encryption resists all but the most sophisticated methods of attack. Therefore, in EFS, the file encryption keys that are used to encrypt the file are encrypted by using a public key from the user's certificate. (Note that Windows 2000 uses X.509 v3 certificates.) The list of encrypted file encryption keys is stored with the encrypted file and is unique to it. To decrypt the file encryption keys, the file owner supplies a private key that only the file owner possesses.
  • Integral data recovery. If the owner's private key is unavailable, the recovery system agent can open the file using his or her own private key. There can be more than one recovery agent, each with a different public key, but at least one public recovery key must be present on the system to encrypt a file.
  • Secure temporary and paging files. Many applications create temporary files while you edit a document, and these temporary files can be left unencrypted on the disk. On computers running Windows 2000, EFS is implemented at the folder level, so any temporary copies of an encrypted file are also encrypted, provided that all files are on NTFS volumes. EFS resides in the Windows operating system kernel and uses the nonpaged pool to store file encryption keys, ensuring that they are never copied to the paging file.

Encrypting

The recommended method to encrypt files is to create an NTFS folder and then encrypt the folder. To do so, in the Properties dialog box for the folder, click the General tab. In the General tab, click Advanced, and then select the Encrypt Contents To Secure Data check box. All files placed in the folder are then encrypted, as the folder is now marked for encryption. Folders that are marked for encryption aren't actually encrypted; only the files within the folder are encrypted.

Compressed files can't be encrypted, and encrypted files can't be compressed.

After you encrypt the folder, when you save a file in that folder, the file is encrypted by using file encryption keys, which are fast symmetric keys designed for bulk encryption. The file is encrypted in blocks, with a different file encryption key for each block. All of the file encryption keys are stored and encrypted in the Data Decryption Field (DDF) and the Data Recovery Field (DRF) in the file header.

You use a file that you encrypted just like you would use any other file because encryption is transparent. You don't need to decrypt a file you encrypted before you can use it. When you open an encrypted file, your private key is applied to the DDF to unlock the list of file encryption keys, allowing the file contents to appear in plain text. EFS automatically detects an encrypted file and locates a user certificate and associated private key. You open the file, make changes to it, and save it like you would any other file. However, if someone else tries to open your encrypted file, he or she is unable to access the file and receives an "access denied" message.

Encrypted files can't be shared.

Decrypting

Decrypting a folder or file refers to clearing the Encrypt Contents To Secure Data check box in a folder's or file's Advanced Attributes dialog box, which you access from the Properties dialog box for the folder or file. Once decrypted, the file remains decrypted until you select the Encrypt Contents To Secure Data check box. The only reason you might want to decrypt a file would be if other people needed access to the folder or file; for example, if you want to share the folder or make the file available across the network.

Using the Recovery Agent

If the owner's private key is unavailable, a person designated as the recovery agent can open the file using his or her own private key, which is applied to the DRF to unlock the list of file encryption keys. If the recovery agent is on another computer in the network, send the file to the recovery agent. The recovery agent can bring his or her private key to the owner's computer, but it is never a good security practice to copy a private key onto another computer.

The default recovery agent is the administrator of the local computer unless the computer is part of a domain. In a domain, the domain administrator is the default recovery agent.

It is a good security practice to rotate recovery agents. However, if the agent designation changes, access to the file is denied. Therefore, Microsoft recommends that you keep recovery certificates and private keys until you have updated all files that are encrypted with them.

The person designated as the recovery agent has a special certificate and associated private key that allow data recovery. To recover an encrypted file, the recovery agent would do the following:

  1. Use Backup or another backup tool to restore a user's backup version of the encrypted file or folder to the computer where his or her file recovery certificate is located.
  2. In Windows Explorer, open the Properties dialog box for the file or folder, and in the General tab, click Advanced.
  3. Clear the Encrypt Contents To Secure Data check box.
  4. Make a backup version of the decrypted file or folder and return the backup version to the user.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next chapter. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Which of the following actions can't you perform on a file encrypted with EFS? (Choose all that apply.)
    1. Compress it
    2. Transmit it over the network
    3. Open it with a non-Microsoft application
    4. Copy it to a FAT volume
  2. What happens when you move a compressed NTFS file to an uncompressed folder on another NTFS volume?
  3. EFS can encrypt files in which of the following states?
    1. Uncompressed files stored on NTFS volumes
    2. Uncompressed files stored on FAT volumes
    3. Compressed files stored on NTFS volumes
    4. Compressed files stored on FAT volumes

Lesson Summary

  • Compressed files can be read and written to by any Microsoft Windows-based or MS-DOS-based application without first being uncompressed by another program.
  • The Windows NTFS file system automatically uncompresses the file before making it available, and when you close or explicitly save a file, NTFS compresses it again.
  • NTFS encryption and compression are mutually exclusive.
  • EFS provides the core file encryption technology for storage of NTFS files on disk.
  • EFS enables users to encrypt NTFS files by using a strong public key-based cryptographic scheme that encrypts all files in a folder.
  • You can use EFS to encrypt and decrypt files stored on Windows 2000 computers, but you can't use it to encrypt data that is transferred over the network.


Managing NTFS Permissions

About This Chapter

NT file system (NTFS) provides administrators the ability to regulate access to file system resources on a Windows 2000 computer. An administrator can assign permissions to a user or group that provide a specified degree of access to a file or folder. This chapter examines the nature of NTFS permissions and the process of assigning them.

Before You Begin

To perform the exercises in this chapter, you must have a computer with Windows 2000 installed on it and at least one hard disk formatted to use NTFS. This computer must also be connected to a network with a functioning domain.


Lesson 1: Understanding NTFS Permissions

NTFS permissions are rules associated with file system objects such as files and folders that specify which users can gain access to an object and in what manner. This lesson introduces the standard NTFS folder and file permissions that administrators use most often when controlling access to shared network drives. The lesson also explores the effects of combining file and folder permissions and of combining permissions assigned to user accounts and groups.

After this lesson, you will be able to

  • List the standard NTFS folder and file permissions
  • Describe the result when multiple NTFS permissions are applied to a resource
  • Describe the result when you combine user account and group permissions for a resource

Estimated lesson time: 15 minutes

Understanding NTFS Permissions

After sharing the drives on a computer running Windows 2000 Server, network administrators use NTFS permissions to specify which users and groups can access files and folders and what they can do with the contents of the file or folder. NTFS permissions are available only on NTFS volumes. NTFS permissions are not available on volumes that are formatted with the file allocation table (FAT) or FAT32 file systems. NTFS security is effective whether a user accesses a file or folder at the computer console or over the network. This point is crucial because Windows 2000 also supports share permissions, which are similar in function but regulate user access to shares only over the network. If you want to protect files and folders from unauthorized access by a user, either on the network or at the computer, you must use NTFS permissions.

For more information about shares and share permissions, see Lesson 1 in Chapter 5, "Sharing Drives and Printers."

NTFS permissions you assign for folders are different from the permissions you assign for files. The following sections describe the two types of permissions.

Controlling Access to NTFS Folders

NTFS folder permissions control the access that users have to folders and to the files and subfolders contained within the folder. On a well-organized directory tree, administrators are far more likely to use folder permissions than file permissions, because it is much easier to assign permissions to one folder than to multiple individual files.

Table 4.1 lists the standard NTFS folder permissions that you can assign and the type of access to the folder that each permission provides.

Table 4.1 Standard NTFS Folder Permissions

NTFS Folder Permission | Enables the User or Group To
Full Control | Change folder permissions, take ownership of folders, and delete subfolders and files, plus perform the actions permitted by all of the other NTFS folder permissions.
Modify | Delete the folder, plus perform all actions permitted by the Write permission and the Read & Execute permission.
Read & Execute | Browse through folders to reach other files and folders, even if the user does not have permission to access those folders, and perform all actions permitted by the Read permission and the List Folder Contents permission.
List Folder Contents | See the names of files and subfolders in the folder.
Read | See the files and subfolders in the folder and view the folder ownership, permissions, and file system attributes (such as Read-Only, Hidden, Archive, and System).
Write | Create new files and subfolders within the folder, change the folder attributes, and view the folder ownership and permissions.

In addition to assigning these permissions, you can also explicitly deny folder permissions to a user account or group. Denying permissions overrides the permission assignments that the user or group has inherited from a parent folder. To deny a user account or group all access to a folder, you can explicitly deny the Full Control permission. This strategy prevents the user or group from accessing the folder in any way and even renders the folder invisible to them. You learn more about the process of assigning permissions later, in Lesson 2 of this chapter.

Controlling Access to NTFS Files

NTFS file permissions enable you to control the access that users have to specific files. Table 4.2 lists the standard NTFS file permissions that you can assign to a file and the type of access that each permission provides.

Table 4.2 Standard NTFS File Permissions

NTFS File Permission | Enables the User or Group To
Full Control | Change file permissions and take ownership of files, plus perform the actions permitted by all of the other NTFS file permissions.
Modify | Modify and delete the file, plus perform all of the actions permitted by the Write permission and the Read & Execute permission.
Read & Execute | Run applications, plus perform all of the actions permitted by the Read permission.
Read | Read the file and view the file's attributes, ownership, and permissions.
Write | Overwrite the file, change the file's attributes, and view the file's ownership and permissions.

What Is an Access Control List?

NTFS stores an access control list (ACL) with every file and folder on an NTFS volume. The ACL contains a list of all user accounts and groups that have been granted or denied access to the file or folder, as well as the type of access that they have been granted or denied. When a user attempts to gain access to a resource, the ACL must contain an entry, called an access control entry (ACE), for the user account or a group to which the user belongs. The ACE must permit the type of access that is requested (for example, Read access) for the user to gain access. If no ACE exists in the ACL, the user cannot gain access to the resource.

Managing Multiple NTFS Permissions

A user account can receive permissions to a file or folder from more than one source at the same time. For example, a user can receive permissions to a particular file or folder by having them assigned to the individual user account and to each group of which the user is a member. This occurrence is common, and to use NTFS permissions effectively, you must understand the rules and priorities that are associated with how NTFS combines multiple permissions. You must also understand NTFS permission inheritance.

Permissions Are Cumulative

A user's effective permissions for a resource are the sum of the NTFS permissions that you assign to the individual user account and to all of the groups to which the user belongs. If a user has the Read permission for a folder and is a member of a group with the Write permission for the same folder, the user has both Read and Write access to that folder.

File Permissions Override Folder Permissions

NTFS file permissions take priority over NTFS folder permissions. A user with access to a file can gain access to that file even if he or she does not have access to the folder containing the file. Users can gain access to files for which they have permission by using the full Universal Naming Convention (UNC) or local path to open the file from its respective application, even though the folder in which the file resides is invisible because the users have no corresponding folder permission. In other words, if you do not have permission to access the folder containing the file you want to access, you must know the full path to the file to access it. Without permission to access the folder, you cannot even see the folder, so you cannot browse for the file you want to access.

The Traverse Folder/Execute File special permission grants or denies the ability to move through folders to reach other files or folders, even if the user has no permissions for the traversed folders. For more information about special permissions, see Lesson 3 of this chapter.

Deny Overrides Other Permissions

You can deny a user account or group permission to access a specific file or folder, although this strategy is not the recommended way to control access to resources. Setting the deny permission overrides all instances where that permission is allowed. Even if a user has permission to gain access to the file or folder as a member of a group, denying permission to the user blocks any other permission that the user might have (see Figure 4.1).

Figure 4.1 NTFS permission combination rules

In Figure 4.1, User 1 has the Read permission to the folder and is a member of Group A and Group B. Group B has Write permission to the folder, but Group A has been denied the Write permission for File 2. The end result is that User 1 can read and write to File 1 and also read File 2. However, User 1 cannot write to File 2 because User 1 is a member of Group A, which has been denied Write permission for File 2.

NTFS Permissions Inheritance

By default, the permissions that you assign to a parent folder are inherited by and propagated to the subfolders and files contained in the parent folder. Nevertheless, it is possible to prevent permissions inheritance, as shown in Figure 4.2.

Figure 4.2 Permissions inheritance

Understanding Permissions Inheritance

Files and subfolders can inherit permissions from their parent folder. Whatever permissions you assign to the parent folder can also apply to the subfolders and files that are contained within the parent folder, depending on the inheritance option set for a given object. When you assign NTFS permissions to grant a user or group access to a folder, you are also assigning that user or group the same access to any existing files and subfolders in that folder, as well as to any new files and subfolders created in the folder.

Preventing Permissions Inheritance

To prevent the permissions that you assign to a parent folder from being inherited by the subfolders and files contained within the folder, set an option that prevents a given file or folder from inheriting any rights assigned to its parent folder. If you block the permissions inheritance for a folder, that folder becomes the top parent folder. Permissions that you assign to this folder are still inherited by the subfolders and files that it contains.

Exercise 4.1: Planning NTFS Permissions

In this exercise, you plan how to assign NTFS permissions to folders and files on a computer running Microsoft Windows 2000 Server. To plan NTFS permissions, you must determine the following:

  • Which groups to create and which built-in groups to use
  • Which permissions users require to gain access to folders and files
  • Whether to prevent the folder or file for which you are assigning permissions from inheriting permissions from its parent folder
Answers

Figure 4.3 shows the folder and file structure used for this exercise. In addition to the default built-in groups, three new groups have been created in the domain, called Accounting, Managers, and Executives, and one new user account, called mlee. The default NTFS folder and file permission assignments are Full Control for the Everyone group.

Figure 4.3 Folder and file structure for practice

Review the following security requirements and record the changes that you should make to the NTFS folder and file permissions to meet those criteria:

  • Administrators require the Full Control permission for all folders and files.
  • All users run programs in the \WordProc folder, but they should not be able to modify the files in the \WordProc folder.
  • Only members of the Accounting, Managers, and Executives groups should be able to read documents in the \Spreadsh and \Database application folders by running the associated applications, but they should not be able to modify the files in those folders.
  • All users should be able to read and create files in the \Public folder.
  • All users should be prevented from modifying files in the \Public\Library folder.
  • Only user mlee should be able to modify and delete files in the \Public\Manuals folder.

Use Table 4.3 to plan and record your permission assignments.

Table 4.3 Permissions Planning Table for Exercise 4.1

Path | User Account or Group | NTFS Permissions | Block Inheritance (Yes/No)
\Apps |  |  |
\Apps\WordProc |  |  |
\Apps\Spreadsh |  |  |
\Apps\Database |  |  |
\Public |  |  |
\Public\Library |  |  |
\Public\Manuals |  |  |
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. If a user has Write permission for a folder and is also a member of a group with Read permission for the folder, what are the user's effective permissions for the folder?
  2. If you assign the Modify permission to a user account for a folder and the Read permission for a file and then copy the file to that folder, which permission does the user have for the file?
  3. If a user has both the Read and Write permissions to a folder and is denied the Write permission to one of the files in that folder, what are the user's effective permissions for that one file?

Lesson Summary

  • NTFS provides file and folder permissions that you can use to regulate the access that users and groups have to specific file system elements.
  • Files and folders have different permissions that you can combine to create an aggregate set called the effective permissions for a user or group.
  • You can deny permissions as well as allow them, and deny entries always take precedence over allow entries.
  • The permissions that you assign to a folder are inherited by the files and subfolders contained in that folder, unless you explicitly block the inheritance.
  • Permissions assigned to individual user accounts and groups are cumulative, meaning that a user's effective permissions are a combination of the permissions assigned to the user account and to each group of which the user is a member.


Lesson 2: Assigning NTFS Permissions

Assigning NTFS permissions is a matter of assessing the needs of your users and groups and devising a permission strategy to provide those needs. In most cases, more than one way exists to provide your users with the permissions they need. The permission strategy you choose should be based on how secure your network has to be and which methods you feel most comfortable using. This lesson presents guidelines for planning NTFS permissions and then walks you through the steps of assigning NTFS permissions.

After this lesson, you will be able to

  • Plan which permissions to assign to users or groups for applications and data folders
  • Assign NTFS folder and file permissions to user accounts and groups

Estimated lesson time: 60 minutes

Planning NTFS Permissions

As a general rule, develop a particular method for assigning permissions and stick to it throughout the enterprise. For example, if one administrator prefers to assign excessive permissions to a folder and then create permission deny entries for specific files in that folder, and another administrator is accustomed to assigning allow permissions to individual files, confusion results. If you take the time to plan your NTFS permissions and follow a few guidelines, NTFS permissions are easy to manage. Use the following guidelines when you assign NTFS permissions:

  • Turn off the permissions inheritance option for users' home folders. Users can then set the permissions for each file or folder in their home folders.
  • When you assign permissions for public data folders, assign the Read & Execute permission and the Write permission to the groups containing your users, and assign the Full Control permission to the CREATOR OWNER identity group. The user who creates a file is by default the creator and owner of the file.

    After you create a file, you can grant another user permission to take ownership of the file. The person who takes ownership becomes the owner of the file. If you assign the Read & Execute permission and the Write permission to the groups containing your users, and you assign the Full Control permission to CREATOR OWNER, users have the ability to read and modify documents that other users create and the ability to read, modify, and delete the files and folders that users create.

  • Deny permissions only when it is absolutely essential to do so.

Setting NTFS Permissions

By default, when you format a volume with NTFS, Windows 2000 assigns the Full Control permission to the Everyone group. You should change this default permission and assign other appropriate NTFS permissions to control the access that users have to file system resources.

Be careful, however, if you assign permissions to the Everyone group and enable the Guest account. Windows 2000 authenticates as Guest any user who does not have a valid user account. The user therefore gets all of the rights and permissions that you have assigned to the Everyone group. If you decide to remove permissions from the Everyone group, first ensure that other users have Full Control over the resources you are modifying. In Windows 2000, it is possible to "orphan" a file folder by removing all permissions to it. If this happens, a user in the Administrators group must take ownership of the resource, and set permissions to give the Administrators group Full Control.

Assigning or Modifying Permissions

Administrators, users with the Full Control permission, and the owners of files and folders can assign permissions to user accounts and groups by using the following procedure:

  1. In Windows Explorer, right-click the file or folder for which you want to assign permissions and, from the pop-up menu, select Properties to display the Properties dialog box for the file or folder.
  2. Click the Security tab (Figure 4.4) and configure the options that are described in Table 4.4.
Figure 4.4 The Security tab of the Properties dialog box for a folder

Table 4.4 Security Tab Options

Option | Description
Name | Contains the user accounts, groups, and special entities that have been assigned permissions to the folder. Select the entry for which you want to change permissions or remove from the list.
Permissions | Displays the currently configured permissions for the entry selected in the Name list. To allow a permission, select the Allow check box. To deny a permission, select the Deny check box. Check boxes that are selected but shaded represent inherited permissions.
Add | Opens the Select Users, Computers, Or Groups dialog box, which you use to select user accounts and groups to add to the Name list.
Remove | Removes from the Name list the selected user account, group, or special entity and its associated permissions for the file or folder.
Advanced | Opens the Access Control Settings dialog box, which you use to add, remove, view, or edit special permissions for selected user accounts and groups.
Allow Inheritable Permissions From Parent To Propagate To This Object | Specifies whether permissions for this object are affected by inheritance from parent objects.

Preventing Permissions Inheritance

By default, subfolders and files inherit the permissions that you assign to their parent folder. In the Security tab of the Properties dialog box, this inheritance is indicated by a check mark in the Allow Inheritable Permissions From Parent To Propagate To This Object check box. If the check boxes under Permissions are selected but shaded, the file or folder has inherited permissions from the parent folder. To prevent a subfolder or file from inheriting permissions from a parent folder, clear the Allow Inheritable Permissions From Parent To Propagate To This Object check box. Then you are prompted to select one of the options described in Table 4.5.

Table 4.5 Preventing Permissions Inheritance Options

Option | Description
Copy | Copies the permissions from the parent folder to the current folder and then denies subsequent permissions inheritance from the parent folder
Remove | Removes the permissions that are assigned to the parent folder and retains only the permissions that you explicitly assign to the file or folder
Cancel | Cancels the dialog box and restores the check mark in the Allow Inheritable Permissions From Parent To Propagate To This Object check box

Exercise 4.2: Assigning NTFS Permissions for the \Data Folder

In this exercise, you assign NTFS permissions for a folder called \Data (which you create on an NTFS drive). The permissions that you assign are based on the following security requirements:

  • All users in the domain should be able to read documents and files in the \Data folder.
  • All users in the domain should be able to create documents in the \Data folder.
  • All users in the domain should be able to modify the contents, properties, and permissions of the documents that they create in the \Data folder.

Procedure 1: Removing Permissions from the Everyone Group

In this procedure, you revoke the default permissions assigned to the Everyone group, which prevent you from exercising precise control over file system resources. Complete the following steps:

  1. Log on to the domain as Administrator.
  2. Open Windows Explorer.
  3. On the root of an NTFS drive, create a new folder called \Data.
  4. Right-click the Data folder you just created and, from the pop-up menu, select Properties to open the Properties dialog box.
  5. Click the Security tab to display the permissions for the \Data folder. Notice that the Allow check boxes are shaded, indicating that the permissions are inherited and cannot be modified. What are the existing folder permissions?
  6. In the Name list, select the Everyone group, and then click Remove. What do you see?
  7. Click OK to close the message box.
  8. Clear the Allow Inheritable Permissions From Parent To Propagate To This Object check box to block permissions from being inherited. Windows 2000 displays a Security message box, prompting you to either copy the currently inherited permissions to the folder or remove all permissions for the folder except those that you explicitly specify.
  9. Click Remove. What are the existing folder permissions?

Procedure 2: Assigning Permissions to the Users Group for the Data Folder

In this procedure, you create the new permission assignments that enable users to access the \Data folder. Complete the following steps:

  1. In the Security tab of the Data Properties dialog box, click Add to display the Select Users, Computers, Or Groups dialog box.
  2. In the Look In list at the top of the Select Users, Computers, Or Groups dialog box, select your domain.
  3. In the Name list, select Domain Users, and click Add.
  4. Click OK to return to the Data Properties dialog box. What are the existing allowed folder permissions?
  5. Make sure that Domain Users is selected in the Name list and select the Allow check box next to the Write permission.
  6. Click Apply to save your changes.

Procedure 3: Assigning Permissions to the CREATOR OWNER Group for the \Data Folder

In this procedure, you assign permissions for the \Data folder to the CREATOR OWNER group. Complete the following steps:

  1. In the Security tab of the Data Properties dialog box, click Add to display the Select Users, Computers, Or Groups dialog box.
  2. In the Look In list at the top of the Select Users, Computers, Or Groups dialog box, select your domain.
  3. In the Name list, select CREATOR OWNER and click Add.
  4. Click OK to return to the Data Properties dialog box. What are the existing allowed folder permissions?
  5. Make sure that CREATOR OWNER is selected in the Name list, and select the Allow check box next to the Full Control permission.
  6. Click Apply to save your changes. What do you see?
  7. Click Advanced to display the Access Control Settings dialog box.
  8. Click the Permissions tab if necessary, and in the Permission Entries list, choose Creator Owner. What permissions are assigned to the Creator Owner group and where do these permissions apply? Why?
  9. Click OK.
  10. In the Data Properties dialog box, click OK and log off the domain.

Procedure 4: Testing the \Data Folder Permissions You Assigned

In this procedure, you test the access that users are granted as a result of the permissions you assigned in the previous procedures. Complete the following steps:

  1. Using an account in the Domain Users group, log on to the domain.
  2. Open Windows Explorer and browse the \Data folder you created.
  3. In the \Data folder, create a new text file. Were you successful? Why or why not?
  4. Attempt to open, modify, and delete the file that you just created, and then record those tasks that you are able to complete.
  5. Close all applications and log off Windows 2000.
Answers

Exercise 4.3: Assigning NTFS Permissions

In this exercise, you assign NTFS permissions to a series of new folders and test the access that your actions allow. Before beginning this exercise, create the following folders off the root of an NTFS drive:

  • Data
  • Data\Managers
  • Data\Managers\Reports
  • Data\Sales

Then create the following users and groups in a Windows 2000 domain:

  • Managers (group)
  • Sales (group)
  • jberry (user, member of Print Operators group)
  • rcarey (user, member of Sales group and Print Operators group)
  • scooper (user, member of Managers group and Print Operators group)

Next, create the permission assignments for the folders you created, as listed in Table 4.6.

Table 4.6 Folder Permissions for Exercise 4.3

Folder Name | User Account or Group | Permissions
\Data | Domain Users group Domain Admins group | Read & Execute Full Control
\Data\Managers | Domain Users group Managers group Domain Admins group | Read & Execute Full Control Modify
\Data\Managers\Reports | Domain Users group Domain Admins group rcarey | Read & Execute Full Control Modify
\Data\Sales | Domain Users group Domain Admins group Sales group | Read & Execute Full Control Modify

Procedure 1: Assigning NTFS Permissions to a Folder

In this procedure, you assign permissions for the folders you created, adding the users and groups listed in Table 4.6 and granting them the specified permissions. Complete the following steps:

  1. Log on to the domain as Administrator.
  2. Open Windows Explorer.
  3. Browse to the drive where you created the new folders.
  4. Right-click the \Data folder and, from the pop-up menu, select Properties to display the Properties dialog box for the folder.
  5. Click the Security tab to display the permissions for the \Data folder.
  6. Clear the Allow Inheritable Permissions From Parent To Propagate To This Object check box to block permissions from being inherited. Windows 2000 displays a Security message box, prompting you to either copy the currently inherited permissions to the folder or remove all permissions for the folder except those that you explicitly specify.
  7. Click Remove.
  8. Click Add to display the Select User, Computer, Or Group dialog box.
  9. Select the Domain Users group, making sure that your domain appears in the Look In list at the top of the Select Users, Computers, Or Groups dialog box, and click Add. Windows 2000 adds the Domain Users group to the selected objects list at the bottom of the dialog box.
  10. Select the Domain Admins group in the same way, and click Add to insert it into the selected objects list.
  11. Click OK to return to the Properties dialog box for the folder.
  12. In the Properties dialog box, select the Domain Users group in the Name list, and click the appropriate check box to assign the Read & Execute permission to that group.
  13. In the Name list, select the Domain Admins group and click the appropriate check box to assign the Full Control permission to that group.
  14. Click OK to apply your changes and close the Properties dialog box for the folder.
  15. Repeat this procedure for each of the other folders listed in Table 4.6, creating the appropriate permissions for the users and groups listed there.
  16. Log off Windows 2000.

Procedure 2: Testing NTFS Permissions

In this procedure, you log on to the domain using the various user accounts you created and test the NTFS permissions you have assigned. Complete the following steps:

  1. Log on to the domain as jberry and open Windows Explorer.
  2. Browse to the \Data\Managers\Reports folder you created.
  3. Attempt to create a new file in the \Reports folder. Were you successful? Why or why not?
  4. Browse to the \Data\Sales folder you created.
  5. Attempt to create a new file in the \Sales folder. Were you successful? Why or why not?
  6. Log off Windows 2000.
  7. Log on to the domain as rcarey and open Windows Explorer.
  8. Browse to the \Data\Managers\Reports folder you created.
  9. Attempt to create a new file in the \Reports folder. Were you successful? Why or why not?
  10. Browse to the \Data\Sales folder you created.
  11. Attempt to create a new file in the \Sales folder. Were you successful? Why or why not?
  12. Log off Windows 2000.
  13. Log on to the domain as Administrator and open Windows Explorer.
  14. Browse to the \Data\Sales folder you created.
  15. Attempt to create a file in the \Sales folder. Were you successful? Why or why not?
  16. Log off Windows 2000.
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. What is the difference between the CREATOR OWNER group and a normal group?
  2. In the Security tab of a Properties dialog box for a folder, what does a shaded check box mean?
  3. List two of the basic guidelines you should use when assigning NTFS permissions.

Lesson Summary

  • To assign permissions to a folder, you open its Properties dialog box.
  • Planning the permissions needed to achieve a specific goal can require assigning new permissions, denying permissions, or blocking permission inheritance.
  • When planing permissions, create a set of rules and apply them throughout the enterprise.
  • The Advanced button in the Security tab of the Properties dialog box provides access to special permissions that do not appear in the Security tab.
  • To block permissions inheritance, clear the Allow Inheritable Permissions From Parent To Propagate To This Object check box.


Lesson 3: Assigning Special Permissions

The standard NTFS permissions generally provide all of the access control that you need to secure your file system resources. However, sometimes the standard NTFS permissions do not provide the specific level of access that you might want to assign to users or groups. To create a more specific level of access, you can assign NTFS special permissions. This lesson introduces the NTFS special permissions and outlines the requirements and procedures for taking ownership of a folder or file.

After this lesson, you will be able to

  • List the capabilities provided by the special permissions
  • Assign special permissions to files and folders
  • Take ownership of a file or folder

Estimated lesson time: 20 minutes

Understanding Special Permissions

The standard permissions that you normally use to control access to file system resources are actually preconfigured combinations of more granular entities called special permissions. Special permissions provide the administrator with an additional level of access control. Table 4.7 lists the special permissions that you can assign to files and folders.

Table 4.7 Special Permissions for Files and Folders

Special Permission | Function
Traverse Folder/Execute File | Traverse Folder grants or denies users or groups the ability to move through folders that the user does not have permission to access and to reach files or folders that the user does have permission to access (applies only to folders). Setting the Traverse Folder permission on a folder does not automatically set the Execute File permission on all files within that folder. Execute File allows or denies users or groups the ability to run program files (applies only to files).
List Folder/Read Data | List Folder grants or denies users or groups the ability to view the filenames and subfolder names within the folder (applies only to folders). Read Data grants or denies users or groups the ability to view data in files (applies only to files).
Read Attributes | Grants or denies users or groups the ability to view the file system attributes of a file or folder, such as read-only and hidden.
Read Extended Attributes | Grants or denies users or groups the ability to view the extended attributes of a file or folder. Extended attributes are defined by programs and can vary.
Create Files/Write Data | Create Files grants or denies users or groups the ability to create files within the folder (applies only to folders). Write Data grants or denies users or groups the ability to make changes to the file and overwrite existing content (applies only to files).
Create Folders/Append Data | Create Folders grants or denies users or groups the ability to create folders within a folder (applies only to folders). Append Data grants or denies users or groups the ability to make changes to the end of the file but not to change, delete, or overwrite existing data (applies only to files).
Write Attributes | Grants or denies users or groups the ability to change the file system attributes of a file or folder, such as read-only or hidden.
Write Extended Attributes | Grants or denies users or groups the ability to change the extended attributes of a file or folder. Extended attributes are defined by programs and can vary.
Delete Subfolders and Files | Grants or denies users or groups the ability to delete subfolders and files, even if the Delete permission has not been granted on the subfolder or file.
Delete | Grants or denies users or groups the ability to delete the file or folder. A user or group can still delete a file or folder, despite not having the Delete permission, if the user or group has been granted the Delete Subfolders and Files permission for the parent folder.
Read Permissions | Grants or denies users or groups the ability to read the permissions for the file or folder, such as Full Control, Read, and Write.
Change Permissions | Grants or denies users or groups the ability to change the permissions for the file or folder, such as Full Control, Read, and Write.
Take Ownership | Grants or denies users or groups the ability to take ownership of the file or folder. The owner of a file or folder can always change permissions on it, regardless of any existing permissions protecting the file or folder.
Synchronize | Grants or denies different threads the ability to use a file or folder and synchronize with another thread that might request it. This permission applies only to multithreaded, multiprocess programs.

You assign special permissions using the Permission Entry dialog box for the file or folder. You access this dialog box by opening the Properties dialog box of the file or folder and, in the Security tab, clicking Advanced. Selecting an entry in the Permission Entries list and clicking View/Edit displays the special permissions for that user or group. You control the special permissions assigned to a user or group much the same way as you assign standard permissions, by selecting the Allow or Deny check boxes for each permission. Each of the standard file and folder permissions consists of a logical group of special permissions. Table 4.8 lists the standard file or folder permissions and specifies which special permissions make up each standard permission.

Table 4.8 Special Permissions Associated with Standard File and Folder Permissions

Special Permission | Full Control | Modify | Read & Execute | List Folder Contents | Read | Write
Traverse Folder/Execute File | x | x | x | x |  |
List Folder/Read Data | x | x | x | x | x |
Read Attributes | x | x | x | x | x |
Read Extended Attributes | x | x | x | x | x |
Create Files/Write Data | x | x |  |  |  | x
Create Folders/Append Data | x | x |  |  |  | x
Write Attributes | x | x |  |  |  | x
Write Extended Attributes | x | x |  |  |  | x
Delete Subfolders and Files | x |  |  |  |  |
Delete | x | x |  |  |  |
Read Permissions | x | x | x | x | x | x
Change Permissions | x |  |  |  |  |
Take Ownership | x |  |  |  |  |
Synchronize | x | x | x | x | x | x
Although the List Folder Contents and Read & Execute standard permissions appear to be composed of the same special permissions, there are differences in the ways the files and folders inherit the special permissions. List Folder Contents is inherited by folders but not files, and it appears only when you view folder permissions. Read & Execute is inherited by both files and folders, and it is always present when you view file or folder permissions.

Although it is not often necessary to work with special permissions directly, the Change Permissions and Take Ownership special permissions are worth noting because they are particularly useful for controlling access to resources. The following sections discuss these two permissions.

Assigning Change Permissions

By assigning them the Change Permissions special permission, you can give other administrators and users the ability to modify the permissions for a file or folder without giving them the Full Control permission for the file or folder. This way, the administrator or user cannot delete or write to the file or folder but can control other users' access to it.

Using the Take Ownership Permission

Using the Take Ownership special permission, you can give users or groups the ability to take over the ownership of files or folders. The current owner of a file or folder or any user with Full Control permission can grant the Full Control standard permission or the Take Ownership special permission to another user or group, giving that user or a member of the group ownership of the file or folder.

Administrators can always take ownership of any file or folder, regardless of assigned permissions. If an administrator takes ownership, the Administrators group becomes the owner and any member of the Administrators group can change the permissions for the file or folder and assign the Take Ownership permission to another user or group. For example, if a user who performs certain tasks leaves the company, an administrator can take ownership of that user's files and assign the Take Ownership permission to the user's replacement, giving the new user ownership of the former user's files.

You cannot assign anyone ownership of a file or folder. The owner of a file, an administrator, or anyone with Full Control permission can assign the Take Ownership permission to a user or group, giving that user ownership. To become the owner of a file or folder, a user or group member with the Take Ownership permission must explicitly take ownership of the file or folder.

Assigning Take Ownership

To take ownership of a file or folder, use the following procedure:

  1. Open Windows Explorer and browse to the file or folder for which you want to take ownership.
  2. Right-click the file or folder and, from the pop-up menu, select Properties to display the Properties dialog box.
  3. Click the Security tab, and click Advanced to open the Access Control Settings dialog box for the file or folder.
  4. Click the Owner tab, as shown in Figure 4.5.

    Figure 4.5 The Owner tab of the Access Control Settings dialog box
  5. Select your name in the Change Owner To list. If you also want to take ownership of all subcontainers and objects, select the Replace Owner On Subcontainers And Objects check box.
  6. Click OK and click OK again to close the Properties dialog box.

Assigning Special Permissions

To modify or assign special permissions for a file or folder, use the following procedure:

  1. Open Windows Explorer and browse to the file or folder for which you want to assign special permissions.
  2. Right-click the file or folder and, from the pop-up menu, select Properties to display the Properties dialog box.
  3. Click the Security tab and click Advanced to open the Access Control Settings dialog box for the file or folder (see Figure 4.6). In the Access Control Settings dialog box, you can view the permissions that are assigned to the file or folder, as well as its owner, and where the permissions apply.

    Figure 4.6 An Access Control Settings dialog box
  4. Using the check box provided, specify whether you want to grant inheritable permissions from parent folders to be inherited by the folder you have selected.
  5. Using the check box provided, specify whether you want to reset the permissions on all child objects so that they can inherit permissions from the folder you have selected.
  6. In the Permission Entries list, select the user or group for which you want to assign special permissions, and click View/Edit to open the Permission Entry dialog box (see Figure 4.7).
    To create a new entry in the Permission Entries list, click Add and select a user or group. Then click OK to open a Permission Entry dialog box.
  7. In the Apply Onto drop-down list, specify which combination of folders, subfolders, and files you want to receive the special permissions you are assigning.
  8. Select the Allow or Deny check boxes for the special permissions that you want to assign to the file or folder for the user or group you selected.
  9. Click OK to assign the permissions and return to the Access Control Settings dialog box.
Figure 4.7 A Permission Entry dialog box

Exercise 4.4: Taking Ownership of a File

In this exercise, you observe the effects of taking ownership of a file. To perform this task, you determine permissions for a file, assign the Take Ownership permission to a user account, and then take ownership as that user.

Procedure 1: Assigning the Take Ownership Special Permission

In this procedure, you create a new file, view its current owner, and then grant another user permission to take ownership of the file. Complete the following steps:

  1. Log on to the domain as Administrator and open Windows Explorer.
  2. On an NTFS drive, create a new folder called \Data and create a new text file in that folder called Test.txt.
  3. Right-click the Test.txt file and, from the pop-up menu, select Properties to display the Properties dialog box.
  4. Click the Security tab to display the permissions for the Test.txt file. What are the current allowed permissions for Test.txt?
  5. Click Advanced to display the Access Control Settings dialog box for Test.txt.
  6. Click the Owner tab. Who is the current owner of the Test.txt file?
  7. Click the Permissions tab and then click Add to open a Select User, Computer, Or Group dialog box.
  8. From the Name list, select a user account and click OK to open a Permission Entry dialog box.
  9. Select the Allow check box for the Take Ownership permission.
  10. Click OK to return to the Access Control Settings dialog box. Notice that an entry for the user you selected now appears in the Permission Entries list.
  11. Click OK to return to the Test.txt Properties dialog box.
  12. Click OK to apply your changes and close the Test.txt Properties dialog box.
  13. Log off Windows 2000.

Procedure 2: Taking Ownership of a File

In this procedure, you log on as the user to which you have granted the Take Ownership permission and actually take ownership of the Test.txt file. Complete the following steps:

  1. Log on to the domain using the account you selected earlier, and open Windows Explorer.
  2. Browse to the \Data folder.
  3. Right-click the Test.txt file and, from the pop-up menu, select Properties to display the Properties dialog box.
  4. Click the Security tab to display the permissions for Test.txt. Windows 2000 displays a Security message box, indicating that you can only view the current permission information on Test.txt.
  5. Click OK to display the Security tab of the Properties dialog box.
  6. Click Advanced to display the Access Control Settings For Test.txt dialog box.
  7. Click the Owner tab. Who is the current owner of Test.txt?
  8. In the Name list, select the user to whom you assigned the Take Ownership permission and click Apply. Notice that the ownership of the file has been transferred to the selected user.
  9. Click OK to close the Access Control Settings dialog box.
  10. Click OK to close the Properties dialog box.
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next chapter. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. If an employee leaves the company, what must you do to transfer ownership of his or her files and folders to another employee?
  2. What is the relationship between special permissions and standard permissions?
  3. Which special permission enables you to browse through folders you do not have permission to access?
    1. List Folders
    2. Traverse Folders
    3. Read Attributes
    4. Read Extended Attributes

Lesson Summary

  • Special permissions provide more precise access control of the NTFS file system.
  • Standard permissions are preconfigured combinations of special permissions.
  • You assign special permissions using the Access Control Settings dialog box.
  • The Take Ownership special permission gives users or groups the ability to take ownership of files or folders.
  • The Change Permissions special permission users or groups the ability to modify the permissions for a file or folder without giving them the Full Control.


Sharing Drives and Printers

About This Chapter

Sharing system resources is one of the primary functions of a network, and in Microsoft Windows 2000, the drives, folders, and printers that you make available to network users are themselves called shares. In this chapter, you learn how to create and manage network shares and to control the access that users have to them.

Before You Begin

To perform the exercises in this chapter, you must have a Windows 2000 network with Active Directory service installed on one of the computers.


Lesson 1: Creating Drive and Folder Shares

You can configure a computer running Windows 2000 to share any of the folders on its drives or even entire drives. When you create the share, users with the appropriate permissions can access it from any workstation on the network, just as if they are working with local folders and files. To share a folder, you must be a member of one of several groups, depending on the role of the computer where the shared folder resides.

When you share a folder, you can control access to the folder by limiting the number of users who can simultaneously gain access to it, and you can also control access to the folder and its contents by assigning permissions to selected users and groups. After you create a shared folder, you might have to modify its folder sharing properties. At any time, you can stop sharing a folder, change its share name, and change the user and group permissions that control access to it. If you decide to stop sharing a folder while users are connected to it, Windows 2000 displays a dialog box to notify you.

After this lesson, you will be able to

  • Create and modify shared folders
  • Configure share caching
  • Make a connection to a shared folder

Estimated lesson time: 20 minutes

Requirements for Sharing Folders

In Windows 2000, members of the built-in Administrators, Server Operators, and Power Users groups can share folders. The groups that can share folders and the computers on which they can share folders depend on the following requirements:

  • In a Windows 2000 domain, the Administrators group can share folders residing on any computer in the domain. The Server Operators Group is a built-in local group in the domain that can share folders on Domain Controllers. The Power Users group is a local group and can share folders residing only on the computer where the group is located.
  • In a Windows 2000 workgroup, the Administrators and Power Users groups can share folders residing only on the computer hosting the group.
If the folder to be shared resides on a volume that uses the NT file system (NTFS), users must also have at least the NTFS Read permission for that folder to be able to share it.

Administrative Shared Folders

Windows 2000 automatically shares certain folders for administrative purposes. These shares are appended with a dollar sign ($). The dollar sign hides the shared folder from users who browse the computer. The root of each volume, the system root folder, and the location of the printer drivers are all hidden shared folders that you can access from across the network.

Table 5.1 describes the purpose of the administrative shares that Windows 2000 automatically creates.

Table 5.1 Windows 2000 Administrative Shares Folders

Share | Purpose
\C$, \D$, \E$, and so on | Windows 2000 automatically shares the root of each volume on the computer's hard disk drives, using the drive letter appended with a dollar sign ($) for the share name. When you connect to this folder, you have access to the entire volume. Windows 2000 assigns the Full Control permission for these shares to the Administrators group so that you can use them to remotely connect to the computer to perform administrative tasks.
\Admin$ | Windows 2000 shares the system root folder, which is C:\Winnt, by default, using the name Admin$. Administrators can gain access to this shared folder to administer Windows 2000 without knowing the folder in which it is installed. Members of the Administrators group have Full Control access to this share.
\Print$ | When you install the first shared printer, Windows 2000 shares the \systemroot\System32\Spool\Drivers folder Print$. This folder provides access to printer driver files for remote clients. Only members of the Administrators, Server Operators, and Print Operators groups have the Full Control permission for this share. The Everyone group has the Read permission.

Hidden shared folders are not limited to those that the system automatically creates. You can share additional folders and append a dollar sign to the end of the share names to hide them from view. Consequently, only users who know the folder names and possess the proper permissions can access the folders.

Sharing a Folder

When you share a folder, the only requirement is that you assign it a share name. Optionally, you can also provide a comment to describe the folder and its contents, limit the number of users who have access to the folder, assign access permissions, and share the same folder multiple times.

To share a folder, use the following procedure:

  1. Open Windows Explorer and browse to the folder that you want to share.
  2. Right-click the folder that you want to share and, from the pop-up menu, choose Sharing to display the Sharing tab in the Properties dialog box of the folder. (See Figure 5.1.)

    Figure 5.1 The Sharing tab
  3. Click Share This Folder.
  4. In the Share Name box, specify a name for the share, which users see when browsing the network.
    By default, Windows 2000 supplies the name of the folder for the share name, but you are free to change it to any name up to 80 characters long. Changing the share name effectively prevents users from knowing the original folder name and location.
  5. In the Comment box, type a description for the share name. This comment appears in addition to the share name when users at client computers browse the shares on the server.
  6. Specify the maximum number of users who can connect to the shared folder simultaneously. By default, the Maximum Allowed option is selected, which in the case of Microsoft Windows 2000 Professional allows up to 10 total connections for all shares and services. The number of connections Microsoft Windows 2000 Server supports is limited only by the number of client access licenses that you have purchased. To impose a stricter limit on the number of concurrent connections, click Allow and use the arrows to specify the maximum number of users who can access the share at once. This feature allows you to control the burden placed on the computer sharing the folder.
  7. Click OK to create the share.

Sharing a Volume

As noted earlier, Windows 2000 creates an administrative share for every hard disk volume on the computer. This fact changes the procedure slightly when you want to create a public (that is, nonadministrative) share for an entire volume.

To share a volume from the root, use the following procedure:

  1. Open Windows Explorer and browse to the volume that you want to share.
  2. Right-click the volume that you want to share and, from the pop-up menu, choose Sharing to display the Sharing tab in the Properties dialog box of a folder (see Figure 5.2).

    Figure 5.2 The Sharing tab
  3. Click New Share to display the New Share dialog box (see Figure 5.3). When you open the Properties dialog box, the Sharing tab displays the administrative share that Windows 2000 has already created. From this tab, you can manage that share, but clicking New Share enables you to create another share from the same root.

    Figure 5.3 The New Share dialog box
  4. In the Share Name box, specify a name for the new share, which users see when browsing the network.
  5. In the Comment box, type a description for the share name. This comment appears in addition to the share name when users at client computers browse the shares on the server.
  6. Specify the maximum number of users who can connect to the shared folder simultaneously. If you want to limit the number of concurrent connections, click Allow and specify the maximum number of users in the box provided.
  7. Click OK to add the new share to the Sharing tab. Doing so converts the Share Name box to a drop-down list, which you can use to select the share for the volume that you want to manage.
  8. Click OK to create the share and then close the Properties dialog box.
By default, Windows 2000 grants the Full Control permission to the Everyone group for every new share you create. This approach enables any user on the network to access the share and create, modify, or delete files. To control access to the share, you must modify the default permissions, as described in Lesson 5 of this chapter. Making a share hidden does not prevent users from accessing the share, it only makes it hidden to users browsing for shared folders.

Modifying Shared Folders

After you have created a share, you can modify its properties at any time from the Sharing tab in the Properties dialog box of the folder. The modifications you can perform are as follows:

  • Stop sharing a folder. To immediately stop sharing a folder, choose Do Not Share This Folder and click Apply or OK.
    If you stop sharing a folder while a user has a file open that is stored on that share, the user might lose data. If you choose Do Not Share This Folder and a user has a connection to the shared folder, Windows 2000 displays a dialog box notifying you that a user has a connection to the shared folder.
  • Add a share name. To create an additional share for a folder that is already shared, in the New Share dialog box, click New Share and supply a share name (and other optional parameters, if desired). New Share appears in the Sharing tab of only a previously shared folder.
  • Remove a share name. To remove one of the shares for a folder that has been shared more than once, in the Share Name box, select the share you want to remove and click Remove Share. The consequences of removing a share while users are accessing files stored on that share is the same as if you select Do Not Share This Folder.
  • Modify share permissions. Click Permissions to open a Permissions dialog box, in which you can control user access to the share. For more information, see Lesson 5 later in this chapter.
  • Modify caching parameters. Click Caching to open the Caching Settings dialog box, in which you can specify if and how clients should cache files accessed through the share. For more information, see the "Caching" section that follows.

Caching

To make shared folders available to clients offline, Windows 2000 can store copies of the files on the local drive of the client computer in an area of disk space called a cache. Because the cache is on a client's hard disk drive, the computer can access it regardless of whether it is connected to the network. By default, the cache size is set to 10 percent of the available disk space. You can change the size of the cache on the client computer from the Offline Files tab of the Windows Explorer Folder Options dialog box.

When you share a folder, you can allow others to make the shared folder available offline. Open the Properties dialog box of the folder and, in the Sharing tab, click Caching to display the Caching Settings dialog box (see Figure 5.4). Selecting the Allow Caching Of Files In This Shared Folder check box allows you to turn caching on and off.

In the Caching Settings dialog box, the Setting drop-down list box provides three caching options:

  • Manual Caching For Documents. The only files available offline are those that the user explicitly selects. This caching option is recommended for a shared network folder containing files that are to be accessed and modified by several people. This option is the default.
  • Automatic Caching For Documents. This option makes every file that a user opens from the shared folder available offline. Files that the user has not opened are not available offline.
  • Automatic Caching For Programs. This option provides offline access to shared folders containing files that are read, referenced, or run, but that are not changed in the process. This option reduces network traffic because offline files are opened directly without accessing the network versions in any way, and they generally start and run faster than the network versions.
Figure 5.4 The Caching Settings dialog box

Connecting to a Shared Folder

When you have shared a folder, users can employ four methods to gain access to that folder from another computer running Windows 2000. These methods are as follows:

  • Map to a network drive using the Map Network Drive Wizard.
  • Add a network place using the Add Network Place Wizard.
  • Connect using the Run command.
  • Connect using My Network Places.

Using the Map Network Drive Wizard

To access a share using the Map Network Drive Wizard, use the following procedure:

  1. On your desktop, right-click the My Network Places icon and, from the pop-up menu, choose Map Network Drive to display the Map Network Drive dialog box (see Figure 5.5).
  2. In the Drive box, select the drive letter you want to assign to the share.
  3. Click Browse to open the Browse For Folder dialog box.
  4. Select the share you want to access and click OK to close the window and insert the name of the selected share in the Folder box. You can also type the path to a share in the Folder box by using the Universal Naming Convention (UNC) format (\\server_name\share_name).

    Figure 5.5 The Map Network Drive dialog box
  5. Select Reconnect At Logon if you want Windows 2000 to automatically reconnect the drive letter to the shared folder each time that you log on to the network.
  6. Click the hyperlink labeled Connect Using A Different User Name to connect to the shared folder with a user account other than the one with which you logged on. Then, in the Connect As dialog box, enter the user name and password and click OK.
  7. Click Finish to create the drive mapping. From this point on, you can access the share in Windows Explorer or any other application using the drive letter you selected.

Using the Add Network Place Wizard

To access a share using the Add Network Place Wizard, use the following procedure:

  1. On your desktop, double-click the My Network Places icon to open the My Network Places window.
  2. Double-click the Add Network Place icon to launch the Add Network Place Wizard (see Figure 5.6).
  3. Click Browse to open the Browse For Folder dialog box.
  4. Select the share you want to access, and click OK to close the window and insert the name of the selected share in the Folder box. In the Folder box, you can also type the path to a share by using the UNC format (\\server_name\share_name). Click Next.
  5. On the Completing The Add Network Place Wizard page, in the Enter A Name For This Network Place box, type the name you want to use for the shared folder.
  6. Click Finish to create the My Network Places entry.
Figure 5.6 The Add Network Place Wizard

Using the Run Command

Both of the preceding sections describe methods for creating persistent connections to a share. To create a one-time connection to a share, you can use the Run dialog box, as shown in the following procedure:

  1. Click Start and, from the Start menu, choose Run.
  2. In the Open box, use UNC notation (\\computer_name) to type the name of the computer, and click OK. Alternatively, you can click Browse and navigate to the computer or share you want to access. Then click OK to close the Browse dialog box and click OK again.
  3. In the window containing the shared folders for the computer, double-click the shared folder to which you want to connect.

Using My Network Places

Another quick way to gain access to a shared folder is to browse the network using My Network Places.

  1. Open Windows Explorer and expand the My Network Places icon.
  2. In the left pane under Other Places, select Entire Network.
  3. Select the Microsoft Windows Network icon.
  4. Select the icon for the domain or workgroup in which the computer hosting the share you want to access is located.
  5. Select the icon for the computer and click the share name you want to access to see its contents in the detail pane in Windows Explorer.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. To share a folder, you must belong to one of which three groups?
  2. How do you share a folder while causing it to remain hidden from users browsing the network?
  3. What are the four ways that users can connect to a shared folder?

Lesson Summary

  • Members of an appropriate group can create a share out of any folder on a hard disk.
  • Windows 2000 automatically creates administrative shares at the root of every volume and at the system root and printer driver folders.
  • After creating a share, you can modify its properties using the Sharing tab of the folder's Properties dialog box.
  • Caching enables clients to store copies of shared files on their local disk drives.
  • Users can employ several methods to create both persistent and temporary connections to shares.


Lesson 2: Using Distributed File System

The Microsoft distributed file system (Dfs) for Windows 2000 Server provides users with convenient access to shared folders that are hosted by computers distributed throughout a network. A single Dfs shared folder serves as an access point to other shared folders on the network. Users access one share, the subdirectories of which are actually located on different computers.

After this lesson, you will be able to

  • Understand the functionality of Dfs
  • Create Dfs roots and links
  • Configure Dfs to provide user access to shared folders

Estimated lesson time: 40 minutes

Understanding Dfs

Dfs for Windows 2000 Server enables network administrators to simplify the tasks of locating and accessing files that are physically distributed across a network. With Dfs, files located on multiple servers appear to users as if they all reside in one place on the network.

Dfs organizes shared folders on different computers into a single composite directory structure, as shown in Figure 5.7, providing users with easy navigation to these

Figure 5.7 Overview of Dfs

shared folders. Users do not need to know where a resource is physically located on the network to gain access to it. Dfs also facilitates the administration of multiple shared folders from a single access point.

Dfs organizes a network's shared resources in a hierarchy, the base unit of which is called a Dfs share. When you view a Dfs share using a standard application, such as Windows Explorer, it looks no different from any other share. Only when you view it with the Dfs console, the tool you use to create and manage Dfs shares, does the real structure becomes evident. To create a Dfs share, you must first create a Dfs root. A Dfs root is a container for Dfs links. Each Dfs root can have multiple links beneath it, each of which points to a shared folder somewhere on the network.

Two types of Dfs roots exist:

  • Domain. A domain root stores the Dfs topology as part of the Active Directory service. For domain-based Dfs, the domain server on which a Dfs root resides is known as a host server. Because the host server for a domain-based Dfs is a member server within a domain, the Dfs topology is automatically published to the Active Directory service by default, thus providing synchronization of Dfs topologies across host servers. This structure, in turn, provides fault tolerance for the Dfs root and supports optional replication of Dfs shared folders.

    To system administrators, a Dfs topology is a single Domain Name System (DNS) name space; the DNS names for the Dfs roots resolve to the host servers for the Dfs root. You can replicate a Dfs root by creating roots on other servers in the domain. This functionality provides file availability if the host server becomes unavailable. Domain roots also enable Dfs links to point to multiple identical shared folders for additional fault tolerance, as well as support multiple-level Dfs links.

  • Stand-alone. A stand-alone root stores the Dfs topology on a single computer, not in the Active Directory service, and provides no fault tolerance if the computer that stores the Dfs topology or any of the shared folders that Dfs uses fails. A stand-alone root also supports only one level of Dfs links.

Dfs links are simply pointers to shared folders located elsewhere on the network. You create Dfs links beneath a Dfs root, creating the hierarchical structure you want your users to see. To the users, the Dfs architecture provides unified and transparent access to the network resources they need. By creating replicas of Dfs links, you can provide your users with continued access to the files they need, despite a server failure.

Dfs simplifies access to shared folders for both users and administrators. A user who navigates to a Dfs-managed shared folder does not need to know the name of the server on which the folder is shared. This simplifies network navigation and access because users no longer need to browse the network searching for the server on which a specific resource is located. After connecting to a Dfs root, users can browse and access all of the resources represented by the Dfs links beneath the root, regardless of where each link points. In fact, users do not even have to know that Dfs is in use, because the client functionality is completely transparent.

Only client computers with Dfs client software can access Dfs resources. Computers running Microsoft Windows NT 4.0 and later or Microsoft Windows 98 include a Dfs client. You must download and install a Dfs client for Microsoft Windows 95.

Dfs also simplifies network administration. If a server fails, you can move a link from one server to another without users being aware of the change. To move a link, all you have to do is modify the Dfs folder to refer to the new server location of the shared folder. Users continue to use the same Dfs path for the link, so their shortcuts and paths remain consistent.

Dfs also preserves the network permissions you have created for the shares that form the Dfs links. Users can access a shared folder through Dfs as long as they have the permissions needed to access the shared folder. If further restrictions are necessary, you can create additional NTFS permissions.

Implementing Dfs

Two procedures are required to implement Dfs on your network: creating a Dfs root and creating at least one Dfs link. Optionally, you can then create replicas of your links to provide fault tolerance and configure the replication policy for the links. You perform all of these tasks using the Distributed File System snap-in for Microsoft Management Console (MMC), which you can access from the Administrative Tools program group of any computer running Windows 2000 Server. The following sections discuss these procedures.

Creating a Dfs Root

The first step in using Dfs is to create a Dfs root, which is the share that users employ to access your Dfs links. You can create a Dfs root on a Windows 2000 file allocation table (FAT), FAT32, or NTFS partition. However, the FAT and FAT32 file systems do not offer the security advantages of NTFS. To create a Dfs root, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, choose Distributed File System to display the Distributed File System console shown in Figure 5.8.
  2. From the Action menu, select New Dfs Root to launch the New Dfs Root Wizard.

    Figure 5.8 The Distributed File System console
  3. Click Next to bypass the Welcome To The New Dfs Root Wizard page and display the Select The Dfs Root Type page, shown in Figure 5.9.

    Figure 5.9 The Select The Dfs Root Type page
  4. Specify whether you want to create a domain Dfs root or a stand-alone Dfs root by clicking the appropriate option. If you do not use the Active Directory service on your network, you can create only a stand-alone Dfs root. Click Next to proceed.
  5. On the Select The Host Domain For The Dfs Root page (Figure 5.10), from the Trusting Domains list, select the domain that you want to host the Dfs root, and click Next to continue. This page appears only if you elected to create a domain Dfs root on the previous page. If you chose to create a stand-alone Dfs root, the wizard proceeds directly to the Specify The Host Server For The Dfs Root page.

    Figure 5.10 The Select The Host Domain For The Dfs Root page
  6. On the Specify The Host Server For The Dfs Root page (Figure 5.11), in the Server Name box, specify the name of the server that you want to use to host the Dfs root, or click Browse to locate a server. Click Next to continue.

    Figure 5.11 The Specify The Host Server For The Dfs Root page
  7. On the Specify The Dfs Root Share page (Figure 5.12), specify whether to use an existing share or to create a new share by selecting the appropriate option. If you elect to use an existing share, use the drop-down list provided to select one of the shares on the specified server. If you chose to create a new share, in the Path To Share box, specify the path to the folder that you want to share, and in the Share Name box, enter a name for the new share. Click Next to continue.

    Figure 5.12 The Specify The Dfs Root Share page
  8. On the Name The Dfs Root page (Figure 5.13), specify a name for the new Dfs root. You can also include a comment that describes the contents of the share. Click Next to continue.

    Figure 5.13 The Name The Dfs Root page
  9. On the Completing The New Dfs Root page, click Finish to close the wizard and create the new Dfs root. The new root now appears in the scope pane of the Distributed File System console screen (see Figure 5.14).

    Figure 5.14 The Distributed File System console with a new Dfs root

Creating Dfs Links

After you create a Dfs root, you create Dfs links. The maximum number of Dfs links that you can assign to a Dfs root is 1000. To create a link, use the following procedure:

  1. Open the Distributed File System console.
  2. Right-click the Dfs root to which you want to add a Dfs link and, from the pop-up menu, select New Dfs Link to open the Create A New Dfs Link dialog box (see Figure 5.15).

    Figure 5.15 The Create A New Dfs Link dialog box
  3. In the Link Name box, specify a name for the link. This name is the one that users see below the root when they browse the Dfs share.
  4. In the Send The User To This Shared Folder box, you can use a UNC name to specify the actual location of the shared folder you want to add to the Dfs root, or you can click Browse and navigate to the share.
  5. In the Comment box, enter a descriptive name for the link.
  6. In the Clients Cache This Referral For X Seconds box, specify the length of time for which clients cache a referral to a Dfs link. After the referral time expires, a client queries the Dfs server about the location of the link, even if the client has previously established a connection with the link.
  7. Click OK to close the dialog box and add the link to the Dfs root, as shown in Figure 5.16. You can then repeat this procedure to create additional links.

    Figure 5.16 The Distributed File System console with a Dfs root and a Dfs link

Replicating Dfs

Dfs can use replication to ensure that your shares remain available to your users, even if the server hosting Dfs links or even a Dfs root fails. The following sections detail the procedures for creating replicas and configuring Dfs replication behavior.

Replicating a Dfs Root

Replicating a Dfs root to another server in the domain ensures that, if the host server becomes unavailable for any reason, the shares associated with that Dfs root are still available to domain users. To replicate a Dfs root, use the following procedure:

  1. Open the Distributed File System console.
  2. Right-click the existing Dfs root that you want to replicate and from the pop-up menu, select New Root Replica to launch the New Dfs Root Wizard.
  3. Specify the name of the server where you want to create a replica of the selected root, or click Browse and navigate to a server. Click Next to continue.
  4. On the Specify The Dfs Root Share page, select the appropriate option to specify whether to use an existing share or to create a new share. Then either select an existing share or specify the path and name for a new share in the boxes provided. Click Finish to create the new replica.

When you create multiple replicas of a Dfs root, the paths to the replicas appear in the detail pane of the Distributed File System console, as shown in Figure 5.17.

Figure 5.17 The Distributed File System console with a replicated Dfs root

Replicating a Shared Folder

For each Dfs link, you can create a set of replicated Dfs shares to which the Dfs link points. You add the first folder to the set when you create the Dfs link. You can then create as many as 32 replicas of that folder on various servers throughout the network. To create replicas of the shared folder associated with a link, use the following procedure:

  1. Open the Distributed File System console.
  2. Right-click the Dfs link that you want to replicate and, from the pop-up menu, select New Replica to open the Add A New Replica dialog box, shown in Figure 5.18.
  3. Specify the name of a share on the network where you want to create the replica, or click Browse and navigate to an existing share.
  4. Specify whether you want to use manual replication or automatic replication.
  5. Click OK to create the replica. If you chose automatic replication, you must now configure the replication policy for the links, as discussed in the next section.
Figure 5.18 The Add A New Replica dialog box

When you create multiple replicas of a Dfs link, the paths to the replicas appear in the detail pane of the Distributed File System console, as shown in Figure 5.19.

Figure 5.19 The Distributed File System console with a replicated Dfs link

Setting Replication Policy

You can ensure that the content of your shared folders is always available to users by replicating that content to other roots or Dfs shared folders in the domain. Creating replicas of Dfs roots and Dfs links is only the first step of the process. To ensure that the data stored on the replicas is identical, you must configure them to replicate automatically, using the Windows 2000 File Replication Service (FRS). Replication copies the content of one Dfs root to another, or from the shared folder associated with one Dfs link to the shared folder of another.

When you create a replica of a Dfs link, the Distributed File System console prompts you to specify whether you want to use manual or automatic replication. If you select manual replication, Windows 2000 takes no further action beyond creating the replica of the link. You are responsible for ensuring that the data stored on all replicas of the Dfs link is identical. If you select automatic replication, Windows 2000 copies the data stored on the shares to keep the replicas updated. To use automatic replication, you must be using a domain Dfs root, and all of the replicas must be stored on NTFS 5.0 volumes.

When you set the replication policy for a Dfs link, you select one of the shared folders in the link to be the initial master, which then replicates its contents to the other replicas in the set of Dfs shared folders. Although invisible to users and administrators, Dfs uses the FRS to perform this function. Within a set of Dfs replicas, FRS manages updates across any folders that are targeted for replication. By default, FRS synchronizes the contents of the Dfs shared folders at 15-minute intervals.

Do not mix automatic and manual replication within a set of Dfs shared folders. Using one method of replication exclusively ensures that the contents of the Dfs shared folders remain synchronized.

To set the replication policy for the shared folders in a replicated Dfs link, use the following procedure:

  1. Open the Distributed File System console.
  2. Right-click the Dfs link containing the shared folders for which you want to set a replication policy and, from the pop-up menu, select Replication Policy to display the Replication Policy dialog box shown in Figure 5.20.

    Figure 5.20 The Replication Policy dialog box
  3. Select a Dfs shared folder that you want to use as the master folder for replication, and click Set Master.
  4. Select each of the shared folders in the list and click Enable. Then click OK.

Exercise 5.1: Using Dfs

In this exercise, you create and share some folders, and then you create a new Dfs root and Dfs links to those folders.

The following procedures assume the use of a domain name called treyresearch.com and two domain controllers called trey1 and trey2. Replace these names with your own domain and server names when performing the exercise.

Procedure 1: Creating a Dfs Root

To create a new Dfs domain root, which you later populate with links, complete the following steps:

  1. Log on to the treyresearch.com domain as Administrator.
  2. Open the Distributed File System console.
  3. From the Action menu, choose New Dfs Root to open the New Dfs Root Wizard. Click Next to continue.
  4. On the Select The Dfs Root Type page, select Create A Domain Dfs Root and click Next.
  5. On the Select The Host Domain For The Dfs Root page, select the treyresearch.com domain and click Next.
  6. On the Specify The Host Server For The Dfs Root page, confirm that trey1 appears in the Server Name box and click Next.
  7. On the Specify The Dfs Root Share page, select Create A New Share. In the Path To Share box, type c:\App-Dfs (assuming that C is your system drive), and in the Share Name box, type Shared Apps.
  8. Click Next. A Distributed File System message box appears, asking if you want to create the C:\App-Dfs folder.
  9. Click Yes to display the Name The Dfs Root page, which already contains the name of the share you provided (Shared Apps). Click Next.
  10. Click Finish. Notice that the \\treyresearch.com\Shared Apps Dfs root now appears in the console tree.

Procedure 2: Creating Dfs Links

To create Dfs links, complete the following steps:

  1. Open Windows Explorer on each of your two servers and create the folders listed in Table 5.2. Then share the folders using the share names supplied in the table.

    Table 5.2 Link Parameters for Exercise 5.1

    Server Folder Share Name Link Name

    trey1

    C:\Apps\Database

    \\trey1\DB

    Database

    trey1

    C:\Apps\Wordprocessing

    \\trey1\Word

    Word Processing

    trey2

    C:\MoreApps\Maintenance

    \\trey2\Maint

    Maintenance

    trey2

    C:\MoreApps\CustomerService

    \\trey2\Custom

    Customer Service

  2. Open the Distributed File System console.
  3. Right-click the \\treyresearch.com\shared apps Dfs root you just created and, from the pop-up menu, select New Dfs Link to open the Create A New Dfs Link dialog box.
  4. In the Link Name box, type Database
  5. In the Send The User To This Shared Folder box, type \\trey1\DB
  6. Click OK to create the Dfs link.
  7. Repeat steps 1 through 6 to add another link called Word Processing, which points to the shared folder \\trey1\Word.
  8. Repeat steps 1 through 6 two more times to create the Maintenance link and the Customer Service link, using the parameters in Table 5.2.

Procedure 3: Accessing a Dfs Root

To access a Dfs root, complete the following steps:

  1. On the desktop of either one of your computers, double-click My Network Places, double-click Entire Network, double-click Microsoft Windows Network, and then double-click treyresearch.
  2. Double-click trey1. Windows Explorer displays a list of all shared folders on your domain controller. Notice that one of the shared folders is Shared Apps, your Dfs root.

    Does Windows 2000 provide an indication that Shared Apps is a Dfs root and not an ordinary shared folder?

  3. Double-click Shared Apps to view the Dfs links. Windows Explorer displays the Shared Apps On Trey1 window, which shows all the Shared Apps links.

    Does Windows 2000 indicate that the folders inside Shared Apps are Dfs links and not ordinary folders?

  4. Close all open windows.
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. How does Dfs facilitate network navigation for users?
  2. What is the difference between a domain root and a stand-alone root?
  3. Which of the following elements are required to use automatic replication of Dfs links?
    1. You must use a domain Dfs root, and the drive where the Dfs root is located must use NTFS.
    2. You can use either type of Dfs root, and all Dfs links must be located on NTFS drives.
    3. You must use a stand-alone root, and the first Dfs link must be located on an NTFS drive.
    4. You must use a domain Dfs root, and all Dfs links must be located on NTFS drives.

Lesson Summary

  • Distributed File System (Dfs) is a tool that enables you to consolidate shared folders located all over the network into a single hierarchical directory structure.
  • To implement Dfs, you must create a Dfs root and then at least one Dfs link.
  • To create and manage Dfs objects, you use the Distributed File System snap-in for MMC.
  • A Dfs root can be stored either in Active Directory or on a single computer.
  • You can create replicas of Dfs roots and links and configure Windows 2000 to automatically replicate the files at regular intervals.


Lesson 3: Installing Network Printers

Windows 2000 is designed for network printing. Client applications on a variety of platforms can send print jobs to printers attached to a computer running Windows 2000 or connected directly to the network by using a dedicated print server device. This lesson introduces you to network printing first by reviewing the terminology used in print services and providing guidelines for setting up a network printing environment, and then by explaining how to install and share a network printer.

After this lesson, you will be able to

  • Define the terms used in Windows 2000 printing
  • Describe the different printing scenarios for local and remote printing for print devices attached to the network and for print devices attached directly to the computer
  • Install and share a printer

Estimated lesson time: 30 minutes

Understanding Printing Terminology

Before you begin deploying printers on your network, you should be familiar with Windows 2000 printing terminology and understand how the different components fit together, as shown in Figure 5.21.

The following list defines a few Windows 2000 printing terms:

  • Printer. In Windows 2000 printing, the term printer refers not to the hardware device that produces printed documents, but to the software interface between the operating system and the print device. The printer defines which path a document takes to reach the print device (such as a local port, a network connection, or a file) when the document is printed, and how various other aspects of the printing process are performed. When users and applications make connections to printers, they use printer names, which point to one or more print devices.
  • Print device. A print device is the hardware device that produces printed documents. Windows 2000 supports both local and network print devices. Local print devices are those that are connected to a physical port on the print server, such as a parallel or serial port. Network print devices are those that are connected to a print server using the network instead of a physical port.

    Network print devices, also called network-interface print devices, require their own network interface adapters and have their own network address. A printer connected to the network in this way functions like any other node on the network; computers send print jobs to the print device just as though they were communicating with another computer. To connect a printer to the network in this way, you typically purchase a product such as an expansion card that installs into a slot in the print device, or you can purchase a stand-alone unit with a parallel port for connecting the print device and another port for connecting the network cable.

  • Print server. A print server is the computer on which the printers associated with local and network print devices reside. The print server receives and processes documents from client computers. You set up and share network printers on print servers.
  • Printer driver. A printer driver is one or more files containing information that Windows 2000 uses to convert application print commands into a page description language (PDL) understood by the print device, such as PostScript. This conversion makes it possible for the print device to print a document. A printer driver is specific to each print device model.
Figure 5.21 Printing terminology

Requirements for Network Printing

The requirements for setting up printing on a Windows 2000 network include the following:

  • At least one computer to operate as the print server-If the printer traffic is expected to be heavy, Microsoft recommends a dedicated print server. The computer can run either Windows 2000 Server or Windows 2000 Professional, depending on the number and type of clients the print server must support. Windows 2000 Server supports an unlimited number of client connections, whereas Windows 2000 Professional supports a maximum of only 10 simultaneous connections.
  • Sufficient random access memory (RAM) to process documents-If a print server manages a large number of printers or many large documents, the server might require additional RAM beyond what Windows 2000 requires for other tasks. If a print server does not have sufficient RAM for its workload, printing performance deteriorates.
  • Sufficient disk space-On the print server, you need sufficient disk space to ensure that Windows 2000 can store documents and other printable data sent to the print server until the print server sends the data to the print device. This requirement is critical when documents are large or likely to accumulate. For example, if 10 users send large documents to print at the same time, the print server must have enough disk space to hold all the spooled documents in the print queue until the print server sends them to the print device. If not enough space exists to hold all the documents, error messages appear and the user is unable to print.
Spooled print jobs can be significantly larger than the actual data the print application reads, because print jobs are sent through the printer driver to prepare the data for the printer.

Printing Configurations

Several combinations of clients, servers, and print devices are possible with Windows 2000, depending on whether the print device is remote or nonremote. Clients access a remote print device through a print server, whereas a nonremote print device receives data directly from the computer. The combination of clients, servers, and print devices also depends on whether the print device is attached to the computer or connected directly to the network.

The following figures show four basic printing configurations. The thin lines represent physical connections, such as network or parallel cables, and the arrows represent the logical print data flow.

Figure 5.22 shows the simplest configuration, a nonremote, local print device. The print device is plugged into the parallel port of the computer that runs the application. The printer driver and job queue are on that computer, which sends print data directly to the print device.

Figure 5.22 A nonremote, local print device

Figure 5.23 shows a small group of computers sharing a network print device. This is a peer-to-peer network, in which each computer has equal access to the print device and there is no central control of printing or security. Each computer has its own job queue and cannot see the documents queued on the print device by other computers. If printing halts, the error message does not appear on every client. This limitation is acceptable for small organizations in which the users are in frequent contact, but it becomes less manageable as traffic increases. Contention among computers submitting documents might cause the print device to time out or reject print jobs.

Figure 5.23 A nonremote, network print device

Figure 5.24 illustrates a network configuration using a central print server. Many clients share access to the print device through the server, which is locally connected to the print device. The job queue resides on the server and is visible to each client.

Figure 5.24 A remote, local print device

Printing is controlled by the server administrator. The administrator defines and enforces a security plan for the network, maintains the printer software, and downloads it to clients when they connect to the printer share. When a client connects to a network print queue, the client checks for new printer drivers on the print server and updates older printer drivers on the client.

Figure 5.25 shows several clients sharing a print device in a domain managed by a computer that is running Windows 2000 Server. The print device is connected to the server over the network, allowing one print server to manage several print devices.

To create and share printers, use the Add Printer Wizard on the print server, which is accessible from the Printers folder in Control Panel. Regardless of where the print devices are located, the printer software must be located on the print server. If the print device is directly attached to the computer, the wizard can usually detect it and then attempts to configure the printer software. If the print device is attached elsewhere on the network, you must create a port for it when you configure the printer software. You can also use the Add Printer Wizard to connect to remote print devices. When doing so, remember the following:

  • Creating a printer means installing the print device either directly on a print server or on the network and then configuring the printer software that controls the print device on the print server.
  • Connecting to a printer means connecting to the share on the computer that created the printer.
Figure 5.25 Remote, network print devices

Installing a Print Device

The first step in sharing a printer with network users is to install the print device on the computer that functions as the print server. The steps for installing a locally- attached print device and a networked print device are similar. When you run the Add Printer Wizard, the Local Or Network Printer page appears (Figure 5.26), on which you select which type of print device you want to install.

To configure the computer to function as a print server, select Local Printer and then specify the port to which the print device is connected. A locally-attached print device typically uses a parallel or serial port, whereas network-attached print devices usually require a newly created port that is associated with an IP address or some other type of identifier. The network printing product that you use to connect the print device to the network typically includes software that automates the port creation process.

The Network Printer option is not for installing a new print device that is connected to the network, but for accessing a printer that has already been shared by another computer on the network.
Figure 5.26 The Local Or Network Printer page of the Add Printer Wizard

After you have selected or created the appropriate port for the print device connection, the wizard takes you through the process of selecting the appropriate printer driver. When you finish the process of creating the printer, it appears as an icon in the Printers window.

Sharing a Printer

When you've installed a print device, it is available for use by the computer where you installed it, but to make it available to the network, you must share it. The Add Printer Wizard includes a Printer Sharing page that you can use to create a printer share during the installation, or you can use the following procedure to share a printer that you've already installed:

  1. Open the Printers window.
  2. Right-click the icon for the printer you want to share and, from the pop-up menu, choose Sharing to open the Properties dialog box of the printer and display the Sharing tab (see Figure 5.27).
  3. Click Shared As and supply a name for the share. This name is the one that users see when browsing the network.
  4. Click OK to create the printer share. Windows 2000 now displays an open hand under the printer icon, indicating that the printer is shared.
Figure 5.27 The Sharing tab in the Properties dialog box of a printer
For information about more advanced printer sharing techniques, see Lesson 4, later in this chapter.

Exercise 5.2: Installing and Sharing a Printer

In this exercise, you use the Add Printer Wizard to add a local printer to your computer and share it. You can perform this exercise without having a print device physically attached to the computer.

  1. Click Start and, from the Settings group, select Printers to open the Printers window.
  2. Double-click the Add Printer icon to launch the Add Printer Wizard.
  3. Click Next to bypass the Welcome page and display the Local Or Network Printer page.
  4. Verify that the Local Printer option is selected, clear the Automatically Detect And Install My Plug And Play Printer check box, and then click Next to display the Select The Printer Port page.
  5. Click Use The Following Port, and then verify that LPT1 is selected. For this exercise, assume that the print device you are adding is directly attached to your computer and using the LPT1 port.
  6. Click Next. The wizard prompts you for the printer manufacturer and model. Add an HP LaserJet 5Si printer.
  7. Under Manufacturers, choose HP; under Printers, choose HP LaserJet 5Si; and then click Next to display the Name Your Printer page. In the Printer Name box, Windows 2000 defaults to the printer name HP LaserJet 5Si. For this exercise, do not change this name. Click Next.
  8. Verify that Yes is selected for Do You Want Your Windows-Based Programs To Use This Printer As The Default Printer, and click Next to proceed to the Printer Sharing page. This page does not appear when you are installing the first printer on the computer.
  9. Click Share As and type printer1 in the text box provided. Click Next to proceed to the Location And Comment page.
  10. In the Location text box, type building 520, floor 18, office 1831; in the Comment text box, type black and white output laser printer - high volume; and then click Next to proceed to the Print Test Page page.
    Windows 2000 displays the values you enter for the Location text box and the Comment text box when a user searches the Active Directory store for a printer. Entering this information is optional, but doing so helps users locate the printer.
  11. Click No and click Next to proceed to the Completing The Add Printer Wizard page.
  12. Click Finish to install and share the printer. If necessary, Windows 2000 displays the Files Needed dialog box, prompting you for the location of the Windows 2000 Server distribution files. Windows 2000 copies the printer files, and an icon for the HP LaserJet 5Si printer appears in the Printers window. Windows 2000 displays an open hand under the printer icon to indicate that the printer is shared. Notice the check mark next to the printer, which indicates that the printer is the default printer for the print server.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. What is the difference between a print device and a printer?
  2. Which of the following Windows 2000 printing elements provides information about the number and type of paper trays in a print device?
    1. Printer
    2. Print device
    3. Print server
    4. Printer driver
  3. Which of the following Windows 2000 printing elements usually takes the form of hardware?
    1. Printer
    2. Print device
    3. Print server
    4. Printer driver

Lesson Summary

  • Windows 2000 network printing requires four components: the print device, the printer, the print server, and the printer driver.
  • A printer, in Windows 2000 terminology, is the software element that you create in the Printers control panel; the hardware that actually produces the printed output is called a print device.
  • To install a printer, you use the Add Printer Wizard to specify the location of the print device and select a printer driver.
  • Printer drivers contain information that is specific to the model of print device you are using, such as the number of fonts and paper trays included with the product.
  • To make a printer available to users on the network, you must create a printer share.


Lesson 4: Administering Network Printers

This lesson examines some of the more advanced administrative tasks used in network printing. Printers require more regular maintenance than most network components, even when you discount the physical maintenance required by the print device itself. The network administrator must ensure that printers are available when users need them and that the users can produce and retrieve their documents with a minimum of trouble.

After this lesson, you will be able to

  • Install additional printer drivers
  • Manage printers and documents
  • Redirect print jobs to another printer or print device
  • Use a Web browser to administer printers
  • Set up a printer pool
  • Set priorities between printers

Estimated lesson time: 30 minutes

Managing Printers

The primary Windows 2000 print management tool is the Printers window, shown in Figure 5.28, which is accessible in Control Panel by double-clicking the Printers tool or directly from the Start menu by selecting Printers from the Settings group. You can also gain partial access to printers for administration by using the Find feature in the Active Directory Users and Computers console.

The Printers window enables you to perform all administrative tasks related to printing; however, you cannot perform some of these tasks from the Active Directory Users and Computers console. For example, you cannot use the console to take a printer offline. You must access the specific printer by using the Printers window instead.

Managing printers includes installing additional printer drivers on a print server and setting a separator page. In addition, you can pause, resume, and cancel all print jobs in a printer queue or in a specific document if a problem occurs on a print device. If a print device is faulty or you add print devices to your network, you might have to redirect documents to a different printer. The following sections discuss some of the common printer management tasks you might have to perform.

Figure 5.28 The Windows 2000 Printers window

Installing Additional Printer Drivers

When you create a printer in Windows 2000, you must specify which printer driver the computer should use. The printer driver is the software component that enables the system to generate print jobs using the appropriate PDL and the appropriate features for the print device. For example, the printer driver knows how many paper trays a print device has and which fonts are built into the unit. The print driver supplies many of the printer-specific controls you use to manage a printer.

The printer driver you install when you create the printer is the one that Windows 2000 uses to create print jobs. However, when you share a printer on a network, some computers might be running other operating systems that access the printer as well. Each of these operating systems has its own drivers for a particular print device, and before a client computer can generate print jobs for the network printer, the driver must be installed.

To simplify this driver installation process, Windows 2000 enables you to install additional printer drivers for other computing platforms on the print server. When you install a shared network printer on a client computer, the system automatically downloads the appropriate drivers from the print server and installs it, saving you the trouble of supplying the driver files to each individual client computer.

To install additional printer drivers, use the following procedure:

  1. Open the Printers window.
  2. Right-click the printer you want to work with and, from the pop-up menu, select Sharing to display the Sharing tab of the Properties dialog box.
  3. Click Additional Drivers to open the Additional Drivers dialog box, shown in Figure 5.29.

    Figure 5.29 The Additional Drivers dialog box
  4. Select the check boxes next to the platforms and operating systems for which you want to install drivers.
  5. Click OK. Windows 2000 then displays a series of Insert Disk dialog boxes, prompting you for the locations of the driver files for each operating system you selected.
  6. Click OK to close the Additional Drivers dialog box, and click OK again to close the Properties dialog box.

Setting a Separator Page

A separator page is a file that contains print device commands. Separator pages have two functions:

  • They identify and separate printed documents. When many users share a single print device, it can be difficult to keep multipage documents separated and to identify to whom they belong. A separator page functions as a divider between documents and can identify the user who created each one.
  • They switch between print modes. Some print devices can switch between print modes that take advantage of different device features. You can use separator pages to specify the correct PDL. For example, you can use a separator page to change between PostScript and Printer Control Language (PCL). Windows 2000 includes four separator page files. They are located in the \systemroot\System32 folder (C:\Winnt\System32, by default). Table 5.3 lists the filename and describes the function for each of the included separator page files.

Table 5.3 Separator Page Files

Filename | Function
Pcl.sep | Switches the print mode to PCL for HP-series print devices and prints a page before each document.
Pscript.sep | Switches the print mode to PostScript for HP-series print devices but does not print a page before each document.
Sysprint.sep | Prints a page before each document. Compatible with PostScript print devices.
Sysprtj.sep | A version of Sysprint.sep that uses Japanese characters.

You can create your own custom separator pages by creating a .sep file that contains legal printer commands. You can also customize the existing .sep files to meet your needs. Refer to the documentation with your printer for commands that are legal for your printer. Once you have decided to use a separator page and have located or created an appropriate one, use the following procedure to implement it:

  1. Open the Printers window.
  2. Right-click the icon for the printer you want to work with and, from the pop-up menu, select Properties to open the Properties dialog box.
  3. Click the Advanced tab.
  4. Click Separator Page to open the Separator Page dialog box.
  5. Type the full path to the separator page file you want to use, or click Browse to navigate to the file.
  6. Click OK to close the Separator Page dialog box.
  7. Click OK to close the Properties dialog box. The separator page now prints at the beginning of each print job.

Pausing, Resuming, and Canceling Documents

When a problem occurs with a print device, it is often necessary to pause and resume the printer while you address the problem or to cancel all of the pending documents in the print queue. To pause a printer or cancel the documents in the queue, right-click the icon representing the printer in the Printers window and from the pop-up menu, choose Pause Printing or Cancel All Documents. When you pause a printer, a check mark appears in the menu next to the Pause Printing command. To resume the paused printer, choose the same command, and the check mark disappears.

You can also pause a printer and cancel printing by double-clicking the printer icon to open the Printers window and selecting the appropriate commands from the Printer menu.

You can also pause a printer by taking it offline. When you take a printer offline, documents stay in the print queue, even when the print server is shut down and then restarted. To take a printer offline, open the window for the specific printer, and on the Printer menu, click Use Printer Offline.

Print devices contain memory that they use to hold the print jobs they are currently processing. When you pause printing or cancel all documents, you stop the print server from sending data to the print device, but the documents that are currently in the device's memory continue to print. To immediately stop the print device from printing, you must physically take it offline using the controls on the device itself.

Redirecting Documents to a Different Printer

If you discover that a printer is connected to a faulty print device, you can redirect queued documents to a different printer so that users do not have to resubmit them. You can redirect all print jobs for a printer, but you cannot redirect specific documents. The new printer must use the same printer driver as the current printer.

You can redirect documents by using the following procedure:

  1. Open the Printers window.
  2. Right-click the icon for the printer you want to work with and, from the pop-up menu, choose Properties to display the Properties dialog box.
  3. Click the Ports tab, as shown in Figure 5.30.

    Figure 5.30 The Ports tab of a Properties dialog box for a printer
  4. To redirect the documents to another print device on the same print server, clear the port that the current print device is using and select the port to which the other print device is connected. Then click OK. To redirect the documents to a print device on another print server, continue with the the next step.
  5. Click Add Port to display the Printer Ports dialog box.
  6. In the Available Port Types list, select Local Port, and click New Port to display the Port Name dialog box.
  7. In the Enter A Port Name box, use UNC notation (\\printserver\printershare) to type the path to a printer share on the network, and click OK.
  8. In the Printer Ports dialog box, click Close.
  9. In the Properties dialog box, click Close.

Managing Documents

In addition to managing printers, Windows 2000 enables you to manage individual documents. Managing documents includes pausing, resuming, restarting, and canceling a document if a printing problem arises. In addition, you can specify who should be notified when a print job is finished, the priority level for a print job (which enables a critical document to print before other documents), and a specific time for a document to print.

Pausing, Restarting, and Canceling a Document

If a printing problem arises with a specific document, you can pause and resume printing only that document. Additionally, you can restart or cancel a document. You must have the Manage Documents permission for the appropriate printer to perform these actions. Because the creator of a document has the permissions needed to manage that document, users can perform any of these actions on their own documents.

To manage a document, use the following procedure:

  1. Open the Printers window.
  2. In the Printers window, double-click the icon for the printer to display the printer window (see Figure 5.31). This window contains a list of the documents that are currently in the queue for that printer.

    Figure 5.31 A Windows 2000 printer window
  3. Select a document from the list.
  4. On the Document menu, choose the appropriate command to pause, resume, restart, or cancel that document.

Setting Notification, Priority, and Printing Time

You can also manage print jobs by setting the notification, priority, and printing time parameters. To perform these document management tasks, you must have the Manage Documents permission for the appropriate printer. You set the notification, priority, and printing time parameters for a document using the following procedure:

  1. Open the Printers window.
  2. Double-click the icon for the printer you want to manage to open the printer window.
  3. Right-click a document in the queue and, from the pop-up menu, select Properties to display the Properties dialog box shown in Figure 5.32.

    Figure 5.32 The Properties dialog box of a document
  4. To notify a particular user when the document has been completed, in the Notify box, type the user's logon name.
  5. To change the printing priority for the document, move the Priority slider to the right.
  6. To specify a time when the document should print, in the Schedule box, select Only From, and specify a range of times when the document should be printed.
  7. Click OK to close the Properties dialog box.

Administering Printers from a Web Browser

Windows 2000 enables you to manage printers from any computer running a Web browser, regardless of whether the computer is running Windows 2000 or has the correct printer driver installed. With any of the more common Internet browsers executing on any client platform, users can view Web pages that display the status of a Windows 2000 print server and its connected printers, as shown in Figure 5.33. All of the tasks you perform with the Windows 2000 management tools are emulated by the Web interface. For a Windows 2000 print server to support Web-based printer management, the computer on which the printer resides must have Microsoft Internet Information Services (IIS) installed.

Figure 5.33 The Windows 2000 Web-based printer management interface

Using a Web browser to manage printers has several advantages:

  • You can administer printers from any computer running a Web browser, regardless of whether the computer is running Windows 2000 or has the correct printer driver installed.
  • You can customize the Web interface. For example, you can create your own Web page containing a floor plan with the locations of the printers and a link to each one.
  • The Web interface provides a summary page listing the status of all printers on a print server.
  • The Web interface can report real-time print device data, such as whether the print device is in Power Saving mode, if the printer driver makes such information available. This information is not available in the Printers window.

To use a Web browser to display a list of all of the printers on a print server, use the URL http://printserver/printers, where printserver is the name of the Windows 2000 computer hosting your printers. If you want to access a specific printer without first viewing a list of all printers, use http://printserver/share, where printserver is the name of the computer and share is the name of a specific printer share.

Setting Up a Printer Pool

A printer pool is one printer that is connected to multiple print devices, each using a different port on the print server. Printers process jobs according to whichever print device becomes available first. This strategy enables a large number of users to share a single printer without incurring delays because of a lengthy queue. The print devices in a printer pool should be identical, or at least use the same printer driver. The devices can be local or connected to the network. Figure 5.34 illustrates a printer pool containing three print devices.

Figure 5.34 A printer pool containing three print devices

When you create a printer pool, users can print documents without having to find out which print device is available-the printer checks for an available port. To create a printer pool, use the following procedure:

  1. Open the Printers window.
  2. Right-click the icon for the printer you want to work with and, from the pop-up menu, choose Properties to display the Properties dialog box.
  3. Click the Ports tab.
  4. Select the check boxes next to the ports that have print devices connected to them.
  5. Select Enable Printer Pooling.
  6. Click OK.

Setting Priorities Between Printers

Windows 2000 allows you not only to connect multiple print devices to a single printer, but also to create multiple printers and connect them all to a single print device. Multiple printers pointing to the same print device enable users to send critical documents to a high priority printer and noncritical documents to a lower priority printer. The critical documents always print first.

To set priorities between printers, point two or more printers to the same print device-that is, the same port. The port can be either a physical port on the print server or a port that points to a network print device. Set a different priority for each printer that is connected to the print device and then have different groups of users print to different printers, or have users send different types of documents to different printers.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. You have configured two Windows 2000 print servers on your network. When a user connects to one from Windows 95, printing is automatic. When the same user connects to the same print server for a different printer, the user is prompted to install a driver. Why is this happening?
  2. In an environment in which many users print to the same print device, how can you help reduce the likelihood of users picking up the wrong documents?
  3. Can you redirect a single document?

Lesson Summary

  • A Windows 2000 print server can supply printer drivers to client computers running a variety of operating systems on several platforms.
  • Using separator pages in a network environment enables users to easily identify their print jobs.
  • Using the Printers window, you can manage both printers and individual print jobs by pausing, resuming, and canceling them.
  • A Windows 2000 computer running Internet Information Services (IIS) provides a Web-based interface that you can use to manage printers from any computer on the network.
  • To facilitate network printing, you can connect several print devices to a single printer or connect several printers to a single print device.


Lesson 5: Managing Share Permissions

An important part of creating shares is controlling the access that users have to them. Windows 2000 shares have a system of permissions that is similar to, but completely independent from, that of the NTFS file system. You can use share permissions to specify which network users and group are permitted access to a share and what degree of access they should have.

After this lesson, you will be able to

  • Understand the effect of shared folder permissions on user access
  • Understand how shared folder permissions and NTFS permissions combine to control access to Windows 2000 volumes
  • Apply shared folder permissions
  • Apply printer permissions

Estimated lesson time: 40 minutes

Understanding Shared Folder Permissions

You can assign shared folder permissions to user and group accounts to control what users can do with the contents of a shared folder. Some of the most important characteristics of shared folder permissions are as follows:

  • Shared folder permissions apply to folders, not to individual files. Because you can apply shared folder permissions only to the entire shared folder, and not to individual files or subfolders in the shared folder, shared folder permissions provide less detailed security than NTFS permissions.
  • Shared folder permissions do not restrict access to users working at the computer where the folder is stored. They apply only to users who connect to the folder over the network.
  • Shared folder permissions are the only way to secure network resources on a FAT or FAT32 volume. File system permissions are not supported by FAT and FAT32.
  • The default shared folder permission is Full Control, and it is assigned to the Everyone group when you share the folder. To restrict access to a shared folder, you must modify or revoke the permissions granted to the Everyone group.
By default, a shared folder appears in Windows Explorer as an icon of a hand holding the shared folder. (Figure 5.35 shows the default sharing icon.)
Figure 5.35 Shared folders in Windows Explorer

Unlike NTFS, which has many different permissions, shared folders have only three. Table 5.4 explains what each of the shared folder permissions enables a client to do.

Table 5.4 Shared Folder Permissions

Shared Folder Permission | Enables the User or Group To
Read | View filenames and subfolder names, view data in files, traverse to subfolders, and run programs.
Change | Add files and subfolders to the shared folder, change data in files, delete subfolders and files, plus perform all actions permitted by the Read permission.
Full Control | Change file permissions (NTFS only), take ownership of files (NTFS only), and perform all tasks permitted by the Change permission.

Like with NTFS, you can allow or deny shared folder permissions. Generally, it is best to allow permissions and to assign permissions to a group rather than to individual users. Deny permissions only when you need to override permissions that are otherwise applied. In most cases, you should deny permissions only when you need to revoke a permission from a specific user who belongs to a group to which you have given the permission. A permission denial at any level (user or group) overrides all allow permissions.

How Windows 2000 Applies Shared Folder Permissions

Some of the rules that Windows 2000 follows when applying shared folder permissions are the following:

  • Multiple permissions combine for effective permissions. A user can be a member of multiple groups, each with different permissions that provide different levels of access to a shared folder. When you assign permissions to a user for a shared folder and that user is a member of a group to which you assigned a different permission, the user's effective permissions are the combination of the user and group permissions. For example, if a user has the Read permission and is a member of a group with the Change permission, the user's effective permission is Change, which includes Read.
  • Denials override other permissions. Denied permissions take precedence over any permissions that you otherwise allow for user accounts and groups. If you deny a shared folder permission to a user, the user does not have that permission, even if you allow the permission for a group of which the user is a member.
  • NTFS permissions are required on NTFS volumes. Shared folder permissions are sufficient to gain access to files and folders on a FAT volume, but not on an NTFS volume. On a FAT volume, users can gain access to a shared folder for which they have permissions, as well as all of the folder's contents. When users gain access to a shared folder on an NTFS volume, they must have the shared folder permission and also the appropriate NTFS permissions for each file and folder to which they gain access.
  • Copied, moved, or renamed shared folders are no longer shared. When you copy a shared folder, the original shared folder is still shared, but the copy is not shared. When you move or rename a shared folder, it is no longer shared.

Guidelines for Shared Folder Permissions

The following list provides some general guidelines for managing your shared folders and assigning shared folder permissions:

  • Determine which groups need access to each resource and the level of access that they require. Document the groups and their permissions for each resource.
  • Assign permissions to groups instead of user accounts to simplify access control administration.
  • Assign to a resource the most restrictive permissions that still enable users to perform required tasks. For example, if users only have to read information in a folder and they never delete or create files, assign the Read permission.
  • Organize resources so that folders with the same security requirements are located within a single folder. For example, if users require Read permission for several application folders, store the applications in subfolders within the same parent folder. Then share this parent folder instead of sharing each individual application folder.
  • Use intuitive share names so that users can easily recognize and locate resources. For example, for the \Applications folder, use Apps for the share name. You should also use share names that all client operating systems can use.

Table 5.5 describes the share and folder naming conventions for different client computer operating systems.

Table 5.5 Shared Folder Naming Conventions

Client Computer Operating System | Share Name Length | Folder Name Length
Windows 2000, Windows NT, Windows 98, and Windows 95 | 80 characters | 255 characters
MS-DOS, Microsoft Windows 3.1, and Windows for Workgroups | 8.3 characters | 8.3 characters

Windows 2000 provides 8.3-character equivalent names, but the resulting names might not be intuitive to users. For example, a Windows 2000 folder named \Accountants Database would appear as \Account~1 on client computers running MS-DOS, Windows 3.1, and Windows for Workgroups.

Combining Shared Folder Permissions and NTFS Permissions

You share folders to provide network users with access to resources. If you are using a FAT volume, the shared folder permissions are the only mechanism providing security for the shared folders and their contents. If you are using an NTFS volume, you can assign NTFS permissions to individual users and groups to better control access to the files and subfolders in the shared folders. When you share a folder on an NTFS volume, both the shared folder permissions and NTFS permissions combine to secure file resources. When you combine shared folder permissions and NTFS permissions, the more restrictive permission is always the overriding permission.

Shared folder permissions provide limited security for resources. One strategy for providing access to resources on an NTFS volume is to leave the shared folder permissions at their defaults and then control access by assigning NTFS permissions. You gain more flexibility by using NTFS permissions to control access to shared folders, plus the NTFS permissions apply whether users access the resource locally or over the network.

In Figure 5.36, the Users group has the shared folder Full Control permission for the \Public folder and the NTFS Read permission for File A. The Users group's effective permission for File A is Read because Read is the more restrictive permission. The effective permission for File B is Full Control because both the shared folder permission and the NTFS permission allow this level of access.

Figure 5.36 Combining shared folder permissions and NTFS permissions

Assigning Shared Folder Permissions

After you share a folder, the next step is to specify which users have access to it by assigning shared folder permissions to selected user accounts and groups. To assign permissions to user accounts and groups for a shared folder, use the following procedure:

  1. Open Windows Explorer and navigate to the shared folder whose permissions you want to modify.
  2. Right-click the shared folder and, from the pop-up menu, choose Sharing to display the Sharing tab of the Properties dialog box for the shared folder, as shown in Figure 5.37.

    Figure 5.37 The Sharing tab of a shared folder
  3. Click Permissions to display the Permissions dialog box for the shared folder. (See Figure 5.38.)

    Figure 5.38 The Permissions dialog box for a shared folder
  4. To modify existing permissions, in the Name list, choose one of the users or groups and select the Allow or Deny check boxes in the Permissions box to make the changes.
  5. To specify permissions for a new user or group, click Add to display the Select Users, Computers, Or Groups dialog box.
  6. In the Name list, choose a user or group, and click Add to insert it into the selected names list. Repeat if necessary.
  7. Click OK to add the selected names to the Name list in the Permissions dialog box.
  8. Select a user or group you just added to the Name list, and in the Permissions box, select the Allow or Deny check boxes next to the permissions you want to assign.
  9. Click OK to close the Permissions dialog box.

Controlling Printer Access

Windows 2000 allows you to control printer use and administration. Open the Properties dialog box for the printer assigning permissions and click the Security tab (see Figure 5.39). By using printer permissions, you can control who uses a printer. You can also assign printer permissions to control who can administer a printer and the level of administration, which can include managing printers and managing documents.

Figure 5.39 The Security tab of a printer's Properties dialog box

For various reasons, you might need to limit user access to certain printers. You might have a printer located in a secured area or a printer that uses expensive consumables to which you want to restrict access. You can also use printer permissions to delegate to users who are not administrators responsibilities for specific printers. Windows 2000 provides three levels of printer permissions, as described in Table 5.6.

Table 5.6 Shared Printer Permissions

Printer Permission | Enables the User or Group To
Print | Connect to a printer, submit documents to a printer for processing, and pause, resume, restart, and cancel printing of documents the user or group submitted.
Manage Documents | Control job settings for all documents; pause, resume, restart, and cancel printing of any documents; and perform all tasks permitted by the Print permission.
Manage Printers | Share a printer, change printer properties, delete printers, and change printer permissions, plus all tasks permitted by the Manage Documents permission.

Like with NTFS and shared folder permissions, you can grant or deny printer permissions, and denied permissions always override granted permissions. For example, if you deny the Manage Documents permission to the Everyone group, no one can manage documents, even if you granted the permission to other user accounts or groups. This is because all accounts are members of the Everyone group.

By default, Windows 2000 assigns to the Everyone group the Print permission for each printer, enabling all users to send documents to the printer. To restrict access to a printer, you must first revoke or modify the permissions granted to the Everyone group.

Taking Ownership of a Printer

By default, the user who installs the printer owns it. If that user can no longer administer the printer-for example, if the current owner leaves the company-another owner should take ownership to administer that printer. Ownership of a printer cannot be assigned by one user to another user. However, an administrator can assign ownership to the Administrators group. The following users can take ownership of a printer:

  • A user or a member of a group who has the Manage Printers permission for the printer.
  • Members of the Administrators, Print Operators, Server Operators, and Power Users groups. By default, these groups have the Manage Printers permission, which enables them to take ownership.

To take ownership of a printer, use the following procedure:

  1. Open the Printers window.
  2. Right-click the icon for the printer you want to work with and from the context menu, select Properties to display the Properties dialog box.
  3. Click the Security tab.
  4. Click Advanced to display the Access Control Settings dialog box for the printer.
  5. In the Change Owner To list, select one of the users or groups and click OK to close the Access Control Settings dialog box.
  6. Click OK to close the Properties dialog box.

Exercise 5.3: Applied Permissions

In this exercise, User 1 has local access to files and has been assigned permissions to gain access to resources as an individual and as a member of a group, as shown in Figure 5.40.

Figure 5.40 Applied permissions

Determine what effective permissions User 1 has in each of the following situations:

  1. User 1 is a member of Group 1, Group 2, and Group 3. Group 1 has Read permission (R) and Group 3 has Full Control permission (FC) for Folder A. Group 2 has no permissions for Folder A. What are User 1's effective permissions for Folder A?
  2. User 1 is also a member of the Sales group, which has Read permission for Folder B. User 1 has been denied the shared folder Full Control permission for Folder B as an individual user. What are User 1's effective permissions for Folder B?
Answers

Exercise 5.4: Managing Shared Folders

Figure 5.41 shows examples of shared folders on NTFS volumes. These shared folders contain subfolders that have also been assigned NTFS permissions.

Figure 5.41 Combined permissions

Determine a user's effective permissions for each example:

  1. In the first example, the \Data folder is shared. The Sales group has the shared folder Read permission for the \Data folder and the NTFS Full Control permission for the \Sales subfolder. What are the Sales group's effective permissions for the \Sales subfolder when Sales group members access the \Sales subfolder by making a connection to the \Data shared folder?
  2. In the second example, the \Users folder contains user home folders. Each user home folder contains data that is accessible only to the user for whom the folder is named. The \Users folder has been shared, and the Users group has the shared folder Full Control permission for the \Users folder. User 1 and User 2 have the NTFS Full Control permission only for their home folder and no NTFS permissions for other folders. These users are all members of the Users group. What permissions does User 1 have when accessing the \User 1 subfolder by making a connection to the \Users shared folder? What are User 1's permissions for the \User 2 subfolder?
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next chapter. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. When a folder is shared on a FAT volume, what does a user with the shared folder Full Control permission for the folder have access to?
  2. What are the shared folder permissions?
  3. By default, what are the permissions that are assigned to a shared folder?
  4. When a folder is shared on an NTFS volume, what does a user with the shared folder Full Control permission for the folder have access to?

Lesson Summary

  • Shared folder permissions enable you to restrict access to shared folders and printers.
  • Shared folder permissions work in combination with NTFS permissions to provide the effective rights for a user or group. To access files in a shared NTFS folder, a user must have both shared folder permissions and NTFS permissions.
  • Deny permissions always override allow permissions.
  • Shared printer permissions enable you to control who can send jobs to printers and manage documents and printer configuration settings.
  • To manage permissions for a shared folder, you click Permissions of the Sharing tab of the folder's Properties dialog box.
  • To manage permissions for a shared printer, you click the Security tab in the printer's Properties dialog box.


Monitoring Server Health and Security

About This Chapter

The server is the lifeblood of many networks, and the network administrator is responsible for ensuring that the server operates properly. Microsoft Windows 2000 includes a variety of tools that you can use to monitor the operations of the server, the actions of the users connected to the server, and the traffic passing over the network. This chapter examines the procedures for using these tools to gather information about the health and security of your server and your network.

Before You Begin

To perform the exercises in this chapter, you need two computers connected to a network with Microsoft Windows 2000 Server properly installed on one of them.


Lesson 1: Monitoring Server Performance

Periodically checking the performance of your server is a good way to spot problematic trends before they become critical. Windows 2000 tools such as Event Viewer, Task Manager, and the Performance console can provide you with a picture both of a server's current activities and of its recent history. Learning to evaluate and understand the information provided by these tools is crucial to maintaining and troubleshooting a server running Windows 2000.

After this lesson, you will be able to

  • Use Event Viewer to read the Windows 2000 logs
  • Use Task Manager to monitor system processes and resources
  • Use the Performance console to monitor and log specific system performance criteria

Estimated lesson time: 40 minutes

Using Event Viewer

Windows 2000 automatically tracks various system events and stores information about them in a series of logs. You use Event Viewer to view these logs and to perform a variety of other tasks, including viewing the information gathered as a result of setting the audit policy and auditing events, as well as searching for specific events within log files.

By default, Windows 2000 maintains three logs that are available in Event Viewer:

  • System log. Contains information about events generated by Windows 2000 components, such as services and device drivers. For example, a failure of a service to start or a driver to load during system startup is recorded in the system log. Windows 2000 chooses the types of events recorded in this log. You should view this log first when looking for information about Windows 2000 system problems.
  • Security log. Contains information about security-related events, such as failed logons, attempts to access protected resources, such as shares and file system elements, and success or failure of audited events. The events that Windows 2000 records in this log are a result of the audit policies you specify. By default, only members of the Administrators group can view this log.
  • Application log. Contains information about specific programs running on the computer, as determined by the application developer.

When you install optional services on a computer running Windows 2000, the system sometimes creates additional logs as well. When you promote a computer running Windows 2000 Server to a domain controller (installing the Microsoft Domain Name System (DNS) service in the process), three additional logs are added to Event Viewer:

  • Directory service log. Contains information about Active Directory service events
  • File replication service log. Contains information about the success or failure of file replication activities
  • DNS server log. Contains information about the status and operations of the DNS service

Viewing Event Logs

Event Viewer is a Microsoft Management Console (MMC) snap-in that you can access in a variety of ways. To use the simplest method to view the contents of the Windows 2000 event logs, from the Administrative Tools program group on the Start menu, select Event Viewer, which opens the Event Viewer console shown in Figure 6.1. You can also access Event Viewer in the Computer Management console or add it to a customized console of your own.

For more information about using MMC snap-ins and consoles, see Lesson 2 in Chapter 1, "Networking with Windows 2000."
Figure 6.1 The Windows 2000 Event Viewer console

The scope pane of the Event Viewer console lists the various logs maintained by the computer. Selecting one of the logs displays its events in chronological order (most recent first) in the details pane. You can re-sort the list by clicking any of the column headings. Each event in a log is flagged with a type indicator, which can have any of the values shown in Table 6.1.

Table 6.1 Windows 2000 Event Types

Event Type | Icon | Description
Error |  | A significant problem, such as loss of data or loss of functionality
Warning |  | An event that might not be significant, but might indicate a future problem
Information |  | An event that describes the successful operation of an application, driver, or service
Success audit |  | An audited security access attempt that succeeds
Failure audit |  | An audited security access attempt that fails

Every logged event is summarized in the details pane with the date and time that the event occurred, plus an event number and the software module associated with the incident. Double-click an event to display an Event Properties dialog box, as shown in Figure 6.2. This dialog box contains a more complete description of the event, plus any related raw data.

Figure 6.2 An Event Properties dialog box

Locating Events

When you first start Event Viewer, it automatically displays all events that are recorded in the selected log. To limit the display of what appears in the log, use the Filter command to select the events you want to see. To implement filters in Event Viewer, from the View menu, choose Filter to display the Filter tab of the System Properties dialog box, as shown in Figure 6.3. In this dialog box, you can specify the event types you want to display and select other event criteria to reduce an event list to a manageable size.

Figure 6.3 The Event Viewer Filter tab

Similarly, you can choose Find from the View menu to perform a search on a log for particular events, using the Find dialog box shown in Figure 6.4.

Figure 6.4 The Event Viewer Find dialog box

Table 6.2 lists the various criteria you can use to create filters for and perform searches on an event log.

Table 6.2 Options for Filtering and Finding Events

Option | Description
From and To | The date range for which to view events (Filter tab only).
Event Types | The types of events to view.
Event Source | The software or component driver that logged the event.
Category | The type of event, such as a logon or logoff attempt or a system event.
Event ID | An event number to identify the event. This number helps product support representatives track events.
User | A user logon name.
Computer | A computer name.
Description | The text that is in the description of the event (Find dialog box only).
Search Direction | The direction (up or down) in which to search the log (Find dialog box only).

Remote Access

As with many MMC snap-ins, you can use Event Viewer to view the logs on other computers as well as the computer on which you are working. To perform this task, in the scope pane, right-click the Event Viewer (Local) icon and choose Connect To Another Computer from the pop-up menu. In the Select Computer dialog box, specify the name of the computer.

Using Task Manager

Windows Task Manager provides summary information about computer performance as well as programs and processes running on the computer. By using Task Manager, you can quickly see the status of programs that are running, end programs that have stopped responding, and view a dynamic display containing key indicators of your computer's performance, including graphs of your current CPU and memory usage.

To open Task Manager, right-click an empty space on the Windows 2000 taskbar and, from the pop-up menu, choose Task Manager. You can also open Task Manager by pressing Ctl+Alt+Delete and then, in the Windows Security dialog box, clicking Task Manager. The Windows Task Manager window contains three tabs: Applications, Processes, and Performance. You can change the display options of each tab by choosing the option you want from the View menu. Many of the View menu options are specific to the selected tab.

To update the data in a Task Manager display, from the View menu, select Refresh Now. You can also change the frequency at which the data is automatically updated by choosing Update Speed from the View menu and then clicking the option that you want (High, Normal, Low, or Paused).

Applications Tab

The Applications tab of Task Manager shows the status of the programs running on your computer, as shown in Figure 6.5. In this tab, you can start a new program (by clicking New Task), end a program (by choosing a task from the list and clicking End Task), or switch to another program (by choosing a task from the list and clicking Switch To). Using Task Manager to start a program is identical to using the Run command on the Start menu. If a program running on the computer stops responding, you can select the program that is not responding and click End Task to forcibly close it. Any data entered or changes made that were not saved when the program stopped responding are then lost.

Figure 6.5 The Task Manager Applications tab

Processes Tab

The Task Manager Processes tab, as shown in Figure 6.6, presents information about the processes running on your computer, such as its current CPU and memory usage. This information is formatted into columns, each of which is devoted to a specific statistic, called a counter. By clicking the column headings, you can sort the list of processes using any of the counters.

Figure 6.6 The Processes tab

You can also modify the counters that are displayed for each process by choosing Select Columns from the View menu, to display the Select Columns dialog box shown in Figure 6.7. Select the check boxes next to the counters you want to display and click OK.

Figure 6.7 The Select Columns dialog box

By enlarging the Task Manager window, you can display information about the processes running on your computer, as shown in Figure 6.8.

Figure 6.8 An expanded Processes tab

In the Processes tab, you can also end a process by selecting it and clicking End Process.

Be careful when ending a process. If you end an application, you will lose unsaved data. If you end a system service, some part of Windows 2000 might not function properly.
Task Manager does not allow you to end a process that is critical to the operation of Windows 2000. Utilities included with the Microsoft Windows 2000 Resource Kit enable you to end critical processes. However, this procedure is likely to cause operating system instability.

In addition, you can end a process and all the processes directly or indirectly created by it. Right-click the process you want to end, and then choose End Process Tree from the pop-up menu. For example, if you end the process tree for an e-mail program such as Microsoft Outlook, you also end related processes such as Mapisp32.exe and the Messaging Application Programming Interface (MAPI) spooler.

The Processes tab also enables you to assign a process to a particular processor in a multiprocessor computer by using the Set Affinity command. Using this command limits the execution of the process to the selected processor and could decrease overall performance. In addition, the Processes tab enables you to change the priority of a running program. Changing the priority of a program can make it run faster or slower, depending on whether you raise or lower the priority, and it can also adversely affect the performance of other processes.

Performance Tab

The Task Manager Performance tab displays a dynamic overview of your computer's performance, as shown in Figure 6.9. This tab includes graphs for CPU and memory usage; totals for the number of handles, threads, and processes running on the computer; and totals, in kilobytes, for physical, kernel, and commit memory.

Figure 6.9 The Performance tab

If you select Show Kernel Times from the View menu, Task Manager adds a red line to the CPU Usage graph and the CPU Usage History graph. The red line indicates the amount of CPU resources that kernel operations consume.

Using the Performance Console

Performance is a built-in MMC console, accessible from the Administrative Tools program group, which contains two preinstalled snap-ins: System Monitor and Performance Logs and Alerts (see Figure 6.10). The System Monitor snap-in enables you to collect and view real-time data about memory, disk, processor, network, and other activity in graph, histogram, or report form. The Performance Logs and Alerts snap-in enables you to collect performance data from local or remote computers, as well as configure logs to record performance data and set system alerts to notify you when a specific counter indicates a value above or below a defined threshold.

Figure 6.10 The Windows 2000 Performance console

Monitoring system performance is an important part of maintaining and administering your Windows 2000 Server installation. You can use performance data for the following purposes:

  • To understand your workload and its effect on your system resources
  • To observe changes and trends in workloads and resource use so that you can plan for future upgrades
  • To test configuration changes or other tuning efforts by monitoring the results
  • To diagnose problems and target components or processes for optimization

Using the System Monitor Snap-In

In Windows 2000, the Performance Monitor snap-in has been replaced by the System Monitor snap-in. With System Monitor, you can measure the performance of your own computer or other computers on a network. System Monitor enables you to perform the following tasks:

  • Collect and view real-time performance data on a local computer or from remote computers
  • View data collected either currently or previously in a counter log
  • Present data in a printable graph, histogram, or report view
  • Incorporate System Monitor functionality into Microsoft Word or other applications in the Microsoft Office suite by means of automation
  • Create HTML pages from performance views
  • Create reusable monitoring configurations that can be installed on other computers that use MMC

With System Monitor, you can collect and view extensive data about hardware resource use and the activity of system services on the computers you administer. You can define the data you want the graph to collect in the following ways:

  • Type of data. To select the data to be collected, you can specify one or more counters, which are instances of performance objects. Some objects (such as the memory object) provide system resource counters; others provide counters on the operation of applications (for example, system services or Microsoft BackOffice applications).
  • Source of data. System Monitor can collect data from your local computer or from other computers on the network for which you have the appropriate permissions. (By default, membership in the Administrators group is required.) In addition, you can include real-time data or data collected previously and saved in counter logs.
  • Sampling parameters. System Monitor supports manual, on-demand sampling or automatic sampling based on the time interval you specify. When viewing logged data, you can also choose starting and stopping times so that you can view data spanning a specific time range.

When you open the Performance console, it shows the two snap-ins in the left pane. System Monitor is selected by default, and a blank graph view and a toolbar appear. After you add counters to the graph, System Monitor begins charting counter values in this graph area, as shown in Figure 6.11. As the figure illustrates, the System Monitor interface has three main areas: the graph area, the legend, and the value bar.

Figure 6.11 The System Monitor snap-in charting counter values in the graph view

You can choose to have the data in the graph area updated automatically or on demand. For updating on demand, use the Update Data button to start and stop the collection intervals. Click Clear Display to remove all data from the display. To add counters to the graph, click Add and select the counters from the Add Counters dialog box, as shown in Figure 6.12.

Figure 6.12 The Add Counters dialog box

The movement of the timer bar (the vertical line crossing the entire graph) indicates the passing of each update interval. Regardless of the update interval, the view shows up to 100 data samples. System Monitor compresses log data as necessary to fit it in the display. To see the compressed data in a log, click Properties (the fourth toolbar icon from the right), click the Source tab, select a log file, and then select a shorter time range. Shorter time ranges contain less data, so the system is less likely to eliminate data points.

You can also define the following attributes of the graph:

  • Type of display, with options for graph, histogram, or report
  • Background color of the details pane and of the data display area
  • Size, type, and style of font used to show text in the display
  • Color, width, and style of line used to chart data

The names and associated information for the counters you select are shown in the legend, the set of columns beneath the graph. The legend displays the following information:

  • Object. A logical collection of counters associated with a resource or service that can be monitored.
  • Counter. A data item associated with an object. For each counter selected, System Monitor presents a value corresponding to a particular aspect of the performance defined for the object.
  • Instance. A term used to distinguish between multiple occurrences of the same counter on a computer. Note that by default, counter instances are listed by name and numerical index. This index appears after the instance name, represented by a pound sign (#) and a number. This index makes it easier to monitor multiple instances, for example, when you are monitoring threads of a process. To turn off the index display, click Properties and clear the Allow Duplicate Counter Instances check box.

You can sort entries in ascending or descending order by object, counter, instance, or computer by clicking the appropriate column name in the counter legend.

To match a line in a graph with the counter for which it is charting values, double-click a position in the graph line. The corresponding counter is selected in the legend. If chart lines are close together, try to find a point in the graph where they diverge. Otherwise, System Monitor might not be able to pinpoint the value you are interested in viewing.

The value bar is located beneath the graph area and above the legend. The value bar contains the Last, Average, Minimum, and Maximum values for the counter currently selected. The values are calculated over the time period and number of samples displayed in the graph, not over the time that has elapsed since monitoring was started. The Duration value in the value bar indicates the total elapsed time displayed in the graph (based on the update interval).

Monitoring System and Network Performance

Network activity can influence the performance not only of your network components, but also of your system as a whole. You should monitor other resources along with network activity, such as disk, memory, and processor activity. System Monitor enables you to track network and system activity by using a single tool.

Use the following counters as part of your normal monitoring configuration:

  • Cache\Data Map Hits %
  • Cache\Fast Reads/sec
  • Cache\Lazy Write Pages/sec
  • Logical Disk\% Disk Space
  • Memory\Pages/sec
  • Memory\Available Bytes
  • Memory\Nonpaged Pool Allocs
  • Memory\Nonpaged Pool Bytes
  • Memory\Paged Pool Allocs
  • Memory\Paged Pool Bytes
  • PhysicalDisk\% Disk Time
  • Processor(_Total)\% Processor Time
  • System\Context Switches/sec
  • System\Processor Queue Length
  • Processor(_Total)\Interrupts/sec

Monitoring network activity with System Monitor involves examining performance data at each network layer, as defined in the Open Systems Interconnection (OSI) reference model. System Monitor provides performance objects for collection of data that reflects transmission rates, packet queue lengths, and other network performance data.

Because of the overhead of the protocol headers, actual transmission rates might differ from the rates specified for the wire or line in use.

When monitoring performance data for your network, begin with the lowest-level components and work your way up. Monitor the objects over periods ranging from days to weeks to a month. Using this data, determine a performance baseline, the level of performance you expect under typical workloads and use. A performance baseline gives you a point from which to compare performance over time to identify growth trends, changing demands, or the emergence of a bottleneck. If performance within the baseline range becomes unsatisfactory, tune the network.

As with other resources, establish a baseline for network performance. When performance data is incompatible with your baseline values, investigate the cause. Abnormal network counter values on a server often indicate problems with the server memory, processor, or disks. For that reason, the best approach to monitoring a server is to watch network counters in conjunction with the Processor(_Total)\% Processor Time, PhysicalDisk\% Disk Time, and Memory\Pages/sec statistics.

For example, if a dramatic increase in Pages/sec is accompanied by a decrease in Bytes Total/sec handled by a server, the computer is probably running short of physical memory for network operations. Most network resources, including network adapters and protocol software, use unpaged memory. If a computer is paging excessively, it could be because most of its physical memory has been allocated to network activities, leaving a small amount of memory for processes that use paged memory. To verify this situation, check the computer system event log for entries indicating that it has run out of paged or unpaged memory. Also monitor the unpaged pool memory and overall memory counters.

Removing Unneeded Services

Based on the information gathered by System Monitor and Task Manager, you might be able to maximize system resources by identifying Windows 2000 services you don't need that are utilizing large amounts of memory or processor time. When you've identified these services, you can prevent them from loading by opening the Services MMC snap-in from the Administrative Tools program group, opening the Properties dialog box for a particular service, and changing the Startup Type value to Disabled or Manual. In some cases, you can also remove the service completely by uninstalling it using the Add/Remove Wndows Components dialog box in the Add/Remove Programs Control Panel.

Using the Performance Logs and Alerts Snap-In

With Performance Logs and Alerts, you can collect performance data automatically from local or remote computers. You can view logged counter data by using System Monitor, or you can export the data to spreadsheet programs or databases for analysis and report generation. Note that, because logging runs as a service, data collection can occur regardless of whether any user is logged on to the computer being monitored. The Performance Logs and Alerts snap-in enables you to perform the following tasks:

  • Collect data in a comma-delimited or tab-separated format for easy import to spreadsheet programs. A binary log-file format is also provided for circular logging or for logging instances such as threads or processes that might begin after the log starts collecting data. (Circular logging is the process of continuously logging data to a single file, overwriting previous data with new data.)
  • View counter data during collection and after collection has stopped.
  • Define start and stop times, filenames, file sizes, and other parameters for automatic log generation.
  • Manage multiple logging sessions from a single console window.
  • Set an alert on a counter, thereby stipulating that a message be sent, a program be run, or a log be started when the selected counter has a value that exceeds or falls below a specified setting.

Similar to System Monitor, Performance Logs and Alerts supports the definition of performance objects, performance counters, and object instances; furthermore, it supports the setting of sampling intervals for monitoring data about hardware resources and system services. Performance Logs and Alerts also offers the following additional options related to recording performance data:

  • Starting and stopping logging. Either manually, on demand, or automatically start and stop logging based on a user-defined schedule.
  • Creating trace logs. Using the default system data provider or another provider, trace logs record data when certain activities occur, such as disk I/O operations or page faults. When the event occurs, the provider sends the data to the Performance Logs and Alerts snap-in. This recording and sending of data differs from the operation of counter logs; when counter logs are in use, the service obtains data from the system when the update interval has elapsed, rather than waiting for a specific event. A parsing tool is required to interpret the trace log output. Developers can create such a tool by using application programming interfaces (APIs) provided on the Microsoft Web site, http://msdn.microsoft.com.
  • Defining a program that runs when a log is stopped.
  • Configuring additional settings for automatic logging, such as automatic file renaming, and setting parameters for stopping and starting a log based on the elapsed time or the file size.
You can work with data from a log file while the service is collecting data and has the log file locked. For example, Microsoft Excel can import an active log file, but it opens a read-only version of the locked log.

In Performance Logs and Alerts, you can define settings for counter logs, trace logs, and alerts. The details pane of the console window shows logs and alerts that you have created, as shown in Figure 6.13.

Figure 6.13 Logs and alerts in the Performance Logs and Alerts snap-in

You can define multiple logs or alerts to run simultaneously. Each log or alert is a saved configuration that you define. If you have configured the log for automatic starting and stopping, a single log can generate many individual log data files. For example, if you were generating a log file for each day's activity, one file would close at 11:59 P.M. today, and a new file would open at midnight tomorrow.

Table 6.3 explains the query summary information provided by the columns in the details pane.

Table 6.3 The Columns in the Details Pane

Column | Description
Name | This column provides the name of the log or alert. Think of it as a "friendly name" describing the type of data you are collecting or the condition you are monitoring. One log can generate multiple log files. A sample log file, named System Overview, has been predefined for counter logging. You can start logging by using this file or by defining your own settings as appropriate.
Comment | This column includes any descriptive information about the log or alert.
Log File Type | This column contains the log-file format you define. For alert, the type is always alerts; for trace logs, it is always sequential. For logs, this type can be binary, binary circular, text-CSV (for comma-delimited text), or text-TSV (for tab-delimited text).
Log File Name | This column lists the path and base filename you defined for the files generated by this log. The base filename is used for automatically naming new files.

To see the parameters defined for each log, select the log name in the details pane and, from the Action menu, choose Properties. In the Properties dialog box that appears, choose how to name your log files, determine when logging is scheduled to occur, and decide which performance objects and counters you want to monitor in your log.

If a log is currently running and collecting data (based on the schedule you defined for the log or alert), a green data icon appears next to the log or alert. If a red icon appears, the log or alert has been defined but is not currently running.

You can configure more than one type of log to run at a time. One log can generate multiple log files if the Restart option is selected or if you start and stop the log multiple times. However, these individual log files do not appear in the console window. Use Windows Explorer to view a listing of these files.

Exercise 6.1: Monitoring System Performance Parameters

In this exercise, you create a System Monitor graph containing a number of counters that provide information on vital system functions.

  1. Click Start and from the Programs/Administrative Tools group, open the Performance console.
  2. Right-click anywhere in the field of the (empty) graph and, from the pop-up menu, choose Add Counters to display the Add Counters dialog box.
  3. From the Performance Object drop-down list, select Processor.
  4. Click the Select Counters From List option and, in the list of counters, select % Processor Time.
  5. Click the Select Instances From List option and, from the list of instances, select Total.
  6. Click Add to add the counter to the graph.
  7. From the Performance Object drop-down list, select Memory.
  8. From the Counters list, select Available MBytes.
  9. Click Add.
  10. Click Close. What do you see?
  11. Click View Histogram and then View Report. What do you see when you click these buttons?
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Name two methods for opening the Windows 2000 Task Manager.
  2. Which three logs does Windows 2000 display in Event Viewer by default?
  3. Which of the following tools is capable of displaying the amount of CPU resources that kernel operations consumed?
    1. Event Viewer
    2. System Monitor
    3. Task Manager
    4. Performance Logs and Alerts

Lesson Summary

  • Event Viewer enables you to view and search through the various log files maintained by Windows 2000.
  • Task Manager displays information about the applications and processes running on the computer, as well as performance statistics such as CPU and memory usage.
  • The System Monitor snap-in enables you to display continually updated system performance statistics in a variety of formats.
  • The Performance Logs and Alerts snap-in collects performance data from computers all over the network, and sets alerts to inform you of unusual system activity.
  • Installing applications on a Windows 2000 computer can add new logs to Event Viewer and new counters to System Monitor.


Lesson 2: Monitoring Shared Resources

Windows 2000 includes the Shared Folders snap-in so that you can easily monitor access to network resources, view sessions and open files, disconnect users from shared folders, and send administrative messages to users. You monitor access to network resources to assess and manage the current use on your network servers.

After this lesson, you will be able to

  • Identify who can monitor access to network resources
  • Use the Shared Folders snap-in
  • View the shared folders on a computer
  • Monitor and create shared folders
  • Monitor open files
  • Disconnect users from one or all open files

Estimated lesson time: 25 minutes

Why Monitor Network Resources?

The three primary reasons why it is important to assess and manage network resources are as follows:

  • Maintenance. To perform maintenance tasks on network resources, you might need to periodically make certain resources unavailable to users. To do this, you first have to determine which users are currently using a resource so that you can notify them before taking the resource offline.
  • Security. To maintain network security, you might want to monitor user access to resources that are confidential to verify that only authorized users are accessing them.
  • Planning. Meeting the expanding needs of the network's users requires that you determine which resources are being used and how much they are being used so that you can plan for future system growth.

Windows 2000 includes the Shared Folders snap-in so that you can easily monitor access to network resources, configure network shares, and send administrative messages to users. The Shared Folders snap-in is included as part of the Computer Management console, which you can access from the Administrative Tools program group. As with any MMC snap-in, you can also add the Shared Folders snap-in to a custom console, specifying whether you want to monitor the resources on the local computer or on a remote computer.

To add the Shared Folders snap-in to a custom console, use the following procedure:

  1. Open the Run dialog box, in the Open box, type MMC, and click OK to open an empty MMC console.
  2. From the Console menu, choose Add/Remove Snap-In to display the Add/Remove Snap-In dialog box.
  3. Click Add to open the Add Stand-Alone Snap-In dialog box.
  4. Scroll down the Available Stand-Alone Snap-Ins list and select Shared Folders.
  5. Click Add to display the Shared Folders dialog box (see Figure 6.14).

    Figure 6.14 The Shared Folders dialog box
  6. Select the appropriate option to specify whether you want to manage the shared folders on the local computer or another computer on the network. If you elect to manage another computer, specify its name in the box provided, or click Browse and navigate to it.
  7. In the View box, specify whether you want the snap-in to contain the Shares folder, the Sessions folder, the Open Files folder, or all three.
    If you select the Allow The Selected Computer To Be Changed When Launching From The Command Line check box, you can choose the remote computer on which you want to create and manage shares. If you don't select this check box, the console is always directed to the same remote computer.
  8. Click Finish to close the Shared Folders dialog box.
  9. Click Close to close the Add Stand-Alone Snap-In dialog box.
  10. Click OK to close the Add/Remove Snap-In dialog box and add the Shared Folders snap-in to the console, as shown in Figure 6.15.

    Figure 6.15 A custom MMC console containing the Shared Folders snap-in

Not all users can use the Shared Folders snap-in to monitor access to network resources, however. In a domain, a user must be a member of the Administrators group or the Server Operators group, and in a workgroup, a user must be a member of the Administrators group or the Power Users group.

The Shared Folders snap-in appears in MMC with three folders, called Shares, Sessions, and Open Files, as shown in Figure 6.16. The Shares folder contains a list of all the shares on the computer. The Sessions folder lists the users who are currently connected to the computer shares, and the Open Files folder lists the files that the connected users are accessing. The following sections examine the functions you can perform by using these three folders.

Figure 6.16 The Shared Folders MMC snap-in

Monitoring Shared Folders

You monitor access to shared folders to determine how many users are currently connected to each shared folder on a computer running Windows 2000. You can also monitor open files to determine which users are gaining access to the files, and you can disconnect users from one open file or from all open files. You use the Shares folder in the Shared Folders snap-in to view a list of all shared folders on the computer and to determine how many users have a connection to each folder. In Figure 6.17, the Shares folder has been selected in the Computer Management console tree, and all the shared folders on that computer are shown in the details pane.

Figure 6.17 The Shares folder in the Computer Management console

The columns in the details pane provide the following information about each share on the computer:

  • Shared Folder. The shared folders on the computer. This name was assigned to the folder when it was shared.
  • Shared Path. The path to the shared folder on the host computer.
  • Type. The operating system that must be running on a computer so that it can gain access to the shared folder.
  • # Client Redirections. The number of clients who have made a remote connection to the shared folder.
  • Comment. Descriptive text about the folder. This comment was provided when the folder was shared.
Windows 2000 does not update the list of shared folders, open files, and user sessions automatically. To update these lists, from the Action menu, select Refresh.

Determining How Many Users Can Access a Shared Folder Concurrently

You can use the Shared Folders snap-in to view and modify the maximum number of users who are permitted to access a folder. In the Shared Folders details pane, right-click the shared folder for which you want to determine the maximum number of concurrent users who can access the folder. Then, from the pop-up menu, select Properties to display the Properties dialog box for the shared folder. The General tab shows you the user limit, which you can modify as needed. In the Security tab, you can manage the permissions for the share.

For more information about creating shares and managing share permissions, see Lesson 1 in Chapter 5, "Sharing Drives and Printers."

Sharing a Folder

In addition to monitoring shares, you can also use the Shared Folders snap-in to share an existing folder or to create a new folder and share it. You can also modify the shared folder and NTFS permissions when you share the folder. The biggest advantage of this capability is that you can use it to create and share folders on other computers on the network. Using the Shared Folders snap-in is the only way that you can create a new shared folder on a remote computer using Windows 2000.

From the Shared Folders snap-in, you can run the Create Shared Folder Wizard to create a new folder and share it, as shown in Figure 6.18. When you use the Shared Folders snap-in to share an existing folder or to create a new shared folder, Windows 2000 assigns the shared folder Full Control permission to the Everyone group by default. You can also assign NTFS permissions when you share the folder.

Figure 6.18 The Create Shared Folder Wizard

Monitoring User Sessions

You can also use the Shared Folders snap-in to monitor which users are currently accessing shared folders on a server from a remote computer, and you can view the resources to which the users have connections. You can disconnect users and send administrative messages to computers and users, including computers and users who aren't currently accessing network resources. This information enables you to determine which users you should contact when you need to stop sharing a folder or shut down the server on which the shared folder resides. You can disconnect one or more users to free idle connections to the shared folder, to prepare for a backup or restore operation, to shut down a server, and to change group membership and permissions for the shared folder.

Use the Sessions folder in the Shared Folders snap-in to view a list of the users with a current network connection to the computer that you are monitoring, as shown in Figure 6.19.

Figure 6.19 The Sessions folder in the Shared Folders snap-in

The columns in the details pane of the Sessions folder provide the following information about each of the computer connections:

  • User. The users with a current network connection to this computer
  • Computer. The name of the user's computer
  • Type. The operating system running on the user's computer
  • Open Files. The number of files that the user has open on this computer
  • Connected Time. The time that has elapsed since the user established the current session
  • Idle Time. The time that has elapsed since the user last gained access to a resource on this computer
  • Guest. Whether this computer authenticated the user as a member of the built-in Guest account

Disconnecting Users

From the Sessions folder, you can disconnect one or all users with a network connection to a computer. You might have to disconnect users so that you can do any of the following:

  • Have changes to shared folder and NTFS permissions take effect immediately. A connected user retains all permissions for a shared resource that Windows 2000 assigned when the user connected to it. Windows 2000 evaluates the permissions again the next time the user establishes a connection.
  • Have free idle connections on a busy computer so that other users can access the shared resources. User connections to resources might remain active for several minutes after a user finishes accessing the resource. Disconnecting user connections frees up the connection immediately.
  • Shut down a server.
After you disconnect a user, he or she can immediately establish a new connection. If you disconnect a user who is currently accessing a shared folder from a Windows-based client computer, the client automatically reestablishes the connection with the shared folder. This connection is reestablished without user intervention, unless you change the permissions to prevent the user from accessing the shared folder or you stop sharing the folder.

To disconnect a specific user, follow this procedure:

  1. In the Shared Folders snap-in, click the Sessions folder in the scope pane.
  2. Right-click the user who you want to disconnect and from the pop-up menu, choose Close Session.
Disconnecting a user session immediately severs all access to the files on the connected share, including files that the user currently has open. This can result in data loss. Therefore, you should always give fair warning to users to save their work before severing connections. One way to perform this task is to send them an administrative message, as explained in the next section.

You can also disconnect all of the current sessions at one time. To do this, right-click the Sessions folder in the scope pane and from the pop-up menu, select Disconnect All Sessions.

Sending Administrative Messages to Users

Using the Shared Folders snap-in, you can send administrative messages to one or more users or computers on the network. You can send administrative messages to users who have a current connection to a computer on which network resources are shared when a disruption to the computer or resource availability occurs. Some of the most common reasons for sending administrative messages are to notify users when you intend to do any of the following:

  • Perform a backup or restore operation
  • Disconnect users from a resource
  • Upgrade software or hardware
  • Shut down the computer

To send an administrative message, right-click the Shared Folders icon in the scope pane, point to All Tasks, and choose Send Console Message. By default, all currently connected computers to which you can send a message appear in the list of recipients. You can add other users or computers to this list by clicking Add, even if they don't have a current connection to resources on the computer.

Monitoring Open Files

You can use the Open Files folder in the Shared Folders snap-in to view a list of the files in the computer's shared folders that are currently opened and to find out which users are connected to each file, as shown in Figure 6.20. You can use this information when you need to contact users to notify them that you are shutting down the system. Additionally, when a user is attempting to access a file in a shared folder and cannot because it is locked open, you can use the Open Files list to determine who is using it.

Figure 6.20 The Open Files folder in the Shared Folders snap-in

The columns in the details pane of the Open Files folder provide the following information about each of the files currently in use:

  • Open File. The name of the open file on the computer.
  • Accessed By. The logon name of the user who has the file open.
  • Type. The operating system running on the computer where the user is logged on.
  • # Locks. The number of locks on the file. Programs can request the operating system to lock a file to gain exclusive access and prevent other programs from making changes to the file.
  • Open Mode. The type of access that the user's application requested when it opened the file, such as Read or Write.

You can use the Open Files folder to disconnect users from one open file or from all open files. For example, if you make changes to the NTFS permissions for a file that is currently opened by a user, the new permissions won't affect that user until the file is closed and reopened. You can force these changes to take place immediately by doing either of the following:

  • Disconnect all users from all open files. Right-click the Open Files folder and, from the pop-up menu, choose Disconnect All Open Files.
  • Disconnect all users from one open file. Right-click a file in the details pane and, from the pop-up menu, choose Close Open File.
You can force the user to reopen the file by forcibly disconnecting the user from it. As with disconnecting a session, however, this type of disconnection can cause data loss if you do not warn the user beforehand to save any changes made to the file.

Exercise 6.2: Creating a Shared Folder

In this exercise, you use the Shared Folders snap-in to create a new shared folder on a remote computer.

If you want to create and manage shared folders on remote computers and you are not in a domain, you must create the same user account with the same password on each computer.
  1. From the Administrative Tools menu, open the Computer Management console.
  2. In the scope pane, right-click the Computer Management (Local) icon and, from the pop-up menu, select Connect To Another Computer to display the Select Computer dialog box.
  3. From the Name list, select another computer running Windows 2000 on your network and click OK. What happens?
  4. Select the System Tools icon to access the Shared Folders snap-in.
  5. Select Shared Folders.
  6. Right-click the Shares folder and, from the pop-up menu, select New File Share to launch the Create Shared Folder Wizard.
  7. In the Folder To Share box, type C:\Library.
  8. In the Share Name box, type Library and click Next. A message box appears asking you whether you want to create the C:\Library folder.
  9. Click Yes. The Create Shared Folder Wizard displays a final page of four basic share permission options.
  10. Select Administrators Have Full Control; Other Users Have Read-Only Access.
  11. Click Finish. A Create Shared Folders dialog box appears, telling you that the share has been successfully created and asking whether you want to create another shared folder.
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. What is the danger inherent in disconnecting a user from a share without prior notification?
  2. Which of the following tasks cannot be performed by the Shared Folders snap-in?
    1. Send an administrative message to another user on the network.
    2. Share an existing folder on the local computer.
    3. Create a new shared folder on a remote computer.
    4. Share an existing printer on the local computer.
  3. What must you do before modifications that you have made to the NTFS permissions for a shared folder have their full effect?

Lesson Summary

  • The Shared Folders MMC snap-in enables you to monitor the shared folders on a computer running Windows 2000, the users connected to the shares, and the files that the users have open.
  • From the Shares folder, you can create new shares on the local computer or a remote computer and monitor the number of connections to each share.
  • From the Sessions folder, you can monitor each user connection to the computer and forcibly disconnect a user or all users.
  • From the Open Files folder, you can monitor the files that a network user is accessing and disconnect the user from a specific file or from all shared files.


Lesson 3: Microsoft Windows 2000 Auditing

In this lesson, you learn about Windows 2000 auditing, which is a tool for maintaining network security. Auditing enables you to track user activities and system-wide events. In addition, you learn about audit policies and what you need to consider before you set up a policy. You also learn how to set up auditing on resources and how to maintain security logs.

After this lesson, you will be able to

  • Plan an audit strategy and determine which events to audit
  • Set up auditing on Active Directory objects and on files, folders, and printers
  • Use Event Viewer to view a log and locate events

Estimated lesson time: 20 minutes

Overview of Windows 2000 Auditing

Auditing in Microsoft Windows 2000 is the process of tracking both user activities and Windows 2000 activities, called events, on a computer. Through auditing, you can specify that Windows 2000 writes a record of an event to the security log. The security log maintains a record of valid and invalid logon attempts and events related to creating, opening, or deleting files or other objects. An audit entry in the security log contains the following information:

  • The action that was performed
  • The user who performed the action
  • The success or failure of the event and when the event occurred

Using an Audit Policy

An audit policy defines the types of security events that Windows 2000 records in the security log on each computer. The security log enables you to track the events that you specify. Windows 2000 writes events to the security log on the computer where the event occurs. For example, you can configure auditing so that any time someone tries to log on to the domain by using a domain user account and the logon attempt fails, Windows 2000 writes an event to the security log on the domain controller. The event is recorded on the domain controller rather than on the computer at which the logon attempt was made, because it is the domain controller that could not authenticate the logon attempt.

You can set up an audit policy for a computer to do the following:

  • Track the success and failure of events, such as logon attempts by users, an attempt by a particular user to read a specific file, changes to a user account or to group memberships, and changes to your security settings.
  • Eliminate or minimize the risk of unauthorized use of resources.

You can use Event Viewer to view events that Windows 2000 has recorded in the security log. You can also archive log files to track trends over time-for example, to determine the use of printers or files or to verify attempts at unauthorized use of resources.

Planning an Audit Policy

When you plan an audit policy, you must determine the computers on which to set up auditing. Auditing is turned off by default. As you are determining which computers to audit, you must also plan what to audit on each computer. Windows 2000 records audited events on each computer separately.

The types of events that you can audit include the following:

  • Access to files and folders
  • Users logging on and off
  • Shutting down and restarting a computer running Windows 2000 Server
  • Changes to user accounts and groups
  • Attempts to make changes to Active Directory objects

After you have determined the types of events to audit, you must determine whether to audit the success or failure of events, or both. Tracking successful events can tell you how often Windows 2000 users or services gain access to specific files, printers, or other objects. You can use this information for resource planning. Tracking failed events can alert you to possible security breaches. For example, if you notice a lot of failed logon attempts by a certain user account, especially if these attempts are occurring outside normal business hours, an unauthorized person might be attempting to break into your system.

Consider the following guidelines in determining your audit policy:

  • Determine if you need to track trends of system usage. If so, plan to archive event logs. Archiving these logs allows you to view how usage changes over time and enables you to plan to increase system resources before they become a problem.
  • Review security logs frequently. You should set a schedule and regularly review security logs because configuring auditing alone does not alert you to security breaches.
  • Define an audit policy that is useful and manageable. Always audit sensitive and confidential data. Audit only those events that will provide you with meaningful information about your network environment. This minimizes usage of server resources and makes essential information easier to locate. Auditing too many types of events can create excess overhead for Windows 2000.
  • Audit resource access by the Everyone group instead of the Users group. This ensures that you audit anyone who can connect to the network, not just the users for whom you create user accounts in the domain.

Auditing is a powerful tool for tracking events that occur on computers in your organization. To implement auditing, you must consider auditing requirements and set the audit policy. After you set an audit policy on a computer, you can implement auditing on files, folders, printers, and Active Directory objects.

Configuring Auditing

You can implement an audit policy based on the role of the computer in the Windows 2000 network. Auditing is configured differently for the following types of computers running Windows 2000:

  • For stand-alone servers or stand-alone computers running Windows 2000 Professional, an audit policy is set for each individual computer. For example, to audit user access to a file on a stand-alone server, you set the audit policy on that computer.
  • For member servers or computers running Windows 2000 Professional that are joined to an Active Directory domain, an audit policy can be set for each individual computer, or set for a group of computers. For example, to audit user access to a file on a member server, you can set the audit policy on that computer, or, if you had a group of computers that need similar audit policies, you can set a group policy to apply the the Orgainizational Unit (OU) that they reside in.
  • For domain controllers, an audit policy is set for all domain controllers in the domain. To audit events that occur on domain controllers, such as changes to Active Directory objects, you configure a group policy for the domain, which applies to all domain controllers.
The types of events that you can audit on a domain controller are identical to those you can audit on a computer that is not a domain controller. The procedure is similar as well, but you use a group policy for the domain to control auditing for domain controllers.

Auditing Requirements

The requirements to set up and administer auditing are as follows:

  • You must have the Manage Auditing And Security Log right for the com-puter where you want to configure an audit policy or review an audit log. Windows 2000 grants these rights to the Administrators group by default.
  • The files and folders to be audited must be on NTFS volumes.

Setting Up Auditing

Setting up auditing is a two-part process that proceeds as follows:

  • Set the audit policy. The audit policy enables auditing of objects but does not activate auditing of specific objects.
  • Enable auditing of specific resources. You identify the specific events to audit for files, folders, printers, and Active Directory objects. Windows 2000 then tracks and logs the specified events.

Setting an Audit Policy

The first step in implementing an audit policy is selecting the types of events that Windows 2000 audits. For each event that you can audit, the configuration settings indicate whether to track successful or failed attempts. You can set audit policies by using the Group Policy snap-in. The types of events that Windows 2000 can audit are as follows:

  • Account logon events. A domain controller received a request to validate a user account.
  • Account management. An administrator created, changed, or deleted a user account or group. A user account was renamed, disabled, or enabled, or a password was set or changed.
  • Directory service access. A user gained access to an Active Directory object. You must configure specific Active Directory objects for auditing to log this type of event.
  • Logon events. A user logged on or logged off, or a user made or canceled a network connection to the computer.
  • Object access. A user gained access to a file, folder, or printer. You must configure specific files, folders, or printers for auditing. Directory service access is auditing a user's access to specific Active Directory objects. Object access is auditing a user's access to files, folders, and printers.
  • Policy change. A change was made to the user security options, user rights, or audit policies.
  • Privilege use. A user exercised a right, such as changing the system time. (This does not include rights that are related to logging on and logging off.)
  • Process tracking. A program performed an action. This information is generally useful only for programmers who want to track details of program execution.
  • System. A user restarted or shut down the computer, or an event occurred that affects Windows 2000 security or the security log. (For example, the audit log is full and Windows 2000 discards entries.)

Changes that you make to your computer's audit policy take effect when one of the following events occurs:

  • You initiate policy propagation by typing secedit /refreshpolicy machine_policy at the command prompt and then pressing Enter.
  • You restart your computer. Windows 2000 applies changes that you made to your audit policy the next time that you restart your computer.
  • Policy propagation occurs. Policy propagation is a process that applies policy settings, including audit policy settings, to your computer. Automatic policy propagation occurs at regular, configurable intervals. By default, policy propagation occurs every eight hours.

Auditing Access to Files and Folders

If security breaches are an issue for your organization, you can set up auditing for files and folders on NTFS partitions. To audit user access to files and folders, you must first enable the Audit object access policy, which includes files and folders.

To set an audit policy on a computer that is not a domain controller, create a custom MMC console and add the Group Policy snap-in. In the console tree, select Audit Policy from the Computer Configuration node, as shown in Figure 6.21. The console displays the current audit policy settings in the details pane.

Figure 6.21 Group Policy snap-in with the Audit Policy folder selected

After you have set your audit policy to audit object access, you enable auditing for specific files and folders and specify which types of access, by which users or groups, to audit. To enable auditing for a specific file or folder, open the Properties dialog box for that file or folder, select the Security tab, and then click Advanced. Select the Auditing tab and configure auditing for the selected file or folder.

Auditing Access to Active Directory Objects

To audit Active Directory object access, you must configure an audit policy and then set auditing for specific objects, such as users, computers, OUs, or groups by specifying which types of access and access by which users to audit. To enable auditing of access to Active Directory objects, enable the Audit directory services access policy in the Group Policy snap-in. To enable auditing for specific Active Directory objects, open the Active Directory Users And Computers snap-in and select Advanced Features from the View menu. Open the Properties dialog box for the object that you want to audit. On the Security tab, click Advanced. Select the Auditing tab and configure auditing for that object.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next chapter. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Where does Windows 2000 store the information gathered during the auditing process?
  2. What command-line program do you use to refresh the audit policy on a Windows 2000 computer?
  3. What steps must you follow to enable auditing of specific file objects on domain controllers in a domain where Group Policy is enabled?

Lesson Summary

  • Auditing in Microsoft Windows 2000 is the process of tracking both user activities and Windows 2000 activities, called events, on a computer.
  • An audit policy defines the types of security events that Windows 2000 records in the Security log on each computer.
  • The Security log enables you to track the events that you specify.
  • To implement auditing, you need to consider auditing requirements and set the audit policy.
  • After you set an audit policy on a computer, you can implement auditing on files, folders, printers, and Active Directory objects.


Managing Active Directory User and Computer Objects

About This Chapter

On a network that uses the Active Directory service included with Microsoft Windows 2000 Server, every user must be represented by a user object in the directory. The user object consists of attributes that contain information about the user and the user's capabilities on the network. The creation and maintenance of user objects are common tasks performed by the network administrator. This chapter introduces you to user objects, how to create them and set their attributes, and how to manage them afterward. The chapter also covers the creation of user profiles and home folders.

Before You Begin

To complete the lessons in this chapter, you must have a basic knowledge of Active Directory concepts, such as objects, attributes, and containers. To complete the exercises, you must have a computer running Windows 2000 on an Active Directory network, with access to the Active Directory Users and Computers console.


Lesson 1: Creating User and Computer Objects

A user account provides a user with the ability to log on to a domain to gain access to network resources or to log on to a computer to gain access to resources on that computer. Each person who regularly uses the network should have a unique user account. Windows 2000 provides two main types of user accounts: local user accounts and domain user accounts. With a domain user account, a user logs on to a domain to gain access to network resources. With a local user account, a user logs on to a specific computer to gain access to resources on that computer. A user logging on to a Windows 2000 Professional or Windows 2000 Server computer (that is a member server, and not a domain controller) can choose whether to log on to a domain or to the local computer.

After this lesson, you will be able to

  • Describe the difference between a local user account and a domain user account
  • Describe the purpose of a built-in account
  • Create a domain user account

Estimated lesson time: 30 minutes

Introducing User Accounts

Windows 2000 provides three types of user accounts, which are discussed in this section:

  • Local user accounts
  • Domain user accounts
  • Built-in user accounts

Local User Accounts

Local user accounts enable users to log on only to the computer where the account is located and gain access to resources on that computer. When you create a local user account, Windows 2000 creates the account in that computer's local security database, as shown in Figure 7.1. Local account information remains local and is not replicated to other computers or domain controllers. After you've created a local user account, the computer uses its local security database to authenticate the local user account, which enables the user to log on to that computer.

Do not create local user accounts on computers that require access to domain resources, because the domain does not recognize local user accounts and does not provide a local user with access to domain resources. Also, domain administrators are unable to administer the local user account properties unless they connect to the local computer using the Action menu in the Computer Management console.

Figure 7.1 Local user accounts

Domain User Accounts

Domain user accounts enable users to log on to the domain and gain access to resources anywhere on the network. A user provides a logon name and password during the logon process. With this information, Windows 2000 authenticates the user and then builds an access token that contains information about the user account and its security settings. The access token identifies the user to computers running Windows 2000 and earlier versions of the Windows operating system on which the user tries to access resources. Windows 2000 provides the access token for the duration of the logon session.

You create a domain user account by creating a user object in an Active Directory folder or organizational unit (OU), which are themselves objects in the Active Directory hierarchy. The Active Directory database is located on computers running Windows 2000 Server called domain controllers, as shown in Figure 7.2. After you create a new domain user account on one domain controller, it is replicated to all of the other domain controllers in the domain. After the replication process is complete, all of the domain controllers in the domain tree can authenticate the user during the logon process.

Figure 7.2 Domain user account
Replicating the domain user account information to all of the domain controllers can take a few minutes. This delay might prevent a user from immediately logging on using the newly created domain user account. By default, replication of directory information occurs every five minutes.

Built-In User Accounts

Windows 2000 automatically creates several user accounts called built-in accounts. Two of the most commonly used built-in accounts are Administrator and Guest. You can use the built-in Administrator account to manage the overall computer and domain configuration, by performing tasks such as creating and modifying user accounts and groups, managing security policies, creating printers, and assigning permissions and rights to user accounts to gain access to resources.

If you are the administrator of the network, you should create a user account for yourself that you use to perform nonadministrative tasks. Log on using the Administrator account only when you perform administrative tasks.

You can rename the Administrator account, but you cannot delete it. One simple way to provide a greater degree of security for a computer or domain running Windows 2000 is to rename the built-in Administrator account. Use a name that does not identify it as the Administrator account. This strategy makes it difficult for unauthorized users to break into the Administrator account because they do not know which user account it is.

You can use the built-in Guest account to give occasional users the ability to log on to a computer or a domain and gain access to resources. For example, an employee who needs access to resources for a short time can use the Guest account. The Guest account is disabled by default. Enable the Guest account only in low-security networks, and always assign it a password. You can rename and disable the Guest account, but you cannot delete it.

The IUSR_computername and IWAM_computername built-in accounts are automatically created when Internet Information Services (IIS) is installed on the domain controller. IUSR_computername is an account for anonymous access to IIS. IWAM_computername is an account for anonymous access to IIS out-of-process applications. In addition, the TsInternetUser account is automatically created when Terminal Services is installed on the domain controller. TsInternetUser is an account used by Windows 2000 Terminal Services.

Creating Domain User Accounts

To create and manage domain user accounts, use the Active Directory Users and Computers console (Figure 7.3) to create user objects in the Active Directory tree. With this tool, you can create, delete, or disable user objects, as well as manage their attributes.

Figure 7.3 The Active Directory Users and Computers console

When you create a domain user account, the user logon name defaults to the domain in which you are creating the account. However, you can select any domain in which you have permissions to create domain user accounts. You must also select the folder in which to create the new user object. You can create the object in the default Users folder or in a folder of your own creation.

When you promote a computer running Windows 2000 Server to a domain controller, the promotion process includes the installation of the Active Directory management tools, including Active Directory Users and Computers. Active Directory Users and Computers is a Microsoft Management Console (MMC) snap-in that you can use to manage the user and computer objects in any domain on the network. You can also run Active Directory Users and Computers from a computer running Windows 2000 Server that is not a domain controller or from a computer running Microsoft Windows 2000 Professional, even though that version of the operating system does not include the console. To install the Active Directory tools on another computer running Windows 2000, use Windows Installer to run the Adminpak.msi package, provided on the Windows 2000 Server distribution CD-ROM in the \I386 folder.

To create a user object in a domain, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, select Active Directory Users And Computers to display the Active Directory Users and Computers console, focused on the domain to which you are currently connected.
  2. In the scope pane, right-click the Users folder and, from the New menu, choose User to open the New Object - User dialog box, as shown in Figure 7.4.
    Windows 2000 creates the Users folder by default in every new Active Directory domain. On a live network, you should create your user objects in organization units that form the Active Directory domain hierarchy, rather than in the Users folder.
    Figure 7.4 The New Object - User dialog box
  3. In the New Object - User dialog box, set the following domain username options and then click Next:
    • First Name. Contains the user's first name. An entry in the First Name, the Last Name, or the Full Name box is required.
    • Initials. Contains the user's middle initial (optional).
    • Last Name. Contains the user's last name. An entry in the First Name, the Last Name, or the Full Name box is required.
    • Full Name. Contains the user's complete name. The name must be unique within the container where you create the user account. Windows 2000 completes this option if you enter information in the First Name, Initials, or Last Name box.
    • User Logon Name. Consists of a box and a list that uniquely identify the user throughout the entire network. The box (on the left) is the user's unique logon name, based on your naming conventions. An entry is required and must be unique within the domain. The list (on the right) is the domain name.
    • User Logon Name (Pre-Windows 2000). Contains the user's unique logon name that is used to log on from earlier versions of Windows, such as Microsoft Windows NT 4.0. An entry is required and must be unique within the domain.
  4. Set the following password options (Figure 7.5), and then click Next.
    • Password. Contains the password that is used to authenticate the user. For greater security, you should always assign a password.
    • Confirm Password. Confirms the password when you type it a second time to make sure that you typed it correctly. An entry is required if you assign a password.
    • User Must Change Password At Next Logon. Requires the user to change the password during the first logon. This ensures that the user is the only person who knows the password.
    • User Cannot Change Password. Prevents the user from changing the password. Only administrators are allowed to control passwords. Select this check box if you have more than one person using the same domain user account (such as Guest) or to maintain control over user account passwords.
    • Password Never Expires. Prevents password from changing. You can select this check box for a domain user account to be used by a program or a Windows 2000 service. Password Never Expires overrides User Must Change Password At Next Logon.
    • Account Is Disabled. Prevents use of the user's account-for example, for a new employee who has not yet started work.
    Always require new users to change their passwords the first time that they log on. This tactic prevents a user account from existing without a password. Also, after the user logs on and changes the password, only the user knows it.
    Figure 7.5 Password options in the New Object - User dialog box
  5. Click Finish to create the new user object.

If you regularly create user objects with the same properties, you can simplify the process by creating a user template object and using it to create your new objects. A user template object is simply a user object that you have configured with the property values you want all of your new objects to have. Whenever you want to create a new user object with those properties, right-click your user template object and select Copy from the pop-up menu. This opens a Copy Object - User dialog box, in which you can specify the user's name, logon name, and password. When you finish creating the new object, it has all of the properties of the user template object, except for the name and password properties you specified.

Setting User Account Attributes

A set of default attributes is associated with each user object that you create. After you create a user account, you can configure the personal and account attributes, logon options, and dial-in settings. You can use the attributes that you define for a domain user account to search for users in the directory or for use in other applications. For this reason, you should provide detailed definitions for each domain user account that you create.

To set values for a user object's attributes, open the Properties dialog box for the object by double-clicking it in the Active Directory Users and Computers console, or by right-clicking it and, from the pop-up menu, choosing Properties. A tabbed dialog box opens like the one shown in Figure 7.6.

Figure 7.6 The Properties dialog box of a user object

The tabs in the Properties dialog box contain information about each user account. The tabs in the default Properties dialog box for a user object are as follows:

  • General. Documents the user's first name, last name, display name, description, office location, telephone number or numbers, e-mail address, home page, and additional Web pages
  • Address. Documents the user's street address, post office box, city, state or province, postal code, and country or region
  • Account. Documents the user's account properties, including the following: user logon name, logon hours, computers permitted to log on to, account options, and account expiration
  • Profile. Sets a profile path, logon script path, home folder, and shared document folder
  • Telephones. Documents the user's home, pager, mobile, fax, and Internet Protocol (IP) telephone numbers, and contains space for comments
  • Organization. Documents the user's title, department, company, manager, and direct reports
  • Remote Control. Configures Terminal Services remote control settings
  • Terminal Services Profile. Configures the Terminal Services user profile
  • Member Of. Documents the groups to which the user belongs
  • Dial-In. Documents the dial-in properties for the user
  • Environment. Configures the Terminal Services startup environment
  • Sessions. Sets the Terminal Services time-out and reconnection settings
Installing other software products that use Active Directory services (such as Microsoft Exchange, for example) can add to the Properties dialog box further tabs containing additional attributes.

The following sections examine some of the attributes that you might have to set in the course of everyday network maintenance.

Setting Personal Attributes

Four of the tabs in the Properties dialog box of each user object contain personal information about the user account. These tabs are General, Address, Telephones, and Organization. The attributes on these tabs are not directly related to the operation of the user object or Active Directory services; they provide only background information about the user. Providing values for the attributes on these tabs enables you to locate domain user accounts more easily by searching the directory using whatever information you have about the user you need to find. For example, if all of the attributes on the Address tab are complete, as shown in Figure 7.7, you can locate that person by using the street address or another field.

Figure 7.7 The Address tab in the Properties dialog box of a user object

Setting Account Properties

The Account tab in the Properties dialog box of a user object (Figure 7.8) contains several of the attributes that you configured while creating the user object, such as the User Logon Name option and the password options.

Figure 7.8 The Account tab

You can modify the values for the attributes in this tab and set values for others. The other attributes that you can set in this tab are as follows:

  • Store Password Using Reversible Encryption. Enables applications that require a password that can be decrypted to function. Remote Access authentication protocols and IIS Digest authentication use this attribute.
  • Smart Card Is Required For Interactive Logon. Enables a user to log on with a smart card. Additional hardware is required.
  • Account Is Trusted For Delegation. Enables a user to assign responsibility for management and administration of a portion of the name space to another user, group, or OU.
  • Account Is Sensitive And Cannot Be Delegated. Prevents the account from being assigned for delegation by another account.
  • Use DES Encryption Types For This Account. Provides support for the Data Encryption Standard (DES).
  • Do Not Require Kerberos Preauthentication. Removes Kerberos preauthentication for accounts using another implementation of Kerberos. Not all implementations or deployments of Kerberos use the preauthentication feature.
  • Account Expires. Sets account expiration dates. Select Never if you do not want the account to expire. Select End Of and then enter a date in the adjoining text box if you want Windows 2000 to automatically disable the user account on the date you specify.

Setting Logon Hours

Click Logon Hours in the Account tab to display the Logon Hours dialog box, in which you can control when the user can log on to the domain. Restricting logon hours limits the hours that users can access the network. By default, Windows 2000 permits users access for all hours on all days. You might want to allow users to log on only during business hours. Setting logon hours also reduces the amount of time that the account is open to unauthorized access attempts.

To set the logon hours for a user object, use the following procedure:

  1. Open the Active Directory Users and Computers console.
  2. Locate and right-click the user object you want to modify and from the pop-up menu, choose Properties to display the Properties dialog box.
  3. Click the Account tab.
  4. Click Logon Hours to display the Logon Hours dialog box (see Figure 7.9). In this dialog box, a blue box indicates that the user can log on during that hour. A white box indicates that the user cannot log on.

    Figure 7.9 The Logon Hours dialog box
  5. Select the rectangles on the days and hours for which you want to allow or deny access by clicking the start time and dragging to the end time. Then click the Logon Permitted option or Logon Denied option.
  6. Click OK to close the Logon Hours dialog box.
  7. Click OK to close the Properties dialog box.
Keep in mind that, by default, Windows 2000 does not disconnect users from the domain based on the Logon Hours configuration; it prevents users from logging on only during hours when they are denied access.

Setting the Computers from Which Users Can Log On

Setting logon options for a domain user account enables you to control the computers from which a user can log on to the domain. By default, a user can log on from any computer in the domain. Setting the computers from which a user can log on prevents the user from accessing the network with his or her account on someone else's computer.

To control the computers from which a user can log on to a domain, NetBIOS over TCP/IP must be enabled.

To specify the workstations from which a user can log on, use the following procedure:

  1. Open the Active Directory Users and Computers console.
  2. Locate and right-click the user object you want to modify and, from the pop-up menu, choose Properties to display the Properties dialog box.
  3. Click the Account tab.
  4. Click Log On To to display the Logon Workstations dialog box, as shown in Figure 7.10.

    Figure 7.10 The Logon Workstations dialog box
  5. Select The Following Computers.
  6. In the Computer Name box, type the NetBIOS name of a computer that you want to allow the user to log on from, and click Add. Repeat the process to add more computers to the list.
  7. Click OK to close the Logon Workstations dialog box.
  8. Click OK to close the Properties dialog box.

Exercise 7.1: Creating Domain User Accounts

In this exercise, you create the domain user accounts shown in the following table:

First Name | Last Name | User Logon Name | Password | Change Password
Jo | Berry | jberry | gobloots | Must
John | Kelly | jkelly | (blank) | Must
Stephanie | Hooper | shooper | (blank) | Must
Jenny | Sax | Jsax | zany | Must
Eric | Lang | Elang | redhead | Cannot

The following procedure outlines the steps that are required to create the first user account using the Active Directory Users and Computers console. After you have created the first user account, follow the same steps to create the remaining user accounts.

  1. Log on to the domain as Administrator.
  2. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users And Computers. Windows 2000 displays the Active Directory Users and Computers console.
  3. Click the Users folder in your domain. Notice that the default user accounts appear in the details pane. Which user accounts does the Active Directory Installation Wizard create by default?
  4. Right-click the Users folder and, from the New menu, choose User. Windows 2000 displays the New Object - User dialog box. Where in the Active Directory will the new user account be created?
  5. In the First Name box, type Jo.
  6. In the Last Name box, type Berry. Notice that Windows 2000 completes the Full Name box for you.
  7. In the User Logon Name box, type jberry.
  8. In the list to the right of the User Logon Name box, select your domain name. The user logon name, combined with the domain name in the box that appears to the right of the User Logon Name box, is the user's full logon name. This name uniquely identifies the user throughout the directory (for example, jberry@microsoft.com). Windows 2000 completes the User Logon Name (earlier versions of Windows) box for you. When is the earlier versions of Windows logon name used?
  9. Click Next to continue. Windows 2000 displays the New Object - User dialog box, prompting you to supply password options and restrictions.
  10. In the Password box, type gobloots and again in the Confirm Password box. Leave these boxes blank if you are not assigning a password. Notice that the password displays in asterisks as you type. This prevents onlookers from viewing the password as it is entered.
  11. Select the User Must Change Password At Next Logon check box.

    What are the results of selecting both the User Must Change Password At Next Logon check box and the User Cannot Change Password check box? Explain.

    Under what circumstances would you select the Account Is Disabled check box when creating a new user account?

  12. Click Next. Windows 2000 opens the New Object - User dialog box, displaying the options and restrictions that you have configured for this user account.
  13. Verify that the user account options are correct, and then click Finish. In the details pane of the Active Directory Users and Computers console, the user account that you just created now appears.
  14. Repeat steps 4-13 for the remaining user accounts in the table.
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. What different capabilities do local user accounts and domain user accounts provide to users?
  2. Which of the following types of Windows 2000 computers does not have local user accounts?
    1. A Windows 2000 Professional workstation
    2. A Windows 2000 Server domain controller
    3. A Windows 2000 Server member server
    4. A Windows 2000 Server stand-alone server
  3. What information is required to create a domain user account?

Lesson Summary

  • Local users and domain users are the two types of user accounts. User accounts enable users to access the resources on a computer or network.
  • To create a domain user account, you must create a user object in the Active Directory database, using the Active Directory Users and Computers console.
  • Using the Active Directory Users and Computers console, you can also set values for the attributes that make up a user object.
  • Every user account has a full name, a user logon name, and a logon name for earlier versions of Windows.
  • By configuring the logon hours for a user account, you can limit the hours of the day when the user is permitted to access the network.


Lesson 2: Maintaining User Accounts

In addition to modifying the attributes of your user objects, the needs of your organization might also require you to modify user accounts in other ways. Some of these modifications are based on personnel changes in your organization or changes in the personal information of your users. These modifications include disabling, enabling, and deleting a user account. You might also need to unlock a user account or reset a user's password at times.

To modify a user account, you make changes to the user account object in Active Directory service. To successfully complete the tasks for modifying user accounts you must have permission, either direct or inherited, to administer the user object. For more information about Active Directory object permissions, see Lesson 1 in Chapter 12, "Active Directory Administration."

After this lesson, you will be able to

  • Disable, enable, rename, and delete user accounts
  • Reset user passwords
  • Unlock user accounts

Estimated lesson time: 15 minutes

Disabling, Enabling, Renaming, and Deleting User Accounts

The modifications that you can make to user accounts that affect their functionality include the following:

  • Disabling and enabling a user account. You disable a user account when a user does not need to use an account for an extended period, but will need it again. For example, if John takes a two-month leave of absence, you can disable his user account when he leaves. When he returns, you can enable his user account again so that he can log on to the network. This strategy prevents unauthorized users from trying to use the account in John's absence.
  • Renaming a user account. You rename a user account when you want to retain all rights, permissions, and group memberships for the user account and modify its name (to accommodate a user whose name has changed) or reassign it to a different user. For example, if a new hire replaces an employee who has left the company, you can rename the former employee's user account by changing the first, last, and user logon names to those of the new employee, rather than create an entirely new account.
  • Deleting a user account. You delete a user account when an employee leaves the company and you are not going to rename the user account. By deleting these user accounts, you avoid the potential security hazard of having unused accounts in Active Directory service.

The procedures for disabling, enabling, renaming, and deleting user accounts are similar. To disable, enable, rename, or delete a user account, proceed as follows:

  1. Open the Active Directory Users and Computers console.
  2. Expand the console tree until the user account you want to modify is visible.
  3. Click the user account.
  4. From the Action menu, choose the command for the type of modification that you want to make, as shown in Figure 7.11.
Figure 7.11 Disabling, enabling, deleting, or renaming user accounts
If a user account is enabled, the Action menu displays the Disable Account command. If a user account is disabled, the Action menu displays the Enable Account command.

Resetting Passwords and Unlocking User Accounts

If a user cannot log on to the domain or to a local computer because of a password problem, you might need to reset the user's password or unlock the user's account. To perform these tasks, you must have administrative privileges for the object in which the user account resides.

Resetting Passwords

After the password has been set for a user account, either by the administrator or by the user, the password is not visible to anyone, including administrators. This improves security by preventing users, including administrators, from learning other users' passwords. If passwords were readable, a person with administrative privileges could look up a user's password and log on as that user.

Situations occur, however, in which an administrator might need to reset a password. For example, if users are required to change their passwords and fail to do so within a given period of time, the passwords might be configured to expire, preventing the users from logging on. Users also have a tendency to forget their passwords, especially if the passwords are assigned by administrators or the users are compelled to change their passwords regularly. In either case, a user with administrative privileges can reset a user's password without knowing the current or expired password.

To reset a user password, use the following procedure:

  1. Open the Active Directory Users and Computers console.
  2. Expand the console tree until the user account you want to modify is visible.
  3. Click the user account.
  4. From the Action menu, choose Reset Password to display the Reset Password dialog box shown in Figure 7.12.

    Figure 7.12 The Reset Password dialog box
  5. Type a new password for the user in the New Password box, and again in the Confirm Password box.
  6. Select the User Must Change Password At Next Logon check box to force the user to change the password.
  7. Click OK.

Unlocking User Accounts

Many networks use Windows 2000 group policies to enforce password restrictions, such as a limit on the number of failed logon attempts permitted for a user account. When a user (authorized or not) enters an incorrect password for a user account too many times, Windows 2000 locks the account, preventing any further logon attempts. You can configure the policy to lock the account for a given period of time, or lock it permanently until an administrator unlocks it.

For further information about using group policies, see Chapter 9, "Using Group Policies."

To unlock a user account, use the following procedure:

  1. Open the Active Directory Users and Computers console.
  2. Expand the console tree until the user account you want to modify is visible. User objects that are currently locked have a red X on them.
  3. Right-click the user account and, from the pop-up menu, choose Properties.
  4. Click the Account tab. Notice that the Account Lock Out check box is selected.
  5. Clear the check box and click OK to close the Properties dialog box.

Exercise 7.2: Disabling and Enabling a User Account

In this exercise, you disable a user account so that it can no longer be used to log on to the domain. You then enable the same account.

Procedure 1: Disabling a User Account

To disable a user account, complete the following steps:

  1. Log on to your domain as Administrator.
  2. Open the Active Directory Users and Computers console.
  3. Select Active Directory and then click the Users folder.
  4. Right-click the user object for Jo Berry (jberry) that you created in Exercise 7.1 and, from the pop-up menu, choose Disable Account. The Active Directory message box appears, stating that the Jo Berry object has been disabled. The object is also marked with a red X.
  5. Click OK to close the Active Directory message box.
  6. In the details pane of the Active Directory Users and Computers console, right-click the user account that you just disabled to display the shortcut menu. How can you tell that the user account is disabled?
  7. Log off from Windows 2000.
  8. Attempt to log on using Jo Berry's account, with the logon name jberry and the password gobloots. Were you successful? Why or why not?

Procedure 2: Enabling a User Account

To enable a user account, complete the following steps:

  1. Log on to your domain as Administrator.
  2. Open the Active Directory Users and Computers console.
  3. Select Active Directory and then click the Users folder.
  4. Right-click the user object for Jo Berry (jberry) and, from the pop-up menu, choose Enable Account. The Active Directory message box appears, stating that the Jo Berry object has been enabled. The X on the user object account also disappears.
  5. Click OK to close the Active Directory message box.
  6. In the details pane of the Active Directory Users and Computers console, right-click the user account that you just enabled to display the shortcut menu. How can you tell that the user account is enabled?
  7. Log off from Windows 2000.
  8. Attempt to log on using Jo Berry's account, with the logon name jberry and the password gobloots. Were you successful? Why or why not?

Procedure 3: Resetting the Password for a User Account

To reset the password for a user account, complete the following steps:

  1. Log on to your domain as Administrator.
  2. Open the Active Directory Users and Computers console.
  3. Select Active Directory and click the Users folder.
  4. Right-click the user object for Jo Berry (jberry) and, from the pop-up menu, choose Reset Password. The Reset Password dialog box appears, prompting you for the new password for this account. Notice that you cannot view the current password, even though you are logged on as Administrator.
  5. In the New Password box and the Confirm Password box, type babaloo and select the box labeled User Must Change Password At Next Logon.
  6. Click OK. Windows 2000 displays the Active Directory message confirming that the password has been changed.
  7. Click OK to close the Active Directory message box.
  8. Log off from Windows 2000.
  9. Attempt to log on using Jo Berry's account, with the logon name jberry and the original password: gobloots. Were you successful? Why or why not?
  10. Log on again using the logon name jberry and the new password: babaloo. Were you successful? Why or why not?
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Why would you rename a user account and what is the advantage of doing so?
  2. How does Active Directory prevent people from learning other users' passwords?
  3. How can you tell when a user object is disabled?

Lesson Summary

  • The Active Directory Users and Computers console enables you to disable user objects, reenable them, rename them, and delete them.
  • Disabling a user object prevents the user from logging on, but leaves all of the account information intact.
  • Administrators can reset a password for a user object by specifying a new password, but they cannot view an existing password for any object.
  • User objects can be locked as a result of group policies, and it is up to the network administrator to unlock them.
  • You can rename user objects to reflect users' name changes and even to enable a new employee to take over an existing position.


Lesson 3: Creating User Profiles

A user profile is a collection of folders and data that stores the user's current desktop environment, application settings, and personal data. A user profile also contains all of the user's Start menu items and mapped drives to network servers. User profiles maintain consistency by providing users with the same desktop environment that they had the last time they logged on to the computer. A home folder is a folder on a network server that is allocated to a particular user for the storage of personal data. This lesson introduces user profiles and the home folder, explaining the differences between local user profiles, roaming user profiles, and mandatory user profiles, and discusses how to create and use home folders.

After this lesson, you will be able to

  • Explain the difference between a local user profile, a roaming user profile, and a mandatory user profile
  • Configure a local user profile
  • Create a roaming user profile
  • Create a mandatory user profile
  • Manage home folders

Estimated lesson time: 45 minutes

Understanding User Profiles

On computers running Windows 2000, user profiles automatically create and maintain the desktop settings for each user's work environment on the local computer. A new user profile is created for each user logging on to the computer for the first time. User profiles provide several advantages to users:

  • More than one user can work on the same computer, with all users maintaining their own desktop settings each time they log on.
  • When users log on to their workstations, they receive the same desktop settings that they had when they logged off.
  • Customization of the desktop environment by one user does not affect another user's settings.
  • User profiles can be stored on a server so that they can follow users to any computer running Windows 2000 or Windows NT 4.0 on the network. These profiles are called roaming user profiles.
  • Applications that are Windows 2000-certified store their settings in user profiles.

As an administrative tool, user profiles provide the following options:

  • You can create a default user profile that is appropriate for the user's tasks.
  • You can set up a mandatory user profile, which is a profile that does not save changes the user made to the desktop settings. Users can modify the desktop settings of the computer while they are logged on, but none of these changes are saved when they log off. The mandatory profile settings are downloaded to the local computer each time the user logs on.
  • You can specify the default user settings to be included in all of the individual user profiles.

Profile Types

The three types of user profiles are as follows:

  • Local user profile. A profile that Windows 2000 creates for each user when the user logs on to the computer for the first time. The local user profile is stored on the computer's local hard disk. Any changes you make to your local user profile are specific to the computer on which you make the changes.
  • Roaming user profile. A copy of your local user profile that you, the network administrator, store on a shared server drive. While you are logged on, the roaming user profile functions in exactly the same way as a local profile. However, because the roaming profile is stored on a server, it is available every time you log on to any computer on the network. Any changes that you make to your desktop environment are replicated to the roaming user profile on the server when you log off.
  • Mandatory user profile. A roaming profile that the user cannot change. Administrators use mandatory user profiles to enforce particular desktop settings for individuals or for a group of users. Even though users can make changes to their desktop environments while they are logged on, these modifications are not written to the mandatory profile when the user logs off. Logging on the next time, users receive the same desktop settings as their previous logon. Only administrators can make changes to mandatory user profiles.

Settings Saved in a User Profile

A user profile contains configuration preferences and options for each user-a snapshot of a user's desktop environment. Table 7.1 lists the settings contained in a user profile.

Table 7.1 Settings Contained in a User Profile

Parameters Saved | Source
All user-definable settings for Windows Explorer | Windows Explorer
User-stored documents | My Documents
User-stored image files | My Pictures
Shortcuts to favorite locations on the Internet | Favorites
Any user-created mapped network drives | Mapped network drive
Links to other computers on the network | My Network Places
Items stored on the Desktop and Shortcut elements | Desktop contents
All user-definable computer screen colors and display text settings | Screen colors and fonts
Application data and user-defined configuration settings | Application data and registry hive
Network printer connections | Printer settings
All user-defined settings made in Control Panel | Control Panel
All user-specific program settings affecting the user's Windows environment, including Calculator, Clock, Notepad, and Paint | Accessories
Per user program settings for programs written specifically for Windows 2000 and designed to track program settings | Windows 2000-based programs
Any bookmarks placed in the Windows 2000 Help system | Online user education bookmarks

Contents of a User Profile

Local user profiles are stored on the computer's system drive (C by default) in the \Documents and Settings folder. When a user logs on for the first time, Windows 2000 creates a subfolder in \Documents and Settings, named with the user's logon name and a new user profile. Roaming user profiles are stored in a shared folder on the server. Figure 7.13 shows the directory structure of a user profile.

Figure 7.13 The user profile directory structure

The functions of the folders in a user profile are as follows:

  • \Application Data (hidden). Contains program-specific data-for example, a custom dictionary. Program vendors decide which data to store in this folder.
  • \Cookies. Contains user information and preferences stored by Microsoft Internet Explorer.
  • \Desktop. Contains desktop icons, including shortcuts to files and folders.
  • \Favorites. Contains shortcuts to favorite locations on the Internet.
  • \Local Settings (hidden). Contains the \Application Data folder and \History folder, as well as additional folders for the storage of temporary files.
  • \My Documents. Contains user-stored documents.
  • \My Pictures (subfolder of My Documents). Contains user-stored image files.
  • \NetHood (hidden). Contains shortcuts to My Network Places items.
  • \PrintHood (hidden). Contains shortcuts to printer folder items.
  • \Recent (hidden). Contains shortcuts to the most recently used documents and accessed folders.
  • \SendTo (hidden). Contains shortcuts to document-handling utilities.
  • \Start Menu. Contains shortcuts to program items and other files that form the Start menu.
  • \Templates. Contains user template items.

In addition to these folders, a user profile also contains a copy of the Ntuser.dat file, which is the Windows 2000 registry file where user-specific settings are stored. These settings include many of the options you configure in Control Panel.

Using Local Profiles

The use of local user profiles on a computer running Windows 2000 is completely invisible to the average user. The operating system automatically creates the user profile for each user logging on for the first time. When that user logs on again, Windows 2000 loads the settings from the correct profile.

Users change their local user profiles without even knowing it, simply by changing their desktop settings. For example, a user might make a new network connection, change the desktop colors, or add a file to the \My Documents folder. When the user modifies the desktop environment while logged on, Windows 2000 incorporates the changes into the user profile stored on the computer the next time the user logs off. Thus, a user logging on to a computer running Windows 2000 always receives the desktop settings and connections like they were at the end of the previous session. When multiple users share the same computer, each user maintains and receives a separate profile.

Using Roaming Profiles

To support users who work at multiple computers, the network administrator can set up roaming user profiles. A roaming user profile is simply a copy of a local user profile that is stored on a network server so that the user can access it from any computer on the network. No matter which computer a user logs on from, the user always receives the desktop settings and connections from the profile stored on the server, in contrast to a local user profile, which resides on only one client computer.

When a user logs on, Windows 2000 copies the roaming user profile from the network server to the appropriate folder of the \Documents and Settings folder on the client computer and then applies the roaming user profile settings to that computer. The first time the user logs on at a particular computer, Windows 2000 copies all of the document files in the roaming profile to the local computer. This enables the user to log on to the computer successfully and receive a copy of the profile, even if the connection to the network is broken.

After the initial copy process, when the user logs on from the same computer, Windows 2000 compares the files in the locally stored user profile with the roaming user profile files. Only the files that have changed since the last time the user logged on are copied to the local drive, which makes the logon process shorter and more efficient.

When the user logs off, Windows 2000 copies any changes that were made to the local copy of the user profile back to the server where the roaming profile is stored.

Creating Roaming User Profiles

You should create roaming user profiles on a file server that you frequently back up so that you have copies of the most recent profiles for your users. To improve logon performance for a busy network, place the users' roaming profiles folder on a member server instead of a domain controller. Copying roaming user profiles between the server and client computers can consume a lot of system resources, such as network bandwidth and processor cycles. If the profiles are on a domain controller, the domain user authentication processes can be delayed.

To successfully create roaming user profiles and assign home folders for user accounts, you must have permission to administer the user objects in which the user accounts reside.

To set up roaming user profiles, use the following procedure:

  1. On the server where you want to store the profiles, create a folder and share it, providing your users with the permissions needed to read and write to it.
  2. Open the Active Directory Users and Computers console.
  3. Locate the user object for a user whose profile you want to store on the server.
  4. Right-click the user object and, from the pop-up menu, choose Properties to display the Properties dialog box.
  5. Click the Profile tab, as shown in Figure 7.14.

    Figure 7.14 The Profile tab in the Properties dialog box of a user object
  6. In the Profile Path box, use Universal Naming Convention (UNC) notation (such as \\server_name\shared_folder_name\logon_name) to type the path to the shared folder you just created. You can use the variable %username% instead of the user's logon name. When you use this variable, Windows 2000 automatically replaces the variable with the user account name for the roaming user profile, which is useful when copying template accounts.
  7. Click OK to close the Properties dialog box.

Using Standard Roaming User Profiles

Some users might not need a unique user profile. On some networks, an administrator creates a standard roaming user profile, which is a single roaming user profile shared by multiple users. You can create a standard roaming user profile for a group of users by configuring the desired desktop environment and then copying the standard profile to the roaming user profile location.

You use standard roaming user profiles for the following reasons:

  • To provide a standard desktop environment for multiple users with similar job responsibilities or who require access to the same network resources.
  • To provide users with a dedicated work environment that contains only the tools they need to perform their jobs, removing the connections and applications they do not require.
  • To simplify the troubleshooting process. By using a standard profile, technical support personnel will know the exact baseline setup of the computers, making it easier to find any deviations.

Creating a Standard Roaming User Profile

The following list provides an overview of the tasks required to implement a standard roaming user profile for a group of users.

  1. Create a user profile template with the appropriate configuration. Perform this task by creating a user account using the Active Directory Users and Computers console and then configuring the appropriate desktop settings.
  2. Create a shared folder on a server to store the standard roaming profile.
  3. Open the User Profiles tab of the System Properties dialog box, as shown in Figure 7.15. Copy the user profile template to the shared folder you created and specify the users who are permitted to use the profile.
  4. For each user who accesses the standard roaming profile, specify the path to the profile template in the Profile tab of the Properties dialog box of a user object.
Figure 7.15 Copying a user profile template

Using Mandatory Profiles

A mandatory user profile is a read-only roaming user profile. Users can modify the desktop settings of the computer while they are logged on, but none of these changes is saved when they log off. The next time the user logs on, the profile is the same as that of the previous logon. Windows 2000 downloads the mandatory profile settings to the local computer each time the user logs on. You can assign one mandatory profile to multiple users who require the same desktop settings, such as a group of users who all do the same job. Because the profile never changes, you do not have to worry about one user making changes that affect all of the other users. In addition, a mandatory profile makes it possible to modify the desktop environment for multiple users by changing only one profile.

To create a mandatory user profile, you rename the Ntuser.dat file in the folder containing the roaming profile to Ntuser.man. The Ntuser.dat file consists of the Windows 2000 system registry settings that apply to the individual user account and contains the user environment settings, such as desktop appearance. Renaming this file with a .man extension makes it read-only, preventing Windows 2000 from writing changes to the profile when a user logs off.

Creating Home Folders

Although the \My Documents folder is the default location for users to store their personal documents, Windows 2000 provides another location for storage. This additional location is the user's home folder. A home folder is an additional folder that you can provide for users to store personal documents. You can store a home folder on a client computer or in a shared folder on a file server. Because a home folder is not part of a roaming user profile, its size does not affect network traffic during the logon process. You can locate all users' home folders in a central location on a network server.

Storing all home folders on a file server provides the following advantages:

  • Users can gain access to their home folders from any client computer on the network.
  • The backing up and administration of user documents is centralized.
  • The home folders are accessible from a client computer running any Microsoft operating system.
You should store home folders on a Windows NT file system (NTFS) volume so that you can use NTFS permissions to secure user documents. If you store home folders on a file allocation table (FAT) volume, you can restrict home folder access only by using shared folder permissions.

Creating Home Folders on a Server

To successfully complete the tasks for creating home folders, you must have permission to modify the user objects in which the user accounts reside.

To create a home folder on a network file server, use the following procedure:

  1. Create and share a folder in which to store all home folders on a network server. Each user's home folder is a subfolder of this folder.
  2. For the shared folder, remove the default Full Control permission from the Everyone group and assign Full Control to the Users group. This ensures that only users with domain user accounts can gain access to the shared folder.
  3. On the Profile tab of each user object's Properties dialog box (Figure 7.16), specify the path to the user's home folder. Because the home folder is on a network server, click Connect and specify a drive letter to connect. In the To box, specify the UNC name of the home folder, such as \\server_name\ shared_folder_ name\user_ logon_name. You can use the %username% variable in place of the user's logon name to automatically name each user's home folder with the user logon name. If you use %username% to name a folder on an NTFS volume, the user is assigned the NTFS Full Control permission and all other permissions are removed for the folder, including those for the Administrator account.
Figure 7.16 Specifying a path to a home folder

Exercise 7.3: Managing User Profiles

In this exercise, you create a shared folder in which a standard roaming user profile can reside. Create a user account named Profile Template, which is the model for a standard roaming user profile. Configure the settings for the template profile. Then copy the Profile Template user profile to the shared folder for User2. Finally, specify the path to the profile for User2. Optionally, you can test the standard roaming profile if you have access to two computers on the same network.

Procedure 1: Creating a Shared Folder

To create a shared folder in which to store roaming user profiles, complete the following steps:

  1. Log on to the domain as Administrator on your domain controller.
  2. In the C folder (where C is your system drive), create a folder named \Profiles.
  3. Right-click the \Profiles folder and, from the pop-up menu, choose Sharing to display the Sharing tab of the Properties dialog box.
  4. Click Share This Folder.
  5. Click OK to close the Properties dialog box.

Procedure 2: Creating a User Profile Template

To create a user profile template, complete the following steps:

  1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users And Computers.
  2. Right-click the Users folder and, from the New menu, choose User to open the New Object - User Wizard.
  3. Create the ptemplate account using the properties listed in the following table.
    First Name Last Name User Logon Name Password Member Of

    Profile

    Template

    ptemplate

    None

    Print Operators

  4. Log off from Windows 2000.
  5. Log on as the ptemplate user. Windows 2000 automatically creates a local user profile for the Profile Template users on the local computer in the C:\Documents and Settings\ptemplate folder (where C is your system drive).
  6. Right-click anywhere on the desktop and click Properties to open the Display Properties dialog box.
  7. Click the Appearance tab and, in the Scheme list, select a different color scheme.
  8. Click OK to change the screen colors.
  9. Log off from the domain and log on again as the ptemplate user. Notice that the screen colors are saved in the user's profile.
  10. Log off from Windows 2000.

Procedure 3: Copying the User Profile Template to a Shared Folder

To copy the user profile template to a shared folder on a network server, complete the following steps:

  1. Log on to the domain as Administrator.
  2. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users And Computers.
  3. Right-click the Users folder and, from the New menu, choose User to open the New Object - User Wizard.
  4. Create the mlee account using the properties listed in the following table.
    First Name Last Name User Logon Name Password Member Of

    Mark

    Lee

    Mlee

    None

    Print Operators

  5. Open Control Panel and double-click the System tool to open the System Properties dialog box.
  6. Click the User Profiles tab. Notice that a user profile has been created for all users who have previously logged on to the computer, including a user profile for your domain called ptemplate.
  7. Select the ptemplate profile and click Copy To to open the Copy To dialog box.
  8. In the Copy Profile To box, type \\computer_name\Profiles\mlee (where computer_name is the name of the server on which you created the Profiles folder). This is the location of the shared folder where the profile template will be stored.
  9. Click Change to display the Select User Or Group dialog box.
  10. In the Name column, select Mark Lee and click OK. The mlee account now appears in the Permitted To Use box.
  11. Click OK. Windows 2000 creates a folder called mlee in the Profiles folder with all the desktop settings configured for the Profile Template user account.

Procedure 4: Specifying a Path to the Roaming User Profile

To specify a path to the roaming user profile, follow these steps:

  1. In the Active Directory Users and Computers console, double-click the Mark Lee user object to open its Properties dialog box.
  2. Click the Profile tab.
  3. In the Profile Path box, type \\computer_name\Profiles\mlee (where computer_name is the name of the computer on which you created the Profiles folder).
  4. Click OK.
  5. Close the Active Directory Users and Computers console.

Procedure 5: Testing the Roaming Profile

To test the roaming profile, log off from the domain and log on as mlee. Notice that the screen colors and desktop are the same as those you set for the Profile Template user. This is because the roaming profile for the mlee account was downloaded from the shared folder on the network server and applied to whatever computer mlee logs on to.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next chapter. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. What is the difference between a local user profile and a roaming user profile?
  2. What do you do to ensure that a user on a client computer running Windows 2000 has a roaming user profile?
  3. How can you ensure that a user has a centrally located home folder?

Lesson Summary

  • A user profile is a collection of folders and files that make up the desktop environment for a specific user.
  • User profiles include the user's personal documents, desktop icons, Start menu shortcuts, and Control Panel settings, such as those that control the screen colors.
  • A local user profile is one that is stored on the local drive, whereas a roaming user profile is one that is stored on a network server.
  • You configure users to access roaming profiles by modifying their Active Directory user objects.
  • A mandatory user profile is one that never changes, providing the same desktop configuration each time the user logs on.


Managing Active Directory Group Objects

About This Chapter

Groups simplify administration by organizing user accounts into manageable units. This chapter provides you with a group planning strategy and procedures for creating groups. The hands-on procedures give you an opportunity to plan and implement global and domain local groups for a network. You learn about the default groups provided by Microsoft Windows 2000. This chapter also explains the groups to which administrators should be assigned and the benefits of using the Run As program to start a program as an administrator while logged on as a user.

Before You Begin

To complete the lessons in this chapter, you must have a computer running Windows 2000 connected to an Active Directory network, with the Active Directory Users and Groups console installed. You must also have created the user objects listed in Exercise 7.1 in Chapter 7, "Managing Active Directory User and Computer Objects."


Lesson 1: Using Group Objects

In this lesson, you learn what groups are and how you can use them to simplify administrative tasks. You also learn about the types of groups and the group scopes that Windows 2000 provides, and how to use these group types and scopes, along with the rules for group membership. Finally, you learn the purpose of using local groups.

After this lesson, you will be able to

  • Explain the purpose of groups
  • Explain the purpose of security and distribution group types
  • Explain the purpose of domain local, global, and universal group scopes
  • Explain the purpose of local groups

Estimated lesson time: 45 minutes

Groups and Permissions

A group is a collection of user or computer accounts. Groups simplify administration by enabling you to assign permissions and rights to a group of users rather than to each individual user account (see Figure 8.1). When you assign permissions or rights to a group, all of the members of the group inherit those permissions or rights. On a network with a well-designed system of groups and memberships, administrators rarely, if ever, have to assign permissions or rights to individual users.

Figure 8.1 Using groups to simplify system and network administration
Permissions control what users can do with a resource, such as a file, folder, or printer. When you assign permissions, you give users the capability to access a resource and define the type of access that they have. Rights enable users to perform system tasks, such as changing the time on a computer, backing up or restoring files, or logging on locally. If several users need to read the same file, you can add their user accounts to a group. Then you give the group permission to read the file. For more information about assigning permissions, see Chapter 4, "Managing NTFS Permissions," and Lesson 5 of Chapter 5, "Sharing Drives and Printers."

In addition to user accounts, you can add other groups, contacts, and computers to groups. You add groups to other groups to create a consolidated group and reduce the number of times that you need to assign permissions. You can also add computers to groups to simplify giving a system task on one computer access to a resource on another computer.

Windows 2000 provides the ability to create groups both in a stand-alone computer security accounts database, and in Active Directory service. Just like with user accounts, local groups are intended strictly for the administration of a single computer's resources, whereas with Active Directory groups, you can grant users access to resources anywhere on the network.

When you create groups in an Active Directory installation, you must choose one of several group types and one of several group scopes. Understanding the differences between the various types and scopes is an essential part of administering Active Directory service. Creating the wrong type or scope of groups can prevent them from functioning the way you expect them to, resulting in what can be a difficult troubleshooting process.

Group Types

Sometimes you use groups for security-related purposes, such as assigning permissions. Other times you use them for nonsecurity purposes, such as sending e-mail messages. To facilitate this task, Windows 2000 includes two types of groups: security and distribution. The group type determines how you use the group. Both types of groups are stored in the Active Directory database, which makes them available anywhere in your network.

Security Groups

Windows 2000 itself uses only security groups, which you use to assign permissions to access resources and rights to perform tasks. Programs that are designed to use Active Directory service can also use security groups for nonsecurity- related purposes, such as retrieving user information for use in a Web application. A security group also has all the capabilities of a distribution group. Because Windows 2000 uses only security groups, this chapter focuses on security groups.

Distribution Groups

Applications can use distribution groups as lists for nonsecurity-related functions. You use distribution groups when the only function of the group is nonsecurity-related, such as sending e-mail messages to a group of users at the same time. You cannot use distribution groups to assign rights and permissions.

Only programs that are designed to work with Active Directory service can use distribution groups. For example, Microsoft Exchange 2000 Server uses distribution groups as mailing lists for sending e-mail messages.

Group Scopes

When you create a group, you must select a group type and a group scope. Group scopes enable you to use groups in different ways to assign rights and permissions. The scope of a group determines where in the network you can use the group. The three group scopes are global, domain local, and universal, as shown in Figure 8.2.

Figure 8.2 Group scopes

Global Groups

Global security groups are most often used to organize users who share similar network access requirements. A global group has the following characteristics:

  • Limited membership. You can add members only from the domain in which you create the global group.
  • Access to resources in any domain. You can use a global group to grant permissions to access resources located in any domain in the tree or forest.

Domain Local Groups

Domain local security groups are most often used to assign permissions to resources. A domain local group has the following characteristics:

  • Open membership. You can add members from any domain.
  • Access to resources in one domain. You can use a domain local group to grant permissions to access resources located only in the same domain where you create the domain local group.

Universal Groups

Universal security groups are most often used to assign permissions to related resources in multiple domains. A universal security group has the following characteristics:

  • Open membership. You can add members from any domain.
  • Access to resources in any domain. You can use a universal group to assign permissions to access resources located in any domain.
  • Available only in Native mode. Universal security groups are not available in Mixed mode. The full feature set of Windows 2000 is available only in Native mode.
The Mixed mode that Active Directory service uses by default is designed to enable pre-Windows 2000 servers to function as domain controllers. While running in Mixed mode, you cannot nest groups or create universal security groups. Switching to Native mode provides these features, but it also requires you to run Windows 2000 on all of your domain controllers. You can switch a domain from Mixed mode to Native mode at any time, using the Active Directory Domains and Trusts console, but once in Native mode, you cannot switch back to Mixed mode. Native mode only affects the domain controllers; it does not prevent pre-Windows 2000 servers from joining the domain.

Group Nesting

Adding groups to other groups, or nesting, creates a consolidated group and can reduce network traffic between domains and simplify administration in a domain tree. For example, you might create a separate group for each department in a company so that administrators can grant each group access to departmental resources. However, with this arrangement, if you want to grant all of the network users access to companywide resources, you would have to assign permissions to each of the departmental groups.

To simplify this process, you can create another group representing the entire company and make all of the departmental groups members of the company group. This way, when you assign permissions to the company group, the departmental groups all inherit the permissions and pass them down to their member users.

Some practical guidelines for group nesting include the following:

  • Minimize levels of nesting. Tracking permissions and troubleshooting can become more complex when you have many levels of nested groups. One level of nesting is usually sufficiently effective for most needs.
  • Document group membership to keep track of permissions assignments. Providing documentation of group membership can eliminate the redundant assignment of user accounts to groups and reduce the likelihood of accidental group assignments.

Rules for Group Membership

The group scope determines the membership of a group. Membership rules determine the types of members that a group can contain. Group members can be user accounts, computers, and other groups. To assign the correct members to groups and to use nesting, you must understand group membership rules. If you encounter a situation in which you cannot add a particular user to a group or use a group to provide users with access to a particular resource, the troubleshooting process should begin with an examination of the scope of the group, in comparison with the design of your Active Directory installation.

Table 8.1 describes group membership rules, including which types of members each group scope can contain in both Native and Mixed mode.

Table 8.1 Group Scope Membership Rules

Group Scope | In Native Mode, Scope Can Contain | In Mixed Mode, Scope Can Contain
Global | User accounts and global groups from the same domain. | Users from the same domain.
Domain local | User accounts, universal groups, and global groups from any domain; domain local groups from the same domain. | User accounts and global groups from any domain.
Universal | User accounts, other universal groups, and global groups from any domain. | Not applicable; you cannot create universal groups in Mixed mode.

Local Groups

A local group is a collection of user accounts on a computer. You use local groups to assign permissions to resources on the computer on which you've created the local group. Windows 2000 creates local groups in the local security database.

Because Active Directory groups with a domain local scope are sometimes referred to as local groups, you must distinguish between a local group and a group with a domain local scope.

Using Local Groups

The following are guidelines for using local groups:

  • You can use local groups only on the computer where you create the local groups. Local group permissions provide access only to resources on the computer where you created the local group.
  • You can use local groups on computers running Microsoft Windows 2000 Professional and member servers running Microsoft Windows 2000 Server. You cannot create local groups on domain controllers because domain controllers cannot have a security database that is independent of the database in Active Directory service.
  • You can use local groups to limit the ability of local users and groups to gain access to network resources without creating domain groups, such as in an Internet Information Services (IIS) environment.

Membership rules for local groups include the following:

  • Local groups can contain local user accounts only from the computer where you created the local group.
  • Local groups cannot be members of any other group.

Planning Global and Domain Local Groups

You must have a group strategy in place before you create groups. Creating groups of the wrong type or with the wrong scope can result in a failure of the groups to perform as expected. The recommended method for deploying groups is to use global and domain local groups. When you plan to use global and domain local groups, use the following strategy:

  1. Assign users with common job responsibilities to global groups. Identify users with common job responsibilities and add their user objects to a global group. For example, in an accounting department, add the user objects for all of the accountants to a global group called Accounting.
  2. Create a domain local group for resources to be shared. Identify the resources, such as related files or printers, to which users need access, and then create a domain local group for that resource. For example, if you have a number of color printers in your company, create a domain local group called Color Printers.
  3. Add global groups that need access to the resources to the domain local group. Identify all global groups that require access to a particular resource and make them members of the appropriate domain local group. For example, add the global groups Accounting, Sales, and Management to the domain local group Color Printers.
  4. Assign resource permissions to the domain local group. Assign the required permissions for the resource to the domain local group. For example, assign the permissions needed to use the color printers to the Color Printers group. Users in the Accounting, Sales, and Management global groups receive the required permissions because their global group is a member of the domain local group Color Printers.

Figure 8.3 illustrates the strategy for using groups: place user objects into global groups, create a domain local group for a group of resources to be shared in common, place the global groups into the domain local group, and then assign permissions to the domain local group. This strategy gives you the most flexibility for growth and reduces the number of permissions assignments.

Figure 8.3 Planning a group strategy

Some of the possible limitations of other strategies include the following:

  • Placing user accounts in domain local groups and assigning permissions to the domain local groups. This strategy does not enable you to assign permissions for resources outside of the domain, thus reducing the flexibility when your network grows.
  • Placing user accounts in global groups and assigning permissions to the global groups. This strategy can complicate administration when you are using multiple domains. If global groups from multiple domains require the same permissions, you have to assign permissions for each global group.

Using Universal Groups

When you plan to use universal groups, follow these guidelines:

  • Use universal groups to give users access to resources that are located in more than one domain. Unlike domain local groups, you can assign permissions to universal groups for resources in any domain on your network. For example, if executives need access to printers throughout your network, you can create a universal group for this purpose and assign it permissions for using the printers on print servers in all of your domains.
  • Use universal groups only when their membership is static. In a domain tree, universal groups can cause excessive network traffic between domain controllers whenever you change membership for the universal group. This problem occurs because universal group membership changes must be replicated to a larger number of domain controllers.
  • Add global groups from several domains to a universal group, and then assign to the universal group the permissions needed to access a resource. Following this guideline enables you to use a universal group in the same way as domain local groups to assign permissions for resources. However, unlike a domain local group, you can assign permissions to a universal group to give users access to a resource that is located in any domain.

Exercise 8.1: Planning New Group Accounts

In this exercise, you plan the groups that are required for the following business scenario.

You are an administrator for the customer service division of a manufacturing company. You administer a domain that is part of your company's domain tree. You do not administer other domains, but you might have to give selected user accounts from other domains access to resources in your domain. Users at the company use several shared network resources. The company is also planning to implement an e-mail program that uses Active Directory service.

Table 8.2 lists the job functions in the customer service division and the number of employees performing each job.

Table 8.2 Customer Service Division Employee Information

Job Function | Number of Employees
Product tester | 20
Customer service representative | 250
Maintenance worker | 5
Manager | 5
Sales representative | 5
Network administrator | 2

Table 8.3 lists the information access requirements for the classes of employees.

Table 8.3 Employee Information Access Requirements

Company Information Resource | Access Required By
Customer database, full access | Customer service representatives and managers
Customer database, read-only access | Sales representatives
Company policies, read-only access | All employees
Company announcements sent through e-mail | All employees
Periodic announcements about manufacturing topics sent through e-mail | Any employees in any domain who are interested in these topics
Shared installation of Microsoft Office | All employees, except maintenance workers
Full access to all resources in the company | Network administrators
Sales reports | Sales representatives from your domain and all other domains

As the domain administrator, you must determine the following:

  • Which groups are needed.
  • The membership of each group. This choice can be user accounts or other groups.
  • The type and scope of each group.

Record your planning strategies in the Group Accounts Planning Worksheet and then answer the questions that follow it. Use these instructions to complete the worksheet:

  1. In the worksheet, provide a name for each group. Record each name in the Group Name column.
  2. Specify type and scope of the group.
  3. List the members of the group.

Group Accounts Planning Worksheet

Group Name | Type and Scope | Members
  1. Does your network require local groups?
  2. Does your network require universal groups?
  3. Sales representatives at the company frequently visit the company headquarters and other divisions. Consequently, you need to give sales representatives with user accounts in other domains the same permissions for resources that sales representatives have in your domain. You also want to make it easy for administrators in other domains to assign permissions to sales representatives in your domain. How can you accomplish this task?

    After completing the exercise, turn to the Appendix, "Questions and Answers," and compare your worksheet to the sample provided. The sample presents only one set of possible answers. You might have planned your accounts differently.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Why should you use groups?
  2. What is the purpose of adding a group to another group?
  3. When should you use security groups instead of distribution groups?
  4. What strategy should you apply when you use domain local and global groups?
  5. Why shouldn't you use local groups on a computer after it becomes a member of a domain?

Lesson Summary

  • Groups enable administrators to assign rights and permissions to multiple users with a single procedure. Members of a group inherit all rights and permissions granted to that group.
  • Windows 2000 provides two types of groups: security groups, which are used for assigning rights and permissions, and distribution groups, which are used to send e-mail and other communications to a list of users.
  • Windows 2000 provides three group scopes: global groups, domain local groups, and universal groups. The scopes differ in the types of objects that they can have as members and the resources to which they can grant access.
  • When Active Directory is running in Native mode, you can make a group a member of another group, a process called group nesting.
  • The group nesting that you can perform when running in Native mode depends on the types and scopes of the groups involved.


Lesson 2: Understanding Default Groups

Windows 2000 has four categories of default groups: predefined, built-in, built-in local, and special identity. Default groups have a predetermined set of user rights and group memberships. User rights determine the system tasks that a user or member of a default group can perform. This lesson examines the properties of the various default groups and explains how to use them.

After this lesson, you will be able to

  • Describe the Windows 2000 default groups

Estimated lesson time: 15 minutes

Predefined Groups

Windows 2000 creates predefined groups with a global scope to group common types of user accounts. By default, Windows 2000 automatically adds members to some predefined global groups. You can add user objects to these predefined groups to provide additional users with the privileges and permissions assigned to the group.

When you create an Active Directory domain, Windows 2000 creates the predefined global groups in the domain \Users folder, as shown in Figure 8.4. By default, these predefined groups do not have any inherent rights or permissions. You can assign rights or permissions to them either by adding the predefined global groups to domain local groups or by explicitly assigning rights or permissions to the predefined global groups.

Figure 8.4 The \Users folder of an Active Directory domain containing predefined global groups

The predefined global groups that Windows 2000 creates and their members include the following:

  • Domain Admins. Windows 2000 automatically adds Domain Admins to the Administrators built-in domain local group so that members of Domain Admins can perform administrative tasks on any computer anywhere in the domain. By default, the Administrator account is a member. Also, any computer that joins the domain automatically places the Domain Admins group in the Administrators local group.
  • Domain Guests. Windows 2000 automatically adds Domain Guests to the Guests built-in domain local group. By default, the Guest account is a member.
  • Domain Users. Windows 2000 automatically adds Domain Users to the Users built-in domain local group. By default, the Administrator, Guest, IUSR_computername, IWAM_ computername, Krbtgt, and TsInternetUser accounts are initially members, and each new domain user account is automatically made a member.
  • Enterprise Admins. Windows 2000 allows you to add user accounts to Enterprise Admins for users who require administrative control for the entire network. Then add Enterprise Admins to the Administrators domain local group in each domain. By default, the Administrator account is a member.

Built-In Groups

Windows 2000 creates built-in groups with a domain local scope in the \Builtin folder of each Active Directory domain, as shown in Figure 8.5. These groups provide users with user rights and permissions to perform tasks on domain controllers and in the Active Directory tree. Built-in domain local groups provide these predefined rights and permissions to user accounts when you add user objects or global groups as members.

Figure 8.5 The \Builtin folder of an Active Directory domain containing built-in domain local groups

The most commonly used built-in domain local groups and the capabilities granted to their members are as follows:

  • Account Operators. Members can create, delete, and modify user and group objects; members cannot modify the Administrators group or any of the operators groups.
  • Administrators. Members can perform all administrative tasks on all domain controllers and on the domain itself. By default, the Administrator user object and the Domain Admins and Enterprise Admins predefined global groups are members.
  • Backup Operators. Members can back up and restore all domain controllers using Windows Backup.
  • Guests. Members can perform only tasks for which you have granted rights; members can gain access only to resources for which you have assigned permissions; members cannot make permanent changes to their desktop environment. By default, the Guest, IUSR_computername, IWAM_computername, and TsInternetUser user accounts and the Domain Guests predefined global group are members.
  • Pre-Windows 2000 Compatible Access. This group is a backward-compatibility group that provides read access for all users and groups in the domain. When you select the Permissions Compatible With Pre-Windows 2000 Servers option in the Active Directory Installation Wizard, the Everyone pre-Windows 2000 system group is made a member.
  • Print Operators. Members can set up and manage network printers on domain controllers.
  • Replicator. This group supports directory replication functions. The only member should be a domain user account used to log on to the Replicator services of the domain controller. Do not add the accounts of actual users to this group.
  • Server Operators. Members can share disk resources and back up and restore files on a domain controller.
  • Users. Members can perform only tasks for which you have granted rights, and they can access only the resources for which you have assigned permissions. By default, the Authenticated Users and Interactive pre-Windows 2000 groups and the Domain Users predefined global group are members. Use this group to assign permissions and rights that every user with an account in your domain should have.

Built-In Local Groups

Windows 2000 stand-alone servers, member servers, and computers running Windows 2000 Professional all have built-in local groups. Built-in local groups give users the rights to perform system tasks on a single computer, such as backing up and restoring files, changing the system time, and administering system resources. Windows 2000 places the built-in local groups in the \Groups folder in the Local Users and Groups snap-in, as shown in Figure 8.6. This snap-in appears by default in the Computer Management console on every computer running Windows 2000 (except for domain controllers).

Figure 8.6 The Local Users and Groups snap-in, as found in the Computer Management console

The most commonly used built-in local groups and their capabilities are as follows. Except where noted, no initial members exist in these groups.

  • Administrators. Members can perform all administrative tasks on the computer. By default, the built-in Administrator user account for the computer is a member. When a member server or computer running Microsoft Windows 2000 Workstation joins a domain, Windows 2000 adds the Domain Admins predefined global group to the local Administrators group.
  • Backup Operators. Members can use Windows Backup to back up and restore the computer.
  • Guests. Members can perform only tasks for which you have specifically granted rights and can access only resources for which you have assigned permissions; members cannot make permanent changes to their desktop environment. By default, the built-in Guest account for the computer is a member. When a member server or a computer running Windows 2000 Workstation joins a domain, Windows 2000 adds the Domain Guests predefined global group to the local guests group.
  • Power Users. Members can create and modify local user accounts on the computer and share resources.
  • Replicator. This group supports directory replication functions. The only member should be a domain user account used to log on to the Replicator services of the domain controller. Do not add the accounts of actual users to this group.
  • Users. Members can perform only tasks for which you have specifically granted rights and can access only resources for which you have assigned permissions. By default, Windows 2000 adds to the Users group local user accounts that you create on the computer. When a member server or a computer running Windows 2000 Professional joins a domain, Windows 2000 adds the Domain Users predefined global group to the local Users group.

Special Identity Groups

Special identity groups exist on all computers running Windows 2000. These groups do not have specific memberships that you can modify, but they can represent different users at different times, depending on how a user accesses a computer or resource. You do not see special identity groups when you administer groups, but they are available for use when you assign rights and permissions to resources. Windows 2000 bases special identity group membership on how the computer is accessed, not on who uses the computer. The most commonly used special identity groups are as follows:

  • Anonymous Logon. Includes any user account that Windows 2000 did not authenticate.
  • Authenticated Users. Includes all users with a valid user account on the computer or in Active Directory service. Use the Authenticated Users group instead of the Everyone group to prevent anonymous access to a resource.
  • Creator Owner. Includes the user account for the user who created or took ownership of a resource. If a member of the Administrators group creates a resource, the Administrators group is owner of the resource.
  • Dialup. Includes any user who currently has a dial-up connection.
  • Everyone. Includes all users who access the computer. Be careful if you assign permissions to the Everyone group and enable the Guest account. Windows 2000 authenticates as Guest a user who does not have a valid user account. The user automatically gets all rights and permissions that you have assigned to the Everyone group. The Everyone group is assigned full control to many resources by default.
  • Interactive. Includes the user account for the user who is logged on at the computer. Members of the Interactive group gain access to resources on the computer at which they are physically located. They log on and gain access to resources by "interacting" with the computer.
  • Network. Includes any user with a current connection from another computer on the network to a shared resource on the computer.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

Specify the type for each of the following groups: either predefined, built-in, built-in local, or special identity.

  1. Power Users
  2. Everyone
  3. Domain Admins
  4. Account Operators
  5. Authenticated Users

Lesson Summary

  • Windows 2000 creates four different types of default groups: predefined, built-in, built-in local, and special identity.
  • Predefined groups are global groups, created in the \Users folder of every Active Directory domain.
  • Built-in groups are domain local groups, created in the \Builtin folder of every Active Directory domain.
  • Built-in local groups are created on every computer running Windows 2000 that is not a domain controller, for the purpose of controlling access only to that computer's resources.
  • Special identity groups are an exceptional type that you use to assign rights and permissions based on how users access computers and their resources.


Lesson 3: Creating Group Objects

After you assess user needs and have a plan in place for your groups, you are ready to create group objects in Active Directory service. To implement your group plan, you should be familiar with the guidelines for creating groups, as discussed earlier in this chapter. This lesson shows you how to create group objects, delete group objects, add members to groups, and change the group type and scope.

After this lesson, you will be able to

  • Create and delete groups
  • Add members to groups
  • Change group type and scope

Estimated lesson time: 25 minutes

Creating and Deleting Groups

To create and manage group objects in Active Directory service, use the Active Directory Users and Computers Microsoft Management Console (MMC) console. When you create groups, you can create them in the Users container or in another container or organizational unit (OU) that you have created specifically for groups. As your organization grows and changes, you might discover groups that you no longer need. Be sure that you delete groups when you no longer need them. This action helps you to maintain security so that you do not accidentally assign access permissions to groups that you no longer need.

To create a group object, use the following procedure:

  1. From the Administrative Tools program group, open the Active Directory Users and Computers console.
  2. Navigate to the container or OU where you want to create the group object.
  3. Right-click the container or OU and, from the New menu, choose Group on the pop-up menu to display the New Object - Group dialog box, as shown in Figure 8.7.

    Figure 8.7 The New Object - Group dialog box
  4. In the Group Name box, type the name you want to assign to the group. The name of the group as it appears to pre-Windows 2000 computers is automatically supplied in the Group Name (Pre-Windows 2000) box.
  5. Specify the scope for the group by selecting the appropriate option (Domain Local, Global, or Universal) in the Group Scope box.
  6. Specify the type of group you want to create by selecting the appropriate option (Security or Distribution) in the Group Type box.
  7. Click OK to close the dialog box and create the new group.

Adding Members to a Group

After you create a group object, you add members to it. The members of groups can include user objects, contacts, other groups, and computers. You can add a computer to a group to give one computer access to a shared resource on another computer-for example, for remote backup. To add members to a group, in the Active Directory Users and Computers console, open its Properties dialog box and select the objects that you want to add as members.

To add members to a group, use the following procedure:

  1. From the Administrative Tools program group, open the Active Directory Users and Computers console.
  2. Right-click the group object to which you want to add members and, from the pop-up menu, choose Properties to display the Properties dialog box.
  3. Click the Members tab, as shown in Figure 8.8.

    Figure 8.8 The Members tab of the Properties dialog box of a group object
  4. Click Add to open the Select Users, Contacts, Or Computers dialog box, as shown in Figure 8.9.

    Figure 8.9 The Select Users, Contacts, Or Computers dialog box
  5. In the Name list, select the object you want to add as a member of the group and click Add. Using the Look In list box, you can select a domain from which to display objects, or you can select Entire Directory to view the objects from anywhere in Active Directory service. The accounts you select are listed in the box at the bottom of the Select Users, Contacts, Or Computers dialog box.
    If you want to add multiple user accounts or groups, repeat the process of selecting them one at a time and then click Add, or you can hold down the Shift or Ctrl key to select multiple user accounts or groups at a time. The Shift key allows you to select a consecutive range of accounts, and the Ctrl key allows you to select specific accounts that you want to add.
  6. Click OK to add the selected objects to the Members list in the Properties dialog box.
  7. Click OK to close the Properties dialog box.
Most Active Directory objects have a Member Of tab in their Properties dialog boxes that enable you to approach this task from the other direction, by selecting the groups of which you want the object to be a member. You can use this method to quickly add the same user or group to multiple groups.

Changing the Group Type

As group functions change, you might need to change a group object from one type to another. For example, suppose a distribution group contains members from multiple departments working on the same project for the purpose of sending e-mail messages. As the project progresses, the members need to access a common database. By converting the distribution group to a security group and assigning permissions to the group, you can provide the project members with access to the common database. You can change the type of a group only when Windows 2000 is operating in Native mode.

To change the type of a group, use the following procedure:

  1. From the Administrative Tools program group, open the Active Directory Users and Computers console.
  2. Right-click the group object for which you want to change the type and, from the pop-up menu, choose Properties to display the Properties dialog box (see Figure 8.10).

    Figure 8.10 The Properties dialog box of a group object
  3. In the General tab, select the appropriate option in the Group Type box to choose a group type.
  4. Click OK to change the group type and close the Properties dialog box.

Changing the Group Scope to Universal

As your network changes, you might also need to change a global or domain local group scope to universal. For example, you might want to change an existing domain local group to a universal group when you need to assign permissions enabling users to access resources in other domains. You can change the scope of a group to universal only when Windows 2000 is operating in Native mode.

Active Directory service permits the following group scope changes:

  • A global group to a universal group, but only if the global group is not a member of another global group
  • A domain local group to a universal group, but only if the domain local group does not contain another domain local group
Windows 2000 does not allow you to change the scope of a universal group because the usage and membership rules for other groups are more restrictive.

To change the scope of a group, use the following procedure:

  1. From the Administrative Tools program group, open the Active Directory Users and Computers console.
  2. Right-click the group object for which you want to change the scope and, from the pop-up menu, choose Properties to display the Properties dialog box, as shown in Figure 8.10.
  3. In the General tab, select the appropriate option in the Group Scope box to select a scope.
  4. Click OK to change the scope of the group and close the Properties dialog box.

Deleting a Group

Each group object that you create in Active Directory service has a unique, nonreusable identifier called the security identifier (SID). Windows 2000 uses the SID to identify the group and the permissions that are assigned to it. When you delete a group, Windows 2000 does not use the same SID for that group again, even if you create a new group with the same name as the one you deleted. Therefore, you cannot restore access to resources by recreating a group object.

When you delete a group, you delete only the group and the permissions and rights that are associated with it. Deleting a group does not delete the objects that are members of the group.

You cannot delete a group if one of the group's members has the group set as his or her primary group.

To delete a group, use the following procedure:

  1. From the Administrative Tools program group, open the Active Directory Users and Computers console.
  2. Right-click the group object to which you want to add a member and, from the pop-up menu, choose Delete.
  3. In the Active Directory message box, click Yes.

Creating Local Groups

To create local groups, you use the Local Users and Groups snap-in for MMC, which is included in the Computer Management console. You create local groups in the \Groups folder.

To create a local group, use the following procedure:

  1. From the Administrative Tools program group, open the Computer Management console. On a Windows 2000 Professional computer, you can access Administrative Tools from Control Panel.
  2. Expand the Local Users and Groups snap-in.
  3. Right-click the Groups container and, from the pop-up menu, choose New Group to display the New Group dialog box, as shown in Figure 8.11.

    Figure 8.11 The New Group dialog box
  4. In the Group Name box, specify a unique name for the local group.
  5. In the Description box, enter a descriptive name for the group (optional).
  6. Click Add to display the Select Users Or Groups dialog box, as shown in Figure 8.12.

    Figure 8.12 The Select Users Or Groups dialog box
  7. In the Name list, select the users you want to add as members of the new group, clicking Add for each one.
  8. Click OK to close the Select Users Or Groups dialog box. Notice that the users you selected now appear in the Members list in the New Group dialog box.
  9. Click Create to create the group and add the members you selected.
  10. Click Close to close the New Group dialog box.
You can add members to a local group when you create the group or after you create the local group.

To delete a local group, use the following procedure:

  1. Open the Computer Management console.
  2. Expand the Local Users and Groups snap-in.
  3. Expand the Groups container.
  4. Right-click the group you want to delete and, from the pop-up menu, choose Delete.
  5. In the Local Users And Groups message box, click Yes.

Exercise 8.2: Creating Groups

In this exercise, you create a global security group and then add to it as members the user objects you created in Exercise 7.1. Next, you create a domain local security group that you can use to assign permissions to access document files. Finally, you provide the global group members with access to the documents by adding the global group to the domain local group.

Procedure 1: Creating a Global Group and Adding Members

To create a global security group, complete the following steps:

  1. Log on to your domain as Administrator.
  2. From the Administrative Tools program group, open the Active Directory Users and Computers MMC console.
  3. Expand your domain and click the Users container. In the details pane, Active Directory Users and Computers displays a list of current user objects and built-in global groups.
  4. Right-click the Users container and, from the New menu, choose Group to display the New Object - Group dialog box.
  5. In the Group Name box, type Sales.
  6. In the Group Scope box, select Global, and in the Group Type box, select Security.
  7. Click OK. Windows 2000 creates the group and adds it to the Users container.

Procedure 2: Adding Members to a Global Group

To add members to the group object you created, complete the following steps:

  1. In the details pane of the Active Directory Users and Computers console, double-click the Sales group object to display the Sales Properties dialog box.
  2. Click the Members tab to view a list of the members of the group. The list is currently empty.
  3. Click Add to open the Select Users, Contacts, Or Computers dialog box.
  4. Select the user object for Jo Berry and click Add.
  5. Select the user object for John Kelly and click Add.
  6. Click OK to add the users you selected to the Sales group.
  7. Click OK to close the Sales Properties dialog box.

Procedure 3: Creating a Domain Local Group

To create a new domain local group, complete the following steps:

  1. Make sure that Active Directory Users and Computers is open with the Users container selected in the console tree.
  2. Right-click the Users container and, from the New menu, choose Group to display the New Object - Group dialog box.
  3. In the Group Name box, type Reports.
  4. In the Group Scope box, select Domain Local, and in the Group Type box, select Security.
  5. Click OK to create the domain local group and add it to the Users container.

Procedure 4: Adding Members to a Domain Local Group

To add the Sales group to the Reports group you just created as a member, complete the following steps:

  1. In the details pane of the Active Directory Users and Computers console, double-click the Reports group object to display the Reports Properties dialog box.
  2. Click the Members tab to view a list of the members of the group. The list is currently empty.
  3. Click Add to open the Select Users, Contacts, Or Computers dialog box.
  4. From the Look In list box, select Entire Directory. The Select Users, Contacts, Or Computers dialog box displays available objects that can be part of the group and shows the location of each object as domain/Users.
  5. Above the list of user accounts, groups, and computers, click the Name column heading to sort the entries in the list alphabetically by name.
  6. Select the Sales group and click Add.
  7. Click OK to close the Select Users, Contacts, Or Computers dialog box. The Sales global group is now a member of the Reports domain local group.
  8. Click OK to close the Reports Properties dialog box.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Which of the following group scope modifications are not permitted? (Choose all that apply.)
    1. Global to universal
    2. Domain local to universal
    3. Universal to global
    4. Domain local to local
  2. What tool do you use to create local groups on a Windows 2000 computer that is not a domain controller?
  3. Which circumstances can prevent you from deleting a group object?

Lesson Summary

  • To create a global group, you use the Active Directory Users and Computers console.
  • To create a local group, you use the Local Users and Groups snap-in.
  • You can create local groups on any Windows 2000 computer that is not a domain controller.
  • After creating a group, you can add members to it and, under certain conditions, modify its type and scope.
  • Once you delete a group object, recreating the group with the same name does not restore the permissions that were granted to that group.


Lesson 4: Managing Administrative Access

For optimum security, Microsoft recommends that you do not add the user objects that network administrators use for their daily access to the Administrators group, and that you avoid running your computer while logged on with administrative access. This lesson examines reasons why you should not run your computer as an administrator, and describes the group memberships and other actions you should take to ensure security for administrators.

After this lesson, you will be able to

  • Explain why you should not run your computer as an administrator
  • Explain the groups administrators should use to log on
  • Explain how to use Run As to start a program as an administrator

Estimated lesson time: 15 minutes

Why You Should Not Run Your Computer as an Administrator

Running Windows 2000 as an administrator or a member of one of the administrative groups makes the network vulnerable to virus and Trojan horse attacks and other security risks. The simple act of visiting an Internet site has the potential to be extremely damaging to the system. An unfamiliar Internet site might contain virus or Trojan horse code that can be downloaded to the system and executed. If you are logged on with administrator privileges, a virus could possibly reformat your hard disk, delete all files, create a new user account with administrative access, and so on.

Therefore, even if you are the administrator of the network, you should not add your personal user object to the Administrators or Domain Admins group, and you should avoid running nonadministrative tasks on your computer while logged on as an administrator. For most computer activity, you should add your user object to the Users group or Power Users group. Then, if you need to perform an administrator-only task, you should log on as an administrator or run the program as the administrator, perform the task, and then log off.

Administrators as Members of the Users Group and Power Users Group

When you log on as a member of the Users group, you can perform routine tasks, including running programs and visiting Internet sites, without exposing your computer to unnecessary risk. As a member of the Power Users group, you can perform routine tasks and install programs, add printers, and use most Control Panel tools. If you need to perform administrative tasks such as upgrading the operating system or configuring system parameters, log off and log back on as Administrator.

If you frequently need to log on as Administrator, you can perform certain administrative tasks by using Run As to start a program with administrator privileges, while logged on as a regular user.

Using Run As to Start a Program

To run a program that requires you to be logged on as Administrator, you can use the Run As program. This program enables you to run administrative tools with either local or domain administrator rights and permissions while you are logged on as a normal user.

Use the Run As program to start any program, program shortcut, saved MMC console, or Control Panel tool, as long as the following conditions are met:

  • You provide the appropriate user account and password information.
  • The user account has the ability to log on to the computer.
  • The program, MMC tool, or Control Panel tool is available on the system and to the user account.

Some applications, such as Windows Explorer, the Printers folder, and desktop items, are started indirectly by Windows 2000 and therefore cannot be started with the Run As program.

Run As is usually used to run programs as Administrator, although it is not limited to administrator accounts. Any user with multiple accounts can use Run As to run a program, MMC tool, or Control Panel tool with alternate credentials.

To use Run As to start a program as Administrator, use the following procedure:

  1. In Windows Explorer, locate the program or its shortcut, MMC console, or Control Panel tool you want to open.
  2. Press the Shift key and right-click the program, tool, or item; then, from the pop-up menu, choose Run As to display the Run As Other User dialog box (see Figure 8.13).

    Figure 8.13 The Run As Other User dialog box
  3. Select Run The Program As The Following User.
  4. In the User Name and Password boxes, type the username and password of the administrator account you want to use.
  5. In the Domain box
    • If you want to use the local administrator account on your computer, type the name of your computer.
    • If you want to use a domain administrator account, type the name of the domain.
  6. Click OK.
If the Run As program fails, the RunAs service might not be running. Using the RunAs Service option in the Services console, you can set the RunAs service to start automatically when the system starts.

If you attempt to start a program, MMC console, or Control Panel tool from a network location using the Run As program, it might fail if the credentials used to connect to the network share are different from the credentials used to start the program. The credentials used to run the program might not be able to gain access to the same network share.

You can also set a property on shortcuts to programs and MMC tools so that you are always prompted for alternate credentials when you use the shortcut. To set the property, right-click the shortcut, click Properties, and then select the Run As Different User check box. When you start the shortcut, the Run As Other User dialog box appears, prompting you for the alternate user name, password, and domain.

The Runas Command

runas.exe is a command-line program that performs the same functions as the RunAs service. The syntax for runas.exe is as follows:

runas [/profile] [/env] [/netonly] /user:UserAccountName program

The following list describes the syntax:

  • /profile Specifies the name of the user's profile, if it needs to be loaded.
  • /env Specifies that the current network environment be used instead of the user's local environment.
  • /netonly Indicates that the user information specified is only for remote access.
  • /user:UserAccountName Specifies the name of the user account under which to run the program. The user account format should be user@domain or domain\user. If you want to use the Administrator account on your computer, for the /user: parameter, type /user:AdministratorAccountName@ ComputerName or /user:ComputerName\AdministratorAccountName. If you want to use this command as a domain administrator, type /user:AdministratorAccountName@DomainName or /user:DomainName\AdministratorAccountName.
  • /program Specifies the program or command to run using the account specified in /user.

Runas Examples

  • To start an instance of the Windows 2000 command prompt as an administrator on the local computer, type:
    runas /user:localmachinename\administrator cmd

    When prompted, type the administrator password.

  • To start an instance of the Computer Management snap-in using a domain administrator account called companydomain\domainadmin, type:
    runas /user:companydomain\domainadmin
    "mmc 	%windir%\system32\compmgmt.msc"

    When prompted, type the account password.

  • To start an instance of Notepad using a domain administrator account called user in a domain called domain.microsoft.com, type:
    runas /user:user@domain.microsoft.com "notepad my_file.txt"

    When prompted, type the account password.

  • To start an instance of a command prompt window, saved MMC console, Control Panel tool, or program that administers a server in another forest, type:
    runas /netonly /user:domain\username "command"

    The user, domain\username, must have sufficient permissions to administer the server. When prompted, type the account password. In this same situation, you can also type:

    runas /user:username@domain.mycompany.com program.exe

Exercise 8.3: Using Run As to Start a Program as an Administrator

In this exercise, you log on as jberry, the user account you created in Exercise 7.1. Then, using Run As, you start the Active Directory Users and Computers console as a domain administrator.

  1. Log on to the domain as jberry.
  2. Click Start, and, in the Administrative Tools program group, point to (but do not click) Active Directory Users And Computers.
  3. Press the Shift key and right-click Active Directory Users And Computers. Then, from the pop-up menu, choose Run As to display the Run As Other User dialog box.
  4. Select Run The Program As The Following User.
  5. In the User Name box, ensure that Administrator appears.
  6. In the Password box, type your administrator password.
  7. In the Domain box, type the name of your domain.
  8. Click OK. You can now use the Active Directory Users and Computers console with full domain administrator privileges.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next chapter. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Why shouldn't the everyday user accounts of network administrators have administrative access to the network?
  2. Describe the function of the RunAs service.
  3. What are two reasons why the Run As program might fail to launch the program you specify?

Lesson Summary

  • Users with administrative access to the network should not use administrative accounts for their everyday user activities.
  • The Power Users group enables a user to perform many basic system configuration tasks without having to log on as an administrator.
  • The Run As program enables a user logged on with one account to run a program using the credentials for another account without having to log off and log on again.
  • Pressing the Shift key while right-clicking a shortcut adds the Run As option to the pop-up menu, enabling you to supply alternative credentials for the execution of the associated program.
  • Runas.exe is a command-line version of the Run As program that provides the same functions.


Using Group Policies

About This Chapter

Administrators use group policies to manage desktop configurations for groups of computers and users. Group policies are flexible and include options for registry-based policy settings, security settings, application management, scripts, computer startup and shutdown, logon and logoff, and folder redirection. Microsoft Windows 2000 Server includes hundreds of group policy settings that you can configure. By enabling administrators to enhance and control user's desktops, group policies allow administrators to exercise comprehensive control over network users and workstations.

Before You Begin

To complete this chapter, you must have a basic knowledge of the Active Directory service. To perform the exercises, you need a computer connected to an Active Directory network and administrative privileges to a domain.


Lesson 1: Understanding Group Policies

Before attempting to implement group policies, you must be familiar with concepts that affect group policy operations. This lesson defines group policy, explains how group policy is administered, and provides an overview of the group policy settings. It also introduces you to how group policy affects startup and logon, how it is processed, and how security groups are used to filter group policy.

After this lesson, you will be able to

  • Explain the purpose and function of group policy
  • Explain how to delegate administrative control of group policy
  • Identify group policy settings
  • Explain how group policy affects startup and logon
  • Describe how group policy is processed
  • Explain how security groups can be used to filter group policy

Estimated lesson time: 35 minutes

What Are Group Policies?

Group policies are collections of user and computer configuration settings that you can link to computers, sites, domains, and organizational units (OUs) to specify the behavior of users' desktops. For example, using group policies, you can specify the programs that are available to users as well as the shortcuts that appear on the user's desktop and on the Start menu.

To create a specific desktop configuration for a particular group of users, you create group policy objects (GPOs): collections of group policy settings. Each Microsoft Windows 2000 computer has one local GPO, which might be subject to any number of nonlocal (Active Directory-based) GPOs.

One local GPO is always stored on each computer running Windows 2000, whether the computer is connected to a network or is part of an Active Directory environment. However, if the computer is part of an Active Directory network, the local GPO settings can be overridden by the nonlocal GPOs, making the local GPO the least influential. In a nonnetworked environment (or in a networked environment lacking a Windows 2000 domain controller), the settings of the local GPO are used because they are not overwritten by nonlocal GPOs.

Nonlocal GPOs are linked to Active Directory objects, such as sites, domains, or OUs, and can be applied to either users or computers. To use nonlocal GPOs, you must have a Windows 2000 domain controller installed on the network. Following the properties of Active Directory service, the policies in nonlocal GPOs are applied hierarchically from the least restrictive group (the site in which the computer is located) to the most restrictive group (the OU in which the computer is located) and are cumulative. This lesson refers to nonlocal GPOs unless otherwise specified.

You can specify which administrative groups can administer (create, modify, or delete) GPOs by defining access permissions for each GPO. By assigning to an administrative group the Read and Write permissions for a GPO, the group can delegate control of the GPO.

Using the Group Policy Snap-In

To create, modify, and manage group policy objects, you use a Microsoft Management Console (MMC) snap-in, as shown in Figure 9.1. Group Policy can function as both a stand-alone snap-in or an extension snap-in, meaning that you can access it in a variety of ways, depending on the action you want to perform and the type of object to which you want to apply the group policies.

Figure 9.1 The Group Policy snap-in

Two primary methods exist for opening the Group Policy snap-in. (The following sections examine these methods in more detail.) You can create a new MMC console and select Group Policy as a stand-alone snap-in, specifying the object or computer whose policy you want to access, or you can select an object in one of the Active Directory management consoles and access Group Policy as an extension snap-in.

For more information about MMC and snap-in modules, see Lesson 2 in Chapter 1, "Networking with Microsoft Windows 2000."

The individual items of the Group Policy snap-in (such as Administrative Templates, Security Settings, and so on) are themselves MMC snap-in extensions, and the snap-in extensions that provide the items can themselves be extended. An example is the Security Settings snap-in, which itself includes several snap-in extensions. By default, all of the available Group Policy snap-in extensions are loaded when you start the Group Policy snap-in. You can modify this default behavior by creating custom consoles and by using the policy settings in the Administrative Templates folder to control the behavior of MMC itself. The advantage of this extension model is that software developers can create their own MMC extensions to the Group Policy snap-in, to provide additional policies specific to their products.

The root node of the Group Policy snap-in is displayed as the name of the GPO and the domain to which it belongs, in the following format:

GPO Name [DomainName] Policy

For example:

Default Domain Controllers Policy [server1.microsoft.com] Policy

Opening the Local Group Policy Snap-In

The local group policies are those stored on each computer running Windows 2000.

To open the Group Policy snap-in with the focus on the local group policies, use the following procedure:

  1. From the Start menu, open the Run dialog box, type mmc in the Open box, and click OK to launch MMC.
  2. From the Console menu, select Add/Remove Snap-In to display the Add/Remove Snap-In dialog box (see Figure 9.2).

    Figure 9.2 The MMC Add/Remove Snap-In dialog box
  3. In the Standalone tab, click Add to display the Add Standalone Snap-In dialog box (see Figure 9.3).

    Figure 9.3 The Add Standalone Snap-In dialog box
  4. Scroll down in the Available Standalone Snap-Ins list, select Group Policy, and click Add to display the Select Group Policy Object dialog box (see Figure 9.4).

    Figure 9.4 The Select Group Policy Object dialog box
  5. Ensure that Local Computer appears in the Group Policy Object box, and click Finish.
  6. Click Close to close the Add Standalone Snap-In dialog box.
  7. Click OK to close the Add/Remove Snap-In dialog box. The Local Computer Policy folder now appears in the MMC console tree.

Opening the Group Policy Snap-In for Another Computer

You can open the local GPO for another computer on the network, as long as you have administrative rights to that computer.

To perform this task, use the following procedure:

  1. From the Start menu, open the Run dialog box, type mmc in the Open box, and click OK to launch MMC.
  2. From the Console menu, choose Add/Remove Snap-In to display the Add/Remove Snap-In dialog box.
  3. In the Standalone tab, click Add to display the Add Standalone Snap-In dialog box.
  4. Scroll down in the Available Standalone Snap-Ins list, select Group Policy, and click Add to display the Select Group Policy Object dialog box.
  5. Click Browse to display the Browse For A Group Policy Object dialog box (see Figure 9.5).

    Figure 9.5 The Browse For A Group Policy Object dialog box
  6. Click the Computers tab and select Another Computer.
  7. Type the name of the computer you want to access or click Browse to display a Select Computer dialog box.
  8. Click OK to close the Browse For A Group Policy Object dialog box.
  9. Click Finish to close the Select Group Policy Object dialog box.
  10. Click Close to close the Add Standalone Snap-In dialog box.
  11. Click OK to close the Add/Remove Snap-In dialog box. A folder for the policy of the selected computer now appears in the MMC console tree.

You can use the Browse For A Group Policy dialog box to select the GPO for any domain, OU, site, or computer on the network. By configuring MMC snap-ins in this manner, you can create a custom console containing any or all of the GPOs on your network.

Opening the Group Policy Snap-In from Active Directory Users and Computers

In addition to the GPOs associated with specific computers, you can also create group policies for Active Directory objects, such as domains, OUs, and sites.

To access the Group Policy snap-in using the Active Directory Users and Computers console, use the following procedure:

  1. From the Administrative Tools program group, open the Active Directory Users and Computers console.
  2. In the console tree, right-click the domain or OU for which you want to set group policy and, from the pop-up menu, select Properties to display the Properties dialog box.
  3. Click the Group Policy tab, select an entry in the Group Policy Object Links list to select an existing GPO, and then click Edit to launch the Group Policy snap-in for the selected domain or OU. (Optionally, click New to create a new GPO and then click Edit.)

Opening the Group Policy Snap-In from Active Directory Sites and Services

To open the GPO for an Active Directory site object, use the following procedure:

  1. From the Administrative Tools program group, open the Active Directory Sites and Services console.
  2. In the console tree, right-click the site for which you want to set group policy and, from the pop-up menu, choose Properties to display the Properties dialog box.
  3. Click the Group Policy tab, select an entry in the Group Policy Object Links list to select an existing GPO, and then click Edit to launch the Group Policy snap-in for the selected site. (Optionally, click New to create a new GPO and then click Edit.)

Group Policy Settings

Group policy settings are contained in a GPO and define the desktop environments for network users. The two types of group policy settings are computer configuration settings and user configuration settings. When you open a GPO, you see Computer Configuration and User Configuration folders beneath the root of the GPO. Use computer configuration settings to set the group policies that you want to apply to computers, regardless of who logs on to them. Windows 2000 applies computer configuration settings when the operating system initializes. Use user configuration settings to set group policies that apply to specific users, regardless of which computer the user logs on to. User configuration settings are applied when the user logs on to the computer.

Although some group policy settings define elements of the user interface-for example, the background bitmap or the ability to use the Run command on the Start menu-you can apply them to computers as well, using computer configuration settings.

Both computer configuration settings and user configuration settings include Software Settings, Windows Settings, and Administrative Templates, which appear as items beneath the Computer Configuration and User Configuration folders. The following sections examine these settings.

Software Settings

For both Computer Configuration and User Configuration, the Software Settings folder (Figure 9.6) contains only Software Installation settings by default. Software Installation settings help you to specify how applications are installed and maintained within your organization, as well as providing a place for independent software vendors to add their own settings.

Figure 9.6 Software Settings

You can manage an application within a GPO that, in turn, is associated with a particular Active Directory container-a site, domain, or OU. Applications can be managed in one of two modes: Assigned or Published. You assign an application to a computer when you want computers or people managed by the GPO to have the application. You publish an application when you want the application to be available to people managed by the GPO, should a person want the application. You cannot publish an application to computers. For more information about creating software installation settings in group policies, see Lesson 4 of this chapter.

Windows Settings

In both Computer Configuration and User Configuration, the Windows Settings folder holds two items: Scripts and Security Settings, as shown in Figure 9.7. Scripts enable you to specify two types of scripts to be applied to a computer or user: startup/shutdown scripts and logon/logoff scripts. Startup/shutdown scripts run at computer startup or shutdown. Logon/logoff scripts run when a user logs on or off the computer.

Figure 9.7 Windows Settings

When you assign multiple logon/logoff or startup/shutdown scripts to a user or computer, Windows 2000 executes the scripts from top to bottom. You can determine the order of execution for multiple scripts in the Properties dialog box. When a computer is shut down, Windows 2000 first processes logoff scripts followed by shutdown scripts. By default, the time-out value for processing scripts is 10 minutes. If the logoff and shutdown scripts require more than 10 minutes to process, you must adjust the time-out value with a software policy.

Administrators can use any ActiveX scripting language that they are comfortable with to create scripts. Some possibilities include VBScript, JScript, Perl, and MSDOS-style batch files (.bat and .cmd).

Security Settings enables a security administrator to manually configure the security levels assigned to a local or nonlocal GPO. This task can be performed after, or instead of, using a security template to set system security. For more details about system security, see Lesson 3 of this chapter.

For only the User Configuration folder, Windows Settings contains additional group policy settings for Internet Explorer Maintenance, Remote Installation Services, and Folder Redirection.

  • Internet Explorer Maintenance enables you to administer and customize Microsoft Internet Explorer on computers running Windows 2000.
  • Remote Installation Services controls the behavior of remote operating system installations. Optionally, you can use this feature to provide customized packages for non-Windows 2000 clients of Active Directory service. (Group policy requires a genuine Windows 2000 client, not merely a pre-Windows 2000 client of Active Directory service, however.)
  • Folder Redirection enables you to redirect Windows 2000 special folders (My Documents, Application Data, Desktop, and the Start menu) from their default user profile location to an alternate location on the network, where you can centrally manage them. For more information about redirecting special folders using group policies, see Lesson 2 of Chapter 10, "Managing Resources with Active Directory."

Administrative Templates

For both Computer Configuration and User Configuration, the Administrative Templates folder contains all registry-based group policy settings, including settings for Windows Components, System, and Network, as shown in Figure 9.8. Windows Components enables you to administer Windows 2000 components including NetMeeting, Internet Explorer, Windows Explorer, Microsoft Management Console, Task Scheduler, and Windows Installer. You use System to control logon and logoff functions and group policies themselves. Network enables you to control settings for Offline Files and Network And Dial-Up Connections.

Figure 9.8 Administrative Templates

For only Computer Configuration, Administrative Templates contains additional group policy settings for Printers. System Settings contains Disk Quotas as well as Domain Name System (DNS) Client and Windows File Protection.

For only User Configuration, Administrative Templates contains additional registry-based group policy settings, including settings for Start Menu & Taskbar, Desktop, and Control Panel. Start Menu & Taskbar settings control a user's start menu and taskbar, and Desktop settings control the appearance of a user's desktop. Control Panel settings determine the Control Panel tools available to a user.

In Administrative Templates, more than 450 policy settings are available for configuring the user environment. In the registry, computer configurations are saved in HKEY_LOCAL_MACHINE (HKLM) and user configurations are saved in HKEY_CURRENT_USER (HKCU).

You can display Administrative Template settings by clicking the Administrative Templates folder, clicking View, and then clicking Show Policies Only to show all settings, or Show Configured Policies Only to show only those settings that have been configured.

How Group Policy Affects Startup and Logon

The following sequence shows the order in which Computer Configuration and User Configuration settings are applied when a computer starts and a user logs on.

  1. The network starts. The Remote Procedure Call System Service (RPCSS) and Multiple Universal Naming Convention Provider (MUP) services are started.
  2. The computer obtains an ordered list of GPOs. The contents of the list depend on whether the computer is part of a Windows 2000 domain and is therefore subject to group policy through Active Directory service, and the contents depend on the location of the computer in Active Directory service. If the list of GPOs has not changed, no processing is done. You can use a group policy setting to change this behavior.
  3. The system processes the Computer Configuration settings. This task occurs synchronously by default, and in the following order: local GPO, site GPOs, domain GPOs, and OU GPOs. The user interface gives no indication while the computer is processing computer configuration settings. See the next section, "How Group Policy Is Processed," for more details about GPO processing.
  4. Startup scripts run. This process is hidden and synchronous by default; each script must complete or time out before the next one starts. The default time out is 600 seconds (10 minutes). You can use several group policy settings to modify this behavior.
  5. The user presses the Ctrl+Alt+Del key combination to log on.
  6. After the user is authenticated, the computer loads the user profile, governed by the group policy settings in effect.
  7. The computer obtains an ordered list of GPOs for the user. The contents of the list depends on these factors:
    • Whether the user is part of a Windows 2000 domain, and is therefore subject to group policy through Active Directory.
    • Whether loopback is enabled, and the state (Merge or Replace) of the loopback policy setting. (Refer to the section "How Group Policy Is Processed" for more information about loopback.)
    • The location of the user in Active Directory. If the list of GPOs to be applied has not changed, then no processing is done. You can use a group policy setting to change this behavior.
  8. The system processes the User Configuration settings synchronously by default, and in the following order: local GPO, site GPOs, domain GPOs, and OU GPOs. The user interface gives no indication while the computer is processing the user policies.
  9. The computer runs the logon scripts. Unlike Microsoft Windows NT 4.0 scripts, group policy-based logon scripts run hidden and asynchronously by default. The user object script runs last.
  10. The operating system user interface prescribed by the group policies appears.

How Group Policy Is Processed

Group policy settings are processed in the following order:

  1. Local GPO. Each computer running Windows 2000 has exactly one GPO stored locally.
  2. Site GPOs. Any GPOs that have been linked to the site in which the computer is located are processed next. Processing is synchronous; the administrator specifies the order of GPOs linked to a site.
  3. Domain GPOs. If multiple GPOs are linked to a domain, the computer processes them synchronously; the administrator specifies the order of GPOs linked to a domain.
  4. OU GPOs. GPOs linked to the OU highest in the Active Directory hierarchy are processed first, followed by GPOs linked to the next highest level, and so on. Finally, the computer processes the GPOs linked to the OU that contains the user or computer object. One, many, or no GPOs can be linked to OUs at each level of the Active Directory hierarchy. If several group policies are linked to an OU, the computer processes them synchronously in an order specified by the administrator.

This order means that the local GPO is processed first, and the GPOs linked to the OU of which the computer or user is a direct member are processed last, overwriting the earlier GPOs. For example, if you set up a domain GPO to allow anyone to log on interactively, an OU GPO-set up for the domain controller- overrides the domain GPO and prevents everyone from logging on except for certain administrative groups. Figure 9.9 shows the relationship of group policy and Active Directory service.

Figure 9.9 Group policy and Active Directory service

Exceptions to the Processing Order

The default order of processing group policy settings is subject to the following exceptions:

  • Workgroup Membership. A computer that is a member of a workgroup processes only the local GPO.
  • No Override. Any GPO linked to a site, domain, or OU (not the local GPO) can be set to No Override with respect to that site, domain, or OU, so that none of its policy settings can be overridden. When more than one GPO has been set to No Override, the one highest in the Active Directory hierarchy (or higher in the hierarchy specified by the administrator at each fixed level in Active Directory service) takes precedence. No Override is applied to the GPO link.
  • Block Policy Inheritance. At any site, domain, or OU, group policy inheritance can be selectively marked as Block Policy Inheritance. However, GPO links set to No Override are always applied and cannot be blocked. The Block Policy Inheritance setting is applied directly to the site, domain, or OU. It is not applied to GPOs, nor is it applied to GPO links. Thus, Block Policy Inheritance deflects all group policy settings that reach the site, domain, or OU from above (by way of inheritance from parents in the Active Directory hierarchy), no matter which GPOs those settings originate from.
  • Loopback. Loopback is an advanced group policy setting that is useful on computers in certain closely managed environments such as kiosks, laboratories, classrooms, and reception areas. Loopback provides alternatives to the default method of obtaining the ordered list of GPOs whose user configuration settings affect a user. By default, a user's settings come from a GPO list that depends on the user's location in Active Directory service. The ordered list goes from site-linked to domain-linked to OU-linked GPOs, with inheritance determined by the location of the user in Active Directory service and in an order specified by the administrator at each level. Loopback can be set to Not Configured, Enabled, or Disabled, like any other group policy setting. In the Enabled state, Loopback can be set to Merge or Replace mode.
  • Replace. With this setting, the GPO list for the user is replaced in its entirety by the GPO list already obtained for the computer at startup (during step 2 in the section "How Group Policy Affects Startup and Logon"). The computer GPOs replace the user GPOs normally applied to the user.
  • Merge. With this setting, the GPO list is concatenated. The GPO list obtained for the computer at startup (step 2 in "How Group Policy Affects Startup and Logon") is appended to the GPO list obtained for the user at logon (step 7). Because the GPO list obtained for the computer is applied later, it has precedence if it conflicts with settings in the user's list.

Group Policy Inheritance

In general, group policies are passed down from parent to child containers in Active Directory service. If you have assigned a separate group policy to a parent container, that group policy applies to all containers beneath the parent container, including the user and computer objects in the container. However, if you specify a group policy setting for a child container, the child container's group policy settings override the settings inherited from the parent container.

If a parent OU has policy settings that are not configured, the child OU doesn't inherit them. Policy settings that are disabled are inherited as disabled. Also, if a policy is configured for a parent OU, and the same policy is not configured for a child OU, the child inherits the parent's policy setting. If a parent policy and a child policy are compatible, the child inherits the parent policy, and the child's setting is also applied. Policies are inherited as long as they are compatible. For example, if the parent's policy causes a certain folder to be placed on the desktop and the child's setting calls for an additional folder, the user sees both folders.

If a policy configured for a parent OU is incompatible with the same policy configured for a child OU, the child does not inherit the policy setting from the parent. The setting in the child is applied.

Using Security Groups to Filter Group Policy

Because you can link more than one GPO to a site, domain, or OU, you might need to link GPOs associated with other directory objects. By setting the appropriate permissions for security groups, you can filter group policy to influence only the computers and users you specify.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. What is a GPO?
  2. What are the two types of group policy settings and how are they used?
  3. In what order is group policy implemented through the Active Directory structure?
  4. What is the difference between Block Policy Inheritance and No Override?

Lesson Summary

  • Group policies are collections of user and computer configuration settings that can be linked to computers, sites, domains, and OUs to define settings of various components that make up the users' desktop environment.
  • To manage group policies, you use the Microsoft Management Console (MMC) Group Policy snap-in.
  • The two types of group policy settings are computer configuration settings and user configuration settings. Each of these types includes the Software Settings, Windows Settings, and Administrative Templates folders. These folders contain the individual policies that you can apply to a computer or user.
  • When multiple group policy objects are applied to a computer, Windows 2000 applies them in the following order: local GPO, site GPOs, domain GPOs, and finally OU GPOs.
  • By default, Active Directory objects inherit group policy settings from parent containers.


Lesson 2: Implementing Group Policies

Although it is not an easy task, at times network administrators have to modify the group policies in place on the network, and possibly even create new GPOs. This lesson guides you through the process of implementing a group policy object using the Group Policy snap-in. You also learn how to modify existing group policies.

After this lesson, you will be able to

  • Implement a group policy
  • Modify a group policy

Estimated lesson time: 60 minutes

Implementing Group Policies

The tasks that you might have to perform to implement group policies are as follows:

  1. Creating a GPO
  2. Creating a GPO console
  3. Delegating administrative control of a GPO
  4. Specifying group policy settings for a GPO
  5. Disabling unused group policy settings
  6. Indicating GPO processing exceptions
  7. Filtering GPO scope
  8. Linking a GPO to a site, domain, or OU

Creating a GPO

The first step in implementing a group policy is to create a GPO. Recall that a GPO is a collection of group policy settings that you link to a computer or Active Directory object.

To create a GPO, use the following procedure:

  1. Determine the type of Active Directory object for which you want to create a GPO. To create a GPO linked to a domain or an OU, open the Active Directory Users and Computers console. To create a GPO linked to a site object, open the Active Directory Sites and Services console. Both of these consoles are accessible from the Administrative Tools program group on the Start menu.
  2. Right-click the site, domain, or OU object for which you want to create a GPO and, from the pop-up menu, select Properties.
  3. Click the Group Policy tab, as shown in Figure 9.10.

    Figure 9.10 The Group Policy tab in the Properties dialog box of an Active Directory object
  4. Click New and type the name you want to assign to the GPO. By default, the new GPO is linked to the site, domain, or OU that you selected in the Active Directory Users and Computers or Active Directory Sites and Services console when you created the GPO, and its settings apply to that site, domain, or OU.
  5. Click Close to close the Properties dialog box and return to the console.

Creating a GPO Console

After you create a GPO, you can create a custom MMC console containing the Group Policy snap-in and focused on the GPO you just created. After saving the console, you can open it whenever necessary from the Administrative Tools menu.

To create a GPO console, use the following procedure:

  1. From the Start menu, open the Run dialog box.
  2. In the Run dialog box, type mmc in the Open box and click OK.
  3. From the Console menu, choose Add/Remove Snap-In to display the Add/Remove Snap-In dialog box.
  4. Click Add to open the Add Standalone Snap-In dialog box.
  5. In the Available Standalone Snap-Ins list, select Group Policy and click Add to display the Select Group Policy Object dialog box.
  6. Click Browse to open the Browse For A Group Policy Object dialog box.
  7. Click the appropriate tab for the type of object or computer to which the GPO you want to manage is linked, and from the Domains, OUs, And Linked Group Policy Objects list, select the GPO.
  8. Click OK to return to the Select Group Policy Object dialog box.
  9. Click Finish to add the Group Policy snap-in to the Add/Remove Snap-In dialog box.
  10. Click Close to close the Add Standalone Snap-In dialog box.
  11. Click OK to close the Add/Remove Snap-In dialog box.
  12. From the Console menu, choose Save As and in the Save As dialog box, type the GPO name in the File Name box.
  13. Click Save. You can now open the GPO you created directly, without having to go through one of the Active Directory consoles.

Delegating Administrative Control of a GPO

After you create a GPO, you must determine which people in your organization have permission to access and modify the GPO. Table 9.1 shows the default permissions for GPOs.

Table 9.1 Default GPO Permissions

Security Group | Default Permissions
Authenticated Users | Read, Apply Group Policy, Special Permissions
Creator Owner | Special Permissions
Domain Administrators | Read, Write, Create All Child Objects, Delete All Child Objects, Special Permissions
Enterprise Administrators | Read, Write, Create All Child Objects, Delete All Child Objects, Special Permissions
SYSTEM | Read, Write, Create All Child Objects, Delete All Child Objects, Special Permissions

By default, the Default Domain Policy GPO cannot be deleted by any administrator. This caveat prevents the accidental deletion of this GPO, which contains important required settings for the domain.

To delegate administrative control of a GPO, use the following procedure:

  1. Open the Group Policy snap-in for the GPO (using either a custom console like the one you created in the previous section or one of the prebuilt Active Directory consoles).
  2. Right-click the root node of the console and, from the pop-up menu, choose Properties to display the Properties dialog box.
    If you are working with a GPO from a prebuilt console, such as Active Directory Users and Computers, you cannot use the Delegation Of Control Wizard to delegate administrative control of a GPO; the wizard controls only the security of an Active Directory object.
  3. Click the Security tab, as shown in Figure 9.11.

    Figure 9.11 The Security tab of a GPO Properties dialog box
  4. In the Name list, select the security group for which you want to allow or deny administrative access to the GPO. To add a group to the list, click Add and in the Select Users, Computers, Or Groups dialog box, choose a group.
  5. For the entries in the Permissions list, select either the Allow or the Deny check box to modify the permissions for the selected group. To provide administrative control of all aspects of the GPO, set the Read and Write permissions to Allow. A user or administrator who has the Read permission to a GPO but does not have the Write permission cannot use the Group Policy snap-in to view the settings that it contains. All extensions to the Group Policy snap-in require write access to open a GPO.
  6. Click OK to apply the permissions you specified.

Specifying Group Policy Settings for a GPO

After you create a GPO and assign permissions to it, you can proceed to specify the group policy settings.

To specify group policy settings for a GPO, use the following procedure:

  1. Open the Group Policy snap-in for the GPO (using either a custom console like the one you created in the previous section or one of the prebuilt Active Directory consoles).
  2. In the console tree, expand the item that represents the particular policy you want to set. For example, expand User Configuration, then Administrative Templates, and then Control Panel, to reach the Display policies (as shown in Figure 9.12).

    Figure 9.12 The Group Policy snap-in Display policies
  3. In the details pane, double-click the policy that you want to set to display a dialog box like that shown in Figure 9.13.

    Figure 9.13 The Properties dialog box for a typical policy
  4. Select Enabled to apply the policy to the users or computers that are subject to this GPO, and then click OK.

By default, the policies in a GPO are set to the Not Configured option. This setting means that the GPO makes no changes to the registry setting associated with the policy on clients' computers. Selecting the Enabled option causes the GPO to modify the registry setting to perform the task specified in the policy name. In this example, enabling the Hide Screen Saver Tab policy causes the GPO to modify the registry setting so that the Screen Saver tab of the Display tool in Control Panel does not appear.

Selecting Disabled explicitly removes the registry setting performing the task specified in the policy name. In this example, disabling the Hide Screen Saver Tab policy removes the registry settings, causing the Screen Saver tab to be hidden. The only time you need to explicitly disable a policy is to nullify the effect of another GPO that has enabled that same policy. For example, the registry setting associated with the Hide Screen Saver Tab policy normally does not appear in the registry. Therefore, disabling the policy when it has not already been enabled by another GPO just causes the client computer to process that policy needlessly.

Many of the policy settings in a GPO have simple yes or no controls. Enabling or disabling the policy simply switches a feature on or off. Many other policies provide additional controls when you enable them, however. For example, the Properties dialog box for the Screen Saver Executable Name policy (Figure 9.14) contains a text box that is activated when you enable the policy. In this box, type the name of the screen saver that you want the computers to use that are affected by the policy. The other policies in a GPO have a variety of different controls that you use when you enable them.

Figure 9.14 The Properties dialog box of a policy containing additional controls

Disabling Unused Group Policy Settings

If, in the course of creating or modifying a GPO, you end up with nothing but unconfigured policies in the Computer Configuration or User Configuration folder, you can avoid having client computers expend the resources needed to process the policies in that folder by disabling it. This action speeds up the startup and logon processes for the computers affected by the GPO.

To disable the Computer Configuration or User Configuration settings for a GPO, use the following procedure:

  1. Open the Group Policy snap-in for the GPO (using either a custom console like the one you created in the previous section or one of the prebuilt Active Directory consoles).
  2. Right-click the root node of the console and, from the pop-up menu, choose Properties to display the Properties dialog box. (See Figure 9.15.)

    Figure 9.15 The General tab in a Properties dialog box of a GPO
  3. In the General tab, select the Disable Computer Configuration Settings check box or the Disable User Configuration Settings check box to disable the appropriate folder.
  4. Click OK to close the Properties dialog box.

Indicating GPO Processing Exceptions

GPOs are processed according to the Active Directory hierarchy: local GPO, site GPOs, domain GPOs, and OU GPOs. However, you can change the default processing order of group policy settings by modifying the order of GPOs for an object, specifying the Block Policy Inheritance option, specifying the No Override option, or by enabling the Loopback setting.

Modifying the GPO Processing Order

To modify the order in which the GPOs for a particular object are processed, use the following procedure:

  1. Open Active Directory Users and Computers to set the GPO processing order for a domain or OU, or open Active Directory Sites and Services to modify the GPO processing order for a site.
  2. In the console tree, right-click the site, domain, or OU object for which you want to modify the GPO processing order and, from the pop-up menu, choose Properties.
  3. Click the Group Policy tab to display the dialog box shown in Figure 9.16.

    Figure 9.16 Modifying the order of GPOs
  4. In the Group Policy Object Links list, select a GPO and click Up or Down to change its place in the processing sequence.
As noted in the dialog box, the GPOs higher in the list have the highest priority. Consequently, Windows 2000 processes the GPOs from the bottom of the list to the top so that the policy settings of the highest priority GPO are applied last, overwriting the policy values of lower priority GPOs.

Blocking Policy Inheritance

To prevent an Active Directory object from inheriting policy values, use the following procedure:

  1. Open Active Directory Users and Computers to block the policy inheritance for a domain or OU object, or open Active Directory Sites and Services to block the policy inheritance for a site object.
  2. In the console tree, right-click the site, domain, or OU object for which you want to block the inheritance of policies and, from the pop-up menu, select Properties.
  3. Click the Group Policy tab.
  4. Select the Block Policy Inheritance check box to specify that all GPOs linked to parent sites, domains, or OUs should be blocked from linking to this site, domain, or OU. You cannot block GPOs that use the No Override option.
  5. Click OK.

Using the No Override Option

To activate the No Override option for an Active Directory object, use the following procedure:

  1. Open Active Directory Users and Computers to activate the No Override option for a domain or OU object, or open Active Directory Sites and Services to activate the No Override option for a site object.
  2. In the console, right-click the site, domain, or OU object to which the GPO is linked and, from the pop-up menu, choose Properties.
  3. Click the Group Policy tab.
  4. Select the GPO you want to modify and click Options to display the dialog box shown in Figure 9.17.

    Figure 9.17 The Options dialog box for a GPO
  5. Select the No Override check box to prevent other GPOs from overriding the policy settings in this GPO.
  6. Click OK.

Enabling the Loopback Setting

To enable the Loopback setting, use the following procedure:

  1. Open the Group Policy snap-in for the GPO.
  2. In the console tree, expand Computer Configuration, Administrative Templates, System, and then Group Policy, as shown in Figure 9.18.

    Figure 9.18 The Group Policy policies of a GPO
  3. In the details pane, double-click User Group Policy Loopback Processing Mode to display the Properties dialog box shown in Figure 9.19.

    Figure 9.19 The User Group Policy Loopback Processing Mode Properties dialog box
  4. Select Enabled.
  5. Select one of the following modes in the Mode list:
    • Replace. Replaces the GPO list for the user with the GPO list already obtained for the computer at startup
    • Merge. Appends the GPO list obtained for the user at logon with the GPO list already obtained for the computer at startup
  6. Click OK.

Filtering GPO Scope

The policies in a GPO apply only to users who have Read permission for that GPO. You can filter the scope of a GPO by creating security groups and then assigning the Read permission to the selected groups. Thus, you can prevent a policy from applying to a specific group by denying that group Read permission to the GPO.

To filter the scope of a GPO, use the following procedure:

  1. Open the Group Policy snap-in for the GPO.
  2. Right-click the root node of the console and, from the pop-up menu, select Properties.
  3. Click the Security tab and select the security group through which you want to filter this GPO. (Use the Add and Remove buttons to modify the list of groups, if necessary.)
  4. Set the permissions as shown in Table 9.2, and then click OK.

Table 9.2 Permissions for GPO Scopes

Set These Permissions | GPO Scope | Result
 | Members of this security group should have the GPO applied to them. | This GPO applies to members of this security group unless they are members of at least one other security group that has the Apply Group Policy permission set to Deny, the Read permission set to Deny, or both.
 | Members of this security group are exempt from this GPO. | This GPO never applies to members of this security group regardless of the permissions the members have in other security groups.
 | Membership in this security group is irrelevant to whether the GPO should be applied. | This GPO applies to members of this security group only if they have both the Apply Group Policy and Read permissions set to Allow as members of at least one other security group. They also must not have the Apply Group Policy or Read permissions set to Deny as members of any other security group.

Linking a GPO to a Site, Domain, or OU

By default, a new GPO is linked to the site, domain, or OU object that was selected in the MMC when it was created. Therefore, its settings apply to that site, domain, or OU. You can use the Group Policy tab in the Properties dialog box of the site, domain, or OU object to link a GPO to additional sites, domains, or OUs.

To create additional GPO links, use the following procedure:

  1. Open the Active Directory Users and Computers console to link a GPO to a domain or OU object, or open the Active Directory Sites and Services console to link a GPO to a site object.
  2. In the console tree, right-click the site, domain, or OU object to which the GPO should be linked and, from the pop-up menu, choose Properties.
  3. Click the Group Policy tab.
  4. If the GPO already appears in the Group Policy Object Links list, click Cancel. If the GPO does not appear in the Group Policy Object Links list, click Add to display the Add A Group Policy Object Link dialog box (see Figure 9.20).

    Figure 9.20 The Add A Group Policy Object Link dialog box
  5. Click the All tab, select the desired GPO, and then click OK.
  6. Click Close to close the Properties dialog box.

Removing a GPO Link

Removing a GPO link simply unlinks the GPO from the specified site, domain, or OU object. The GPO remains in Active Directory service until it is deleted.

To remove a GPO link, use the following procedure:

  1. Open the Active Directory Users and Computers console to unlink a GPO from a domain or OU object, or open the Active Directory Sites and Services console to unlink a GPO from a site object.
  2. In the console tree, right-click the site, domain, or OU object from which the GPO is to be unlinked and, from the pop-up menu, choose Properties.
  3. Click the Group Policy tab.
  4. Select the GPO that you want to unlink and click Delete.
  5. In the Delete dialog box, select Remove The Link From The List and click OK.
  6. Click Close to close the Properties dialog box.

    The GPO remains in Active Directory service but is no longer linked.

Deleting a GPO

If you delete a GPO, it is removed from Active Directory service, and any sites, domains, or OUs to which it is linked are no longer affected by it. You might want to take the less drastic step of removing the GPO link, which disassociates the GPO from its OU but leaves the GPO intact in Active Directory service.

To delete a GPO, use the following procedure:

  1. Open the Active Directory Users and Computers console to delete a GPO from a domain or OU object, or open the Active Directory Sites and Services console to delete a GPO from a site object.
  2. In the console tree, right-click the site, domain, or OU object from which the GPO is to be deleted and, from the pop-up menu, choose Properties.
  3. Click the Group Policy tab.
  4. Select the GPO that you want to delete and click Delete.
  5. In the Delete dialog box, select Remove The Link And Delete The Group Policy Object Permanently, and click OK.
  6. Click Close to close the Properties dialog box.

    The GPO is removed from Active Directory service.

Employing Group Policy Best Practices

Employing the following practices when planning and deploying group policies can help to minimize the amount of administrative maintenance required later, as well as improve the performance of the client computers using the group policies.

  • Disable unused parts of a GPO. Under the User Configuration or Computer Configuration folder of the console, if a GPO only has settings that are not configured, you can avoid processing those settings by disabling the folder. This action expedites startup and logon for those users and computers subject to the GPO.
  • Use the Block Policy Inheritance and No Override features sparingly. Routine use of these features makes it difficult to troubleshoot group policy.
  • Minimize the number of GPOs associated with users or computers in domains or OUs. The more GPOs applied to a user, the longer it takes to start up and log on.
  • Filter policies based on security group membership. Users who do not have permissions directing that a particular GPO be applied to them can avoid the associated logon delay, because the GPO is not processed for those users.
  • Use the Loopback setting only when necessary: for example, if you need the desktop configuration to be the same regardless of who logs on.
  • Avoid cross-domain GPO assignments. The processing of GPOs slows down the logon and startup processes if the group policies are obtained from another domain.

Exercise 9.1: Implementing a Group Policy

In this exercise, you implement a group policy for your domain. In Procedures 1 through 8, you create a GPO, create a GPO console, delegate administrative control of the GPO, specify group policy settings for the GPO, disable unused group policy settings, indicate a GPO processing exception, filter the scope of the GPO, and link the GPO to an additional OU. Then in Procedure 9, you test the group policy.

Procedure 1: Creating a GPO

To create a GPO at the OU level, complete the following steps:

  1. Log on to the domain as Administrator.
  2. Click Start and from the Administrative Tools program group, select Active Directory Users And Computers.
  3. Right-click the name of your domain and, from the New menu, select OU to open the New Object - Organizational Unit dialog box.
  4. In the Name box, type Dispatch and click OK to create the new OU.
  5. Right-click the Dispatch OU you just created and, from the pop-up menu, choose Properties.
  6. Click the Group Policy tab.
  7. Click New and then type DispatchPolicy as the name of the new GPO.
  8. Click Close.

Procedure 2: Creating a GPO Console

To create a console for the DispatchPolicy GPO, complete the following steps. After saving the console, you can open it whenever necessary from the Administrative Tools menu.

  1. Click Start and then open the Run dialog box.
  2. In the Open box, type mmc and click OK. A new, blank MMC console appears.
  3. From the Console menu, choose Add/Remove Snap-In to display the Add/Remove Snap-In dialog box.
  4. Click Add to display the Add Standalone Snap-In dialog box.
  5. Select Group Policy and click Add to display the Select Group Policy Object tab.
  6. Click Browse to open the Browse For A Group Policy Object dialog box.
  7. Click the All tab, select the DispatchPolicy GPO, and then click OK.
  8. Click Finish and then, in the Add Standalone Snap-In dialog box, click Close.
  9. In the Add/Remove Snap-In dialog box, click OK.
  10. From the Console menu, select Save As to display the Save As dialog box.
  11. In the File Name box, type DispatchPolicy GPO and then click Save. The DispatchPolicy GPO is now available in the Administrative Tools program group.

Procedure 3: Delegating Administrative Control of a GPO

To delegate administrative control for the DispatchPolicy GPO to the Administrators group, complete the following steps:

  1. Open the DispatchPolicy GPO console.
  2. Right-click the root node of the console, DispatchPolicy [computername.domain.com] Policy and, from the pop-up menu, choose Properties to display the Properties dialog box for the GPO.
  3. Click the Security tab. Which security groups already have administrative control of the DispatchPolicy GPO?
  4. Click Add and from the Select Users, Computers, Or Groups dialog box, select the Administrators group.
  5. Click Add. The Administrators group now appears in the Security tab in the Name list.
  6. To provide administrative control of all aspects of the GPO to the Administrators group, select the Allow check boxes for the Read, Write, Create All Child Objects, and Delete All Child Objects permissions.
  7. Click OK to close the Properties dialog box.

Procedure 4: Specifying Group Policy Settings

To specify some group policy settings for the DispatchPolicy GPO, complete the following steps:

  1. Open the DispatchPolicy GPO console.
  2. In the console tree, expand the root node of the console, expand User Configuration, and then expand Administrative Templates.
  3. In the console tree, click Start Menu & Task Bar. What appears in the details pane?
  4. In the details pane, double-click the Remove Search Menu From Start Menu policy. The Remove Search Menu From Start Menu Properties dialog box appears.
  5. Select Enabled and then click OK. How can you tell at a glance that this setting is enabled?
  6. Repeat steps 4 and 5 to enable the Remove Run Menu From Start Menu policy (still under User Configuration).
  7. In the console tree, expand System and click Logon/Logoff. The policies available for this category appear in the details pane.
  8. In the details pane, enable the Disable Lock Computer policy and click OK.

Procedure 5: Disabling Unused Group Policy Settings

To disable the Computer Configuration folder of the console (because this folder contains only policies that are not configured), complete the following steps. This action speeds up the computer startup process for those users subject to the GPO.

  1. Open the DispatchPolicy GPO console.
  2. Right-click the root node of the console and, from the pop-up menu, choose Properties. The DispatchPolicy [computername.domain.com] Policy Properties dialog box appears.
  3. In the General tab, select the Disable Computer Configuration Settings check box. The Confirm Disable message box appears, asking you to confirm that you want to disable the Computer Configuration settings.
  4. Click Yes and then click OK.

Procedure 6: Indicating GPO Processing Exceptions

To set the No Override option to prevent other GPOs from overriding the policies set in the DispatchPolicy GPO, complete the following steps:

  1. From the Administrative Tools program group, open the Active Directory Users and Computers console.
  2. Right-click Dispatch OU and, from the pop-up menu, choose Properties to display the Properties dialog box.
  3. Click the Group Policy tab, select the DispatchPolicy GPO, and then click Options, to display the DispatchPolicy Options dialog box.
  4. Select the No Override check box and click OK.
  5. Click OK to close the Properties dialog box.

Procedure 7: Filtering GPO Scope

To prevent a policy from applying to the Sales security group by denying that group Read permission to the GPO, complete the following steps. You created the Sales group in Exercise 8.2 and added user objects you created in Exercise 7.1 as members.

  1. Open the DispatchPolicy GPO console.
  2. Right-click the root node of the console and, from the pop-up menu, choose Properties to display DispatchPolicy [computername.domain.com]. The Policy Properties dialog box appears.
  3. Click the Security tab. Then click Add and double-click the Sales group you created earlier in the Select Users, Computers, Or Groups dialog box.
  4. Click OK to add the Sales group to the Name list in the Security tab.
  5. For the Sales group, click the Deny check boxes for the Apply Group Policy and Read permissions.
  6. Click OK. The Security message box appears, asking you to confirm that you want to prevent the DispatchPolicy GPO from applying to the Sales group.
  7. Click Yes.

Procedure 8: Linking a GPO

By default, the DispatchPolicy GPO is linked and its settings apply to the Dispatch OU. To link the DispatchPolicy GPO to another OU, complete the following steps:

  1. From the Administrative Tools program group, open the Active Directory Users and Computers console.
  2. Right-click the name of your domain and from the New menu, select OU to open the New Object - Organizational Unit dialog box.
  3. In the Name box, type Security and click OK to create the new OU.
  4. Right-click the Security OU you just created and, from the pop-up menu, choose Properties to display the Properties dialog box.
  5. Click the Group Policy tab and then click Add to display the Add A Group Policy Object Link dialog box.
  6. Click the All tab, select the DispatchPolicy GPO, and then click OK.
  7. Click OK to close the Properties dialog box.

Procedure 9: Testing a GPO

To view the effects of the group policy you created and deployed in the previous procedures, complete the following steps:

  1. Log on to the domain as Administrator.
  2. In the Security OU, create a new user object called Scott Fallon, with the logon name sfallon.
    For more information about creating user objects, see Lesson 1 in Chapter 7, "Managing Active Directory User and Computer Objects."
  3. Log off from the domain.
  4. Log on as sfallon.
  5. Press Ctrl+Alt+Del. The Windows Security dialog box appears. Are you able to lock the workstation? Why?
  6. Click Cancel and then click Start. Does the Search command appear on the Start menu?

    Does the Run command appear on the Start menu?

  7. Log off from the domain.
  8. Log on as Administrator.
  9. Open the Active Directory Users and Computers console and make the Scott Fallon user object a member of the Sales security group.
  10. Log off from the domain.
  11. Log on as sfallon.
  12. Press Ctrl+Alt+Del. Are you able to lock the workstation? Why?
  13. Log off from the domain.
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. What are the tasks for implementing group policy?
  2. How do you prevent an Active Directory object from inheriting group policy settings from its parent container?
  3. How do you filter the scope of a GPO?

Lesson Summary

  • To implement group policies, you must create a GPO and link it to an Active Directory object, such as a site, domain, or OU.
  • By using the Properties dialog box of a GPO, you can also link a GPO to an additional site, domain, or OU object, and you can set permissions enabling other users and groups to manage the GPO, disable unused policy settings, and filter the scope of the GPO.
  • To set group policies, you navigate through the Group Policy snap-in to locate the desired setting, open its Properties dialog box, and select Enable or Disable.
  • You can control the inheritance of group policy settings for each Active Directory object.
  • Disabling unused parts of a GPO reduces the processing burden on each computer receiving the policy.


Lesson 3: Using Security Policies

One of the primary functions of group policies is to implement security policies that protect network resources from unauthorized access. Many of the security-related policies are provided by an MMC extension snap-in called Security Settings, which is installed with the Group Policy snap-in by default. You use the Security Settings snap-in to define security configurations for computers and groups. This lesson introduces the policies found in the Security Settings snap-in.

After this lesson, you will be able to

  • Recognize security configuration settings in a GPO
  • List the types of policies in the Security Settings snap-in
  • Understand the functions of the security policies in the Security Settings snap-in

Estimated lesson time: 10 minutes

When you open the Group Policy snap-in with the focus on a nonlocal GPO, a Security Settings item appears under both the Computer Configuration and User Configuration folders, as shown in Figure 9.21.

Figure 9.21 The Security Settings item in a GPO

In User Configuration, the only function provided by Security Settings is the ability to create a certificate trust list. Most of the security policies that you are likely to implement on an average network are found under Computer Configuration. The security settings that you can apply to computers are broken down into nine areas, as follows:

  • Account Policies
  • Local Policies
  • Event Log
  • Restricted Groups
  • System Services
  • Registry
  • File System
  • Public Key Policies
  • IP Security Policies

The following sections examine these areas further.

Account Policies

The Account Policies area contains the Windows 2000 implementations of familiar account management features that you can use to exercise control over users' passwords and logon procedures. Account Policies are among the most useful of the policies in the Security Settings item. The Account Policies security area is subdivided into three items, which are discussed in the following sections.

Do not configure account policies for OUs that do not contain any computers, because OUs containing only users always receive account policies from the domain.

When setting account policies in Active Directory service, keep in mind that Windows 2000 permits only one domain account policy: the account policy applied to the root domain of the domain tree. The domain account policy becomes the default account policy of any Windows 2000 workstation or server that is a member of the domain. The only exception to this rule is when another account policy is defined for an OU. The account policy settings for the OU affect the local policy on any computers contained in the OU, as is the case with a Domain Controllers OU.

Password Policy

The Password Policy contains the policies that you can use to impose restrictions on users' passwords. Passwords are the single most common security mechanism used on networks, and they can be among the most effective. However, when users are left to their own devices, they tend to be lax in the passwords they select and the care they take in keeping them confidential. The settings in Password Policy enable you to control which passwords users select and how often they change them. These policies are as follows:

  • Enforce Password History. This policy specifies the number of passwords that Windows 2000 should remember for each user. When used in combination with the Maximum Password Age and Minimum Password Age policies, this setting prevents users from continually reusing the same few passwords.
  • Maximum Password Age. This policy specifies the number of days until a password expires. You use this policy to force users to change their passwords at regular intervals.
  • Minimum Password Age. This policy specifies the number of days that a password must remain in effect before the user can change it. This policy prevents users from circumventing the Maximum Password Age policy by changing their passwords and then changing them back again.
  • Minimum Password Length. This policy specifies the smallest number of characters that a password can contain. The longer a password is, the more difficult it is to guess.
  • Passwords Must Meet Complexity Requirements. This policy forces users to choose passwords that contain a mixture of uppercase and lowercase characters, numerals, and symbols, to make them more difficult to guess.
  • Store Passwords Using Reversible Encryption For All Users In The Domain. This policy modifies the encryption algorithm used to store user passwords so that it is possible to decrypt and read them.

Account Lockout Policy

Account Lockout policy enables you to prevent "brute force" penetration of user passwords by locking a user account after a specified number of failed logon attempts. This precaution prevents a potential intruder from repeatedly trying different passwords in the hope of guessing the correct one and gaining access to another user's account. The policies under Account Lockout are as follows:

  • Account Lockout Duration. This policy specifies the amount of time (in minutes) that a user account remains locked after the Account Lockout Threshold has been reached.
  • Account Lockout Threshold. This policy specifies the number of failed logon attempts that can occur before the user account is locked, preventing even a user with the right password from logging on.
  • Reset Account Lockout Counter After. This policy specifies the amount of time (in minutes) before the counter recording the number of failed logon attempts automatically resets to zero.

Kerberos Policy

The Kerberos Policy contains the following policies:

  • Enforce User Logon Restrictions. This policy causes the Kerberos Key Distribution Center (KDC) to validate each request for a session ticket by examining the user rights policy on the target computer to verify that the user has either the Log On Locally right or the Access This Computer From The Network right.
  • Maximum Lifetime For Service Ticket. This policy specifies the amount of time, in minutes, that a session ticket issued by the KDC remains active.
  • Maximum Lifetime For User Ticket. This policy specifies the amount of time, in minutes, that a ticket granting ticket (TGT) issued by the KDC remains active.
  • Maximum Lifetime For User Ticket Renewal. This policy specifies the amount of time, in days, that Windows 2000 can use a repeatedly renewed TGT.
  • Maximum Tolerance For Computer Clock Synchronization. This policy specifies the maximum difference (in minutes) that Kerberos tolerates between the time on a client computer's clock and a server's clocks.

Local Policies

The settings in the Local Policies area pertain to the security settings on the computer used by an application or user. Local policies are based on the computer you are logged on to and the rights you have on that particular computer. This security area contains three items, as discussed in the following sections.

Audit Policy

Auditing is an optional feature that enables you to configure Windows 2000 to maintain a log of particular system activities. The settings in Audit Policy enable you to select the security events that you want to capture to the security log, for later display in Event Viewer. When you enable logging for an event, you can specify whether you want Windows 2000 to maintain a log of successful attempts, failures, or both. The policies in Audit Policy are as follows:

  • Audit Account Logon Events
  • Audit Account Management
  • Audit Directory Service Access
  • Audit Logon Events
  • Audit Object Access
  • Audit Policy Change
  • Audit Privilege Use
  • Audit Process Tracking
  • Audit System Events

User Rights Assignment

User rights are specific tasks that you can grant a user the ability to perform. User Rights Assignment contains policies that grant specific rights to users.

In some operating systems, the term rights is synonymous with the term permissions, referring to specific forms of user access granted to a file system or directory service. In Windows 2000, rights and permissions refer to completely different elements and must not be confused. Windows 2000 rights apply to user accounts, whereas permissions are properties of objects.

The policies in User Rights Assignment are as follows:

  • Access This Computer From The Network. This right enables a user to connect to the computer over the network. By default, this right is granted to the Administrators, Everyone, and Power Users groups.
  • Act As Part Of The Operating System. This right enables a process to authenticate as any user, and therefore gain access to the same resources as any user. Only low-level authentication services should require this right.
  • Add Workstations To Domain. This right enables the user to add a computer to a specific domain. The user specifies the domain through an administrative user interface on the computer being added, creating an object in the Active Directory Computer container. The behavior of this right is duplicated in Windows 2000 by permissions attached to the Computer container or OU.
  • Back Up Files And Directories. This right enables the user to circumvent file and directory permissions to back up the system. Specifically, this right is similar to granting the following permissions on all files and folders on the local computer: Traverse Folder/Execute File, List Folder/Read Data, Read Attributes, Read Extended Attributes, and Read Permissions.
  • Bypass Traverse Checking. This right enables the user to pass through directories to which the user otherwise has no access, while navigating an object path in any Windows file system or in the registry. This right does not enable the user to list the contents of a directory, only to traverse directories.
  • Change The System Time. This right enables the user to set the time on the computer's internal clock.
  • Create A Pagefile. This right enables the user to create and change the size of a pagefile by specifying a paging file size for a given drive in the Performance Options dialog box, accessed from the System tool in Control Panel.
  • Create A Token Object. This right enables a process to create a token that it can then use to access any local resources when the process uses NtCreate-Token() or other token-creation application programming interfaces (APIs). Processes requiring this right should use the LocalSystem account, which already includes this right, rather than using a separate user account with this right specially assigned.
  • Create Permanent Shared Objects. This right enables a process to create a directory object in the Windows 2000 object manager. This right is useful to kernel-mode components that plan to extend the Windows 2000 object name space. Because components running in Kernel mode already have this right assigned to them, it is not necessary to specifically assign this right.
  • Debug Programs. This right enables the user to attach a debugger to any process, providing powerful access to sensitive and critical system operating components.
  • Deny Access To This Computer From The Network. This right prohibits a user or group from connecting to the computer from the network. By default, no one is granted this right.
  • Deny Logon As A Batch Job. This right prohibits a user or group from logging on through a batch-queue facility. By default, no one is granted this right.
  • Deny Logon As A Service. This right prohibits a user or group from logging on as a service. By default, no one is granted this right.
  • Deny Logon Locally. This right prohibits a user or group from logging on locally. By default, no one is granted this right.
  • Enable Computer And User Accounts To Be Trusted For Delegation. This right enables the user to set the Trusted For Delegation setting on a user or computer object. The user or object that is granted this right must have write access to the account control flags on the user or computer object. A server process either running on a computer that is trusted for delegation or run by a user that is trusted for delegation can access resources on another computer. This right uses a client's delegated credentials, as long as the client account does not have the Account Cannot Be Delegated account control flag set. Misuse of this right or of the Trusted For Delegation setting could make the network vulnerable to sophisticated attacks using Trojan horse programs that impersonate incoming clients and use their credentials to gain access to network resources.
  • Force Shutdown From A Remote System. This right enables a user to shut down a computer from a remote location on the network.
  • Generate Security Audits. This right enables a process to make entries in the security log for object access auditing. The process can also generate other security audits.
  • Increase Quotas. This right enables a process with write property access to another process to increase the processor quota assigned to that other process. This right is useful for system tuning but can be abused, as in a denial of service attack.
  • Increase Scheduling Priority. This right enables a process with write property access to another process to increase the execution priority of that other process. A user with this right can change the scheduling priority of a process through the Task Manager user interface.
  • Load And Unload Device Drivers. This right enables a user to install and uninstall Plug and Play device drivers. Device drivers that are not Plug and Play are not affected by this right and can be installed only by administrators. Because device drivers run as trusted (highly privileged) programs, this right could be misused to install hostile programs and give these programs destructive access to resources.
  • Lock Pages In Memory. This right enables a process to keep data in physical memory, preventing the system from paging the data to virtual memory on disk. Exercising this right could significantly affect system performance. This right is obsolete and is therefore never selected.
  • Log On As A Batch Job. This right enables a user to log on using a batch-queue facility. By default, this right is granted to the Administrators group.
  • Log On As A Service. This right enables a security principal to log on as a service, as a way of establishing a security context. The LocalSystem account always retains the right to log on as a service. Any service that runs under a separate account must be granted this right. By default, this right is not granted to anyone.
  • Log On Locally. This right enables a user to log on at the keyboard of the computer. By default, this right is granted to the Administrators, Account Operators, Backup Operators, Print Operators, and Server Operators groups.
  • Manage Auditing And Security Log. This right enables a user to specify object access auditing options for individual resources such as files, Active Directory objects, and registry keys. Object access auditing is not actually performed unless you have enabled it in the computerwide Audit Policy settings under Group Policy or under Group Policy defined in Active Directory service; this right does not grant access to the computerwide audit policy. A user with this right can also view and clear the security log from Event Viewer.
  • Modify Firmware Environment Values. This right enables modification of the system environment variables, either by a user who modifies the System properties or by a process.
  • Profile Single Process. This right enables a user to use Windows 2000 and Windows NT performance-monitoring tools to monitor the performance of nonsystem processes.
  • Profile System Performance. This right enables a user to use Windows 2000 and Windows NT performance-monitoring tools to monitor the performance of system processes.
  • Remove Computer From Docking Station. This right enables a user to undock a computer using the Windows 2000 user interface.
  • Replace A Process Level Token. This right enables a process to replace the default token associated with a process that has been started.
  • Restore Files And Directories. This right enables a user to circumvent file and directory permissions when restoring backed up files and directories, and to set any valid security principal as the owner of an object.
  • Shut Down The System. This right enables a user to shut down the local computer.
  • Synchronize Directory Service Data. This right enables a process to provide directory synchronization services; relevant only on domain controllers. By default, this right is assigned to the Administrator and LocalSystem accounts on domain controllers.
  • Take Ownership Of Files Or Other Objects. This right enables a user to take ownership of any securable object in the system, including Active Directory objects, files and folders, printers, registry keys, processes, and threads.

Security Options

The policies under Security Options (see Figure 9.22) enable or disable security settings for the computer that control elements such as the digital signing of data, Administrator and Guest account names, floppy drive and CD-ROM access, driver installation, and logon prompts.

Figure 9.22 The Security Options policies in a GPO

The policies under Security Options are as follows:

  • Additional restrictions for anonymous connections
  • Allow server operators to schedule tasks (domain controllers only)
  • Allow system to be shut down without having to log on
  • Allowed to eject removable NTFS media
  • Amount of idle time required before disconnecting session
  • Audit the access of global system objects
  • Audit use of Backup and Restore privilege
  • Automatically log off users when logon time expires
  • Automatically log off users when logon time expires (local)
  • Clear virtual memory pagefile when system shuts down
  • Digitally sign client communication (always)
  • Digitally sign client communication (when possible)
  • Digitally sign server communication (always)
  • Digitally sign server communication (when possible)
  • Disable Ctrl+Alt+Del requirement for logon
  • Do not display last user name in logon screen
  • LAN Manager Authentication Level
  • Message text for users attempting to log on
  • Message title for users attempting to log on
  • Number of previous logons to cache
  • Prevent system maintenance of computer account password
  • Prevent users from installing printer drivers
  • Prompt user to change password before expiration
  • Recovery Console: Allow automatic administrative logon
  • Recovery Console: Allow floppy copy and access to drives and folders
  • Rename administrator account
  • Rename guest account
  • Restrict CD-ROM access to locally logged-on user only
  • Restrict floppy access to locally logged-on user only
  • Secure channel: Digitally encrypt or sign secure channel data (always)
  • Secure channel: Digitally encrypt secure channel data (when possible)
  • Secure channel: Digitally sign secure channel data (when possible)
  • Secure channel: Require strong (Windows 2000 or later) session key
  • Send unencrypted password to connect to third-party SMB servers
  • Shut down system immediately if unable to log security audits
  • Smart card removal behavior
  • Strengthen default permissions of global system objects
  • Unsigned driver installation behavior
  • Unsigned nondriver installation behavior

Event Log

The Event Log security area contains a single item, called Settings For Event Logs. These policies define attributes related to the application, security, and system event log, as shown in Figure 9.23.

Figure 9.23 The Event Log policies

The policies define the following settings for each of the three default logs (application, security, and system):

  • Maximum Log Size. This policy specifies the maximum size (in kilobytes) that the log is permitted to reach.
  • Restrict Guest Access To Log. This policy enables only authenticated users to access the log.
  • Retain Log. This policy specifies the amount of time (in days) that events can remain in the log before they are overwritten.
  • Retention Method For Log. This policy enables you to specify whether events in the log should be overwritten individually, by day, or not at all.

An additional policy enables you to configure a computer to shut down when the security audit log is full. You should configure the event log size and log wrapping settings to match your business and security requirements. You might consider implementing these event log settings at the site, domain, or OU level, to take advantage of group policy settings.

Restricted Groups

The Restricted Groups security area provides an important new security feature that acts as a governor for group membership. Restricted Groups automatically provides security memberships for default Windows 2000 groups that have predefined capabilities, such as the Administrators, Power Users, Print Operators, Server Operators, and Domain Admins groups. You can later add any groups that you consider sensitive or privileged to the Restricted Groups security list, and specify the users who should be members of those groups. You can also specify the other groups of which the group you add should be a member.

The purpose of the Restricted Groups area is to prevent users who have been added to a group temporarily from remaining in the group because of neglect.

To use Restricted Groups, use the following procedure:

  1. Open the Group Policy snap-in with the focus on the GPO you want to modify.
  2. Expand the Group Policy tree to display the Restricted Groups security area, as shown in Figure 9.24.

    Figure 9.24 The Restricted Groups security area
  3. Right-click Restricted Groups and, from the pop-up menu, choose New Group to display the Add Group dialog box.
  4. In the Group box, type the name of a group or click Browse to select a group.
  5. Click OK to add the specified group to the Restricted Groups list.
  6. Double-click the group entry you just created to display the Configure Membership dialog box. (See Figure 9.25.)
  7. Click Add to display the Add Member dialog box.
  8. Specify the name of a user object or click Browse to select an object.
  9. Click OK to add the specified member to the restricted group.
  10. Click OK to close the Configure Membership dialog box.
Figure 9.25 The Configure Membership dialog box

The users you add to Restricted Groups are assumed to be the only users authorized to be permanent members of that group. If you add new group members without adding them to this policy, the next time the group policies are applied, those members are removed from the group.

For example, the Power Users group is automatically part of Restricted Groups because it is a default Windows 2000 group. Assume that the Power Users group contains two users: Alice and Bob. Later, Bob adds Charles to the group, using the Active Directory Users and Computers console, to cover for him while he is on vacation. However, no one remembers to remove Charles from the Power Users group when Bob comes back from vacation. In actual deployments, these situations can add up over time, resulting in extra group memberships for various users who should no longer have these privileges. Configuring security through Restricted Groups prevents this situation. Because only Alice and Bob are listed in the Restricted Groups area as members of the Power Users group, Charles is automatically removed from the group the next time the administrator applies group policy settings.

Configuring Restricted Groups ensures that group memberships are enforced as specified. Groups and users not specified in Restricted Groups are removed from the specific group. In addition, the Reverse Membership Configuration option ensures that each restricted group is a member of only those groups specified in the Member Of column. For these reasons, you should use Restricted Groups primarily to configure membership of local groups on workstation or member servers.

System Services

In the System Services area, you can use group policies to configure the security permissions and startup settings for the services running on a computer running Windows 2000. These parameters are the same ones that you can adjust using the Services console. The Security properties for the service determine which user or group objects have permission to read, write, delete, and execute the service.

The startup settings specify whether a service should load automatically when Windows 2000 starts. The options for each service are as follows:

  • Automatic. Starts a service automatically at system start time
  • Manual. Starts a service only if manually started by an authorized user
  • Disabled. Disables a service so it cannot be started

If you choose to set system service startup to Automatic, perform adequate testing to verify that the service can start without user intervention. You should track the system services used on a computer. For performance optimization, set unnecessary or unused services to Manual.

Registry and File System Areas

The Registry and File System areas enable you to use group policies to set access permissions for registry keys and file system elements, such as folders and files. You can edit the Security properties of the registry key or file path to specify which user or group objects have permission to access the key or path, as well as to configure inheritance settings, auditing, and ownership permissions.

Public Key Policies

The Public Key Policies area is used to control and manage public key certificate settings by performing the following tasks:

  • Specify that computers should automatically submit a certificate request to an enterprise certification authority and install the issued certificate.
  • Create and distribute a certificate trust list.
  • Establish common trusted root certification authorities.
  • Add encrypted data recovery agents and change the encrypted data recovery policy settings.

IP Security Policies On Active Directory

Internet Protocol Security (IPsec) is a security architecture for the Internet Protocol (IP) that enables computers to transmit data over a network in encrypted form. Windows 2000 supports IPsec, and using the IP Security Policies On Active Directory area is one way to configure computers on the network to use it. (The other method is by using the Internet Protocol (TCP/IP) Properties dialog box, accessed from the Network And Dial-Up Connections tool in Control Panel.) The three policies in this area enable you to specify which types of TCP/IP traffic should use the following IPsec communication modes:

  • Client (Respond Only). A computer running in this mode supports IPsec communication but never initiates it. The computer can respond to a server requesting the use of IPsec but also communicates normally with other systems that do not request it.
  • Secure Server (Require Security). A computer running in this mode can communicate only with other computers that support IPsec. Requests for unsecured communications are refused.
  • Server (Request Security). A computer running in this mode attempts to initiate all communications using IPsec but can still support unsecured communication if the other computer does not support IPsec.

Refreshing Policies

In some cases, the modifications you make to security policies do not take effect immediately. This is because the security settings are only applied when the group policy is propagated (applied) to your computer. To initiate policy propagation, you can do one of the following:

  • Restart the computer.
  • Wait for automatic policy propagation, which occurs at regular, configurable intervals. By default, policy propagation occurs every eight hours.
  • Use the Secedit.exe program to refresh the security settings comfigured in the GPO.

Secedit.exe is a command line utility included with Windows 2000 that you can use to automatically create and apply templates, analyze system security, and refresh a computer's security settings. To refresh the computer policies or user policies on a computer, use one of the following commands:

Secedit /refreshpolicy machine_policy

Secedit /refreshpolicy user_policy

Exercise 9.2: Understanding Security Policies

Match the policies in the left column with the descriptions in the right column.

Policy Description
  1. Account Lockout Threshold
  2. Restricted Groups
  3. Audit Account Logon Events
  4. Deny Logon Locally
  5. Enforce User Logon Restrictions
  1. Removes group privileges of unauthorized users
  2. Grants a user right
  3. A Kerberos policy
  4. Prevents brute force intrusions
  5. Adds entries to the security log
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. How are user rights different from permissions?
  2. Which of the following security areas in a GPO contains policies that enable a Windows 2000 computer to transmit an application file in encrypted form?
    1. Kerberos Policies
    2. IP Security Policies On Active Directory
    3. System Services
    4. Account Policies
  3. Which of the following policies prevents administrators from having to manually unlock user accounts after repeated failed logon attempts?
    1. Account Lockout Threshold
    2. Reset Account Lockout Counter After
    3. Enforce Password History
    4. Account Lockout Duration

Lesson Summary

  • Group policy objects use a snap-in called Security Settings to provide a large number of security-related policies.
  • Account policies enable you to control user password and logon behavior.
  • Local policies enable you to configure auditing, user rights assignments, and other security options.
  • Restricted Groups is a feature that enables you to enforce membership in user groups.
  • The Registry and File System security areas enable you to control permissions by using group policies.


Lesson 4: Troubleshooting Group Policy Problems

This lesson describes some of the problems you might encounter that relate to group policies. It also describes some best practices you should employ to keep group policy troubleshooting activities to a minimum.

After this lesson, you will be able to

  • Recognize common group policy error messages
  • Distinguish problems related to group policy from problems affecting other services
  • Troubleshoot group policy problems

Estimated lesson time: 10 minutes

Troubleshooting Group Policy

An important part of troubleshooting group policy problems is to consider the dependencies between components. For example, the Software Installation extension relies on Group Policy, and Group Policy relies on the Active Directory service. The Active Directory service relies on proper configuration of network services. When trying to fix problems that appear in one component, it is generally helpful to check whether the components, services, and resources on which it relies are working correctly. The Windows 2000 event logs are useful for tracking down problems caused by this type of hierarchical dependency.

Table 9.3 describes scenarios in which problems exist using the Group Policy snap-in.

Table 9.3 Group Policy Snap-In Problems and Solutions

Symptom: Administrators cannot open a GPO in the Group Policy snap-in, even though they have the Read access permission.

Cause | Solution
An administrator must have both Read and Write permission for the GPO to open in the Group Policy snap-in. | Modify the permissions for the GPO to grant the administrator the Read and Write permissions or add the administrator to a group with the appropriate permissions.

Symptom: When an administrator tries to edit a GPO, the Failed To Open The Group Policy Object message appears.

Cause | Solution
This problem is a networking problem, specifically with the Domain Name System (DNS) configuration. | Make sure DNS server is working properly and that the computer is configured to use the correct DNS server.

Table 9.4 describes scenarios in which group policy settings are not taking effect.

Table 9.4 Group Policy Settings Problems and Solutions

Symptom: Group policies are not being applied to users and computers in a security group that contains those users and computers, even though a GPO is linked to an OU containing that security group.

Cause | Solution
This behavior is correct. Group policy affects only users and computers contained in sites, domains, and OUs. GPOs are not applied to security groups. | Link GPOs only to sites, domains, and OUs. Keep in mind that the location of a security group in Active Directory service is unrelated to whether group policy applies to the users and computers in that security group.

Symptom: Group policy is not affecting users and computers in a site, domain, or OU.

Cause Solution

Group policy settings can be prevented, intentionally or inadvertently, from affecting users and computers in several ways. A GPO can be disabled from affecting users, computers, or both. A GPO also needs to be linked either directly to an OU containing the users and computers or linked to a parent domain or OU so that the group policy settings apply through inheritance. When multiple GPOs apply, they are processed in this order: local, site, domain, and OU. By default, settings applied later take precedence. In addition, group policy can be blocked at the level of any OU or enforced through a No Override setting applied to a particular GPO link. Finally, the user or computer must belong to one or more security groups with the appropriate permissions set.

  • Make sure that the intended policy is not being blocked.
  • Make sure no policy set at a higher level of Active Directory service has been set to No Override.
  • If Block Policy Inheritance and No Override are both used, keep in mind that No Override takes precedence.
  • Verify that the user or computer is not a member of any security group for which the Apply Group Policy permission is set to Deny.
  • Verify that the user or computer is a member of at least one security group for which the Apply Group Policy permission is set to Allow.
  • Verify that the user or computer is a member of at least one security group for which the Read permission is set to Allow.

Symptom: Group policy is not affecting users and computers in an Active Directory container.

Cause | Solution
GPOs cannot be linked to Active Directory containers other than sites, domains, and OUs. | Link a GPO to an OU that is a parent to the Active Directory container. Then, by default, the users and computers in the container receive those settings through inheritance.

Symptom: Group policy is not taking effect on the local computer.

Cause | Symptom
Local policies are the weakest. Any nonlocal GPO can over-write them. | Check to see which GPOs are being applied through Active Directory service and if those GPOs have settings that are in conflict with the local settings.

Table 9.5 describes scenarios in which problems exist with using the Software Installation extension.

Table 9.5 Software Installation Extension Problems and Solutions

Symptom: Published applications do not appear in the Add/Remove Programs tool in Control Panel.

Cause Solution

Several causes are possible:

  • The group policy was not applied or the user does not have any published applications in the GPOs that apply to him or her.
  • Active Directory service cannot be accessed.
  • The user is running a Terminal Server client.

Investigate each possibility:

  • Ensure that the users are located properly in the Active Directory tree and have the appropriate permissions to the GPO.
  • Make sure that the users' computers are properly configured to access Active Directory service.
  • Note that Software Installation is not supported for Terminal Server clients.

Symptom: Document activation of a published application does not cause the application to install.

Cause | Solution
The administrator did not set the Auto-Install option. | Ensure that Auto-Install This Application By File Extension Activation is selected in the Deployment tab of the application's Properties dialog box.

Symptom: The user receives an error message such as The Feature You Are Trying To Install Cannot Be Found In The Source Directory.

Cause Solution

Network or permissions problems exist.

  • Ensure that the network is working correctly.
  • Ensure that the user has the Read and Apply Group Policy permissions for the GPO.
  • Ensure that the user has the Read permission for the Software Distribution Point.
  • Ensure that the user has the Read permission for the application.

Symptom: After removing an application, the shortcuts for the application still appear on the user's desktop.

Cause | Solution
The user has created shortcuts and Windows Installer has no knowledge of them. | The user must remove the shortcuts manually.

Symptom: The user receives an error message such as Another Installation Is Already In Progress.

Cause | Solution
An uninstall of another application might be taking place in the background with no user interface presented to the user, or perhaps the user has inadvertently triggered two installations simultaneously (which is not supported). | The user can try again later.

Symptom: The user opens an already installed application, and Windows Installer starts.

Cause | Solution
An application might be undergoing automatic repair or a user-required feature is being added. | No action is required.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next chapter. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. What are three reasons why the users or computers in a site, domain, or OU to which a GPO is linked might not be receiving the policies in the GPO?
  2. Why is it possible for some members of a security group to receive group policies from a GPO, whereas other members with the same permissions cannot?
  3. What does a Failed To Open The Group Policy Object message indicate?

Lesson Summary

  • When troubleshooting group policy problems, be sure to check on the services that group policies rely on, such as Active Directory service, Domain Name System (DNS), and the Windows 2000 networking components.
  • To open a GPO in the Group Policy snap-in, a user needs both the Read and Write permissions.
  • Security group memberships do not cause group policies to be applied to the users in the group; the user objects must receive the group policies from a site, domain, or OU to which a GPO is linked.
  • Software Installation is not supported by Windows 2000 Terminal Server clients.
  • The No Override option takes precedence over the Block Policy Inheritance option.


Managing Resources with Active Directory Service

About This Chapter

In addition to providing an organizational hierarchy for the users and computers on your network, with Active Directory service you can manage other network resources, such as shared folders, printers, and applications. This chapter explains how to publish resources in Active Directory service so that users can easily locate and access them, and how to use group policies to redirect special folders and install software on client computers.

Before You Begin

To understand this chapter, you should have a basic knowledge of Active Directory service and particularly of group policies, as covered in Chapter 9, "Using Group Policies." To perform the exercises, you must have a computer running Microsoft Windows 2000 connected to an Active Directory network and administrative privileges to Active Directory service so that you can create new objects.


Lesson 1: Publishing Resources in Active Directory Service

Active Directory service is designed to be a repository for information about many different types of network resources, enabling users to locate virtually any person, piece of equipment, or software product. As an administrator, you must be able to provide secure and selective publication of network resources to network users and make it easy for users to find what they need. Active Directory service stores this information for rapid retrieval and integrates Windows 2000 security mechanisms to control access. This lesson explains how to publish shared network resources in Active Directory service.

After this lesson, you will be able to

  • Publish shared folders
  • Publish printers
  • Publish network services

Estimated lesson time: 10 minutes

Some of the resources that can be published in Active Directory service include objects such as users, computers, printers, folders, files, and network services. You can create user and computer objects using tools such as the Active Directory Users and Computers console. In other cases, objects are created automatically. All of these objects have attributes that you can use to supply information that helps users locate the resource that the object represents.

For example, when you create user objects, supplying personal information about the users, such as postal and e-mail addresses, telephone numbers, and company-specific information, such as like departments and job descriptions, makes it possible for users to locate a person by searching for any one of these attributes. Other information about the accounts that can be useful to network users is published automatically. Some attributes are published freely, whereas others, such as those containing account security information, are available only to certain administrative groups.

Publishing Shared Resources

Publishing information about shared resources such as printers, folders, and files makes it easy for users to find these resources on the network. When you install a printer, Windows 2000 automatically creates network printer objects in Active Directory service. To publish information about shared folders and pre-Windows 2000 printers, you can create objects manually using the Active Directory Users And Computers console.

To publish a shared folder, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, select Active Directory Users And Computers.
  2. In the console tree, expand the domain node and locate the container in which you want to create the shared folder object.
  3. Right-click the container and, from the New menu, choose Shared Folder to display the New Object - Shared Folder dialog box, as shown in Figure 10.1.

    Figure 10.1 The New Object - Shared Folder dialog box
  4. In the Name text box, type the name you want to assign to the shared folder object.
  5. In the Network Path text box, use Universal Naming Convention (UNC) notation (\\server\share\) to type the name of the shared folder that you want to publish in Active Directory service.
  6. Click OK. The new shared folder object appears in the directory in the container you selected.
Publishing a folder in Active Directory service does not share it. You must first share the folder in the usual manner, and then you can publish it.

To publish a pre-Windows 2000 printer, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, select Active Directory Users And Computers.
  2. In the console tree, expand the domain node and locate the container in which you want to create the shared printer object.
  3. Right-click the container and, from the New menu, choose Printer.
  4. In the New Object - Printer dialog box, in the Network Path Of The Pre-Windows 2000 Print Share text box, use UNC format to type the name of the shared printer that you want to publish in Active Directory service.
  5. Click OK. The new printer object appears in the directory in the folder you selected.
The pre-Windows 2000 printer must be installed and shared before you can publish it in Active Directory service. To install a pre-Windows 2000 printer, click Start and from the Settings group, select Printers.

Publishing Network Services

You can also publish network-enabled services, such as Certificate Services, in Active Directory service so that administrators can find and administer them using the Active Directory Sites And Services console. By publishing a service, rather than computers or servers, administrators can focus on managing the service regardless of which computer is providing that service or where the computer is located. Additional services or applications can be published in the directory using Active Directory programming interfaces.

The following topics describe some types of service information that might be useful to publish in Active Directory service. You can better understand the qualities that make a service appropriate for publishing by examining how Active Directory service uses services.

Categories of Service Information

Two types of information are frequently published using Active Directory service: binding information and configuration information.

  • Binding information enables clients to connect to services that do not have well-known bindings and that conform to a service-centric model. By publishing the bindings for these kinds of services, Windows 2000 can automatically establish connections with services. Machine-centric services are typically handled on a service-by-service basis and should not be published to the directory.
  • Configuration information can be common across client applications. Publishing this information enables you to distribute current configuration information for these applications to all clients in the domain. Client applications access the configuration information as needed. This feature eases application configuration for users and gives you more control over application behaviors.

Characteristics of Service Information

Service information that you publish to Active Directory service is most effective if it has the following characteristics:

  • Useful to many clients. Avoid publishing information that is useful only to a small set of clients or that is useful only in certain areas of the network. If not widely used, this information wastes network resources, because it is published to every domain controller in the domain.
  • Relatively stable and unchanging. Although exceptions to this rule can occur, generally it makes sense to publish only service information that changes less frequently than two replication intervals. For intrasite replication, the maximum replication period is 15 minutes, and for intersite replication, the maximum replication period is configured in the site link object used for the replication. Object properties that change more frequently create excessive demands on network resources. Property values might be out of date until updates are published, which can take as long as the maximum replication period. Consequently, having properties out of date for that period of time must not create unacceptable conditions. For example, some network services select a valid Transmission Control Protocol (TCP) port for use each time they are started. After selecting the port, the service updates Active Directory service with this information, which is stored as the service connection point. Clients access the service connection point when they want to use the service, but if the new service connection point has not been replicated when the client requests it, the client receives an outdated port, rendering the service temporarily inaccessible.
  • Well-defined, reasonable properties. Information that is of a consistent form is easier for services to use. The information should also be relatively small in size.

Publishing a Service

The following is an example of service publication using Active Directory Sites And Services.

To set security permissions and delegate control of certificate templates, use the following procedure:

  1. Log on to the domain as Administrator.
  2. Click Start and from the Administrative Tools program group, select Active Directory Sites And Services.
  3. In the scope pane, click Active Directory Sites And Services.
  4. From the View menu, select Show Services Node.
  5. In the console tree, expand Active Directory Sites And Services, expand Services, expand Public Key Services, and click Certificate Templates.
  6. In the details pane, for each certificate template for which you want to set security permissions, double-click the certificate template to open a Properties dialog box.
  7. Click the Security tab and set appropriate security permissions for the service.
  8. Click OK to close the Properties dialog box. These changes apply only to certificate templates in the current domain.

Exercise 10.1: Publishing a Shared Folder

In this exercise, you create a shared folder, publish it in Active Directory service, and then access the documents in the shared folder object by browsing the directory.

Procedure 1: Sharing a Folder

To create and share the folder that you later publish in Active Directory service, complete the following steps:

  1. Log on to the domain as Administrator.
  2. Open Windows Explorer and create a folder called Sales Documents on one of your drives.
  3. Right-click the Sales Document folder you just created and, from the pop-up menu, choose Sharing.
  4. Select Share This Folder and in the Share Name text box, type Sales Docs.
  5. Click OK to create the share. Why must you share the folder if you are going to publish it in Active Directory service?
  6. Which permissions are assigned to the newly created share by default? How can you tell?

Procedure 2: Publishing the Shared Folder

To create a new shared folder object in Active Directory service out of the share you just created, complete the following steps:

  1. Open the Active Directory Users and Computers console.
  2. Right-click the Users item and, from the New menu, choose Shared Folder to open the New Object - Shared Folder dialog box.
  3. In the Name text box, type Sales Documents.
  4. In the Network Path text box, type the name of the shared folder you created in Procedure 1. Use UNC notation, in the form \\server\Sales Docs, where server is the name of the computer on which you created the share.
  5. Click OK. What happens?
  6. Double-click the Sales Documents shared folder object you just created to open its Properties dialog box.
  7. Click Keywords to open the Keywords dialog box.
  8. In the box provided, type inventories and click Add.
  9. Click OK to close the Keywords dialog box.
  10. Click OK to close the Properties dialog box.

Procedure 3: Accessing the Published Share

To learn how users can access files by browsing and searching for shared folder objects in Active Directory service, complete the following steps:

  1. Open Windows Explorer and, in the scope pane, expand My Network Places.
  2. Expand the Entire Network item and click Directory.
  3. In the details pane, right-click the object representing your domain and, from the pop-up menu, choose Find to open the Find Users, Contacts, And Groups dialog box.
  4. In the Find drop-down list, select Shared Folders. What happens?
  5. In the Named text box, type Sales and click Find Now. What happens?
  6. Delete the entry you typed in the Named text box and in the Keywords box, type inventory. Then click Find Now. What happens? Why?
  7. Replace the previous entry you typed in the Keywords box with invent, and click Find Now. What happens?
  8. In the Find Shared Folders dialog box, double-click the Sales Documents shared folder object. What happens?
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. What is the purpose of publishing a shared folder in Active Directory service?
  2. Which of the following search strings successfully locates a shared folder object called Marketing Images? (Choose all that apply.)
    1. Market
    2. Marketing
    3. Images
    4. Market Images
  3. When is it necessary to create a printer object in Active Directory service?

Lesson Summary

  • You can create Active Directory objects to represent any shared folder on the network and place them in any container of the directory tree.
  • To publish a shared folder or printer, you create an object representing it in the Active Directory Users and Computers console.
  • Users can access shared folders by searching the directory for its object, based on the object name or on keywords that you supply.
  • Windows 2000 creates printer objects in Active Directory service automatically. However, if your network has printers on pre-Windows 2000 computers, you must create the printer objects in Active Directory service manually.
  • In addition to folders and printers, you can also publish network services in Active Directory.


Lesson 2: Redirecting Folders Using Group Policies

Windows 2000 enables you to redirect the folders containing a user's profile to a location on the network using the Folder Redirection extension in the Group Policy snap-in. This lesson introduces special folder redirection and walks you through the steps for setting up folder redirection using group policies.

After this lesson, you will be able to

  • Redirect special folders based on group membership
  • Redirect special folders for an entire site, domain, or organizational unit (OU)
  • Control \My Pictures redirection

Estimated lesson time: 15 minutes

Redirecting Folders

You use the Folder Redirection extension of the Group Policy snap-in to redirect certain Windows 2000 special folders to alternate locations on the network. Special folders such as \My Documents and \My Pictures are located by default in the \Documents and Settings folder on the workstation's system drive (usually C).

Windows 2000 enables you to redirect the following special folders:

  • \Application Data
  • \Desktop
  • \My Documents
  • \My Pictures
  • \Start Menu

The Folder Redirection extension is located under User Configuration\Windows Settings in the Group Policy snap-in, as shown in Figure 10.2.

Figure 10.2 The Folder Redirection extension in the Group Policy snap-in

Advantages of Redirecting the \My Documents Folder

The following benefits pertain to the redirection of any folder, but redirecting \My Documents can be particularly advantageous because this folder tends to become large over time.

  • Even if users log on to various computers on the network, their documents are always available to them.
  • When using roaming user profiles, only the network path to the \My Documents folder is stored as part of the profile, not the contents of the \My Documents folder itself. As a result, the contents of the folder are not copied back and forth between the client computer and the server each time the user logs on or off. This benefit greatly accelerates the logon and logoff processes when the user has a large amount of data in the \My Documents folder.
  • When users store their data on a shared network server, backing it up can be a part of the routine maintenance of the system. This task is simpler and safer than backing up workstation drives, because it requires no action on the part of the user.
  • The system administrator can use group policies to set disk quotas, limiting the amount of space occupied by users' special folders.
  • You can redirect the user-specific data to a different hard disk on the user's computer from the disk holding the operating system files. This benefit makes the user's data safer if the operating system needs to be reinstalled.

Default Special Folder Locations

The default locations for special folders that have not been redirected depend on the operating system that was in place prior to the installation of Windows 2000. Table 10.1 lists these locations.

Table 10.1 Default Locations for Special Folders

Operating System Location of Special Folders
  • Windows 2000 new installation (no previous operating system)
  • Windows 2000 upgrade of Microsoft Windows 95 with user profiles disabled
  • Microsoft Windows 98 with user profiles disabled

Documents and Settings (on the system drive, such as C:\Documents and Settings)

  • Windows 2000 upgrade of Microsoft Windows NT 4
  • Windows 2000 upgrade of Microsoft Windows NT 3.51

\Profiles (in the system root, such as C:\Winnt\Profiles)

  • Windows 2000 upgrade of Windows 95 with user profiles enabled
  • Windows 98 with user profiles enabled

\Profiles (in the system root; for example, C:\Windows\System\Profiles)

Setting Up Folder Redirection

You can set up the folder redirection in two ways. You can redirect special folders to a location according to security group membership, or you can redirect special folders to one location for everyone in the site, domain, or OU object to which the group policy object is applied. In addition, you can also direct the \My Pictures folder to follow the redirection of the \My Documents folder (that is, to remain as its subfolder whenever \My Documents is redirected, like it does by default).

The default association of the \My Pictures folder following \My Documents is recommended unless you have a specific reason for separating the two. If you separate the two folders, a shortcut takes the place of the \My Pictures folder in \My Documents.

Redirecting Folders Based on Group Membership

To redirect special folders to a location according to security group membership, use the following procedure:

  1. Open a group policy object (GPO) linked to the site, domain, or OU containing the users whose special folders you want to redirect to a network location.
  2. In User Configuration, expand the Windows Settings folder and then double-click Folder Redirection to display the folders you can redirect.
  3. Right-click the folder you want to redirect and, from the pop-up menu, choose Properties to display the Properties dialog box shown in Figure 10.3.

    Figure 10.3 The Target tab of the Properties dialog box
  4. In the Target tab, in the Setting list, select Advanced-Specify Locations For Various User Groups to display the Security Group Membership box.
  5. Click Add to open the Specify Group And Location dialog box, as shown in Figure 10.4.

    Figure 10.4 The Specify Group And Location dialog box
  6. In the Security Group Membership box, click Browse to display the Select Group dialog box.
  7. Select the security group for which you want to redirect the folder, and click OK.
  8. In the Target Folder Location box, click Browse to display the Browse For Folder dialog box.
  9. Select the location where you want to redirect the folder for this security group, and then click OK to close the Browse For Folder dialog box. If you enter a path using a drive letter in this field, the path must be valid on the user's local computer. Enter a full UNC path. If you want each of the users in the specified security group to have his or her own subfolder at this location, you can incorporate the %username% variable into the UNC path, such as \\server\share\%username%. Windows 2000 replaces the %username% variable with the user's logon name.
  10. Click OK to close the Specify Group And Location dialog box. If you want to redirect folders for members of other security groups, repeat steps 5 through 10 until you have entered all of the groups.
  11. In the Properties dialog box for the folder, click the Settings tab, as shown in Figure 10.5, and then set each of the following options. (The default setting is recommended.)

    Figure 10.5 The Settings tab of the Properties dialog box
    • Grant The User Exclusive Rights To [the selected folder]. This option, which is enabled by default, grants the user and the local system Full Control permission over the folder; no one else, not even an administrator, has any rights. This option is enabled by default; if you disable this setting, no changes are made to the permissions on the folder. If administrators need access to this folder, they can take ownership of it. The permissions that apply by default remain in effect.
    • Move The Contents Of [the selected folder] To The New Location. This option, which is enabled by default, causes Windows 2000 to move the contents of the specified folder to the new, redirected location.
  12. Choose one of the following options in the Policy Removal area (the default setting is recommended).
    • Leave The Folder In The New Location When Policy Is Removed. This option, which is enabled by default, causes Windows 2000 to leave the folder in its redirected location, even after the GPO no longer applies.
    • Redirect The Folder Back To The Local Userprofile Location When Policy Is Removed. This option causes the folder to move back to its local user profile location when the GPO no longer applies.
    See "Policy Removal Considerations," later in this chapter, for more information about selecting a policy removal option.
  13. In the My Pictures Preferences box (which is present only in the Properties dialog box for the \My Documents folder), choose one of the following options in the My Pictures Preferences area:
    • Make My Pictures A Subfolder Of My Documents. This option causes Windows 2000 to redirect \My Pictures automatically to a subfolder of \My Documents in its new location.
    • Do Not Specify Administrative Policy For My Pictures. This option removes \My Pictures as a subfolder of \My Documents and lets the user profile determine the location of \My Pictures.
    You can also specify whether you want the \My Pictures folder to follow the \My Documents folder by setting the folder redirection properties for \My Pictures. See the "Configuring \My Pictures Redirection" section for details.
  14. Click OK to close the Properties dialog box.

Redirecting Folders to a Single Location

To redirect special folders to one location for everyone in the site, domain, or OU, use the following procedure:

  1. Open a GPO linked to the site, domain, or OU containing the users whose special folders you want to redirect to a network location.
  2. In User Configuration, expand the Windows Settings node, and then double-click the Folder Redirection node to display the folders you can redirect.
  3. Right-click the folder you want to redirect and, from the pop-up menu, select Properties to display the Properties dialog box.
  4. In the Target tab in the Setting list, select Basic - Redirect Everyone's Folder To The Same Location, and then click Browse.
  5. In the Browse For Folder dialog box, select the redirect location you want to use for this GPO. If you enter a path using a drive letter in this field, the path must be valid on the user's local computer. Enter a full UNC path. If you want each of the users in the specified security group to have his or her own folder at this location, incorporate the %username% variable into the UNC path, such as \\server\share\%username%. Windows 2000 replaces the %username% variable with the user's logon name.
  6. Click OK to close the Browse For Folder dialog box.
  7. Click the Settings tab in the Properties dialog box for the folder, and then set each of the following options. (The default setting is recommended.)
    • Grant The User Exclusive Rights To [the selected folder]. This option, which is enabled by default, grants the user and the local system Full Control permission over the folder; no one else, not even an administrator, has any rights. This option is enabled by default; if you disable this setting, no changes are made to the permissions on the folder. The permissions that apply by default remain in effect.
    • Move The Contents Of [the user's current special folder] To The New Location. This option, which is enabled by default, causes Windows 2000 to move the contents of the specified folder to the new, redirected location.
  8. Select one of the following options in the Policy Removal area. (The default setting is recommended.)
    • Leave The Folder In The New Location When Policy Is Removed. This option, which is enabled by default, causes Windows 2000 to leave the folder in its redirected location, even after the GPO no longer applies.
    • Redirect The Folder Back To The Local Userprofile Location When Policy Is Removed. This option causes the folder to move back to its local user profile location when the GPO no longer applies.
    See "Policy Removal Considerations," later in this chapter, for more information about selecting a policy removal option.
  9. In the My Pictures Preferences box (which is present only in the Properties dialog box of the \My Documents folder), choose one of the following options in the My Pictures Preferences area:
    • Make My Pictures A Subfolder Of My Documents. This option causes Windows 2000 to redirect \My Pictures automatically to a subfolder of \My Documents in its new location.
    • Do Not Specify Administrative Policy For My Pictures. This option removes \My Pictures as a subfolder of \My Documents and lets the user profile determine the location of \My Pictures.
    You can also specify whether you want the \My Pictures folder to follow the \My Documents folder by setting the folder redirection properties for \My Pictures. See the next section for details.
  10. Click OK.

Configuring \My Pictures Redirection

To direct the \My Pictures folder to follow the redirection of the \My Documents folder, use the following procedure:

  1. Open a GPO linked to the site, domain, or OU containing the users whose \My Pictures folders you want to redirect.
  2. In User Configuration, expand the Windows Settings node, and, then double-click the Folder Redirection node.
  3. Right-click the \My Pictures folder (located beneath \My Documents) and, from the pop-up menu, choose Properties to display the Properties dialog box.
  4. In the Setting list, select Follow The My Documents Folder.
  5. Click OK.

Policy Removal Considerations

Table 10.2 summarizes what happens to redirected folders and their contents when the GPO no longer applies.

Table 10.2 Policy Removal Considerations

When the Move The Contents Of [the selected folder] To The New Location Setting Is And the Policy Removal Option Is The Results, When Policy Is Removed, Are

Enabled

Redirect The Folder Back To The User Profile Location When Policy Is Removed

  • The special folder returns to its user profile location.
  • The contents are copied, not moved, back to the user profile location.
  • The contents are not deleted from the redirected location.
  • The user continues to have access to the contents, but only on the local computer.

Disabled

Redirect The Folder Back To The User Profile Location When Policy Is Removed

  • The special folder returns to its user profile location.
  • The contents are not copied or moved to the user profile location.
If the contents of a folder are not copied to the user profile location, the user can no longer see them.

Either enabled or disabled

Leave The Folder In The New Location When Policy Is Removed

  • The special folder remains at its redirected location.
  • The contents remain at the redirected location.
  • The user continues to have access to the contents at the redirected folder.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Which folders can be redirected?
  2. What is the default behavior of the \My Pictures folder when you redirect the \My Documents folder?
  3. What are two benefits of redirecting users' personal folders to network shares?

Lesson Summary

  • Folder redirection is a feature of group policies that enables you to store the contents of users' selected directories on network drives.
  • When used in combination with roaming user profiles, folder redirection eliminates the need for the computer to copy the contents of the \My Documents folder during each logon and logoff.
  • You can redirect users' folders based on group membership or redirect the folders for all of the users in a site, domain, or OU to the same location.
  • You can configure the \My Pictures folder to be redirected as a subordinate of \My Documents, or redirect it to its own location.
  • Redirected folders can remain in place or be moved back to their original locations when you disable a policy, depending on the configuration options you choose.


Lesson 3: Deploying Applications Using Group Policies

The Software Installation extension snap-in, a software management feature of Windows 2000, is the administrator's primary tool for managing software within an organization. Managing software with the Software Installation extension snap-in provides your users with immediate access to the software they need to perform their jobs and ensures that they have an easy and consistent experience when working with software throughout its life cycle. Users no longer need to search for a network share; use a CD-ROM; or install, fix, and upgrade software themselves. This lesson walks you through the steps for deploying software using Software Installation.

After this lesson, you will be able to

  • Deploy software using group policy
  • Configure deployment options
  • Maintain software using group policy

Estimated lesson time: 75 minutes

Three tools are provided with Microsoft Windows 2000 Server for software installation and maintenance. Table 10.3 describes these tools.

Table 10.3 Windows 2000 Software Installation and Maintenance Tools

Tool | Role
The Software Installation extension of the Group Policy snap-in | Used by administrators to manage software
Windows Installer | Used by the users and the system to install software packaged in Windows Installer files
Add/Remove Programs in Control Panel | Employed by users to manage software on their own computers

The Software Installation Extension Snap-in

The Windows 2000 Software Installation extension snap-in is the primary tool for managing software within an organization. The Software Installation extension snap-in works in conjunction with Group Policy and Active Directory service, establishing a group policy-based software management system that enables you to centrally manage the initial deployment of software, as well as mandatory and nonmandatory upgrades, patches, and quick fixes. You can update a version of the software, replace it, or remove it, and even upgrade the operating system using service packs.

Using Software Installation, you can centrally manage the installation of software on a client computer in two ways: by assigning applications to users or computers or by publishing applications for users. You assign required or mandatory software to users or to computers, and you publish software that users might find useful to perform their jobs.

Assigning Applications

When you assign an application to users, the application is advertised to the users the next time they log on to a workstation. The application advertisement follows the user regardless of which physical computer he or she actually uses. Windows 2000 installs the advertised application the first time the user activates it on the computer, either by selecting the application on the Start menu or by loading a document associated with the application.

When you assign an application to the computer, the advertisement and the installation happen only when conditions are safe for them to occur. Typically, the advertisement and installation occur when the computer starts up so that no competing processes are running on the computer.

Publishing Applications

When you publish an application to users, the application does not appear to be installed on the users' computers, like with an assigned application. No shortcuts are visible on the desktop or the Start menu, and no changes are made to the local registry on the computers. Instead, the published applications store their advertisement attributes in Active Directory service. Then information such as the name and file associations of the application is exposed to the users in an Active Directory container. The application is then available for the user to install using Add/Remove Programs in Control Panel or by clicking a file associated with the application (such as an .xls file for Microsoft Excel).

Installing published applications requires a greater understanding of the network on the part of its users than assigning them. However, publishing applications in this way is a good method for providing users with a collection of software tools that they can install at will, without the participation of an administrator.

How Software Installation Works

The Software Installation extension snap-in uses Windows Installer technology to package, assign, and publish software. Windows Installer is a service that enables the operating system to manage the software installation process. Windows Installer is composed of three key parts:

  • An operating system service that performs the installation, modification, and removal of the software in accordance with the information in the Windows Installer package
  • The Windows Installer package, a database containing information that describes the installed state of the application
  • An application programming interface (API) that enables applications to interact with Windows Installer to install or remove additional features of the application after the initial installation is complete

Because the Software Installation extension snap-in relies on Windows Installer, users can take advantage of self-repairing applications. Windows Installer notes when a program file is missing and immediately reinstalls the damaged or missing files, thereby returning the application to its original state.

Understanding Windows Installer Package Files

The Windows Installer package is a file with an .msi extension that contains explicit instructions about the installation and removal of specific applications. The developer who produces the application provides the Windows Installer package file and ships it with the application. If a Windows Installer package does not come with an application, you might need to create a Windows Installer package or repackage the application using a third-party tool.

You can deploy software using the Software Installation extension snap-in only if the file type fits one of the following categories:

  • Native Windows Installer package (.msi) files are developed as a part of the application and designed to take full advantage of the Windows Installer.
  • Repackaged application (.msi) files enable you to deploy applications that do not have a native Windows Installer package, in much the same way that you repackage software today to customize installations.
  • An existing setup program-a down-level application package (.zap) file-installs an application by using its original Setup.exe program. A .zap file is an ASCII text file that contains information such as the path to the application's installation program, the description of the application that appears in the Add/Remove Programs tool in Control Panel, and the file extensions that should trigger the automatic installation of the application.

In addition, you can make modifications to customize the installation of a Windows Installer package at the time of assignment or publication. Modifications are saved as separate files with an .mst extension. Other files you might encounter during software installation are patch (.msp) files, which are used for bug fixes, service packs, and similar files, and application assignment scripts (.aas files), which contain instructions associated with the assignment or publication of a package.

Customizing Windows Installer Packages

You can customize Windows Installer applications by using modifications,also called transforms. The Windows Installer package format provides for customization by enabling you to "transform" the original package using authoring and repackaging tools. Some applications also provide wizards or templates that permit a user to create modifications.

For example, Microsoft Office 2000 supplies a Customization Wizard that builds modifications. Using the Customization Wizard, you can create a modification that enables you to manage the configuration of Office 2000 that is deployed to users. A modification might be designed to accommodate Microsoft Word as a key feature, installing it during the first installation. Less popular features, such as revision support or document translators, could install on first use, and other features, such as clip art, might not install at all. You might have another modification that provides all of the features of Word and does not install Microsoft PowerPoint. The exact mix of which features to install and when to install them varies based on the audience for the application and how they use the software.

Implementing Software Installation

The tasks for installing software using group policies are as follows:

  1. Planning and preparing a software installation
  2. Setting up a software distribution point
  3. Specifying software installation defaults
  4. Deploying software applications
  5. Setting automatic installation options
  6. Setting up application categories
  7. Setting software application properties
  8. Maintaining software applications

The following sections examine these tasks.

Planning and Preparing a Software Installation

When planning a software installation, you should begin by reviewing your organization's software requirements and comparing them to your Active Directory organizational structure and your available GPOs. With this information, you can determine how you want to deploy your applications. Then create a test environment to determine exactly how you want to assign or publish software to your users or computers. Prepare your software using a format that enables you to manage it based on your organization's requirements, and test all of the Windows Installer packages or repackaged software extensively.

Consider some of the following basic strategies for software deployment using group policies:

  • Create OUs based on software management needs. This strategy enables you to target applications to the appropriate set of users. Group policy security settings are not required to target the appropriate set of users.
  • Deploy software close to the root of your Active Directory domain. Deploying software higher in the domain makes it easier to provide all users in an organization with access to an application. This strategy reduces administration because you can deploy the package in a single GPO rather than having to recreate the object in multiple containers deeper in the Active Directory tree.
  • Deploy multiple applications with a single GPO. This practice reduces administration overhead by enabling you to create and manage a single GPO rather than multiple GPOs. Also, the logon process is faster because a single GPO deploying 10 applications processes faster than 10 GPOs each deploying one application. This strategy is appropriate in organizations where users share the same core set of applications.
  • Publish or assign applications only once to a given group of users or computers. Deploying the same application in multiple configurations is sometimes necessary to support different types of users. However, you should avoid deploying multiple copies of the same application in such a way that users are forced to decide which version they need. Instead, adjust your deployment strategy wherever possible so that each configuration is delivered only to the users and computers that need it.
  • Specify application categories for your organization. Using categories makes it easier for users to find an application in Add/Remove Programs in Control Panel. For example, you could define categories such as Sales Applications, Accounting Applications, and so on.
  • Make sure Windows Installer packages include the modifications you publish or assign them. Remember that modifications are applied to packages at the time of assignment or publication. In practical terms, you should make sure the Modifications tab of the package Properties dialog box is set up like you intend before you click OK. If you neglect to perform this task and assign or publish a modified package before you have completely configured it, you can either remove the software and republish or reassign it, or upgrade the software with a completely modified version.
  • Take advantage of authoring tools. Developers familiar with the files, registry entries, and other requirements for an application to work properly can author native Windows Installer packages using tools available from various software vendors.
  • Repackage existing software. You can use commercially available tools to create Windows Installer packages for software that does not include natively authored .msi files. These tools work by comparing a computer's state before and after installation. For best results, install on a computer free of other application software (clean install).
  • Use Microsoft Systems Management Server (SMS) and the Windows 2000 distributed file system (Dfs). SMS and Dfs are helpful in managing the software distribution points, the network shares from which users install their managed software.
  • Use Software Installation properties for widely scoped control. This practice spares administrative keystrokes when assigning or publishing a large number of packages with similar properties in a single GPO-for example, when all the software is published and it all comes from the same software distribution point.
  • Use Windows Installer package properties for fine control. Use the package properties for assigning or publishing a single package.
You must have the appropriate software licenses for applications written by independent software vendors that you distribute using group policies. It is your responsibility to match the number of users who can access and use the software to the number of licenses you have on hand. It is also your responsibility to verify that you are working within the license agreement included by each independent software vendor.

Setting Up a Software Distribution Point

A software distribution point is located on a shared network drive where Software Installation packages are stored so that they are always available to the users and computers on the network. After you have planned your software distribution strategy and obtained or created your software packages, the next step is to copy the software to one or more software distribution points.

To set up a software distribution point, use the following procedure:

  1. On the file server, create the folders for the software that function as the software distribution point and share them with the network. Create a separate share for each application or create a single share with multiple folders for different applications.
  2. Copy all of the software distribution components, including the software packages, modifications, and all other necessary files, to the software distribution point. Be sure to place all of the software for each application (or each version of each application, if you are deploying multiple configurations) in a separate folder on the software distribution point.
  3. Set the appropriate permissions (using either share or NT file system [NTFS] permissions) on the software distribution point folders so that only administrators have Read and Write access to the files. Users need only the Read permission.
Some software supports special commands to facilitate the creation of a software distribution point. For example, you should prepare Office 2000 by running setup/a from a command prompt. This step enables you to enter the product key once for all users and specify the network share location to which you want to copy the files. Other software products might have other ways to expand compressed files from the distribution media and transfer the files to the appropriate location.

Specifying Software Installation Defaults

A GPO can contain several settings that affect how an application is installed, managed, and removed. You can globally define the default settings for the new packages within the GPO in the General tab of the Software Installation Properties dialog box. You can then change some of these settings later by editing the package properties in the Software Installation extension snap-in.

To specify the software installation defaults, use the following procedure:

  1. Open the Group Policy snap-in. Then, in either Computer Configuration or User Configuration, open Software Settings.
  2. Right-click the Software Installation node, and, from the pop-up menu, choose Properties to display the Software Installation Properties dialog box as shown in Figure 10.6.

    Figure 10.6 The General tab of the Software Installation Properties dialog box
  3. In the General tab in the Default Package Location text box, type the path to the default software distribution point for packages (.msi files), or click Browse to select a location.
  4. In the New Packages box, select one of the following.
    • Display The Deploy Software Dialog Box. This option indicates that you want the Group Policy snap-in to display a dialog box whenever you add a new package, enabling you to assign, publish, or configure package properties.
    • Publish. This option specifies that when you add a new package, you want it published with standard package properties by default. Packages can be published only to users, not computers. If this installation is under the Computer Configuration node of the Group Policy snap-in, the Publish option is shaded, indicating that it is not available.
    • Assign. This option specifies that when you add a new package, you want it assigned with standard package properties by default. Packages can be assigned to both users and computers.
    • Advanced Published Or Assigned. This option indicates that when you add a new package, you want the Configure Package Properties form to appear.
  5. In the Installation User Interface Options box, select one of the following:
    • Basic. This option provides only a simplified display of the install process to users. This option is usually preferable in the case of software assignments that users do not need to monitor or understand.
    • Maximum. This option causes Windows 2000 to display all installation messages and screens during the package installation. This option is preferable in testing situations and when users opt to install specific packages and might want to monitor the progress of the installation.
  6. Select the Uninstall The Applications When They Fall Out Of The Scope Of Management check box to specify that the packages should be removed when the GPO no longer applies to users or computers.
  7. Click OK.

Deploying Software Applications

Given that software can be either assigned or published and targeted to users or computers, you must select the proper deployment strategy for your network and its users. Table 10.4 contains some of the basic questions you might ask regarding group policy software installations as well as the answers for the various types of deployments.

Table 10.4 Software Deployment Options

Question | Publish (User Only) | Assign (User) | Assign (Computer)
After the deployment, when is the software available for installation? | After the next logon | After the next logon | It is available the next time the computer starts.
How does the user install the software? | By using Add/Remove Programs in Control Panel | By accessing the application from the Start menu or a desktop shortcut | The software is already installed automatically when the computer reboots; no action from the user is required.
If the software is not installed and the user opens a file associated with the software, does the software install? | Yes (if autoinstall is turned on) | Yes | Not applicable; the software is already installed.
Can the user remove the software using Add/Remove Programs in Control Panel? | Yes, and the user can choose to install it again from Add/Remove Programs in Control Panel | Yes, and the software is available for installation again from the typical install points | No. Only the local administrator can remove the software; a user can run a repair on the software.
Which types of installation files are supported? | Windows Installer packages, .zap files | Windows Installer packages | Windows Installer packages are supported.
Modifications, or .mst files, are customizations applied to Windows Installer packages. A modification must be applied at the time of assignment or publication, not at the time of installation.

Assigning Applications

You assign an application when you want all of your users to have the application installed on their computers. An application can be published to both computers and users.

To assign an application, use the following procedure:

  1. Open the Group Policy snap-in. Then in either Computer Configuration or User Configuration, open Software Settings.
  2. Right-click the Software Installation node and from the New menu, choose Package. In the Open dialog box, the File Name list shows the Windows Installer packages located at the software distribution point you specified as the default. If the Windows Installer package you want is located on a different network share, you can browse to find the software distribution point for the package.
  3. In the Open dialog box in the File Name list, select the Windows Installer package to be assigned, and then click Open to display the Deploy Software dialog box shown in Figure 10.7.

    Figure 10.7 The Deploy Software dialog box
  4. Select Assigned and then click OK. If you are deploying the application under the Computer Configuration node of the Group Policy snap-in, the Published option is unavailable, because you can only assign packages to computers, not publish them.

Publishing Applications

You publish an application when you want it to be available to people managed by the GPO, should they want it. With published applications, each person is responsible for deciding whether to install the software. You can only publish applications to users.

To publish an application, use the following procedure:

  1. Open the Group Policy snap-in. Then in User Configuration, open Software Settings.
  2. Right-click the Software Installation node and from the New menu, select Package. In the Open dialog box, the File Name list shows the packages located at the software distribution point you specified as the default. If the Windows Installer package you want is located on a different network share, browse to find the software distribution point for the package.
  3. In the Open dialog box, in the File Name list, select the Windows Installer package to be assigned, and then click Open to display the Deploy Software dialog box.
  4. Click Published and then click OK. The application is now available for users to install either by using Add/Remove Programs in Control Panel or by opening a file with a filename extension that you have associated with the application.

Deploying Applications with Modifications

You associate modifications with a Windows Installer package at deployment rather than when the Windows Installer is actually using the package to install or modify the application. Modifications (.mst files) are applied to Windows Installer packages (which have the .msi extension) in an order specified by the administrator. You must determine this order before the application is assigned or published.

To add or remove modifications for applications, use the following procedure:

  1. Open the Group Policy snap-in. Then in either Computer Configuration or User Configuration, open Software Settings.
  2. Right-click the Software Installation node and from the New menu, choose Package.
  3. In the Open dialog box, in the File Name list, select the Windows Installer package to be assigned, and then click Open to display the Deploy Software dialog box.
  4. Select Advanced Published Or Assigned and then click OK.
  5. In the Properties dialog box for the package, click the Modifications tab, shown in Figure 10.8.

    Figure 10.8 The Modifications tab of the Properties dialog box
    • To add modifications, click Add. In the Open dialog box, browse to find the modification file (.mst) and then click Open. You can add multiple modifications to a single package.
    • To remove modifications, select the modification you want to remove and click Remove. Repeat until you have removed each unwanted modification.
    • To set the order of modifications, select a modification and then click Move Up or Move Down. Modifications are applied according to the order specified in the list.
  6. Make sure that the modifications are configured exactly the way you want them, and then click OK.
Do not click OK until you have finished configuring the modifications. When you click OK, the package is assigned or published immediately. If the modifications are not properly configured, you must uninstall the package or upgrade the package with a correctly configured version.

Setting Automatic Installation Options

To determine which application users install when they load a data file, you can select a file extension and configure a priority for installing applications associated with it, using the File Extensions tab in the Software Installation Properties dialog box. The first application listed is the application installed in association with the file extension.

For example, if you use a GPO to deploy both Word 2000 and Microsoft FrontPage 2000, both of these applications can edit Hypertext Markup Language (HTML) documents, files with the .htm extension. To configure the file extension priority so that users who are managed by this GPO always install FrontPage, set FrontPage as the application with the highest priority for the .htm extension.

Users who are managed by this GPO and who have installed neither Word 2000 nor FrontPage 2000 receive an .htm file (by e-mail or other means). When they double-click the .htm file, the GPO installs FrontPage 2000, and FrontPage 2000 opens the .htm file for editing. Without the GPO, the user would see the Open With dialog box and would be asked to select the best alternative from the software already present on his or her computer.

You manage file extension associations on a per GPO basis. Changing the priority order in a GPO affects only those users who have that GPO applied to them.

To set automatic installation options based on filename extension, use the following procedure:

  1. Open the Group Policy snap-in. Then in either Computer Configuration or User Configuration, open Software Settings.
  2. Right-click the Software Installation node and, from the pop-up menu, choose Properties to display the Software Installation Properties dialog box shown in Figure 10.9.

    Figure 10.9 The File Extensions tab of the Software Installation Properties dialog box
  3. In the File Extensions tab, from the Select File Extension drop-down list, select the file extension for which you want to specify an automatic software installation.
  4. In the Application Precedence list box, move the application with the highest precedence by default to the top of the list using Up or Down. Windows 2000 automatically installs the application at the top of the list if a document with the selected filename extension is invoked before the application has been installed.
  5. Click OK.

Setting Up Application Categories

You can organize assigned and published applications into logical categories to make it easier for users to locate the appropriate application from within the Add/Remove Programs tool in Control Panel. Windows 2000 does not ship with any predefined categories. The categories that you establish are per domain, not per GPO. You need to define them only once for the whole domain.

To set up categories for applications to be managed, use the following procedure:

  1. Open the Group Policy snap-in. Then in either Computer Configuration or User Configuration, open Software Settings.
  2. Right-click the Software Installation node and from the pop-up menu, choose Properties to display the Software Installation Properties dialog box shown in Figure 10.10.

    Figure 10.10 The Categories tab of the Software Installation Properties dialog box
  3. In the Categories tab, click Add to display the Enter New Category dialog box.
  4. In the Category box, type the name of the application category, and click OK to close the Enter New Category dialog box.
  5. Click OK.

Setting Software Application Properties

You can fine-tune each application by editing its installation options, specifying the application categories it should use, and setting permissions for the software installation.

Editing Installation Options for Applications

Although you may have globally defined the default settings for new packages within the GPO in the General tab of the Software Installation Properties dialog box, you can change some of these same settings later by editing the package properties. Installation options affect how an application is installed, managed, and removed.

To edit installation options for applications, use the following procedure:

  1. Open the Group Policy snap-in. Then in either Computer Configuration or User Configuration, open Software Settings.
  2. Click the Software Installation node.
  3. In the details pane, right-click the application for which you want to edit the installation options and, from the pop-up menu, choose Properties to display the Properties dialog box.
  4. Click the Deployment tab in the Properties dialog box for the application as shown inFigure 10.11 and select one of the following in the Deployment Type are:
    • Select Published to enable users in the selected site, domain, or OU to install the application using either Add/Remove Programs in Control Panel or by invoking the application installation by file activation.
    • Select Assigned to enable users in the selected site, domain, or OU to receive the application the next time they log on (for assignment to users) or when the computer restarts (for assignment to computers).
    Figure 10.11 The Deployment tab in the Properties dialog box of an application
  5. In the Deployment Options box, select one of the following:
    • Select the Auto-Install This Application By File Extension Activation check box to use the application precedence for the filename extension as determined in the File Extensions tab of the Software Installation Properties dialog box. If the application is under the Computer Configuration node of the Group Policy snap-in, the check box is unavailable but selected, because by default, the application is installed automatically.
    • Select the Uninstall This Application When It Falls Out Of The Scope Of Management check box to remove the application at logon (for users) or startup (for computers) if they move to a site, domain, or OU for which the application is not deployed in a GPO.
    • Select the Do Not Display This Package In The Add/Remove Programs Control Panel check box to specify that this package should not be displayed in Add/Remove Programs in Control Panel.
  6. In the Installation User Interface Options box, select one of the following:
    • Select Basic to provide only a basic display to users during the installation process.
    • Select Maximum to display all installation messages and screens to users during the package installation.
  7. Click Advanced to display the Advanced Deployment Options dialog box. In the Advanced Deployment Options box, select either of the following check boxes:
    • Select the Ignore Language When Deploying This Package check box to specify whether to deploy the package even if it is in a different language.
    • Select the Remove Previous Installs Of This Product From (Users/Computers) If Product Was Not Installed By Group Policy-Based Software Installation check box to specify whether to remove previous installs of this product from users or computers if the product was not installed by group policy-based software installation.
  8. Click OK to close the Advanced Deployment Options dialog box.
  9. Click OK.

Specifying Application Categories

You associate applications with categories in Add/Remove Programs in Control Panel to control how they appear on the user's computer. The categories pertain only to published applications, because assigned applications do not appear in Add/Remove Programs.

To specify application categories for Add/Remove Programs in Control Panel, use the following procedure:

  1. Open the Group Policy snap-in. Then in either Computer Configuration or User Configuration, open Software Settings.
  2. Click the Software Installation node.
  3. In the details pane, right-click the application for which you want to specify application categories and, from the pop-up menu, choose Properties to display the Properties dialog box.
  4. In the Categories tab shown in Figure 10.12, choose the category you want to specify from the Available Categories list, and then click Select.

    Figure 10.12 The Categories tab in the Properties dialog box of an application
  5. Repeat Step 4 to specify additional categories. Click OK when you're finished.

Setting Permissions for Software Installation

Permissions set for software installations pertain only to the installation of the application, not its execution.

To set permissions for software installations, use the following procedure:

  1. Open the Group Policy snap-in. Then in either Computer Configuration or User Configuration, open Software Settings.
  2. Click the Software Installation node.
  3. In the details pane, right-click the application for which you want to specify software installation permissions and, from the pop-up menu, choose Properties to display the Properties dialog box.
  4. In the Properties dialog box of the application in the Security tab, click the security group for which you want to set permissions. Administrators who manage the application installation should have the Full Control permission set to Allow. Users who use the software assigned or published by the application should have the Read permission set to Allow.
  5. Click OK.

Maintaining Software Applications

After the deployment of software applications, it might be necessary to upgrade or remove them at some point in the software life cycle.

Upgrading Applications

Several events in the life cycle of the software can trigger an upgrade, including the release of a new version or a decision by your organization to switch to a different application. Upgrades typically involve major changes to the software and normally have new version numbers. Usually, an application upgrade contains a substantial number of changed files. You can use the Software Installation extension snap-in to establish the procedure for upgrading an existing application to the current release.

To upgrade applications, use the following procedure.

This procedure assumes that you have already assigned or published the upgrade as a separate package.
  1. Open the Group Policy snap-in. Then in either Computer Configuration or User Configuration, open Software Settings.
  2. Click the Software Installation node.
  3. In the details pane, right-click the Windows Installer package that functions as the upgrade (not the package to be upgraded) and, from the pop-up menu, choose Properties to display the Properties dialog box.
  4. Click the Upgrades tab and then click Add to open the Add Upgrade Package dialog box shown in Figure 10.13. Use this dialog box to create or add to the list of packages that are to be upgraded by the current package.

    Figure 10.13 The Add Upgrade Package dialog box
  5. Select either Current Group Policy Object (GPO) or A Specific GPO as the source of the package to be upgraded. In the latter case, click Browse and select the GPO you want, and then click OK.

    A list of all the other packages assigned to be published within the selected GPO appears under Package To Upgrade. Depending on the GPO, this list might have zero or more entries.

  6. Click the package to upgrade and select either Uninstall The Existing Package, Then Install The Upgrade Package, or Package Can Upgrade Over The Existing Package. Then click OK to close the Add Upgrade Package dialog box.

    Typically, the uninstall option is for replacing an application with a completely different one (perhaps from a different vendor). The upgrade option is for installing a newer version of the same product, retaining the user's application preferences, document type associations, and so on.

  7. In the Upgrades tab in the Properties dialog box, select the Required Upgrade For Existing Packages check box if you want the upgrade to be mandatory, and then click OK. If this is an upgrade under the Computer Configuration node of the Group Policy snap-in, the check box is unavailable but selected, because packages can only be assigned to computers, not published.

Removing Applications

At some point, users might no longer require an application, so you might need to remove it. The removal choices you set within the Software Installation extension snap-in enable you to address the following two scenarios:

  • A version of a software application is no longer supported. Administrators can remove the software version from the Software Installation node without forcing the (physical) removal of the software from the computers of users who are still using the software. Users can continue to use the software until they remove it themselves. No user can install the software version (from the Start menu, from Add/Remove Programs in Control Panel, or by document invocation).
  • A software application is no longer used. Administrators can force the removal of the software. The software is automatically deleted from a computer, either the next time the computer is turned on (when the software is assigned to the computer) or the next time the user logs on (when the software is assigned to the user). Users cannot install or run the software.
When you originally deploy the software, if you want the application to be removed when a GPO no longer applies, select the Uninstall This Application When It Falls Out Of The Scope Of Management option.

To remove applications, use the following procedure:

  1. Open the Group Policy snap-in. Then, in either Computer Configuration or User Configuration, open Software Settings.
  2. Click the Software Installation node.
  3. In the details pane, right-click the application you want to remove and from the All Tasks menu, choose Remove to display the Remove Software dialog box.
  4. In the Remove Software Dialog box, select one of the following removal options:
    • Immediately Uninstall The Software From Users And Computers. Choose this option to specify that the application be removed the next time a user logs on or restarts the computer.
    • Allow Users To Continue To Use The Software But Prevent New Installations. Choose this option to specify that users can continue to use the application if they have already installed it. If they remove the application or have never installed it, they cannot install it.
  5. Click OK.

Exercise 10.2: Deploying a Service Pack with Group Policies

In this exercise, you use group policies to deploy a Windows 2000 service pack to all of the computers in a domain. To ensure that every computer receives the update, assign the software package to the computers in the domain, causing the installation to occur the next time each computer is restarted.

Procedure 1: Creating the Software Distribution Point

To copy the installation files for the service pack to a server drive and create a share out of the folder, complete the following steps:

  1. Obtain the latest Windows 2000 service pack, either by download or CD-ROM, and copy it to a folder on a server drive.
  2. If you downloaded the service pack in archive form, you must extract the files from the archive by opening a command prompt window and executing the archive file with the /x parameter, as in the following example:
    W2ksp2 /x
  3. Open Windows Explorer and locate the server directory where the service pack files are located.
  4. Right-click the directory and, from the pop-up menu, choose Sharing to display the Sharing tab of the Properties dialog box.
  5. Select Share This Folder.
  6. In the Share Name text box, type Service Pack.
  7. Click Permissions to open the Permissions dialog box. What are the default permissions for the share?
  8. Remove the Full Control and Change permissions from the Everyone group by clearing the corresponding Allow check boxes and clicking OK. What is the purpose of doing this?
  9. In the Properties dialog box, click OK to create the new share.

Procedure 2: Creating the Software Package

To create a software package using the Update.msi file supplied with the service pack and assign it to your domain, complete the following steps:

  1. From the Administrative Tools program group, open the Active Directory Users and Computers console.
  2. Right-click your domain object and, from the pop-up menu, choose Properties to display the Properties dialog box.
  3. Click the Group Policy tab, select the GPO you want to edit, and click Edit to open the Group Policy snap-in window.
  4. Expand the Software Settings node under Computer Configuration.
  5. Right-click the Software Installation node and, from the New menu, choose Package.
  6. In the Open dialog box, browse to the service pack share you created earlier and select \Update folder.
  7. Select the Update.msi file and click Open.
  8. In the Deploy Software dialog box, select Assigned. Why is the Published option unavailable?
  9. Click OK to create the software package.
  10. In the details pane of the Group Policy snap-in, right-click the new package you created and, from the pop-up menu, select Properties to open the Properties dialog box.
  11. Click the Deployment tab. What are the default settings on this tab, and what do they mean?
  12. Click the Security tab. Which permissions are granted to the network users?
  13. Click OK to close the Properties dialog box.
  14. Close the Group Policy window and click OK to close the domain's Properties dialog box.

Procedure 3: Testing the Group Policy

To verify that the group policy modification you've made has taken effect, complete the following steps:

  1. Restart a workstation in the domain for which you created the new software package. What do you see during the boot process?
  2. Press Ctrl+Alt+Del and log on to the workstation.
  3. Right-click the My Computer object on the desktop to display the System Properties dialog box. What does the system information in the General tab say?
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next chapter. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. What is the difference between assigning software and publishing software?
  2. When you create an assigned application package in the Computer Configuration node of a GPO, which of the following methods can users employ to install the application?
    1. Use the Add/Remove Programs tool in Control Panel.
    2. Double-click a file with an extension associated with the application.
    3. Log on to the domain.
    4. Restart the computer.
  3. What is the effect of selecting Maximum in the Deployment tab of the Properties dialog box for an application package?

Lesson Summary

  • The Software Installation extension snap-in of the Group Policy snap-in enables you to deploy applications to the users and computers on your network without having to travel to each computer or distribute installation disks.
  • Administrators deploy applications using group policies by supplying users and computers with Windows Installer package files, which can be supplied by the application's manufacturer or created by a third-party utility.
  • Depending on how you configure the software packages, you add applications to a group policy object (GPO) that the client can install automatically when the computer starts or the user logs on, or that users can manually install either by using Add/Remove Programs in Control Panel or by selecting a data file associated with the application.
  • When you disable the installation of a particular software package in a GPO, you can configure group policies to leave the software in place on the computers where it is already installed or to remove it.
  • The permissions you set in the Software Installation snap-in pertain only to the installation of the software, not its subsequent execution.


Replicating Active Directory

About This Chapter

Active Directory service uses objects called sites and subnets to configure a replication topology for enterprise networks that use wide area network (WAN) links to connect remote locations. This chapter introduces you to the process of creating sites and configuring intersite replication, as well as providing troubleshooting information for problems you might encounter that relate to intersite replication.

Before You Begin

To understand this chapter, you should have a basic knowledge of Active Directory service and the creation of Active Directory objects. To perform the exercises, you must have a computer running Microsoft Windows 2000 connected to an Active Directory network and administrative privileges to Active Directory service so that you can create new objects.


Lesson 1: Creating Sites and Subnets

Replication is one of the most important functions of Active Directory service. Active Directory service must have multiple domain controllers for fault tolerance and load balancing, and it is essential that each of the domain controllers has an identical copy of the Active Directory database. Whenever administrators make changes to the information in Active Directory, the domain controller on which the changes were made replicates the information to all of the other domain controllers.

In most cases, the replication process is automatic and self-adjusting, but in other cases, you have to create the Active Directory objects needed to manually configure replication procedures. This lesson walks you through the steps for configuring site settings, including creating a site, associating a subnet with a site, connecting a site using site links, and selecting a site license server.

After this lesson, you will be able to

  • Create site and subnet objects
  • Configure site settings
  • Join sites with links

Estimated lesson time: 20 minutes

Configuring Site Settings

To configure site settings, you must complete the following tasks:

  1. Create a new site object.
  2. Associate a subnet with the site.
  3. Connect the sites using site links.

Creating a Site Object

In Active Directory service, a site is a set of servers that are well connected in terms of speed and cost. In nearly all cases, well connected means that the servers are connected using a local area network (LAN) protocol such as Ethernet or Token Ring. Domain controllers on the same site replicate on the basis of notification. When a domain controller has changes, it notifies its replication partners. The notified partners then request the changes and replication occurs. Because LAN protocols run at relatively high speeds and the equipment is wholly owned by the organization running the network, replication speed or cost is less of a concern. Therefore, replication within sites occurs as needed rather than as scheduled.

By default, all of the domain controllers on an Active Directory network are part of a single site, which is created by default when you create the first domain. You create additional sites in Active Directory service when you have domain controllers communicating over links that are relatively slow or costly. The typical scenario for the use of multiple sites is a large corporate network with LANs in several cities, joined by WAN links.

WAN technologies are typically slower than even the slowest LAN, and they usually involve an outside service provider that computes its charges based on the amount of bandwidth the network uses. Because of the need to regulate the amount of traffic that passes over the WAN links, Active Directory service replication between sites occurs according to a schedule; you use the schedule to determine the most beneficial time for replication on the basis of network traffic and cost.

When you install Active Directory service on the first domain controller on your network, Windows 2000 creates a site object named Default-First-Site-Name in the Sites container. The first domain controller is always installed on this site (after which you can rename the site object as needed). When you install Active Directory service on subsequent servers, if alternate sites have been defined in Active Directory service and the Internet Protocol (IP) address of the installation computer matches an existing subnet in a defined site, the domain controller is added to that site. Otherwise, it is added to the site of the source domain controller.

Unlike most Active Directory objects, sites and the other objects involved in the replication process do not appear in the Active Directory Users and Computers console. You use a separate utility, called the Active Directory Sites and Services console (shown in Figure 11.1) to manage these objects, although they are part of the same Active Directory database as user and computer objects.

Figure 11.1 The Active Directory Sites and Services console

To create a new site object, use the following procedure:

  1. Click Start and, from the Administrative Tools group, open the Active Directory Sites And Services console.
  2. Right-click the Sites folder and, from the pop-up menu, choose New Site to display the New Object - Site dialog box as shown in Figure 11.2.

    Figure 11.2 The New Object - Site dialog box
  3. In the Name text box, type the name of the new site object.
  4. From the Link Name list, select a site link object, and click OK.

    The console displays an Active Directory message box providing instructions for the rest of the site configuration process.

  5. Click OK to close the Active Directory message box.

On an internetwork that uses multiple sites, rename the Default-First-Site-Name object to make it conform to your network naming conventions.

To rename a site object, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Active Directory Sites And Services console.
  2. Click the Sites folder.
  3. Right-click the site you want to rename and, from the pop-up menu, choose Rename.
  4. Type the new site name over the existing site name. Click in an empty part of the console tree.

Associating a Subnet Object with a Site

Computers on Active Directory networks based on Transmission Control Protocol/Internet Protocol (TCP/IP) are assigned to sites based on their location in a subnet or a set of subnets. Subnets group computers in a way that identifies their physical proximity on the network. A site is one or more IP subnets. You specify the subnets associated with each site on your network by creating subnet objects in the Active Directory Sites and Services console. Computers on the network use subnet information to find a domain controller in the same site so that authentication traffic does not cross over WAN links. Active Directory service also uses subnets during the replication process to determine the best routes between domain controllers.

To create a subnet object, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Active Directory Sites And Services console.
  2. Expand the Sites folder.
  3. Right-click the Subnets folder and, from the pop-up menu, choose New Subnet to display the New Object - Subnet dialog box, shown in Figure 11.3.

    Figure 11.3 The New Object - Subnet dialog box
  4. In the Address text box, enter the subnet address. In the Mask text box, enter the subnet mask that describes the range of addresses included in this site's subnet. Choose the site to which the subnet is to be associated, and then click OK.

To associate an existing subnet object with a particular site, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Active Directory Sites And Services console.
  2. Click the Subnets folder, right-click the subnet you want to work with and, from the pop-up menu, choose Properties to open the Properties dialog box, shown in Figure 11.4.

    Figure 11.4 The Properties dialog box for a subnet
  3. From the choices available in the Site list, select a site with which to associate this subnet, and click OK.

Creating Site Links

For replication to occur between two sites, you must establish a link between the sites. This link refers not only to the physical link (usually a WAN connection), but also an Active Directory site link object. The site link is the object you configure with the parameters that dictate when replication between the connected sites should occur. Site link objects are not generated automatically; you must create them in the Active Directory Sites and Services console. Unless a site link is in place, connections cannot be established between the computers in the two sites, and replication between them cannot take place. Each site link contains the schedule that determines when replication can occur between the sites that it connects. The Active Directory Sites and Services console guarantees that every site is associated with at least one site link.

You can use a single site link object to connect more than one pair of sites, in which case all the sites are considered equally well connected. For example, if your network consists of three or more sites and all of them are connected using the same type of WAN technology, you can create a single site link object and use it throughout the network. If you have sites that are connected with various WAN technologies that run at different speeds, you should create a separate site link object for each type of WAN connection.

When you install Active Directory service on the first domain controller in the site, the Active Directory Installation Wizard automatically creates a site link object named DEFAULTIPSITELINK in the IP container. It is necessary to create this site link for the first default site, which is also created by the Active Directory Installation Wizard. You must create any additional site link objects you need yourself. After the installation of your first domain controller is complete, you can rename the DEFAULTIPSITELINK object to whatever name you want to use for the site link.

Replication Protocols

Active Directory site link objects can use one of two protocols to establish the connections between sites: IP or Simple Mail Transfer Protocol (SMTP).

  • IP replication uses remote procedure calls (RPCs) for replication over site links (intersite) and within a site (intrasite). By default, intersite IP replication adheres to replication schedules, although you can configure Active Directory service to ignore schedules.
  • SMTP replication is used only for replication over site links (intersite), and not for replication within a site (intrasite). Because SMTP is asynchronous, it typically ignores all schedules.
If you choose to use SMTP over site links, you must complete the process of installing and configuring a certification authority (CA). The CA signs SMTP messages that are exchanged between domain controllers, ensuring the authenticity of directory updates.

Creating Site Link Objects

When you expand the Sites container in the Active Directory Sites And Services console, the Inter-Site Transports folder appears, and beneath that, two folders called IP and SMTP under the Sites folder, as shown in Figure 11.5. Create site link objects under the folder for the protocol that you want the link to use.

Figure 11.5 The Inter-Site Transports folder in the Active Directory Sites And Services console

To create a site link object, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Active Directory Sites And Services console.
  2. Expand the Inter-Site Transports folder and right-click either the IP or SMTP folder, depending on which protocol you want the site to use. From the pop-up menu, choose New Site Link to display the New Object - Site Link dialog box, as shown in Figure 11.6.

    Figure 11.6 The New Object - Site Link dialog box
  3. In the Name text box, type the name of the new site link object.
  4. From the Sites Not In This Site Link box, select two or more sites to connect, and click Add.
  5. Click OK to create the new site link object.

To associate a site with an existing site link object, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Active Directory Sites And Services console.
  2. Expand the Inter-Site Transports folder and either the IP or SMTP folder, and right-click the site link object to which you want to add the site. From the pop-up menu, choose Properties to display the Properties dialog box shown in Figure 11.7.

    Figure 11.7 The Properties dialog box for a site link object
  3. In the General tab, in the Sites Not In This Site Link list, select the site you want to add to the site link. Then click Add.
  4. Click OK.

Exercise 11.1: Linking Sites

In this exercise, you add a new site to your test network and link it to the existing site by creating and configuring the appropriate Active Directory objects.

Procedure 1: Renaming a Site

To rename the Default-First-Site-Name object to conform to the site's location, complete the following steps:

  1. Click Start, point to Programs, point to Administrative Tools, and then select Active Directory Sites And Services. The Active Directory Sites And Services console appears.
  2. Click the Sites folder. Which objects appear in the details pane?
  3. Right-click the Default-First-Site-Name site and, from the pop-up menu, choose Rename.
  4. Type the new site name, Redmond, over Default-First-Site-Name. Click in an empty part of the console tree. The Default-First-Site-Name site has been renamed Redmond.

Procedure 2: Creating a Site Object

To create a second site object on your network, complete the following steps:

  1. Right-click the Sites folder and, from the pop-up menu, choose New Site to display the New Object - Site dialog box.
  2. In the Name text box, type Chicago.
  3. Select DEFAULTIPSITELINK for the site link of the Chicago site.
  4. Click OK.

    The Active Directory message box appears, reminding you to finish configuring the Chicago site. To do so, you must do the following:

    • Ensure that the site is linked to other sites with site links as appropriate.
    • Add subnets for the site to the Subnets folder.
    • Install one or more domain controllers in the site or move existing domain controllers into the site.
    • Select the licensing for the site.
  5. Click OK to close the message box.

Procedure 3: Creating a Subnet Object

To create the subnet object associated with the Chicago site, complete the following steps:

  1. Double-click the Sites folder.
  2. Right-click the Subnets folder and, from the pop-up menu, choose New Subnet to display the New Object - Subnet dialog box.
  3. In the Address text box, type 10.10.1.1.
  4. In the Mask text box, type 255.0.0.0.
  5. Choose the Chicago site to associate to this subnet.
  6. Click OK to create the 10.0.0.0/8 subnet object and associate it to the Chicago site.

Procedure 4: Creating a Site Link Object

To create a new site link object and use it to connect your network's two sites, complete the following steps:

  1. Open the Inter-Site Transports folder and click the IP folder. Which object appears in the details pane?
  2. Right-click the IP folder and, from the pop-up menu, choose New Site Link to display the New Object - Site Link dialog box.
  3. In the Name text box, type Redmond to Chicago.
  4. Ensure that the Chicago and Redmond sites are in the Sites In This Site Link list, and then click OK.
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Which tasks must you complete to configure a site?
  2. Which two site configuration objects does the Active Directory Installation Wizard create automatically?
  3. Which replication protocol uses RPCs for replication over site links (intersite) and within a site (intrasite)?

Lesson Summary

  • A site object represents a group of well-connected computers that can exchange Active Directory replication traffic without regard to speed or cost.
  • Well-connected computers are typically connected by a LAN technology, such as Ethernet or Token Ring.
  • Subnet objects are used to identify the computers that belong in a specific site.
  • Site link objects represent a connection between sites of a given speed or cost.
  • You must link sites together with site link objects for Active Directory service to replicate its information across the whole network.


Lesson 2: Configuring Intersite Replication

The WAN technologies that connect your sites together are represented in Active Directory service by site link objects. By creating site links and configuring the parameters that specify the cost, replication frequency, and replication availability of the link, you provide Active Directory service with information about how to use these connections to replicate directory data. You can improve site link connectivity by joining overlapping site links together into site link bridges, or you can bridge all of the site links and maximize connectivity. You can also configure a server, known as a bridgehead server, to function as a contact point for the exchange of directory information between sites. This lesson explains how to configure intersite replication.

After this lesson, you will be able to

  • Configure the replication properties of a site link object
  • Create a site link bridge object
  • Create a bridgehead server

Estimated lesson time: 25 minutes

Configuring Intersite Replication

To configure intersite replication, you must complete the following tasks:

  • Create site links (as described in Lesson 1).
  • Configure site link attributes.
  • Create site link bridges.
  • Configure connection objects (optional).
  • Designate a preferred bridgehead server (optional).

Configuring Site Link Attributes

You should provide site link cost, replication frequency, and replication availability information for all site links as part of the process of configuring intersite replication.

Site Link Cost

Configure the site link cost to assign a value indicating the relative cost of each available connection used for intersite replication. If you have multiple redundant network connections, create a site link object for each connection, and then assign costs to the site links that reflect their relative bandwidth. The term cost in this case does not refer to the actual monetary cost of the connection, but is instead a measurement of the priority you want to assign to each site link object.

For example, if your network uses a high-speed T-1 line to connect two sites, and also a dial-up network connection as a backup in case the T-1 line is unavailable, you would specify a lower cost for the T-1 line and a higher cost for the dial-up network connection (even though the T-1 is more expensive to run than the dial-up). Active Directory service always chooses the connection on a per cost basis, using the connection with the lowest cost, as long as it is available.

To configure the cost of a site link object, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Active Directory Sites And Services console.
  2. Expand the Inter-Site Transports folder and either the IP or SMTP folder.
  3. Right-click the site link object for which you want to configure the cost and, from the pop-up menu, choose Properties to open the Properties dialog box shown in Figure 11.8.

    Figure 11.8 The Properties dialog box for a site link object
  4. In the Cost text box, enter a value for the cost of replication.

    The default cost is 100; the lower the value, the higher the priority allotted to the link. For example, the cost of a T-1 link might be 100, whereas the cost of a dial-up link might be 120.

    The cost values that you assign to your site link objects have no direct correlation to Active Directory performance; only the relationship between the cost values for the various site link objects is significant. For example, assigning the values 100 and 120 to two site link objects is functionally no different from assigning them the values 10 and 12. Only that one link has a higher cost than the other is important.
  5. Click OK.

Replication Frequency

You configure the replication frequency for site links by providing an integer value that specifies how many minutes Active Directory service should wait before using a connection to check for replication updates. The replication interval must be at least 15 minutes and no more than 10,080 minutes (equal to one week). A site link must be available for any replication to occur, so if a site link is scheduled as unavailable when the interval between replication updates elapses, no replication occurs.

To configure the replication frequency for a site link object, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Active Directory Sites And Services console.
  2. Expand the Inter-Site Transports folder and either the IP or SMTP folder.
  3. Right-click the site link object for which you want to configure the replication frequency and, from the pop-up menu, choose Properties.
  4. In the Replicate Every text box, enter the desired number of minutes between replications. The default value is 180; the value is processed as the nearest multiple of 15, ranging from a minimum of 15 to a maximum of 10,080 minutes (one week).
  5. Click OK.

Replication Availability

You configure site link replication availability to specify when a site link should be available for replication. Because the SMTP protocol is asynchronous, it typically ignores all schedules. Therefore, do not configure site link replication availability on SMTP site links unless one or more of the following conditions applies:

  • The site link uses scheduled connections.
  • The SMTP queue is not on a schedule.
  • Information is being exchanged directly from one server to another and not through intermediaries, as is the case, for example, on a network backbone.

To configure site link replication availability, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Active Directory Sites And Services console.
  2. Expand the Inter-Site Transports folder and either the IP or SMTP folder.
  3. Right-click the site link object for which you want to configure site link replication availability and, from the pop-up menu, choose Properties to display the Properties dialog box.
  4. Click Change Schedule to display the Schedule For dialog box, as shown in Figure 11.9.

    Figure 11.9 The Schedule For dialog box for a site link object
  5. Create a schedule specifying when you want replication to occur by selecting blocks of time and selecting Replication Not Available.

    By default, replication can occur at any time, so creating a schedule is a matter of selecting the times at which you don't want replication to occur.

  6. Click OK to close the Schedule For dialog box.
  7. Click OK to close the Properties dialog box.

This procedure has no effect if you have enabled Ignore Schedules in the Properties dialog box for the intersite transport protocol folder.

To ignore schedules for an intersite transport, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Active Directory Sites And Services console.
  2. Expand the Inter-Site Transports folder.
  3. Right-click either the IP or SMTP folder and, from the pop-up menu, choose Properties to open the Properties dialog box, as shown in Figure 11.10.

    Figure 11.10 The Properties dialog box for an intersite transport protocol folder
  4. Select the Ignore Schedules check box.
  5. Click OK.

Creating Site Link Bridges

By default, when more than two sites are linked for replication and they all use the same transport, the site links are bridged in terms of cost, assuming the site links have common sites. When site links are bridged, they are transitive. That is, all site links for a specific transport implicitly belong to a single site link bridge for that transport. In the common case of a fully routed IP network (in which all of the sites can communicate with each other using IP), you do not have to configure any site link bridges.

If your IP network is not fully routed, you can turn off the transitive site link feature for the IP transport, in which case all IP site links are considered intransitive and you configure site link bridges. A site link bridge is the equivalent of a disjointed network; all site links within the bridge can route transitively, but they do not route outside the bridge.

To create a site link bridge, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Active Directory Sites And Services console.
  2. Expand the Inter-Site Transports folder.
  3. Right-click either the IP or SMTP folder and, from the pop-up menu, choose New Site Link Bridge to open the New Object - Site Link Bridge dialog box, as shown in Figure 11.11.

    Figure 11.11 The New Object - Site Link Bridge dialog box
  4. In the Name text box, type a name for the site link bridge.
  5. Click two or more sites to connect, and then click Add.
  6. Click OK to create the site link bridge object.

This procedure is redundant and has no effect if you have enabled Bridge All Site Links in the Properties dialog box for the intersite transport protocol.

To bridge all site links for an intersite transport, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Active Directory Sites And Services console.
  2. Expand the Inter-Site Transports folder.
  3. Right-click either the IP or SMTP folder and, from the pop-up menu, choose Properties to display the Properties dialog box.
  4. Select the Bridge All Site Links check box.
  5. Click OK.

Manually Configuring Connections

Active Directory service automatically creates and deletes connections under normal conditions. Although you can manually add or configure connections or force replication over a particular connection, normally you should allow Active Directory service to automatically optimize the replication process based on information you provided about your deployment when you configured the replication-related objects. Create connections manually only if you are certain the connection is required and you want the connection to persist until you manually remove it.

To manually configure connections, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Active Directory Sites And Services console.
  2. Double-click the site that contains the domain controller for which you want to manually add or configure a connection.
  3. Expand the Servers folder and then the domain controller object.
  4. Right-click NTDS Settings and, from the pop-up menu, choose Connection to display the Find Domain Controllers dialog box, as shown in Figure 11.12.

    Figure 11.12 The Find Domain Controllers dialog box
  5. Select the domain controller that you want to include in the connection object, and click OK to display the New Object - Connection dialog box, as shown in Figure 11.13.

    Figure 11.13 The New Object - Connection dialog box
  6. In the Name text box, enter a name for the new connection object, and click OK.

To force replication over a connection, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Active Directory Sites And Services console.
  2. Double-click the site that contains the connection over which you want to replicate directory information.
  3. Open the Servers folder, select the domain controller, and then open NTDS Settings.
  4. Right-click the connection over which you want to replicate directory information and, from the pop-up menu, choose Replicate Now, as shown in Figure 11.14.
Figure 11.14 Forcing replication over a connection

Designating a Preferred Bridgehead Server

Ordinarily, Active Directory service uses all domain controllers to exchange information between sites, but you can further control replication behavior by specifying a bridgehead server for intersite replication. Establishing a bridgehead server provides some ranking or criteria for choosing which domain controller should be preferred as the recipient for intersite replication. This bridgehead server subsequently distributes the directory information through intrasite replication.

Bridgehead servers are the contact point for the exchange of directory information between sites. You can specify a preferred bridgehead server if you have a computer with appropriate bandwidth to transmit and receive information. If a high level of directory information exchange is typical, a computer with more bandwidth can ensure that these exchanges are handled promptly. Matching the demands of your Active Directory deployment with a domain controller having the capacity to handle those demands enables efficient updates of directory information.

You can specify multiple preferred bridgehead servers, but only one is the active preferred bridgehead server at any time at a single site. If the active preferred bridgehead server fails, Active Directory service selects another preferred bridgehead server to be the active preferred bridgehead server from the set you designate. If no active preferred bridgehead server is available and no other preferred bridgehead servers are available for Active Directory service to select, it selects another domain controller in the site to be the preferred bridgehead server. Problems can occur if the domain controller that Active Directory service selects does not have the bandwidth to efficiently handle the increased requirements posed by being a preferred bridgehead server.

You must specify a preferred bridgehead server if your deployment uses a firewall to protect a site. Establish your firewall proxy server as the preferred bridgehead server, making it the contact point for the exchange of information with servers outside the firewall. If you do not do this, directory information might not be successfully transmitted through the firewall.

Establishing a preferred bridgehead server designates that server as the preeminent server for information exchange over the protocol for which the site link is established. Other domain controllers can still exchange directory information if a need arises, but under normal conditions, the bridgehead server is used as the first choice to receive and send all directory traffic.

To designate a preferred bridgehead server, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Active Directory Sites And Services console.
  2. Expand the Sites folder and the site containing the domain controller you want to make a bridgehead server. Then expand the Servers folder in the selected site.
  3. Right-click the domain controller that you want to make a bridgehead server and, from the pop-up menu, choose Properties to display the Properties dialog box, as shown in Figure 11.15.

    Figure 11.15 The Properties dialog box for a server object
  4. In the Transports Available For Inter-Site Data Transfer list box, select the intersite transport or transports for which this computer is a preferred bridgehead server, and then click Add.
  5. Click OK to close the Properties dialog box.

Exercise 11.2: Configuring Intersite Replication

In this exercise, you configure site link cost, replication availability, and replication frequency. Then you create a site link bridge object.

Procedure 1: Configuring a Site Link Object

To configure the replication properties for the Redmond to Chicago site link object you created in Exercise 11.1, complete the following steps:

  1. Click Start, point to Programs, point to Administrative Tools, and then select Active Directory Sites And Services. The Active Directory Sites And Services console appears.
  2. Expand the Inter-Site Transports folder and the IP folder, right-click the Redmond To Chicago site link and, from the pop-up menu, choose Properties to display the Redmond To Chicago Properties dialog box. What are the current values for the Cost and Replicate Every properties?
  3. In the Cost text box, type 20 for the cost of replication.
  4. In the Replicate Every text box, type 120 for the number of minutes between replications.
  5. Click Change Schedule to display the Schedule For Redmond To Chicago dialog box.
  6. Make the connection available at all times except Monday through Friday from 8:00 A.M. to 9:00 A.M. and from 4:00 P.M. to 5:00 P.M. How many changes are required to do this?
  7. Click OK to close the Schedule For Redmond To Chicago dialog box.
  8. Click OK to close the Redmond To Chicago Properties dialog box.

Procedure 2: Creating a Site Link Bridge Object

To create a site link bridge object, complete the following steps:

  1. Expand the Inter-Site Transports folder.
  2. Right-click the IP folder and, from the pop-up menu, choose New Site Link Bridge to open the New Object - Site Link Bridge dialog box.
  3. In the Name text box, type Redmond to Chicago Bridge.
  4. Ensure that the DEFAULTIPSITELINK and Redmond to Chicago site link objects are in the Site Links In This Site Link Bridge list, and click OK.
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Which three tasks must you complete to configure intersite replication?
  2. What is the difference between replication frequency and replication availability?
  3. What is the function of a bridgehead server?

Lesson Summary

  • Configuring the site link cost, replication frequency, and replication availability enables you to control which site links Active Directory service should use for replication and when.
  • The cost that you assign to each site link enables Active Directory to select the most efficient link.
  • Active Directory automatically creates and deletes connections under normal conditions, but it is possible to create them manually.
  • By creating site link bridges, you can improve site link connectivity by linking overlapping existing site links together, or you can bridge all site links and maximize connectivity.
  • You can designate a domain controller as a bridgehead server to specify which domain controller should be preferred as the recipient for intersite replication.


Lesson 3: Troubleshooting Active Directory Replication

This lesson describes some of the Active Directory replication problems you might encounter. Most of the problems that can be remedied with Active Directory Sites and Services involve poor directory information. This can mean that new directory information is not distributed or service requests are not handled in a timely fashion.

After this lesson, you will be able to

  • Troubleshoot replication
  • Check replication topology

Estimated lesson time: 5 minutes

Troubleshooting Replication

Ineffective replication can result in declining Active Directory performance, such as new users not being recognized. Ineffective replication or request handling primarily results in out-of-date directory information or unavailable domain controllers. Each problem (cause) has one or more possible solutions. Table 11.1 outlines some replication troubleshooting scenarios.

Table 11.1 Replication Troubleshooting Scenarios

Symptom: Replication of directory information has stopped.

Cause | Solution
The sites containing the clients and domain controllers are not connected by site links to domain controllers in other sites on the network. This problem results in a failure to exchange directory information between sites. | Create a site link object joining the current site to a site that is connected to the rest of the network's sites.

Symptom: Replication has slowed but not stopped.

Cause Solution

Although all sites are connected by site links, your intersite replication structure is not as complete as it might be. Directory information is replicated to all domain controllers if they are all connected by site but this situation is not optimal. If you have site links but no site link bridges, changes made to domain controllers might take an unacceptably long time to be distributed to other domain controllers that are not closely linked.

Make sure Active Directory service has been configured properly. To span the multiple site links that need more efficient replication, consider creating a site link bridge or consider bridging all site links.

The current network resources are insufficient to handle the amount of replication traffic. This problem can affect services unrelated to Active Directory, because the exchange of directory information is consuming an inordinate amount of network resources.

  • Increase the proportion of available network resources relative to directory traffic.
  • Decrease the frequency of the replication schedule.
  • Configure site link costs.
  • To achieve network connections with more bandwidth, create site links or site link bridges.

Directory information changed at domain controllers in one site is not being updated in domain controllers at other sites in a timely fashion because intersite replication is scheduled too infrequently.

Increase the frequency of replication. If the replication is occurring over a site link bridge, check which site link is restricting replication. Increase the time range during which replication can occur or the frequency of replication within the time frame for that site link.

Clients are having to request authentication, information, and services from a domain controller with a low-bandwidth connection. This problem might result in clients receiving a slow response for authentication, directory information, or other services.

  • Check for a site that better serves the client's subnet.
  • If a client experiencing poor service is isolated from domain controllers, consider creating another site with its own domain controller that includes the client.
  • Install a connection with more bandwidth.

Checking Replication Topology

Active Directory service runs a process called the Knowledge Consistency Checker (KCC) that considers the cost of intersite connections, checks to see whether any previously available domain controllers are no longer available, and checks to see whether new domain controllers have been added. It then uses this information to add or remove connection objects to create an efficient replication topology. This process does not affect manually created connection objects.

To check the replication topology, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Active Directory Sites And Services console.
  2. In the Active Directory Sites And Services console tree, browse to the server that you want to use to check replication topology.
  3. Double-click the server object.
  4. Right-click the NTDS Settings object and, from the All Tasks menu, choose Check Replication Topology.

    A Check Replication Topology message box appears, which either states Active Directory Has Checked The Replication Topology, or states that a problem has been detected.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next chapter. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. What happens when you create a new site on an Active Directory network but neglect to connect it to the existing sites with site link objects?
    1. Active Directory service automatically creates the site links.
    2. Replication between the sites cannot occur.
    3. Active Directory service creates a site link bridge object.
    4. Active Directory replication is slowed down considerably.
  2. What are two possible causes for a slowdown in replication traffic?
  3. Which type of Active Directory object do you use to check the replication topology?
    1. A server
    2. A site
    3. A site link
    4. A site link bridge

Lesson Summary

  • A complete lack of Active Directory replication is often caused by a lack of site link objects.
  • A slowdown of Active Directory replication usually occurs because of incorrectly configured site link objects.
  • You can check the replication topology for your network by accessing a server object.


Active Directory Service Administration

About This Chapter

Administering Active Directory service involves more than setup and configuration. It includes locating objects, moving objects within and between domains, assigning permissions to objects, delegating administrative control to organizational units (OUs), and troubleshooting Active Directory service. This chapter examines these Active Directory administrative tasks in detail.

Before You Begin

To complete this chapter, you must have a basic understanding of Active Directory service and how to create objects, as described in Chapter 7, "Managing Active Directory User and Computer Objects." To complete the exercises in this chapter, you must have a computer running Microsoft Windows 2000 connected to an Active Directory network, and sufficient permissions to create and manage new objects in the directory.


Lesson 1: Managing Object and Container Permissions

Windows 2000 uses an object-based security model to implement access control for all Active Directory objects. This security model is similar to the ones Windows 2000 uses to control access to NT file system (NTFS) drives and shared folders and printers. Every Active Directory object has a security descriptor that defines who has permissions to access the object and what type of access is allowed. This lesson explains how to set permissions for Active Directory objects.

After this lesson, you will be able to

  • Describe the difference between standard permissions and special permissions
  • Set permissions on Active Directory objects to control user access
  • Understand permission inheritance

Estimated lesson time: 20 minutes

Understanding Active Directory Permissions

Active Directory permissions provide security for resources by enabling you to control who can access individual objects or object attributes and the type of access allowed. Either an administrator or the object's owner must assign permissions to the object before users can access the object. Windows 2000 stores a list of user access permissions, called the access control list (ACL), in every Active Directory object. The ACL for an object lists who can access the object and the specific actions that each user can perform on it. You can use permissions to grant administrative privileges to a specific user or group for an OU, a hierarchy of OUs, or a single object, without assigning them administrative permissions for other Active Directory objects.

Object Permissions

The permissions that you can grant for an object vary, depending on the object type. For example, you can grant the Reset Password permission for a user object but not for a printer object.

A user can be a member of multiple groups, each with different permissions that provide different levels of access to objects. When you assign a permission to a user for access to an object and that user is a member of a group to which you have assigned different permissions, the user's effective permissions are the combination of the user and group permissions. For example, if you grant a user the Read permission for an object and the user is also a member of a group that has the Write permission, the user's effective permissions for the object are Read and Write.

As with NTFS and share permissions, you can allow or deny permissions to Active Directory objects. Denied permissions take precedence over any permissions that you otherwise allow for user accounts and groups. If you deny a user permission to access an object, the user does not have that permission, even when the user is a member of a group that does have permission to access that object. You should deny permissions only when it is absolutely necessary to override permissions that the user has inherited from a group membership.

Always ensure that all objects have at least one user with the Full Control permission. Failure to do so might result in some objects being inaccessible to the person using the Active Directory Users and Computers console, even an administrator, unless the object's ownership is changed.

Standard Permissions and Special Permissions

You can set standard permissions and special permissions for Active Directory objects, just as you can with NTFS files and folders. Standard permissions are the most frequently used combinations of special permissions, and they simplify the task of controlling access to Active Directory service. Working with special permissions provides you with a finer degree of control for assigning access to objects. For example, the Write standard permission is composed of the Write All Properties, Add/Remove Self As Member, and Read special permissions.

Table 12.1 lists the standard object permissions available for most objects (most object types also have special permissions) and the type of access that each allows.

Table 12.1 Standard Permissions for Active Directory Objects and the Types of Access They Allow

Object Permission | Enables the User To
Full Control | Change permissions and take ownership, plus perform the tasks that are allowed by all of the other standard permissions
Read | View objects and object attributes, the object owner, and Active Directory permissions
Write | Change object attributes
Create All Child Objects | Add any type of child object to an OU
Delete All Child Objects | Remove any type of object from an OU

Assigning Active Directory Permissions

You can use the Active Directory Users and Computers console to set standard permissions for objects and object attributes. You assign permissions in the Security tab of an object's Properties dialog box. The Properties dialog box is different for each object type.

You must choose Advanced Features from the View menu to access the Security tab and assign standard permissions for an object.

If the check boxes in the Permissions list are shaded, then the object has inherited permissions from a parent object. To prevent an object from inheriting permissions from a parent object, clear the Allow Inheritable Permissions From Parent To Propagate To This Object check box.

To assign standard permissions for an object, use the following procedure:

  1. Click Start and, from the Administrative Tools group, open the Active Directory Users And Computers console.
  2. From the View menu, choose Advanced Features.
  3. Right-click an object in the directory tree and, from the pop-up menu, choose Properties to display the Properties dialog box.
  4. Click the Security tab.
  5. To add a new user or group to the Name list, click Add to display the Select Users, Computers, Or Groups dialog box shown in Figure 12.1.

    Figure 12.1 The Select Users, Computers, Or Groups dialog box
  6. Select the user or group object to which you want to assign permissions and click Add. Repeat this process to select additional users or groups.
  7. Click OK to close the Select Users, Computers, Or Groups dialog box and add the selected users to the Name list in the Security tab.
  8. Select a user or group in the Name list and select the Allow or Deny check box in the Permissions list to set the desired permissions.
  9. Click OK to close the Properties dialog box.

Standard permissions are usually sufficient for most administrative tasks. However, you might at times need to view the special permissions that make up a standard permission. You might notice occasionally that the Security tab is displaying a user or a group object with none of the standard permissions allowed or denied. In such a case, the user or group has been assigned special permissions that you can access and modify by clicking Advanced.

To view special permissions, use the following procedure:

  1. Open the Properties dialog box for an object in the Active Directory tree and click the Security tab.
  2. Click Advanced to display the Access Control Settings dialog box.
  3. In the Permissions tab, in the Permission Entries list, select the entry that you want to view, and then click View/Edit to display the Permission Entry dialog box, as shown in Figure 12.2.

    Figure 12.2 The Permission Entry For Users dialog box
  4. Click the Object tab to view the special permissions for the object itself, or click the Properties tab to view the special permissions for the object's Properties.
Avoid assigning permissions for specific object properties, because this can complicate system administration. Errors can result, such as Active Directory objects not being visible, preventing users from completing tasks.

Using Permissions Inheritance

Just as in NTFS, permissions inheritance for Active Directory objects minimizes the number of times that you need to assign permissions for objects. When you assign permissions, you can apply the permissions to parent objects, which propagates the permissions to all of the child objects for a parent.

For example, you can grant a group the Full Control permission for an OU that contains printers and then propagate this permission to all of the child objects in the OU. The result is that all of the group's members can administer all of the printers in the OU.

You can specify whether the permissions for a given object are propagated to all child objects, thus preventing permissions inheritance if desired. When you copy previously inherited permissions, you start with exactly the same permissions that the object currently inherits from its parent object. However, any permissions for the parent object that you modify after blocking inheritance no longer apply. When you remove the previously inherited permissions, Windows 2000 removes existing permissions and assigns no additional permissions to the object. You then have to assign any permissions you want for the object.

You can prevent permissions inheritance so that a child object does not inherit permissions from its parent object by clearing the Allow Inheritable Permissions From Parent To Propagate To This Object check box in the Security tab of an object's Properties dialog box. When you prevent inheritance, only the permissions that you explicitly assign to the object apply.

When you clear the Allow Inheritable Permissions From Parent To Propagate To This Object check box to prevent permissions inheritance, Windows 2000 displays a Security message box with buttons that enable you to do either of the following:

  • Copy previously inherited permissions to the object. The new explicit permissions for the object are a copy of the permissions that it previously inherited from its parent object. You can then make any necessary changes to the permissions.
  • Remove previously inherited permissions from the object. Windows 2000 removes any previously inherited permissions. No permissions exist for the object. You can then assign any necessary permissions for the object.

Exercise 12.1: Controlling Access to Active Directory Objects

In this exercise, you create an OU with two users and review the default security settings on Active Directory components.

In this exercise, do not change any security settings in Active Directory service. Making changes could result in losing access to portions of Active Directory service.

Procedure 1: Creating an OU Containing Two User Accounts

To create the OU and user objects you need to perform the rest of the exercise, complete the following steps:

  1. Log on to your domain as Administrator, and then open the Active Directory Users And Computers console.
  2. In the console tree, click your domain menu.
  3. In the Name text box, type Security1 and click OK.
  4. In the Security1 OU, create a user object for Elizabeth Boyle with the User Logon Name field set to eboyle. Type password as the password and accept the defaults for all other options.
  5. In the same OU, create another user account for Josh Barnhill with the User Logon Name jbarnhill. Type password as the password and accept the defaults for all other options.
  6. Grant both users membership in the Print Operators group or another group with the right to log on locally to the domain controller.
For more information about working with Active Directory user and group objects, see Chapter 7, "Managing Active Directory User and Computer Objects," and Chapter 8, "Managing Active Directory Group Objects."

Procedure 2: Viewing the Default Active Directory Permissions for an OU

To examine and list the permissions for the OU object you just created, complete the following steps:

  1. Open the Active Directory Users And Computers console.
  2. From the View menu, choose Advanced Features, which enables you to review and configure Active Directory permissions.
  3. In the console tree, right-click the Security1 user object and, from the pop-up menu, choose Properties.
  4. Click the Security tab.
  5. In the following table, list the groups that have permissions for the Security1 OU.
    User Account or Group Assigned Permissions

    How can you tell if any of the default permissions are inherited from the domain, which is the parent object?

Procedure 3: Viewing Special Permissions for an OU

To examine the special permissions for the OU you created, complete the following steps:

  1. In the Security tab of the Properties dialog box for the Security1 OU, click Advanced to display the Access Control Settings For Security1 dialog box.
  2. To view the special permissions for Account Operators, in the Permission Entries box, select each entry for Account Operators, and then click View/Edit to display the Permission Entry For Security1 dialog box.

    What object permissions are assigned to Account Operators? What can Account Operators do in this OU? (Hint: Check each of the permission entries for the Account Operators group in the Access Control Settings For Security1 dialog box.)

    Do any objects within this OU inherit the permissions assigned to the Account Operators group? Why or why not?

  3. Close all open dialog boxes, but do not close the Active Directory Users And Computers console.

Procedure 4: Viewing the Default Active Directory Permissions for a User Object

To examine and list the permissions granted to a newly created user object by default, complete the following steps:

  1. In the Active Directory Users And Computers console tree, select the Security1 OU.
  2. In the details pane, right-click Jbarnhill and, from the pop-up menu, choose Properties to display the Properties dialog box.
  3. Click the Security tab.
  4. In the following table, list the groups that have standard permissions for the jbarnhill user account. If the dialog box indicates that special permissions are present for a group, do not list them.
    Group Assigned Permissions

    Are the standard permissions for a user object the same as those for an OU object? Why or why not?

    Are any of the standard permissions inherited from Security1, the parent object? How can you tell?

    What do the permissions of the Account Operators group allow its members to do with the user object?

  5. Close all windows and log off from Windows 2000.
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Describe the relationship between standard permissions and special permissions.
  2. How do you prevent an Active Directory object from inheriting permissions from its parent object?
  3. What does it mean when the Allow and Deny check boxes in the Security tab of an object's Permissions dialog box are shaded?

Lesson Summary

  • Every Active Directory object has a security descriptor that defines who has permission to access the object and what type of access is allowed.
  • You manage the standard permissions for an Active Directory object in the Security tab of its Properties dialog box.
  • You can manage the special permissions for an Active Directory object in the Access Control Settings dialog box.
  • Objects in the Active Directory tree inherit permissions from their parent objects.
  • You can explicitly prevent objects from inheriting permissions by modifying their properties.


Lesson 2: Locating and Moving Active Directory Objects

Active Directory stores information about objects on the network. Each object is a distinct, named set of attributes that represents a specific network entity. You move objects from one location to another when organizational or administrative functions change-for example, when an employee moves from one department to another. This lesson shows you how to move Active Directory objects within and between domains. Active Directory is also designed to provide information in response to queries about directory objects from both users and programs. In this lesson, you learn how to use the Find function in the Active Directory Users And Computers console to locate Active Directory objects.

After this lesson, you will be able to

  • Identify the types of Active Directory objects
  • Use Find to locate any type of Active Directory object
  • Move objects within a domain
  • Move objects between domains
  • Move domain controllers between sites

Estimated lesson time: 20 minutes

Understanding Common Active Directory Objects

Adding new resources to your network creates new Active Directory objects that represent these resources. You should be familiar with the most common Active Directory object types, listed and described in Table 12.2.

Table 12.2 Active Directory Object Types and Their Contents

Object Type | Contents
User | An object that contains information that enables a user to log on to Windows 2000, such as a user logon name. This object also has many optional fields that you can use to maintain information about the user, including first name, last name, display name, telephone number, e-mail address, and home page.
Contact | An object containing information about a person with a connection to the organization. This object also has many optional fields for information including telephone number, e-mail address, address, and home page.
Group | An object consisting of a collection of user, computer, and/or other group objects that you can create and use to simplify administration.
Shared folder | An object that functions as a pointer to a shared folder on a computer. A pointer contains the location of certain data, rather than the data itself. Shared folders and printers exist in the registry of a computer. When you publish a shared folder in Active Directory service, you are creating an object that contains a pointer to the shared folder.
Printer | An object that functions as a pointer to a printer on a computer. You must manually publish a printer on a computer that is not in Active Directory. Windows 2000 automatically adds printers that you create on domain computers to Active Directory service.
Computer | An object containing information about a computer that is a member of the domain.
Domain controller | An object containing information about a domain controller, including an optional description, its Domain Name System (DNS) name, its pre-Windows 2000 name, the version of the operating system installed on the computer, the domain controller's location, and who is responsible for managing it.
Organizational unit | An object that functions as a container for other objects, including users, groups, computers, and other OUs. You use OU objects to create an organizational hierarchy in Active Directory service.

Locating Active Directory Objects

In a large Active Directory installation, locating one specific object by browsing through hundreds or thousands of objects can be difficult. To make it easier to find the objects you need, Active Directory service maintains a Global Catalog of the entire directory, which you can search using the Find dialog box in the Active Directory Users And Computers console. The Global Catalog contains information about every object in the directory, even those in domains that are serviced by other domain controllers. Any domain controller in the forest can be designated a Global Catalog server, so users can search the entire directory without having to contact all of the domain controllers on the network. This is a great advantage if your network spans different sites connected by relatively slow or expensive wide area network (WAN) links.

The Global Catalog does not contain a complete replica of every object in the directory, just the key attributes used for searching, to keep its size manageable. Once users or applications locate the object they need, they can contact a domain controller where that object is stored for more complete information. Windows 2000 uses the Lightweight Directory Access Protocol (LDAP) to generate the directory search requests that domain controllers execute against a specific domain or OU.

Running Basic Searches

To search Active Directory service for an object, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Active Directory Users And Computers console.
  2. Right-click a domain or container object in the console tree. From the pop-up menu, choose Find to display the Find Users, Contacts, And Groups dialog box shown in Figure 12.3.

    Figure 12.3 The Find Users, Contacts, And Groups dialog box
  3. Select the type of object that you want to locate in the Find drop-down list. Notice that when you change the value in the Find box from the default (Users, Contacts, And Groups), the title bar of the dialog box changes to reflect the change.
  4. Select the domain you want to search from the In drop-down list. From this list, you can select an OU or any of the domains in your Active Directory installation, or you can choose to search the entire directory. By default, the object you used to open the Find dialog box appears in this box.
  5. Type the name of the object you want to locate in the Name text box. You can enter all or part of the object name, or other information about the object, such as a user's first or last name. LDAP searches can successfully locate objects based on fragmentary information, such as the first few letters of a user's first name, last name, or logon name. However, you cannot successfully search for a name using a sequence of letters from the middle of a user's name. For example, to search for a user named Elizabeth Boyle with the logon name eboyle, you can use the strings eli, bo, or ebo and successfully locate the object, but a search for liz or oyl fails.
  6. Click Find Now to begin the search. The results appear in the Name list at the bottom of the dialog box. You can right-click the objects found and work with them just as you would when browsing through the directory tree.

Running Advanced Searches

In the Find dialog box, when you click the Advanced tab, the query interface changes to a display like that shown in Figure 12.4. The same type of interface appears when you select Custom in the Find drop-down list. Using the Advanced interface, you can search for a string of characters located anywhere in any of an object's attributes. You can, for example, create a search that locates all user objects for people in the sales department with telephone numbers in a specific area code.

Figure 12.4 The Advanced search interface in the Find dialog box

To perform an advanced search, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Active Directory Users And Computers console.
  2. Right-click a domain or container object in the console tree. From the pop-up menu, choose Find to display the Find Users, Contacts, And Groups dialog box.
  3. Select the type of object that you want to locate in the Find drop-down list.
  4. Select the domain or OU that you want to search from the In drop-down list, or select Entire Directory.
  5. Click the Advanced tab to switch to the advanced search interface.
  6. Click Field and select the attribute you want to search. The object types and attributes in the Field menu depend on the value you selected from the Find drop-down list. When you select Users, Contacts, And Groups in the Find list, the Field menu has a separate menu for each of these three object types, containing all of the attributes for each one. Selecting one of the other object types in the Find list displays the attributes for that type of object.
  7. Select a value from the Condition drop-down list specifying how you want to search in the selected attribute, using the values shown in Figure 12.5.

    Figure 12.5 The Condition options in the Advanced interface of the Find dialog box
  8. Enter the information you want to search for in the Value text box.
  9. Click Add to add the search parameters you selected to the list of search criteria.
  10. Repeat Steps 6 through 9, if desired, to create additional strings for the same search.
  11. Click Find Now to perform the search.

When you open the Find Users, Contacts, And Groups dialog box and select Custom Search from the Find drop-down list, you see an interface similar to that provided by clicking the Advanced tab, except that you can choose any attribute of any object type from the Field pull-down menu. With this interface, you can create a search for any type of object. In the Find list, select Custom Search and click the Advanced tab to display an Enter LDAP Query box in which you can manually type a query string that conforms to the notation described in the LDAP standard.

Moving Active Directory Objects

You might want to move Active Directory objects around after you have created them. For example, you might have to modify the Active Directory tree to accommodate physical changes in your network, such as the movement of computers to a different domain or site, or you might have to move user objects to containers representing different departments when people change jobs. In the logical environment represented by the Active Directory tree, you can move objects within and between domains. In the physical environment of your network, you can move domain controllers between sites.

Moving Objects Within a Domain

To reduce administrative overhead, you can move objects with identical security requirements into a different OU or container within a domain. You can then assign access permissions to the OU or container so that they are inherited by all of the objects in it.

To move objects within a domain, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Active Directory Users And Computers console.
  2. In the console tree, right-click the object you want to move and, from the pop-up menu, choose Move to open the Move dialog box, as shown in Figure 12.6.

    Figure 12.6 The Move dialog box
  3. Select the OU or container to which you want to move the selected object.
  4. Click OK to close the Move dialog box and move the object.

The following conditions apply when you move objects between OUs or containers:

  • Permissions that are assigned directly to moved objects remain in force when the objects are in their new locations.
  • The moved objects inherit permissions from their new parent OU or container. Any permissions that the objects inherited from their old parent OU or container are no longer in force.
  • You can move multiple objects at the same time.
To simplify the assignment of permissions for printers, move printers on different print servers that require identical permissions to the same OU or container. Printers are located in the Computer object for the print server. To view printer objects in the Active Directory Users And Computers console, from the View menu, choose Users, Groups, And Computers As Containers.

Moving Objects Between Domains

To support domain consolidation or organizational restructuring operations, Windows 2000 enables you to move objects between domains. Use the Movetree command-line utility to move Active Directory objects such as OUs, users, and groups between domains in a single forest, with some exceptions. This tool is not installed with the Windows 2000 operating system, but it is available as part of Windows 2000 Support Tools, which are included on the Windows 2000 CD-ROM in the \Support\Tools folder. To install the Windows 2000 Support Tools, insert the Windows 2000 CD-ROM into your drive, browse to the \Support\Tools folder, and run the SETUP.EXE file there.

The procedure for moving an object (whether it is a leaf or container object) involves taking an existing object and making it the child of an existing parent. The distinguished name of the moved object changes to reflect its new position in the Active Directory hierarchy. The object's globally unique identifier (GUID) is unchanged by a move or rename.

As users and groups are migrated from one domain to another, Active Directory service assigns them a new SID. To preserve the security credentials of an account when it is moved from one domain to another, Windows 2000 supports SIDHistory, a security attribute available only in Windows 2000 native mode. As users and groups are moved from one domain to another, to reduce the administrative overhead of resetting ACLs and ownership of resources, the old SID is added to the SIDHistory attribute for the new object. Whenever users log on, any SIDs present in their SIDHistory or any SIDs present in the SIDHistory of a group of which the users are members are added to their access token. They are given permissions and ownership to any resources that they previously had.

Movetree enables you to move an OU to another domain, keeping all of the linked group policy objects (GPOs) in the old domain intact. The GPO link is moved and continues to work, although clients receive their group policy settings from the GPOs located in the old domain. For more information about group policy, see Chapter 9, "Using Group Policies."

Moving Domain Controllers Between Sites

In general, you can install a domain controller into a site that has existing domain controllers. The exception to this rule is the first domain controller installed, which automatically creates the Default-First-Site-Name site. You cannot create a first domain controller in any site but Default-First-Site-Name, but you can create a domain controller in a site that has a previously existing domain controller and then move it to another site. Therefore, after you have installed the first domain controller, creating the Default-First-Site-Name site, you can create other domain controllers in this site and then move them to alternative sites. You can also use this procedure to move member servers between sites.

To move a domain controller between sites, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Active Directory Users And Computers console.
  2. Right-click the domain controller that you want to move to a different site. From the pop-up menu, choose Move to display the Move Server dialog box (see Figure 12.7).

    Figure 12.7 The Move Server dialog box
  3. Select the site to which you want to move the domain controller.
  4. Click OK.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. How does the Global Catalog help users locate Active Directory objects?
  2. What happens to the permissions of an object when you move it from one OU to another OU?
  3. What program do you use to move a user object to a different domain?
    1. Active Directory Users and Computers
    2. Active Directory Sites and Services
    3. MOVETREE.EXE
    4. NETDOM.EXE

Lesson Summary

  • You can use the Find dialog box to locate Active Directory objects by name or by using the values of their attributes.
  • The Find dialog box uses Lightweight Directory Access Protocol (LDAP) to send queries to Active Directory service.
  • To move Active Directory objects to different locations in the same domain, use the Active Directory Users And Computers console.
  • To move objects such as users and groups to a different domain, use the MOVETREE.EXE utility.
  • To move a workstation or member server from one domain to another, use the NETDOM.EXE program with the move parameter.


Lesson 3: Delegating Control

In this lesson, you learn that you can delegate administrative control of objects to individuals so that they can perform administrative tasks on the objects. You learn how to use the Delegation of Control Wizard to delegate control of objects and the guidelines for delegating control.

After this lesson, you will be able to

  • Delegate administrative control of OUs and objects

Estimated lesson time: 20 minutes

Guidelines for Delegating Control

You delegate administrative control of objects by assigning permissions to the object to allow users or groups of users to administer the objects. An administrator can delegate the following types of control:

  • Assign a user or group the permissions to change properties on a particular container.
  • Assign a user or group the permissions to create, modify, or delete objects of a specific type in a specific OU or container.
  • Assign a user or group the permissions to modify specific properties onobjects of a specific type in a specific OU or container.

Because tracking permissions at the higher levels of the Active Directory tree is easier than tracking permissions on objects or object attributes, the most common method of delegating administrative control is to assign permissions at the OU or container level. Assigning permissions at this level enables you to delegate administrative control for all of the objects contained in the OU or container.

For example, you can delegate administrative control by assigning the Full Control permission for an OU to the appropriate manager only within his or her area of responsibility. By delegating control of the OU to the manager, you can decentralize administrative operations and issues. For example, the manager can create user objects for new employees and modify the attributes of existing user objects, rather than asking a network administrator to do it. This reduces your administration time and costs by distributing administrative control closer to its point of service.

To help you delegate administrative control, you might want to follow these suggestions:

  • Assign control at the OU or container level whenever possible. Assigning control at the OU or container level permits easier tracking of permission assignments. Tracking permission assignments becomes more complex when you assign control for objects and object attributes.
  • Use the Delegation of Control Wizard. This wizard assigns permissions only at the OU or container level, and simplifies the process of assigning object permissions by stepping you through the process.
  • Track the delegation of permission assignments. Tracking assignments enables you to maintain records to easily review security settings.
  • Follow business requirements. Follow any guidelines that your organization has in place for delegating control.

Delegation of Control Wizard

The Delegation of Control Wizard steps you through the process of assigning permissions at the OU or container level. More specialized permissions must be manually assigned. To delegate control of an OU or container, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Active Directory Users And Computers console.
  2. Right-click the container or OU for which you want to delegate control. From the pop-up menu, choose Delegate Control to launch the Delegation of Control Wizard.
  3. Click Next to bypass the Welcome page and display the Users Or Groups page.
  4. Click Add to open the Select Users, Computers, Or Groups dialog box (see Figure 12.8).

    Figure 12.8 The Select Users, Computers, Or Groups dialog box
  5. Select the user or group to which you want to delegate control of the OU or container and click Add.
  6. Click OK to close the Select Users, Computers, Or Groups dialog box and add the object you added to the Selected Users And Groups list.
  7. Click Next to display the Tasks To Delegate page shown in Figure 12.9.

    Figure 12.9 The Tasks To Delegate page of the Delegation of Control Wizard
  8. Ensure that Delegate The Following Common Tasks is selected and select the check boxes next to the tasks that you want the selected user or group to be able to perform for the OU or container.
  9. Click Next to proceed to the Completing The Delegation Of Control Wizard page.
  10. Click Finish to close the wizard and assign the appropriate permissions.

When you click Create A Custom Task To Delegate in the Tasks To Delegate page, the Delegation of Control Wizard displays two additional pages. In the Active Directory Object Type page, you specify exactly which objects in the selected OU or container you want to delegate control for. In the Permissions page, you specify what permission you want to grant for the selected objects or specific properties of those objects.

When you delegate control of the OUs and containers in Active Directory service, ensure that the delegated users take responsibility and can be held accountable. You gain nothing if you delegate administrative control without ensuring future accountability. As an administrator, you are ultimately responsible for all of the administrative changes that are made to the Active Directory database. If the users to whom you delegate responsibility are not performing the administrative tasks, you must assume responsibility for their failure. Provide training for the users who have control of Active Directory objects. Ensure that the users to whom you delegate responsibility understand these responsibilities and know how to perform the administrative tasks.

Exercise 12.2: Delegating Administrative Control in Active Directory Service

In this exercise, you delegate control over objects in an OU to a user. You must create the user objects described in Exercise 12.1 and refer to the tables you completed in Exercise 12.1 to perform these procedures.

Procedure 1: Testing Current Permissions

To test the capabilities granted to the eboyle account you created earlier by the permissions you assigned to it, complete the following steps:

  1. Log on to your domain as eboyle, and type password as the password.
  2. Click Start and open the Active Directory Users And Computers console.
  3. In the console tree, expand your domain and then click Security1. What user objects are visible in the Security1 OU?

    Which permissions allow you to see these objects?

    For the user account with the logon name jbarnhill, change the logon hours. Were you successful? Why or why not?

    For the eboyle user account, under which you are currently logged on, change the logon hours. Were you successful? Why or why not?

  4. Close the Active Directory Users And Computers console and log off from Windows 2000.

Procedure 2: Using the Delegation of Control Wizard to Assign Active Directory Permissions

To delegate control of the Security1 OU you created earlier to the eboyle user object, complete the following steps:

  1. Log on to your domain as Administrator and open the Active Directory Users And Computers console.
  2. In the console tree, expand your domain.
  3. Right-click the Security1 OU. From the pop-up menu, choose Delegate Control to activate the Delegation of Control Wizard.
  4. In the Delegation of Control Wizard Welcome page, click Next. The Delegation of Control Wizard displays the Users Or Groups page. Notice that the wizard does not display any user accounts or groups. You add the user account to which you delegate control.
  5. Click Add to display the Select Users, Computers, Or Groups dialog box.
  6. Select the eboyle user object, click Add, and then click OK.
  7. Click Next. The Delegation of Control Wizard displays the Tasks To Delegate page. Here you can choose to delegate common tasks from a list or create custom tasks to delegate.
  8. Confirm that Delegate The Following Common Tasks is selected, select the Create, Delete, And Manage User Accounts check box, and then click Next. The Delegation of Control Wizard displays the Completing The Delegation Of Control Wizard page.
  9. Review the Summary page and click Finish.
  10. Close the Active Directory Users And Computers console and log off from Windows 2000.

Procedure 3: Testing Delegated Permissions

To test the permissions that you just granted the eboyle user object with the Delegation of Control Wizard, complete the following steps:

  1. Log on to your domain as eboyle, and type password as your password.
  2. Open the Active Directory Users And Computers console.
  3. In the console tree, expand your domain and click Security1.
  4. Attempt to change the logon hours for the user accounts in the Security1 OU. Were you successful? Why or why not?
  5. Attempt to change the logon hours for a user account in the Users container. Were you successful? Why or why not?
  6. Close the Active Directory Users And Computers console and log off from Windows 2000.
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. The Delegation of Control Wizard allows you to set administrative control at what level?
  2. Why is it preferable to delegate control over an OU or container rather than over individual user and group objects?
  3. Why would a network's Active Directory administrator want to grant other users control over OUs or containers?

Lesson Summary

  • You can delegate administrative control of objects to individuals so that they can perform administrative tasks on the objects.
  • Assigning permissions at the OU or container level enables you to delegate administrative control for the objects that are contained in the OU or container.
  • Use the Delegation of Control Wizard to delegate control of objects.
  • The Delegation of Control Wizard enables you to grant users or groups control of specific object types in an OU or container.
  • The Delegation of Control Wizard enables you to grant users or groups permissions to work with specific properties in the selected object types.


Lesson 4: Troubleshooting Active Directory Service

This lesson describes some problems that you might encounter related to Active Directory, along with some possible solutions.

After this lesson, you will be able to

  • Troubleshoot Active Directory service

Estimated lesson time: 10 minutes

Troubleshooting Active Directory Service

Table 12.3 describes some of the more common Active Directory troubleshooting scenarios.

Table 12.3 Active Directory Troubleshooting Scenarios

Symptom: Cannot add or remove a domain.

Cause | Solution
The domain naming master is not available. This might be caused by a network connectivity problem. A failure of the computer holding the domain naming master role might also be the cause. | Resolve the network connectivity problem or repair or replace the domain naming master computer. It might be necessary to seize the domain naming master role.

Symptom: Cannot create objects in Active Directory.

Cause | Solution
The relative ID master is not available. This problem might be caused by a network connectivity problem or a failure of the computer holding the relative ID master role. | Resolve the network connectivity problem or repair or replace the computer holding the relative ID master role. It might be necessary to seize the relative ID master role.

Symptom: Cannot modify the schema.

Cause | Solution
The schema master is not available. This might be caused by a network connectivity problem or a failure of the computer holding the schema master role. | Resolve the network connectivity problem or repair or replace the computer holding the schema master role. It might be necessary to seize the schema master role.

Symptom: Changes to group memberships are not taking effect.

Cause | Solution
The infrastructure master is not available. This might be caused by a network connectivity problem or a failure of the computer holding the infrastructure master role. | Resolve the network connectivity problem or repair or replace the computer holding the infrastructure master role. It might be necessary to seize the infrastructure master role.

Symptom: Clients without Active Directory client software installed cannot log on.

Cause | Solution
The primary domain controller emulator is not available. This may be caused by a network connectivity problem. A failure of the computer holding the primary domain controller emulator role might also be the cause. | Resolve the network connectivity problem or repair or replace the computer holding the primary domain controller emulator role. It might be necessary to seize the primary domain controller emulator role.

Symptom: Clients are unable to access resources in another domain.

Cause | Solution
A failure of the trust between the domains has occurred. | Reset and verify the trust between the domains. The primary domain controller emulator must be available for a trust to be successfully reset.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next chapter. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Which of the following problems could prevent client computers that do not have Active Directory client software installed from logging on?
    1. Failure of the computer holding the primary domain controller emulator role
    2. Failure of the computer holding the schema master role
    3. Failure of the computer functioning as the infrastructure master
    4. Failure of the trust relationship between the domains on the network
  2. List two reasons why you might not be able to create new objects in Active Directory service.
  3. What is the function of a trust relationship?

Lesson Summary

  • The domain naming master is needed to add or remove Active Directory domains.
  • The relative ID master is needed to create new objects in Active Directory.
  • The schema master is needed to modify the Active Directory schema.
  • The infrastructure master is needed to change group memberships.
  • The primary domain controller emulator is needed to log on to computers not running Active Directory client software.


TCP/IP Administration

About This Chapter

This chapter provides an overview of the Transmission Control Protocol/Internet Protocol (TCP/IP) suite, and discusses the process of configuring a computer running Microsoft Windows 2000 to use TCP/IP. Finally, you learn how to use the various utilities included with the Windows 2000 TCP/IP stack to test your network and troubleshoot communication problems.

Before You Begin

To complete the exercises in this chapter, you must have a computer running Windows 2000 that is connected to a TCP/IP network with a Dynamic Host Configuration Protocol (DHCP) server available.


Lesson 1: TCP/IP Overview

TCP/IP is an industry-standard suite of protocols designed for use on both local area networks (LANs) and wide area networks (WANs). Windows 2000 has extensive support for TCP/IP, both as a protocol suite and as a set of services for connectivity and management of Internet Protocol (IP) networks. This lesson includes an overview of TCP/IP concepts, terminology, and the Internet standards that are created. You also learn how Windows 2000 integrates with TCP/IP.

After this lesson, you will be able to

  • Describe how the TCP/IP protocol suite maps to a four-layer model
  • Describe how Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) transmit data
  • Describe the purpose of an Internet Protocol (IP) address
  • Identify different classes of IP addresses
  • Describe the difference between static and dynamic routing

Estimated lesson time: 30 minutes

Architectural Overview of the TCP/IP Protocol Suite

The TCP/IP protocols provide networking support to connect all of the computers (called hosts, in TCP/IP parlance) on a LAN, as well as WAN sites, and follow a set of standards for how computers communicate and how networks are interconnected. The TCP/IP protocols follow a four-layer conceptual model known as the Department of Defense (DOD) model. The layers, from top to bottom, are application, transport, Internet, and link, as illustrated in Figure 13.1. These layers are examined in more detail in the following sections.

Figure 13.1 The four-layer model for the TCP/IP protocol stack

Application Layer

The application layer is at the top of the four-layer conceptual TCP/IP model. This is where software programs gain access to the network. This layer corresponds roughly to the session, presentation, and application layers of the Open Systems Interconnection (OSI) reference model. Some TCP/IP utilities and services run at the application layer, including the following:

  • Hypertext Transfer Protocol (HTTP). HTTP is the protocol used for Web communications. Windows 2000 includes Microsoft Internet Explorer as an HTTP client and Internet Information Services (IIS) as an HTTP server.
  • File Transfer Protocol (FTP). FTP is an Internet service that transfers files from one computer to another. In Windows 2000, Internet Explorer and the command-line utility Ftp.exe both act as FTP clients, and IIS includes an FTP server.
  • Simple Mail Transfer Protocol (SMTP). SMTP is a protocol that mail servers use to transfer e-mail. IIS can send messages using the SMTP protocol.
  • Telnet. Telnet is a terminal emulation protocol used to log on to remote network hosts. Telnet offers users the capability of running programs remotely and facilitates remote administration. Telnet is available for practically all operating systems and eases integration in heterogeneous networking environments. Windows 2000 includes both a Telnet client and server.
  • Domain Name System (DNS). DNS is a set of protocols and services on a TCP/IP network that enables users of the network to use hierarchical, user-friendly names when locating hosts instead of remembering and using their IP addresses. DNS is used extensively on the Internet and on many private enterprise networks today. When you enter a server name in a Web browser, Telnet application, FTP utility, or other similar TCP/IP utilities on the Internet, you are probably using a DNS server to resolve that name into an IP address before communication begins. All Windows 2000 computers have a DNS client, and Microsoft Windows 2000 Server also includes a DNS server.
  • Simple Network Management Protocol (SNMP). SNMP enables you to manage network nodes such as servers, workstations, routers, bridges, and hubs by gathering information using SNMP agents and displaying it on a central host computer. You can also use SNMP to configure remote devices, monitor network performance, detect network faults or inappropriate access, and audit network usage.

Microsoft TCP/IP also provides two interfaces for network applications to use the services of the TCP/IP protocol stack:

  • WinSock. The Windows 2000 implementation of the widely used Sockets application programming interface (API). The Sockets API is the standard mechanism for accessing datagram and session services over TCP/IP.
  • NetBIOS. A standard API used as an interprocess communication (IPC) mechanism in the Windows environment. Although Network Basic Input/Output System (NetBIOS) can be used to provide a standard connection to protocols that support the NetBIOS naming and messaging services, such as TCP/IP and NetBIOS Enhanced User Interface (NetBEUI), it is included with Windows 2000 mainly to support legacy applications.

Transport Layer

Transport protocols provide communication sessions between computers and define the type of transport service as either connection-oriented (as with the TCP protocol) or connectionless datagram-oriented (as with UDP). TCP provides connection-oriented, reliable communications for applications that typically transfer large amounts of data at one time. TCP is also used for applications that require an acknowledgment for data received by the destination system. UDP provides connectionless communications and does not guarantee delivery of packets. Applications that use UDP typically transfer small amounts of data at one timein a request/reply format, leaving the reliable delivery of data up to the application. The transport layer in the DOD model corresponds roughly to the transport layer in the OSI reference model.

Internet Layer

The protocols at the Internet layer encapsulate transport layer data into units called datagrams, address them, and route them to their destinations. The routing functions that the Internet layer protocols perform are necessary to enable hosts to interoperate with other networks. The Internet layer is roughly analogous to the network layer in the OSI reference model. Windows 2000 implements three main protocols at this layer, which are as follows:

  • IP. IP is the primary Internet layer protocol, responsible for addressing and routing packets. All user data generated by applications is transmitted inside IP datagrams.
  • Address Resolution Protocol (ARP). ARP is responsible for converting the IP addresses of outgoing packets into the hardware addresses needed to transmit them over a network using a LAN protocol such as Ethernet or Token Ring.
  • Internet Control Message Protocol (ICMP). ICMP is a protocol that IP uses to transmit error messages generated by Internet layer processes and to perform diagnostic functions on the network.

Link Layer

At the base of the model is the link layer. Each of the LAN, metropolitan area network (MAN), and WAN types, such as Ethernet, Token Ring, and Fiber Distributed Data Interface (FDDI), have different requirements for cables, signaling, and data encoding. The link layer in the TCP/IP stack specifies the requirements equivalent to the data-link and physical layers of the OSI reference model. The link layer is responsible for sending and receiving frames, which are packets of information transmitted on a network as a single unit. The link layer puts frames on the network and pulls frames off the network.

On LANs, the protocols responsible for link layer functionality are generally not part of the TCP/IP suite. Ethernet and Token Ring, for example, are separate protocols that can work with TCP/IP protocols but are not developmentally associated with them. The protocols often used for WAN connection, Point-to-Point Protocol (PPP) and Serial Line Internet Protocol (SLIP), are part of the TCP/IP suite, however.

PPP and SLIP are relatively simple protocols when compared to Ethernet and Token Ring, because they are designed for communications on a dedicated link only between two computers. LAN protocols typically use a shared network medium and must therefore deal with the problems of packet addressing and media access control. Windows 2000 supports both PPP and SLIP, but PPP is far more commonly used, because it provides greater security, configuration handling, and error detection than SLIP.

Windows 2000 supports only SLIP client functionality, not SLIP server functionality. The Windows 2000 Routing and Remote Access Service does not accept SLIP client connections.

Transmission Control Protocol

The Transmission Control Protocol (TCP) is a reliable, connection-oriented delivery service. In a reliable service, messages transmitted back to the sender acknowledge the data received by the destination systems. In a connection- oriented service, two computers must establish a connection before they can exchange application data. The connection establishment process ensures that the computers are ready to transmit and receive data before any application packets are sent. TCP uses byte-stream communications, which means that the data is treated as a sequence of bytes.

TCP achieves reliability by assigning a sequence number to each segment transmitted. If a segment is broken into smaller pieces in transit, the receiving host knows whether it has received all of the pieces. An acknowledgment message verifies that the other host received the data. The receiving host must return an acknowledgment (ACK) for the segments transmitted to it within a specified period. If the sender does not receive an ACK for particular segments, it retransmits the data. This system is called positive acknowledgment with retransmission. If the segment is received damaged, the receiving host discards it without sending an ACK. Because an ACK is not sent, the sender retransmits the segment.

Many Internet client applications, such as Web browsers and FTP clients, rely on TCP to transmit files. Virtually every application that transmits large amounts of data over a network uses TCP.

User Datagram Protocol

UDP offers a connectionless datagram service that guarantees neither delivery nor correct sequencing of delivered packets. UDP can use checksums for error correction purposes, but this service is optional, providing a way to exchange data over highly reliable networks without unnecessarily consuming network resources or processing time. UDP is used by applications that do not require an acknowledgment of data receipt. These applications typically transmit small amounts of data at one time. Broadcast transmissions use UDP, as do services and applications such as DNS, DHCP, and SNMP. UDP is also used in some high-bandwidth situations such as streaming media, which uses application layer protocols to ensure data delivery.

Internet Protocol

Although TCP separates data into discrete segments and is responsible for guaranteeing their delivery, IP does the actual delivery. At the IP layer, each incoming or outgoing packet is referred to as a datagram. Datagrams are, in essence, the envelopes that carry the messages generated by the protocols at the upper layers. IP adds the following header fields to each packet when it is passed down from the transport layer:

  • Source IP Address. Identifies the sender of the datagram by the IP address.
  • Destination IP Address. Identifies the ultimate destination of the datagram by the IP address.
  • Protocol. Informs IP at the destination host whether to pass the packet up to the TCP or UDP protocol at the transport layer.
  • Checksum. A simple mathematical computation that is used to verify that the packet's IP header information has not been damaged in transit.
  • Time to Live (TTL). Specifies the number of routers that a datagram is permitted to pass through on the way to its destination before it is discarded. This prevents packets from looping endlessly around an internetwork. Each router that forwards the packet decrements the TTL by one, and the router that decrements the value to 0 discards the packet. The default TTL value in Windows 2000 is 128.

IP Addressing

Every host on a TCP/IP network, be it a computer, router, or other device, must have a unique IP address, which is a 32-bit number that identifies both the host and the network on which the host is located. The IP address is strictly a network layer address and has no dependence on data-link layer addresses, such as the hardware addresses coded into network interface adapters. IP addresses are normally expressed in dotted-decimal format, which is four numbers separated by periods, such as 192.168.123.132. Each of the four numbers (called bytes, octets, or quads) represents eight bits of the binary address, ranging from the value 00000000 to 11111111. In decimal notation, the equivalents of these values are 0 to 255.

The division of the IP address into a network identifier and a host identifier is what makes it possible for TCP/IP to route data packets to other networks. The division between the network bits and the host bits can vary. An IP address in Windows 2000 (and on most operating systems) is accompanied by a second 32-bit number called a subnet mask. The subnet mask looks something like an IP address because it uses the same dotted decimal notation, but it has a different function. When the subnet mask is written in binary form and compared to the IP address, the 1s identify the network bits in the IP address and the 0s identify the host bits. Thus, if an IP address has 255.255.0.0 as its subnet mask, the first 16 bits (or two octets) of the IP address are the network identifier and the last 16 bits are the host identifier. You can understand this more easily if you convert the subnet mask to its binary form, which is 11111111 11111111 00000000 00000000.

For a TCP/IP internetwork to work efficiently as a collection of networks, the routers that pass packets of data between networks do not need to know the exact location of each host for which a packet is destined. Routers only know what network the host is a member of and use the information stored in their routing tables to determine how to get the packet to the destination host's network. After the packet is delivered to the destination's network, the local router can deliver it to the appropriate host.

Understanding IP Address Classes

For a computer to communicate on the Internet, it must use an IP address that is registered with the Internet Assigned Numbers Authority (IANA). This prevents the duplication of addresses. The IANA assigns network identifiers only; it is up to the network administrator to assign a unique host identifier to each computer on the network. The network addresses that the IANA assigns are divided into classes, based on the size of the network. The addresses used to build registered networks are either Class A, B, or C. Classes D and E do exist, but they are used for special purposes. Each of the address classes has a different default subnet mask, because it uses a different number of bits as the network identifier, as shown in Figure 13.2.

Figure 13.2 IP address classes
In practice, you do not contact the IANA directly to obtain a network address. All of the network identifiers in the IP address space have long been assigned to Internet service providers (ISPs) and other users. Instead, you obtain registered addresses through an ISP, which typically registers a large network address and then provides segments of it to subscribers.

Table 13.1 lists the characteristics for the three IP address classes. You can identify the class of an IP address by looking at the binary value of its first octet. For example, a Class A address always begins with a 0 as the value of its first bit. This means that the possible values for the first octet range from 00000000 to 01111111, in binary form. In decimal form, this is 0 to 127.

Table 13.1 IP Address Classes and Their Parameters

 | Class A | Class B | Class C
First Bits | 0 | 10 | 110
First Octet Values | 1 through 127 | 128 through 191 | 192 through 223
Network ID Bits | 8 | 16 | 24
Host ID Bits | 24 | 16 | 8
Number of Networks | 126 | 16,384 | 2,097,152
Number of Hosts | 16,777,214 | 65,534 | 254
Subnet Mask | 255.0.0.0 | 255.255.0.0 | 255.255.255.0

Because a Class A address uses only eight bits for its network identifier, only 126 possible Class A addresses exist, each of which can support more than 16 million hosts. Obviously no single network has 16 million computers on it, so Class A addresses are always broken up into segments called subnets. Creating multiple subnets out of a single registered network address is the true function of the subnet mask. To create a subnet, you borrow a number of bits from the host identifier and use them as part of the network identifier, which is called a subnet identifier.

As an example, you can take a Class A address, which normally uses a subnet mask of 255.0.0.0, and allocate the second quad for use as a subnet identifier. The subnet mask then becomes 255.255.0.0. You can then create up to 256 subnets consisting of 65,534 hosts each out of that single Class A address. You can use any number of bits for the subnet identifier, which enables you to subnet a Class A, B, or C address as needed. When the division between the identifiers falls in the middle of an octet, the process of determining the IP addresses you should use in your network is more complicated, but it is still feasible.

No hard and fast rules govern how to assign IP addresses to the computers on your network, so be sure to assign valid network and host identifiers. You should follow several general guidelines when planning your address assignments, which are as follows:

  • The first octet of the network identifier cannot be 127. This value is reserved for loopback and diagnostic functions.
  • The network and host identifier bits cannot all be 1s. If all bits are set to 1, the address is interpreted as a broadcast rather than a host identifier.
  • The network and host identifier bits cannot all be 0s. If all bits are set to 0, the address is interpreted to mean "this network only."
  • The host identifier for each computer must be unique to the local network identifier.
  • A unique network identifier is required for each network and wide area connection. If you are connecting to the Internet, you must obtain a registered network identifier.
  • All TCP/IP hosts, including interfaces to routers, require unique host identifiers. The host identifier of the router is the IP address configured as a workstation's default gateway.
  • Each host on a TCP/IP network requires a subnet mask-either a default subnet mask, which is used when a network is not divided into subnets, or a custom subnet mask, which is used when a network is divided into subnets.

Using Private Addresses

Registered IP addresses are required for computers that are accessible from the Internet but not by every computer that is connected to the Internet. For security reasons, networks typically use a firewall or some other technology to protect their systems from intrusion by outside computers. These firewalls use various techniques that provide workstations with access to Internet resources without making them accessible to other systems on the Internet.

These workstations typically use unregistered private IP addresses, which the network administrator can freely assign without obtaining them from an ISP or the IANA. Special network addresses occur in each class, shown in Table 13.2, that are intended for use on private networks and are not registered to anyone. When building your own private network, you should use these addresses rather than simply choosing an address at random.

Table 13.2 IP Addresses for Private Networks

Class | Network Address
A | 10.0.0.0 through 10.255.255.255
B | 172.16.0.0 through 172.31.255.255
C | 192.168.0.0 through 192.168.255.255

IP Routing

Routing is the process of choosing a path over which to send packets, which is a primary function of IP. A router (also referred to as a gateway, in TCP/IP terminology) is a device that forwards the packets from one physical network to another. When a router receives a packet, the network interface adapter passes the datagrams up to IP at the Internet layer. IP examines the destination address on the datagram and then compares it to a routing table. The computer then makes a decision as to where the packet is to be forwarded.

A router helps LANs and WANs achieve interoperability and connectivity and can link LANs that have different network topologies, such as Ethernet and Token Ring. Each packet sent over a LAN has a packet header that contains source and destination address fields. Routers match packet headers to a LAN segment and choose the best path for the packet, optimizing network performance. For example,if a packet is sent from a computer on Network A to a computer on Network C, as illustrated in Figure 13.3, the best route uses only one hop. If Router 1 is the default router for the computers on Network A, the packet is routed through Router 3, which is two hops. As each route is found, the packet is sent to thenext router, called a hop, until finally delivered to the destination host. If a route is not found, the packet is discarded and an error message sent to the source host.

Figure 13.3 Packet routed from a computer on Network A to computer on Network C

To make routing decisions, the IP layer consults a routing table that is stored in memory. A routing table is a series of entries, called routes, that contain information about where the network identifiers that comprise the internetwork are located. A routing table in a computer that is running Windows 2000 is built automatically based on its TCP/IP configuration. You can view a routing table by typing route print at a command prompt.

The routing table is not exclusive to a router. Hosts also have a routing table that is used to forward packets to their destinations.

Static and Dynamic IP Routing

The process that routers use to obtain routing information differs based on whether the router performs static or dynamic IP routing. Static routing is a function of IP that limits you to fixed routing tables. Static routers require that routing tables are built and updated manually. You use the Route.exe command to add static entries to the routing table.

If a route changes, static routers do not inform each other of the change, nor do static routers exchange routes with dynamic routers. By contrast, dynamic routing automatically updates the routing tables, reducing administrative overhead. However, dynamic routing increases traffic in large networks. Dynamic routing is a function of routing protocols, such as the Routing Information Protocol (RIP) and Open Shortest Path First (OSPF). Dynamic routers use routing protocols to periodically transmit the contents of their routing tables to the other routers on the network. If a route changes, the other routers are automatically informed of the change and can modify their tables accordingly. For a computer running Windows 2000 to function as a dynamic router, it must have two network interfaces, and the Routing and Remote Access Service must be running.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. What is the purpose of a subnet mask?
  2. What is the difference between static routing and dynamic routing?
  3. What is the primary protocol operating at the Internet layer?
    1. TCP
    2. ICMP
    3. ARP
    4. IP

Lesson Summary

  • Transmission Control Protocol/Internet Protocol (TCP/IP) uses a conceptual model that consists of four layers: application, transport, Internet, and link.
  • Internet Protocol (IP) is the primary protocol of the Internet layer, used to carry most of the data generated by the upper layer protocols.
  • Transmission Control Protocol (TCP) is a connection-oriented protocol that provides a reliable delivery service for applications that generate large amounts of data.
  • User Datagram Protocol (UDP) is a connectionless protocol that is used to transmit relatively small amounts of data without packet acknowledgments.
  • Every computer on a TCP/IP network must have a unique IP address, consisting of a network identifier and a host identifier.


Lesson 2: Configuring TCP/IP Clients

This lesson describes the procedures for installing and configuring the Microsoft TCP/IP client. Although it is possible to avoid manually installing and configuring TCP/IP by installing Windows 2000 with its default settings and using DHCP to configure the network's TCP/IP clients, a network administrator should be familiar with the procedures.

After this lesson, you will be able to

  • Install the Internet Protocol (TCP/IP) module in Windows 2000
  • Manually configure the Windows 2000 TCP/IP client
  • Configure the TCP/IP client to use DHCP
  • View the current TCP/IP settings

Estimated lesson time: 35 minutes

Installing TCP/IP

TCP/IP protocols can be used in network environments ranging from small LANs to the global Internet. When you install the Windows 2000 operating system, the setup program installs TCP/IP as the default network protocol if it detects a network interface adapter in the computer. Therefore, you need to manually install TCP/IP only if the default protocol selection was overridden during setup or if you have deleted it from a connection in the Network And Dial-Up Connections Control Panel.

Although TCP/IP refers to a suite of protocols, Windows 2000 implements them as a single module called Internet Protocol (TCP/IP), which you install from the Network And Dial-Up Connections Control Panel. If you have more than one network interface in the computer (such as two network interface adapters or one network interface adapter and a modem), installing the Internet Protocol (TCP/IP) module once binds the protocols to both network interfaces. You can unbind the protocols from one or both interfaces later, if needed.

To install TCP/IP on a computer running Windows 2000, use the following procedure:

  1. Log on to the computer using an account with administrative privileges.
  2. Click Start, point to Settings, and then select Network And Dial-Up Connections to display the Network And Dial-Up Connections dialog box.
  3. Right-click the Local Area Connection icon and, from the pop-up menu, choose Properties to display the Local Area Connection Properties dialog box, as shown in Figure 13.4.
  4. Click Install to open the Select Network Component Type dialog box.

    Figure 13.4 The Local Area Connection Properties dialog box
  5. In the Select Network Component Type dialog box, select Protocol and click Add. The Select Network Protocol dialog box appears.
  6. In the Select Network Protocol dialog box, select Internet Protocol (TCP/IP) in the Network Protocol list and click OK. You might be prompted to supply a source for the Windows 2000 installation files, after which the TCP/IP protocol module is installed and added to the Components list in the Local Area Connection Properties dialog box.
  7. Click Close.

Configuring TCP/IP

If you are implementing TCP/IP for the first time on your network, you should create a detailed plan for the IP addressing you use on the network. The plan should include whether you intend to use public or private addresses on your network, how you assign addresses to the computers, and what addresses you assign, along with the values for the other TCP/IP configuration parameters, such as subnet masks, default gateways, and DNS server addresses.

If your network is not connected to the Internet, you can use either registered or private addresses. However, most networks today are connected to the Internet in some fashion, and, if this is the case, you can most likely implement some public IP addresses for Internet connectivity. This is because devices connected directly to the Internet require a registered IP address. If you have a dial-up connection to the Internet, your ISP automatically assigns a registered IP address to your modem connection when you log on. If you have a router providing your network with Internet access, at least one of the router's network interfaces must have a registered address, even if you use private addresses on the rest of the network. Using a firewall of some type typically enables you to use private IP addresses for all of your workstations, which protects them from unauthorized access through the Internet connection. These are all elements that you should consider while developing your IP addressing plan, long before you actually begin installing and configuring TCP/IP on your network's computers.

When configuring the Windows 2000 TCP/IP client, you can assign IP addresses dynamically using DHCP, and you can use Automatic Private IP Addressing. You can also configure TCP/IP manually with values of your own choosing. Generally speaking, the method you use to configure TCP/IP on a computer should be based on your network configuration and on the computer's function. For example, whereas you might use DHCP to dynamically configure your workstations, some servers still require manual configuration to ensure that their IP addresses do not change. The following sections describe the various types of TCP/IP configuration procdures you can use.

Configuring TCP/IP with DHCP

By default Windows 2000 computers attempt to obtain TCP/IP configuration parameters from a DHCP server on the network. If a static TCP/IP configuration is currently implemented on a computer, you can implement a dynamic TCP/IP configuration by performing the following procedure:

  1. Click Start, point to Settings, and then select Network And Dial-Up Connections.
  2. Right-click the Local Area Connection icon and, from the pop-up menu, choose Properties to display the Local Area Connection Properties dialog box.
  3. In the General tab, select Internet Protocol (TCP/IP), and then click Properties to open the Internet Protocol (TCP/IP) Properties dialog box shown in Figure 13.5.

    Figure 13.5 Configuring your computer to obtain TCP/IP settings automatically
  4. Select Obtain An IP Address Automatically and then click OK.

Configuring TCP/IP Manually

Some servers, such as DHCP, DNS, and Windows Internet Naming Service (WINS) servers, as well as computers functioning as Internet Web and FTP servers, should be assigned an IP address manually. In addition, if you do not have a DHCP server on your network, you must configure TCP/IP computers manually to use a static IP address. To manually configure the TCP/IP parameters of a Windows 2000 computer, use the following procedure:

  1. Click Start, point to Settings, and then select Network And Dial-Up Connections.
  2. Right-click the Local Area Connection icon and, from the pop-up menu, choose Properties to display the Local Area Connection Properties dialog box.
  3. In the General tab (see Figure 13.5), select Internet Protocol (TCP/IP), and then click Properties to open the Internet Protocol (TCP/IP) Properties dialog box.
  4. Select Use The Following IP Address.
  5. Enter a value in the IP Address text box. The address you supply must be unique on your network and must conform to the addressing scheme you previously planned for your network.
  6. Enter a value in the Subnet Mask text box. The subnet mask value must conform to the subnetting strategy in use on your network.
  7. (Optional) Enter a value in the Default Gateway text box. The address you enter in this box must be that of a router connected to the same LAN as the computer you are configuring, which provides access to other connected networks. If you are configuring a computer on a stand-alone LAN using the same subnet, you can leave this box blank.
  8. (Optional) Select Use The Following DNS Server Addresses and enter the IP addresses of DNS servers in the Preferred DNS Server and Alternate DNS Server text boxes. If the computer accesses the Internet through the LAN, or if your network uses DNS for host name resolution, you must supply values for these boxes. On a stand-alone LAN that does not use DNS, you can leave these boxes blank.

You can also configure the Microsoft TCP/IP client with additional IP addresses, subnet masks, and default gateways. If a network is configured so that a single physical network contains two or more IP subnets, it might be necessary for the computers to have more than one IP address, so that they can communicate with the computers on each of the subnets. Configuring the Microsoft TCP/IP client with multiple default gateway addresses is a fault tolerance measure. If the first default gateway address is unreachable, the computer proceeds to use the next one.

To configure additional IP addresses and default gateways, use the following procedure:

  1. In the Internet Protocol (TCP/IP) Properties dialog box, click Advanced to display the Advanced TCP/IP Settings dialog box, as illustrated in Figure 13.6.

    Figure 13.6 The Advanced TCP/IP Settings dialog box
  2. In the IP Settings tab, in the IP Addresses box, click Add to display the TCP/IP Address dialog box.
  3. In the IP Address and Subnet Mask text boxes, type an IP address and subnet mask, and then click Add.
  4. Repeat Steps 2 and 3 for each IP address you want to add.
  5. In the IP Settings tab, in the Default Gateways box, click Add to display the TCP/IP Gateway Address dialog box.
  6. In the Gateway text box, type the IP address of the default gateway you want to add.
  7. In the Metric text box, enter a value that you want to appear as the metric for the gateway in the computer's routing table. Windows 2000 always selects the router with the lower metric when forwarding packets.
  8. Click Add.
  9. Repeat Steps 5 through 8 for each default gateway you want to add, and then click OK.
You learn how to configure a client to use a WINS server in Chapter 15, "Windows Name Resolution."

Using Automatic Private IP Address Assignment

Another TCP/IP address configuration option is to use Automatic Private IP Addressing when DHCP is not available. In previous versions of Windows, IP address configuration could be performed either manually or dynamically through DHCP. If a client was not able to obtain an IP address from a DHCP server, network services for the client were unavailable. The Automatic Private IP Addressing feature of Windows 2000 automates the process of assigning an unused IP address to the computer in the event that a DHCP server is not available.

Windows 2000 selects an Automatic Private IP Addressing address from the Microsoft-reserved address block 169.254.0.0, with the subnet mask 255.255.0.0. When a Windows 2000 computer configured to use DHCP fails to contact a DHCP server, the operating system uses the Automatic Private IP Addressing feature to assign itself an IP address ranging from 169.254.0.1 through 169.254.255.254. The computer uses the assigned IP address until it successfully contacts a DHCP server, from which it retrieves a new address.

Testing TCP/IP with Ipconfig and Ping

You should always verify and test your TCP/IP configuration to make sure your computer can connect to other TCP/IP hosts and networks. You can perform basic TCP/IP configuration testing using the Ipconfig.exe and Ping utilities.

With Ipconfig, you verify the TCP/IP configuration parameters on a host, including the IP address, subnet mask, and default gateway, from a command prompt. This is useful in determining whether the configuration is initialized or if a duplicate IP address is configured. When you use DHCP to configure the TCP/IP client, Ipconfig is the best way to see what parameters have been assigned to the computer.

To use Ipconfig, open a command prompt window, type Ipconfig, and press Enter. The program displays the TCP/IP configuration information.

After you verify the configuration with the Ipconfig utility, you can use the Ping utility to test connectivity. The Ping utility is a diagnostic tool that tests TCP/IP configurations and diagnoses connection failures. Ping uses the Internet Control Message Protocol (ICMP) Echo Request and Echo Reply messages to determine whether a particular TCP/IP host is available and functional. Like the Ipconfig utility, the Ping utility is executed at the command prompt. The command syntax is:

Ping IP_Address

If Ping is successful, a message similar to the illustration in Figure 13.7 appears.

For more information about using Ipconfig and Ping, as well as other TCP/IP utilities, see Lesson 3.
Figure 13.7 Reply messages displayed by the Ping utility

Exercise 13.1: Installing and Configuring TCP/IP

In this exercise, you use Ipconfig and Ping to verify your computer's configuration. Then you configure your computer to use a static IP address and verify the computer's new configuration. Next, you configure the computer to use a DHCP server to automatically assign it an IP address, whether or not a DHCP server is available on your network. Finally, you test the Automatic Private IP Addressing feature in Windows 2000 by disabling the DHCP server, if one exists on your network.

To complete this exercise, you need a computer running Windows 2000, connected to a LAN, with TCP/IP as the only installed protocol. You also need a server on the network running the DHCP Service to provide IP addresses. If you are working on a computer that is not part of a network or a server running the DHCP Service is not available, you cannot perform certain procedures in this exercise.

In Table 13.3, record the IP address, subnet mask, and default gateway that your network administrator provides for you to use during this practice. Also, ask your network administrator whether you can use another computer to test your computer's connectivity and record the IP address of that computer as well. If you are not on a network, you can use the suggested values.

Table 13.3 TCP/IP Configuration Parameters for Exercise 13.1

Variable Value | Suggested Value | Your Value
Static IP address | 192.168.1.201 |
Subnet mask | 255.255.255.0 |
Default gateway (if required) | None |
Computer to test connectivity | N/A |

Procedure 1: Verifying a Computer's TCP/IP Configuration

To use Ipconfig and Ping to verify your computer's configuration, complete the following steps:

  1. Open a command prompt window.
  2. At the command prompt, type ipconfig /all | more and then press Enter. The Windows 2000 IP Configuration utility displays the TCP/IP configuration of the physical and logical adapters configured on your computer.
  3. Press Spacebar as necessary to display the heading containing the words Local Area Connection. Use the information displayed in this section to complete as much of Table 13.4 as possible. Press Spacebar to display additional information as necessary, and to return to the command prompt.

    Table 13.4 Current TCP/IP Configuration Settings

    Setting Value

    Host name

    Description

    Physical address

    DHCP enabled

    Autoconfiguration enabled

    IP address

    Subnet mask

    Default gateway

    DNS servers

  4. To verify that the TCP/IP stack is working and configured for your adapter, type ping 127.0.0.1 and press Enter. A response similar to the following indicates a successful ping:
            Pinging 127.0.0.1 with 32 bytes of data:

        Reply from 127.0.0.1: bytes=32 time<10ms TTL=128
            Reply from 	127.0.0.1: bytes=32 time<10ms TTL=128
            Reply from 127.0.0.1: bytes=32 time<10ms TTL=128
            Reply from 127.0.0.1: bytes=32 time<10ms TTL=128

        Ping statistics for 127.0.0.1:
                Packets: Sent = 4, Received = 4, Lost = 0 <0% loss>,
            Approximate round trip times in milliseconds:

                Minimum = 0ms, Maximum = 0ms, Average = 0ms
  5. Minimize the command prompt window.

Procedure 2: Configuring TCP/IP to Use a Static IP Address

To configure TCP/IP to use a static IP address, complete the following steps:

  1. Right-click My Network Places on the desktop and, from the pop-up menu, choose Properties to display the Network And Dial-Up Connections window.
  2. Right-click the Local Area Connection icon and, from the pop-up menu, choose Properties to display the Local Area Connection Properties dialog box containing the network interface adapter in use and the network components used in this connection.
  3. Click Internet Protocol (TCP/IP) and verify that the check box to the left of the entry is selected.
  4. Click Properties to display the Internet Protocol (TCP/IP) Properties dialog box.
  5. Select Use The Following IP Address.
  6. In the IP Address text box, the Subnet Mask text box, and the Default Gateway text box (if required), type the values that you entered in Table 13.3 or the suggested values listed in the table.
    Be careful when manually entering IP configuration settings, especially numeric addresses. The most frequent cause of TCP/IP connection problems is incorrectly entered IP address information.
  7. Click OK to return to the Local Area Connection Properties dialog box.
  8. Click OK to close the Local Area Connection Properties dialog box.
  9. Minimize the Network And Dial-Up Connections window.
  10. To test the static IP configuration, restore the command prompt, type ipconfig /all | more, and then press Enter. The Windows 2000 IP Configuration utility displays the physical and logical adapters configured on your computer.
  11. Press Spacebar as needed to scroll through the configuration information and locate the local area connection information. Record the current TCP/IP configuration settings for your local area connection in Table 13.5.

    Table 13.5 Static TCP/IP Configuration Settings

    Setting Value

    IP address

    Subnet mask

    Default gateway

    How do the results compare with the information you recorded in Table 13.4?

  12. To verify that the IP address is working and configured for your adapter, type ping 127.0.0.1 and then press Enter. What happens?
  13. If you have a computer that you can use to test connectivity, type ping ip_address (where ip_address is the IP address of the computer you are using to test connectivity), and then press Enter. (If you don't have a computer to test connectivity, skip this step.) What happens?
  14. Minimize the command prompt window.

Procedure 3: Configuring TCP/IP to Automatically Obtain an IP Address

To configure TCP/IP to automatically obtain an IP address from a DHCP server and then test the configuration to verify that the DHCP Service has provided the appropriate IP addressing information, complete the following steps. Be sure to perform the first part of this procedure even if you have no DHCP server on your network, because you also use these settings in Procedure 4.

  1. Restore the Network And Dial-Up Connections window and then right-click the Local Area Connection icon. From the pop-up menu, choose Properties to display the Local Area Connection Properties dialog box.
  2. Click Internet Protocol (TCP/IP) and verify that the check box to the left of the entry is selected.
  3. Click Properties to display the Internet Protocol (TCP/IP) Properties dialog box.
  4. Select Obtain An IP Address Automatically. What happens?
  5. Click OK to close the Internet Protocol (TCP/IP) Properties dialog box.
  6. Click OK to close the Local Area Connection Properties dialog box.
  7. Minimize the Network And Dial-Up Connections window.
    If a server running the DHCP Service is not available to provide an IP address, skip to Procedure 4.
  8. To test the DHCP client, restore the command prompt, type ipconfig /release, and then press Enter. This command releases any existing DHCP address leases that might exist.
  9. At the command prompt, type ipconfig /renew and then press Enter. This command requests a new TCP/IP configuration from the DHCP server.
  10. At the command prompt, type ipconfig /all | more and then press Enter.
  11. Pressing Spacebar as necessary, record the current TCP/IP configuration settings for your local area connection in Table 13.6.

    Table 13.6 DHCP Client Configuration Parameters

    Setting Value

    IP address

    Subnet mask

    Default gateway

    How do the results in the table compare with the previous settings you recorded in Table 13.5?

  12. To test that TCP/IP is working and bound to your adapter, type ping 127.0.0.1, and then press Enter. What happens?

Procedure 4: Obtaining an IP Address Using Automatic Private IP Addressing

In this procedure, if you have a server running the DHCP Service, you must disable the service (or ask an administrator to do it) so that DHCP is not available to provide an IP address for your computer. Without a DHCP server available to provide an IP address, the Windows 2000 Automatic Private IP Addressing feature provides a unique IP address for your computer.

  1. At the command prompt, type ipconfig /release and then press Enter.
  2. At the command prompt, type ipconfig /renew and then press Enter. Wait while Windows 2000 locates the DHCP server on the network. What message appears, and what does it indicate?
  3. At the command prompt, type ipconfig | more and then press Enter.
  4. Pressing Spacebar as necessary, view the current TCP/IP settings for your local area connection. Is this the same IP address assigned to your computer in Procedure 3? Why or why not?
  5. Restore the TCP/IP settings for the computer to their original values, as recorded in Table 13.4, either by manually entering the values or reenabling the DHCP.
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Which of the following is a valid reason for assigning more than one IP address to a single network interface adapter?
    1. To balance the network traffic load between the addresses
    2. To support multiple subnets on one network
    3. To provide fault tolerance
    4. To support both TCP and UDP traffic
  2. How many default gateway addresses does a computer need to function on a LAN?
    1. 0
    2. 1
    3. 2
    4. 3
  3. Your computer running Windows 2000 Client for Microsoft Networks was configured manually for TCP/IP. You can connect to any host on your own subnet, but you cannot connect to or even ping any host on a remote subnet. What is the likely cause of the problem and how would you fix it?

Lesson Summary

  • Windows 2000 installs the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol module by default if the setup program detects a network interface adapter in the computer.
  • You can manually install TCP/IP from the Network And Dial-up Connections Control Panel.
  • You can configure the TCP/IP parameters manually on a computer running Windows 2000, or you can use DHCP to automatically assign parameters.
  • The Windows 2000 TCP/IP client is configured by default to use DHCP. If a DHCP server is not available, the Windows 2000 Automatic Private IP Addressing feature assigns an address to the computer.
  • To configure TCP/IP manually, open the Internet Protocol (TCP/IP) Properties dialog box and enter values into the available fields.


Lesson 3: Using TCP/IP Utilities

Virtually every operating system with networking capabilities includes support for the TCP/IP protocols, and in most cases TCP/IP includes an assortment of utilities that enable you to gather information about the various protocols and the network. Traditionally, these utilities run from the command line, although graphical versions are sometimes supplied. In many cases, a program uses the same syntax, even on different operating systems. This lesson examines some of the most common TCP/IP utilities and the purposes for which they are used.

After this lesson, you will be able to

  • Understand the functions of the primary TCP/IP utilities

Estimated lesson time: 20 minutes

Using Ping

Ping is the most basic of the TCP/IP utilities. Virtually every TCP/IP implementation includes a version of it. In Windows 2000, the program is called Ping.exe. Ping is a command-line utility that can tell you if the TCP/IP stack of another system on the network is functioning normally. The Ping program generates a series of Echo Request messages using ICMP and transmits them to the computer whose name or IP address you specify on the command line. The basic syntax of the Ping program is as follows:

ping target

The target variable contains the IP address or name of a computer on the network. You can use either DNS names or NetBIOS names in ping commands. The program resolves the name into an IP address before sending the Echo Request messages, and it then displays the address in its readout. Most Ping implementations also have command-line switches that enable you to modify the operational parameters of the program, such as the number of Echo Request messages it generates and the amount of data in each message.

Most TCP/IP computers respond to any Echo Request messages they receive that are addressed to them by generating Echo Reply messages and transmitting them back to the sender. When the computer that initiated the Ping request receives the Echo Reply messages, it produces a display like the following:

Pinging cz1 [192.168.2.10] with 32 bytes of data:

Reply from 192.168.2.10: bytes=32 time<10ms TTL=128
Reply from 192.168.2.10: bytes=32 time<10ms TTL=128
Reply from 192.168.2.10: bytes=32 time<10ms TTL=128
Reply from 192.168.2.10: bytes=32 time<10ms TTL=128

Ping statistics for 192.168.2.10:
   Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
   Minimum = 0ms, Maximum =  0ms, Average =  0ms

In Windows 2000 Ping implementation, the display shows the IP address of the computer receiving the Echo Requests, the number of bytes of data included with each request, the elapsed time between the transmission of each request and the receipt of each reply, and the value of the Time to Live (TTL) field in the IP header. In this particular example, the target computer was on the same LAN, so the time measurement is very short-less than 10 milliseconds. When pinging a computer on the Internet, the interval is likely to be longer. A successful use of Ping like this one indicates that the target computer's networking hardware is functioning properly, as are the protocols, at least as high as the network layer of the OSI reference model. If the Ping test fails, one or both of the computers might be experiencing a problem with its networking hardware or software.

Using Traceroute

Traceroute is a variant of the Ping program that displays the path that packets take to their destination. Because of the nature of IP routing, paths through an internetwork can change from minute to minute, and Traceroute displays a list of the routers that are currently forwarding packets to a particular destination. The program is called traceroute on UNIX systems, and Tracert.exe by Windows.

Traceroute uses ICMP Echo Request and Echo Reply messages just like Ping, but it modifies the messages by changing the value of the TTL field in the IP header. The TTL field is designed to prevent packets from getting caught in router loops that keep them circulating endlessly around the network. The computer generating the packet normally sets a relatively high value for the TTL field; on Windows systems, the default value is 128. Each router that processes the packet reduces the TTL value by one. If the value reaches zero, the last router discards the packet and transmits an ICMP error message back to the original sender.

When you start the Traceroute program with the name or IP address of a target computer, the program generates its first set of Echo Request messages with TTL values of 1. When the messages arrive at the first router on their path, the router decrements their TTL values to 0, discards the packets, and reports the errors to the sender. The error messages contain the router's IP address, which the Traceroute program displays as the first hop in the path to the destination. Traceroute's second set of Echo Request messages use a TTL value of 2, causing the second router on the path to discard the packets and generate error messages. The Echo Request messages in the third set of have a TTL value of 3, and so on. Each set of packets travels one hop farther than the previous set before causing a router to return error messages to the source. The list of routers displayed by Traceroute as the path to the destination is the result of these error messages. The following is an example of a Traceroute display:

Tracing route to www.microsoft.co.uk [173.146.1.1] over a maximum of 30 hops:
     1  <10 ms   1 ms  <10  ms  192.168.2.99
     2  105 ms  92	ms  98	ms  qrvl-67terminal01.epoch.net [199.24.67.3]
     3  101	ms  110	ms  98	ms  qrvl.epoch.net [199.24.67.1]
     4  123	ms  109	ms  118	ms  svcr03-7b.epoch.net [199.24.103.125]
     5  123	ms  112	ms  114	ms  clsm02-2.epoch.net [199.24.88.26]
     6  136	ms  130	ms  133	ms  sl-gw19-pen-6-1-0-T3.sprintlink.net
[144.228.116.5]
     7  143	ms  126	ms  138	ms  sl-bb10-pen-4-3.sprintlink.net
[144.232.5.117]
     8  146	ms  129	ms  133	ms  sl-bb20-pen-12-0.sprintlink.net
[144.232.5.1]
     9  131	ms  128	ms  139	ms  sl-bb20-nyc-13-0.sprintlink.net
[144.232.18.38]
    10  130	ms  134	ms  134	ms  sl-gw9-nyc-8-0.sprintlink.net [144.232.7.94]
    11  147	ms  149	ms  152	ms  sl-demon-1-0.sprintlink.net [144.232.173.10]
    12  154	ms  146	ms  145	mS  ny2-backbone-1-ge021.router.demon.net
[195.173.173.121]
    13  230	ms  225	ms  226	ms  tele-backbone-1-ge023.router.demon.net [195.173.173.12]
    14  233	ms  220	ms  226	ms  tele-core-3-fxp1.router.demon.net
[194.159.252.56]
    15  223	ms  224	ms  224	ms  tele-access-1-14.router.demon.net
[194.159.254.245]
    16  236	ms  221	ms  226	ms  tele-service-2-165.router.demon.net
[194.159.36.149]
    17  220	ms  224	ms  210	ms  www.microsoft.co.uk [173.146.1.1]
Trace complete.

In this example, Traceroute is displaying the path between a computer in Pennsylvania and one in the United Kingdom. Each of the hops contains the elapsed times between the transmission and reception of three sets of Echo Request and Echo Reply packets. In this trace, you can clearly see the point at which the packets begin traveling across the Atlantic Ocean. At hop 13, the elapsed times increase from approximately 150 to 230 milliseconds and stay in that range for the subsequent hops. This additional delay of only 80 milliseconds is the time it takes the packets to travel the thousands of miles across the Atlantic Ocean.

Traceroute can be a handy tool for isolating the location of a network communications problem, particularly when a router is the cause of the problem. Ping simply tells you whether or not a problem exists; it cannot tell you where. A failure to contact a remote computer could be due to a problem in your workstation, in the remote computer, or in any of the routers in between. Traceroute can tell you how far your packets are going before they run into the problem, and identify the router that is failing to properly forward the packets.

Because the configuration of the Internet is constantly changing, you have no guarantee that the route displayed by the Traceroute program is completely accurate when you use it to trace an Internet route. The IP datagrams that execute each step of the Traceroute process might in fact be taking different routes to the same destination, resulting in the display of a composite route between two points that does not actually exist.

Using Pathping

The Pathping.exe program is a route tracing tool that combines features of the Ping and Tracert programs with additional information that neither of these utilities provides. The Pathping command sends packets to each router on the way to a final destination over a period of time, and then computes results based on the packets returned from each hop. Because the command shows the degree of packet loss at any given router or link, it is easy to determine which routers or links might be causing network problems.

The following is a typical Pathping report. The compiled statistics that follow the hop list indicate packet loss at each individual router.

D:\>pathping -n msw

Tracing route to msw [7.54.1.196]
over a maximum of 30 hops:
 0  172.16.87.35
 1  172.16.87.218
 2  192.168.52.1
 3  192.168.80.1
 4  10.54.247.14
 5  10.54.1.196

Computing statistics for 125 seconds...
           Source to Here   This Node/Link
Hop  RTT    Lost/Sent = Pct  Lost/Sent = Pct  Address
 0                                           172.16.87.35
                               0/ 100 =  0%   |
 1   41ms     0/ 100 =  0%     0/ 100 =  0%  172.16.87.218
                              13/ 100 = 13%   |
 2   22ms    16/ 100 = 16%     3/ 100 =  3%  192.168.52.1
                               0/ 100 =  0%   |
 3   24ms    13/ 100 = 13%     0/ 100 =  0%  192.168.80.1

                               0/ 100 =  0%   |
 4   21ms    14/ 100 = 14%     1/ 100 =  1%  10.54.247.14
                               0/ 100 =  0%   |
 5   24ms    13/ 100 = 13%     0/ 100 =  0%  10.54.1.196

Trace complete.

When Pathping is run, you first see the results for the route as it is tested for problems. This is the same path that is shown by the Tracert command. The Pathping command then displays a busy message for the next 125 seconds (this time varies by the hop count). During this time, Pathping gathers information from all the routers previously listed and from the links between them. At the end of this period, it displays the test results.

The two rightmost columns-This Node/Link Lost/Sent = Pct and Address-contain the most useful information. The link between 172.16.87.218 (hop 1), and 192.168.52.1 (hop 2) is dropping 13 percent of the packets. All other links are working normally. The routers at hops 2 and 4 also drop packets addressed to them (as shown in the This Node/Link column), but this loss does not affect their forwarding path.

The loss rates displayed for the links (marked as | in the rightmost column) indicate losses of packets being forwarded along the path. This loss indicates link congestion. The loss rates displayed for routers (indicated by their IP addresses in the rightmost column) indicate that the CPUs for those routers might be overloaded. These congested routers might also be a factor in end-to-end problems, especially if packets are forwarded by software routers.

Using Ipconfig.exe

UNIX systems have a program called ifconfig (the name is derived from interface configuration) that you use to assign TCP/IP configuration parameters to a particular network interface. Running ifconfig with just the name of an interface displays the current configuration of that interface. Windows 2000 has a version of this program, Ipconfig.exe, which omits the configuration capabilities and retains the configuration display. Microsoft Windows Me, Microsoft Windows 98, and Microsoft Windows 95 include a graphical version of the utility called Winipcfg.exe.

Running the program with no parameters at the Windows 2000 command line displays a limited list of configuration data. When you run Ipconfig.exe with the /all parameter, you see a display like the following:

Windows 2000 IP Configuration
Host Name  . . . . . . . . . . . . .  :cz2-w2ksvr
Primary DNS SuffiX . . . . . . . . .  :zacker2.com
Node Type  . . . . . . . . . . . . .  :Hybrid
IP Routing Enabled . . . . . . . . .  :Yes
WINS Proxy Enabled . . . . . . . . .  :No
DNS Suffix Search List . . . . . . .  :zacker2.com
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . . .  :
Description  . . . . . . . . . . . .  :3Com EtherLink XL 10/100 PCI For
Complete PC Management NIC (3C905C-TX)
Physical Address . . . . . . . . . .  :00-01-02-68-24-DD
DHCP Enabled . . . . . . . . . . . .  :No
IP Address . . . . . . . . . . . . .  :192.168.2.2
Subnet Mask  . . . . . . . . . . . .  :255.255.255.0
Default Gateway  . . . . . . . . . .  :192.168.2.99
DNS Servers  . . . . . . . . . . . .  :199.224.86.15
                                       199.224.86.16

Ipconfig also has another function. The utility is often associated with DHCP because it is the easiest way on a Windows system to see what IP address and other parameters the DHCP server has assigned to your computer. However, these programs also enable you to manually release IP addresses obtained through DHCP and renew existing leases. By running Ipconfig with the /release and /renew command-line parameters, you can release or renew the IP address assignment of one of the network interfaces in the computer or for all of the interfaces at once.

The Microsoft Windows Me, Microsoft Windows 98, and Microsoft Windows 95 operating systems do not include Ipconfig.exe. Instead, they have a graphical version of the utility called Winipcfg.exe. Winipcfg.exe provides exactly the same information and performs the same functions as Ipconfig.exe. The only difference is the appearance of the display and the graphical controls on the interface.

Using Route.exe

Creating static routes is a matter of using a utility supplied with the TCP/IP protocol to create (or delete) entries in the routing table. In Windows 2000 the utility is called Route.exe and runs from the command line. The syntax for Route.exe is as follows:

ROUTE [-f] [-p] [command [destination] [MASK netmask] [gateway]
[METRIC metric] [IF interface]]
  • -f This parameter deletes all of the entries from the routing table. When used with the ADD command, it deletes the entire table before adding the new entry.
  • -p When used with the ADD command, this parameter creates a persistent route entry in the table. A persistent route is one that remains in the table permanently, even after the system is restarted. When -p is used with the PRINT command, the system displays only persistent routes.
  • command This variable contains a keyword that specifies the function of the command.
  • destination This variable specifies the network or host address of the table entry being managed.
  • MASK netmask The variable netmask specifies the subnet mask to be applied to the address specified by the destination variable.
  • gateway This variable specifies the address of the router that the system should use to reach the host or network specified by the destination variable.
  • METRIC metric The variable metric specifies a value that indicates the relative efficiency of the route in the table entry.
  • IF interface The variable interface specifies the address of the network interface adapter that the system should use to reach the router specified by the gateway variable.

The Route.exe command variable takes one of four values, which are as follows:

  • PRINT. This value displays the contents of the routing table. When used with the -p parameter, it displays only the persistent routes in the routing table.
  • ADD. This value creates a new entry in the routing table.
  • DELETE. This value deletes an existing entry from the routing table.
  • CHANGE. This value modifies the parameters of an entry in the routing table.

The ROUTE PRINT command displays the current contents of the routing table. To delete an entry, you use the ROUTE DELETE command with a destination parameter to identify the entry you want to remove. To create a new entry in the table, you use the ROUTE ADD command with parameters that specify the values for the entry. The ROUTE CHANGE command works in the same way, except that it modifies the table entry specified by the destination variable. The destination variable is the address of the network or host for which you are providing routing information. The other parameters contain the subnet mask, gateway, interface, and metric information for the routing table. For example, using the network configuration shown in Figure 13.8 to create an entry that informs the Windows 2000 system labeled Router A of the existence of Router B on the same LAN, you would execute a Route.exe command like the following at the Router A system's command line:

ROUTE ADD 192.168.5.0 MASK 255.255.255.0 192.168.2.7 IF 192.168.2.2
METRIC 1
Figure 13.8 By adding a static route to the routing table in the Router A system, Router A can forward packets to Router B

The functions of the Route.exe parameters in this particular example are as follows:

  • ADD Indicates that the program should create a new entry in the existing routing table
  • 192.168.5.0 The address of the other network to which Router B provides access
  • MASK 255.255.255.0 The subnet mask to be applied to the destination address, which in this case indicates that the address represents an unsubnetted Class C network
  • 192.168.2.7 The address of the network interface adapter with which Router B is connected to the same network as Router A
  • IF 192.168.2.2 The address of the network interface adapter in Router A that provides access to the network it shares with Router B
  • METRIC 1 Indicates that the destination network is one hop away

This new routing table entry essentially tells Router A that when it has traffic to send to any computer on the network with the address 192.168.5.0, it should send the traffic to the router with the address 192.168.2.7, using the Router A network interface adapter with the address 192.168.2.2.

Using Arp.exe

The Address Resolution Protocol (ARP) enables a TCP/IP computer to convert IP addresses to the hardware addresses that data-link layer protocols need to transmit frames. IP uses ARP to discover the hardware address to which each of its datagrams are transmitted. To minimize the amount of network traffic ARP generates, the computer stores the resolved hardware addresses in a cache in system memory. The information remains in the cache for a short period of time (usually between 2 and 10 minutes), in case the computer has additional packets to send to the same address.

Windows 2000 includes a command-line utility called Arp.exe that you can use to manipulate the contents of the ARP cache. For example, you can use Arp.exe to add the hardware addresses of computers you contact frequently to the cache, thus saving time and network traffic during the connection process. Addresses that you add to the cache manually are static, meaning that they are not deleted after the usual expiration period. The cache is stored in memory only, however, so it is erased when you reboot the computer. If you want to preload the cache whenever you boot your system, you can create a batch file containing Arp.exe commands and execute it from the Windows Startup group.

Arp.exe uses the following syntax:

ARP [-a {ipaddress}] [-n ipaddress] [-s ipaddress hwaddress
{interface}]  [-d ipaddress {interface}]
  • -a {ipaddress} This parameter displays the contents of the ARP cache. The optional ipaddress variable specifies the address of a particular cache entry to be displayed.
  • -n ipaddress This parameter displays the contents of the ARP cache, where ipaddress identifies the network interface for which you want to display the cache.
  • -s ipaddress hwaddress {interface} This parameter adds a new entry to the ARP cache, where the ipaddress variable contains the IP address of the computer, the hwaddress variable contains the hardware address of the same computer, and the interface variable contains the IP address of the network interface in the local system for which you want to modify the cache.
  • -d ipaddress {interface} This parameter deletes the entry in the ARP cache that is associated with the computer represented by the ipaddress variable. The optional interface variable specifies the cache from which the entry should be deleted.

The ARP table of a Windows 2000 computer, as displayed by Arp.exe, appears as follows:

Interface: 192.168.2.6 on Interface 0x1000003

          Internet Address      Physical Address      Type

          192.168.2.10          00-50-8b-e8-39-7a     dynamic

          192.168.2.99          08-00-4e-a5-70-0f     dynamic

Using Netstat.exe

Netstat.exe is a Windows 2000 command-line program that displays information about the current network connections of a computer running TCP/IP and about the traffic generated by the various TCP/IP protocols. The syntax for Netstat.exe is as follows:

NETSTAT [interval] [-a] [-p protocol] [-n] [-e] [-r] [-s]
  • interval Refreshes the display every interval seconds until the user aborts the command
  • -a Displays the current network connections and the ports that are currently listening for incoming network connections
  • -p protocol Displays the currently active connections for the protocol specified by the protocol variable
  • -n When combined with other parameters, causes the program to identify computers using IP addresses instead of names
  • -e Displays incoming and outgoing traffic statistics for the network interface, broken down into bytes, unicast packets, nonunicast packets, discards, errors, and unknown protocols
  • -r Displays the routing table plus the current active connections
  • -s Displays detailed network traffic statistics for the IP, ICMP, TCP, and UDP protocols

The network connection listing displayed by Netstat.exe on a Windows 2000 computer appears as follows:

Active Connections

  Proto  Local Address          Foreign Address        State

  TCP    CZ6:epmap              CZ6.zacker1.com:0      LISTENING

  TCP    CZ6:microsoft-ds       CZ6.zacker1.com:0      LISTENING

  TCP    CZ6:1051               CZ6.zacker1.com:0      LISTENING

  TCP    CZ6:1070               CZ6.zacker1.com:0      LISTENING

  TCP    CZ6:2883               CZ6.zacker1.com:0      LISTENING

  TCP    CZ6:3348               CZ6.zacker1.com:0      LISTENING

  TCP    CZ6:3517               CZ6.zacker1.com:0      LISTENING

  TCP    CZ6:3907               CZ6.zacker1.com:0      LISTENING

  TCP    CZ6:3937               CZ6.zacker1.com:0      LISTENING

  TCP    CZ6:3941               CZ6.zacker1.com:0      LISTENING

  TCP    CZ6:3952               CZ6.zacker1.com:0      LISTENING

  TCP    CZ6:3956               CZ6.zacker1.com:0      LISTENING

  TCP    CZ6:4062               CZ6.zacker1.com:0      LISTENING

  TCP    CZ6:6103               CZ6.zacker1.com:0      LISTENING

  TCP    CZ6:pop3               CZ6.zacker1.com:0      LISTENING

  TCP    CZ6:1365               CZ6.zacker1.com:pop3   TIME_WAIT

  TCP    CZ6:1367               CZ6.zacker1.com:pop3   TIME_WAIT

  TCP    CZ6:netbios-ssn        CZ6.zacker1.com:0      LISTENING

  TCP    CZ6:3846               CZ6.zacker1.com:0      LISTENING

  TCP    CZ6:3937               CZ10:1026              ESTABLISHED

  TCP    CZ6:3941               CZ10:1232              ESTABLISHED

  TCP    CZ6:3952               CZ10:1026              ESTABLISHED

  TCP    CZ6:3956               CZ10:1232              ESTABLISHED

  TCP    CZ6:4367               CZ6.zacker1.com:0      LISTENING

  TCP    CZ6:4367               CZ10:netbios-ssn       ESTABLISHED

  UDP    CZ6:ntp                *:*

  UDP    CZ6:epmap              *:*

  UDP    CZ6:microsoft-ds       *:*

  UDP    CZ6:1026               *:*

  UDP    CZ6:1039               *:*

  UDP    CZ6:1046               *:*

  UDP    CZ6:1193               *:*

  UDP    CZ6:3938               *:*

  UDP    CZ6:3939               *:*

  UDP    CZ6:3953               *:*

  UDP    CZ6:3954               *:*

  UDP    CZ6:2677               *:*

  UDP    CZ6:3879               *:*

  UDP    CZ6:3942               *:*

  UDP    CZ6:netbios-ns         *:*

  UDP    CZ6:netbios-dgm        *:*

  UDP    CZ6:isakmp             *:*

The interface statistics display looks like this:

Interface Statistics

                           Received            Sent

Bytes                     855899622      2031780028

Unicast packets              744616         1304524

Non-unicast packets           50810            1421

Discards                          0               0

Errors                            0               0

Unknown protocols             33220

Using Nbtstat.exe

Nbtstat.exe is a Windows 2000 command-line program that displays information about the NetBIOS over TCP/IP connections that Windows uses when communicating with other Windows computers on the TCP/IP LAN. The syntax for Nbtstat.exe is as follows:

NBTSTAT [-a name] [-A ipaddress] [-c] [-n] [-r] [-R] [-s] [-S] [-RR]
  • -a name Displays the NetBIOS names registered on the computer identified by the name variable
  • -A ipaddress Displays the NetBIOS names registered on the computer identified by the ipaddress variable
  • -c Displays the contents of the local computer's NetBIOS name cache
  • -n Displays the NetBIOS names registered on the local computer
  • -r Displays the number of NetBIOS names registered and resolved by the local computer, using both broadcasts and WINS
  • -R Purges the local computer's NetBIOS name cache of all entries and reloads the LMHOSTS file
  • -s Displays a list of the computer's currently active NetBIOS settings (identifying remote computers by name), their current status, and the amount of data transmitted to and received from each system
  • -S Displays a list of the computer's currently active NetBIOS settings (identifying remote computers by IP address), their current status, and the amount of data transmitted to and received from each system
  • -RR Sends name release requests to WINS, and then starts refresh
Unlike the other utilities discussed in this lesson, the command-line parameters for Nbtstat.exe are case-sensitive.

The NetBIOS cache listing as displayed by Nbtstat.exe on a Windows 2000 computer appears as follows:

Local Area Connection:

Node IpAddress: [192.168.2.6] Scope Id: []

                  NetBIOS Remote Cache Name Table

        Name              Type       Host Address    Life [sec]

    ------------------------------

    CZ10           <20>  UNIQUE          192.168.2.10        345

The list of NetBIOS names registered by a computer looks like this:

Local Area Connection:

Node IpAddress: [192.168.2.6] Scope Id: []

           NetBIOS Remote Machine Name Table

       Name               Type         Status

    ----------------------

    CZ6            <00>  UNIQUE      Registered

    ZACKER1        <00>  GROUP       Registered

    CZ6            <03>  UNIQUE      Registered

    CZ6            <20>  UNIQUE      Registered

    ZACKER1        <1E>  GROUP       Registered

    MAC Address = 00-D0-B7-AD-1A-7B

Using Nslookup.exe

Nslookup.exe is a Windows 2000 command-line utility that enables you to generate DNS request messages and transmit them to specific DNS servers on the network. The basic syntax of Nslookup.exe is as follows:

NSLOOKUP DNSname DNSserver
  • DNSname Specifies the DNS name that you want to resolve
  • DNSserver Specifies the DNS name or IP address of the DNS server that you want to query for the name specified in the DNSname variable

The output generated by the program looks like the following:

C:\>nslookup www.microsoft.com 199.224.86.15

Server:  ns1-dlls.epoch.net

Address:  197.28.65.115

Non-authoritative answer:

Name:    www.microsoft.akadns.net

Addresses:  207.46.131.91, 207.46.197.102, 207.46.230.218, 207.46.230.229

Aliases:  www.microsoft.com

The advantage of Nslookup is that you can test the functionality and the quality of the information on a specific DNS server by specifying it on the command line. By running Nslookup with no command-line parameters, you can use the program in interactive mode, which lets you employ some of its many options.

Using Netdiag.exe

Netdiag.exe is a utility that helps isolate networking and connectivity problems by performing a series of tests to determine the state of your network client and whether it is functional. These tests and the key network status information they expose give network administrators and support personnel a more direct means of identifying and isolating network problems. Moreover, because this tool does not require parameters or switches to be specified, support personnel and network administrators can focus on analyzing the output, rather than training users about tool usage.

Netdiag diagnoses network problems by checking all aspects of a host computer's network configuration and connections. Beyond troubleshooting TCP/IP issues, it also examines a host computer's Internetwork Packet Exchange (IPX) and NetWare configurations.

Run Netdiag whenever a computer is having network problems. The utility tries to diagnose the problem and can even flag problem areas for closer inspection. It can fix simple DNS problems with the optional /fix switch.

Netdiag performs its tests by examining .dll files, output from other tools, and the system registry to find potential problem spots. It checks to see which network services or functions are enabled and then runs a series of network configuration tests. In general, Netdiag calls Ipconfig and returns a structure that contains most of the general information that ipconfig /all prints. It takes that information from the registry and by calling the various drivers.

Netdiag prints the string [FATAL] when it detects a condition that needs to be fixed immediately. By contrast, the string [WARNING] signals a failure condition that can be put off for a while. One of the simplest ways to examine the voluminous information provided by the Netdiag program is to redirect the program's output to a text file and then search the file for occurrences of [FATAL] and [WARNING].

Exercise 13.2: TCP/IP Utilities

Match the utilities in the left column with their functions in the right column.

  1. Ipconfig.exe
  2. Tracert.exe
  3. Ping
  4. Arp.exe
  5. Netstat
  6. Winipcfg.exe
  7. Nbtstat.exe
  1. Displays TCP/IP configuration on a Windows 98 system
  2. Creates cache entries containing IP and hardware addresses
  3. Displays NetBIOS connection information
  4. Tests communications between two computers
  5. Releases and renews IP address assignments on Windows 2000
  6. Displays network traffic statistics
  7. Lists the routers forwarding packets to a particular destination
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next chapter. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Which TCP/IP utility should you use to most easily identify which router on your internetwork is malfunctioning?
    1. Ipconfig
    2. Ping
    3. Traceroute
    4. Netstat
  2. Which of the following protocols does the Ping program never use to carry its messages?
    1. Ethernet
    2. ICMP
    3. IP
    4. UDP
  3. Which of the following commands displays the routing table on the local computer?
    1. Arp -r
    2. Netstat -r
    3. Nbtstat -r
    4. Telnet -r
  4. Which command would you use to purge the local computer's NetBIOS name cache?
    1. Nbtstat -p
    2. Nbtstat -P
    3. Nbtstat -r
    4. Nbtstat -R

Lesson Summary

  • Ping is a utility that tests whether one Transmission Control Protocol/Internet Protocol (TCP/IP) computer can communicate with another one.
  • Traceroute is a program that displays the path that packets take through a network to reach their destinations.
  • Ipconfig is a program that displays information about the computer's TCP/IP configuration and manipulates Dynamic Host Configuration Protocol (DHCP) IP address assignments.
  • Address Resolution Protocol (ARP) enables you to view and modify the contents of the ARP cache maintained by a TCP/IP system.
  • Netstat displays information about a computer's TCP/IP connections and the traffic passing over them.
  • Nbtstat displays information about Network Basic Input/Output System (NetBIOS) connections and their traffic.
  • Nslookup enables you to transmit Domain Name System (DNS) requests to specific servers.


Dynamic Host Configuration Protocol

About This Chapter

In this chapter, you learn how to use the Dynamic Host Configuration Protocol (DHCP) to automatically configure the parameters required by Transmission Control Protocol/Internet Protocol (TCP/IP) clients and eliminate some common configuration problems. During the lessons, you install and configure a DHCP server, test the DHCP configuration, and then obtain an Internet Protocol (IP) address from a DHCP server.

Before You Begin

To complete the lessons in this chapter, you must have a basic understanding of TCP/IP communications, as provided in Lesson 1 of Chapter 13, "TCP/IP Administration." To perform the exercise, you need a computer running Microsoft Windows 2000 Server on a TCP/IP network.


Lesson 1: Understanding DHCP

DHCP is a service and a protocol that work together to automatically assign IP addresses and other TCP/IP configuration settings to the computers on a network. DHCP overcomes the limitations of configuring TCP/IP clients and managing IP addresses manually. This lesson provides an overview of DHCP, how it works, and how you install it.

After this lesson, you will be able to

  • List the types of IP address allocation supported by DHCP
  • Understand the process by which DHCP clients request, receive, and renew IP address assignments
  • Describe the functions of the DHCP message types
  • Install a DHCP server
  • Install a DHCP relay agent

Estimated lesson time: 20 minutes

DHCP Overview

DHCP is an extension of the Bootstrap Protocol (BOOTP), which was designed to enable diskless workstations to retrieve an IP address and other TCP/IP configuration settings from a network server. The primary limitation of BOOTP is that an administrator must manually enter the configuration parameters for each workstation on the server. DHCP improves on this concept by dynamically assigning IP addresses to clients from a pool. When you use DHCP to manage the IP address assignments and TCP/IP configuration tasks for a network, administrators are relieved of the need to travel to each computer to configure its TCP/IP client, and they no longer have to maintain a record of the IP addresses that they have assigned. By automatically tracking IP address assignments, DHCP reduces the possibility of address duplication.

As illustrated in Figure 14.1, each time a DHCP client starts, it requests IP addressing information from a DHCP server, including the IP address, the subnet mask, and any other necessary parameters. These other parameters might include a default gateway address, Domain Name System (DNS) server addresses, and Windows Internet Naming Service (WINS) server addresses.

When a DHCP server receives a request, it selects IP addressing information from a pool of addresses (called a scope) defined in its database and offers it to the DHCP client. If the client accepts the offer, the IP addressing information is leased to the client for a specified period of time. As the lease interval progresses, the client computer renews the address assignment each time it logs on. If the lease expires without a renewal, the IP address is returned to the pool for reassignment.

Figure 14.1 DHCP client/server interaction

DHCP is based on open standards published by the Internet Engineering Task Force (IETF), which also publishes the TCP/IP standards. Although Microsoft had a large hand in the development of DHCP, and all of the Windows operating systems have DHCP client support, you can use the Microsoft DHCP Server service included in Windows 2000 Server to configure clients running other operating systems as well. In the same way, you can use a DHCP server running on another operating system to configure Windows DHCP clients.

Manual vs. Automatic Configuration

To understand why DHCP is beneficial in configuring TCP/IP on client computers, it is useful to contrast the manual method of configuring TCP/IP with the automatic method using DHCP. Configuring TCP/IP manually means that users can easily pick a random IP address instead of getting a valid IP address from the network administrator. Using incorrect addresses can lead to network problems, such as a conflict with an existing address, or failure of the computer to communicate with the network at all. In addition, manually typing the IP address, subnet mask, and default gateway can result in typographical errors that lead to similar problems. Another limitation of configuring TCP/IP manually is the administrative overhead on internetworks where computers are frequently moved from one subnet to another. For example, when you move a workstation to a different subnet, you must change the IP address and default gateway address for the computer to communicate from its new location.

Using DHCP to automatically configure IP addressing information means that users no longer need to acquire IP addressing information from an administrator to configure TCP/IP. The DHCP server supplies all of the necessary configuration information to all of the DHCP clients. Many difficult-to-trace network problems can be eliminated using DHCP. When you move a workstation to another subnet on a network using DHCP, the computer is assigned a new IP address the first time it connects to the network. The address on the old subnet is abandoned, and after its lease expires, it is returned to the DHCP server's address pool.

DHCP Address Allocation Types

The core function of DHCP is to assign IP addresses. This is the most complicated part of the service, because an IP address must be unique for each client computer. The DHCP standard defines three types of IP address allocation, which are as follows:

  • Manual allocation. An administrator assigns a specific IP address to a computer in the DHCP server and the server provides that address to the computer when it is requested.
  • Automatic allocation. The DHCP server supplies clients with IP addresses taken from a common pool of addresses, and the clients permanently retain the assigned addresses.
  • Dynamic allocation. The DHCP server supplies IP addresses to clients from a pool on a leased basis. The client must periodically renew the lease or the address returns to the pool for reallocation.

Manual allocation is the functional equivalent of BOOTP address assignment. This option saves the least amount of administrative labor, but it is necessary for computers that require permanently assigned IP addresses, such as Internet servers that have DNS names associated with specific addresses. Administrators could conceivably configure the TCP/IP clients of these computers directly, but using the DHCP server for the assignment prevents IP addresses from being accidentally duplicated.

Automatic allocation is a fitting solution for networks on which administrators rarely move workstations around between subnets. Assigning IP addresses from a scope eliminates the need to furnish a specific address for each computer and prevents address duplication. Permanently assigning those addresses minimizes the network traffic generated by DHCP client/server communications.

Once the server is configured, dynamic allocation completely automates the TCP/IP client configuration process and enables administrators to add, remove, and relocate computers as needed. When a computer boots, the server leases an address to the computer for a given period of time, renews the lease if the computer remains active, reclaims the address when it is no longer in use, and returns the address to the pool. Most DHCP installations use dynamic allocation.

How DHCP Works

A typical transaction between a DHCP client and server consists of four phases, as shown in Figure 14.2. Communication between the DHCP client and server uses the User Datagram Protocol (UDP), over ports 67 and 68. DHCP has eight different message types, which are as follows:

  • DHCPDISCOVER. Used by clients to request configuration parameters from a DHCP server
  • DHCPOFFER. Used by servers to offer IP addresses to requesting clients
  • DHCPREQUEST. Used by clients to accept or renew an IP address assignment
  • DHCPDECLINE. Used by clients to reject an offered IP address
  • DHCPACK. Used by servers to acknowledge a client's acceptance of an offered IP address
  • DHCPNAK. Used by servers to reject a client's acceptance of an offered IP address
  • DHCPRELEASE. Used by clients to terminate an IP address lease
  • DHCPINFORM. Used by clients to obtain additional TCP/IP configuration parameters from a server
Figure 14.2 DHCP client/server communications

DHCP Communications

DHCP clients initiate communication with servers when they boot for the first time. The client generates a series of DHCPDISCOVER messages, which it transmits as broadcasts. At this point, the client has no IP address, and is said to be in the init state. Like all broadcasts, these transmissions are limited to the client's local network, but administrators can install a DHCP Relay Agent service on a computer on the local area network (LAN), which relays the messages to DHCP servers on other networks. This enables a single DHCP server to service clients on multiple LANs. Many routers also have this functionality built in.

When a DHCP server receives a DHCPDISCOVER message from a client, it generates a DHCPOFFER message containing an IP address and whatever other optional parameters the server is configured to supply. In most cases, the server transmits this as a unicast message directly to the client. Because the client broadcasts its DHCPDISCOVER messages, it might receive DHCPOFFER responses from multiple servers. After a specified period of time, the client stops its broadcasting and accepts one of the offered IP addresses. To signal its acceptance, the client generates a DHCPREQUEST message containing the address of the server from which it is accepting the offer along with the offered IP address. Because the client has not yet configured itself with the offered parameters, it transmits the DHCPREQUEST message as a broadcast. This broadcast notifies the server that the client is accepting the offered address and also notifies the other servers on the network that the client is rejecting their offers.

On receipt of the DHCPREQUEST message, the server commits the offered IP address and other settings to its database using a combination of the client's hardware address and the offered IP address as a unique identifier for the assignment. This is known as the lease identification cookie. To conclude its part of the transaction, the server sends a DHCPACK message to the client, acknowledging the completion of the process. If the server cannot complete the assignment (because it has already assigned the offered IP address to another system, for example), it transmits a DHCPNAK message to the client and the whole process begins again.

As a final test, the client performs an Address Resolution Protocol (ARP) test to ensure that no other system on the network is using the assigned IP address. If no response to the ARP message is received, the DHCP transaction is completed and the client enters what is known as the bound state. If another system does respond to the ARP message, the client can't use the IP address and transmits a DHCPDECLINE message to the server, nullifying the transaction. The client can then reissue a series of DHCPDISCOVER messages, restarting the whole process.

DHCP Leasing

The process by which a DHCP server assigns configuration parameters to a client is the same whether the server uses manual, automatic, or dynamic allocation. With manual and automatic allocation, this process is the end of the DHCP client/server communications. The client retains the settings assigned to it by the server until someone explicitly changes them or forces a reassignment. However, when the server dynamically allocates settings, the client leases its IP address for a certain period of time (configured at the server) and must renew the lease to continue using it.

The length of an IP address lease is typically measured in days, and is generally based on whether computers are frequently moved around the network or whether IP addresses are in short supply. Shorter leases generate more network traffic but enable servers to reclaim unused addresses faster. For a relatively stable network, longer leases reduce the amount of traffic that DHCP generates.

The lease renewal process, illustrated in Figure 14.3, begins when a bound client reaches what is known as the renewal time value, or T1 value, of its lease. By default, the renewal time value is 50 percent of the lease period. When a client reaches this point, it enters the renewing state and begins generating DHCPREQUEST messages. The client transmits the messages to the server that holds the lease as unicasts, unlike the broadcast DHCPREQUEST messages the client generates while in the init state. If the server is available to receive the message, it responds with either a DHCPACK message, which renews the lease and restarts the lease time clock, or a DHCPNAK message, which terminates the lease and forces the client to begin the address assignment process again from the beginning.

Figure 14.3 The DHCP lease renewal process

If the server does not respond to the DHCPREQUEST unicast message, the client continues to send them until it reaches the rebinding time value or T2 value, which defaults to 87.5 percent of the lease period. At this point, the client enters the rebinding state and begins transmitting DHCPREQUEST messages as broadcasts, soliciting an address assignment from any DHCP server on the network. Again, a server can respond with either a DHCPACK or DHCPNAK message. If the lease time expires with no response from any DHCP server, the client's IP address is released and all of its TCP/IP communication ceases, except for the transmission of DHCPDISCOVER broadcasts.

Releasing an IP Address

It is also possible for a client to terminate an IP address lease at any time by transmitting a DHCPRELEASE message containing the lease identification cookie to the server. On a system running Windows 2000 or Microsoft Windows NT, for example, you can do this manually, using the Ipconfig.exe utility. Use the Winipcfg.exe utility in Microsoft Windows Me, Microsoft Windows 98, or Microsoft Windows 95.

When No DHCP Servers Are Online

If a Windows 2000 DHCP client fails to receive any responses to its DHCPDISCOVER broadcast, it retransmits the message at varying intervals. If there is still no response, Windows 2000 can automatically configure an IP address and subnet mask for itself. This is a feature of Windows 2000 called Automatic Private IP Addressing. Automatic Private IP Addressing is useful for clients on small private networks, such as a small business, a home network, or a remote access client. The Windows 2000 DHCP client service goes through the following process to autoconfigure the client:

  1. The DHCP client attempts to locate a DHCP server to obtain an IP address and configuration.
  2. If a DHCP server cannot be found or does not respond, the DHCP client autoconfigures its IP address and subnet mask using a selected address from the Microsoft-reserved Class B network, 169.254.0.0, with the subnet mask 255.255.0.0.
  3. The DHCP client tests for an address conflict to make sure that the IP address it has chosen is not already in use on the network. If a conflict is found, the client selects another IP address. The client will retry autoconfiguration for up to ten addresses.
  4. Once the DHCP client succeeds in selecting an address, it configures its network interface with the IP address. The client then continues to check for a DHCP server every five minutes in the background. If a DHCP server is found later, the client abandons its autoconfigured information. The DHCP client then uses an address offered by the DHCP server (and any other provided DHCP option information) to update its IP configuration settings.

Installing a DHCP Server

Before you install DHCP, answer the following questions:

  • Will all of the computers on the network be DHCP clients? If not, consider that non-DHCP clients have static IP addresses, and static IP addresses must be excluded from the DHCP server configuration. If a client requires a specific address, the IP address needs to be reserved.
  • Will a DHCP server supply IP addresses to multiple LANs? If so, consider that you must either have a DHCP server on every LAN or configure the routers connecting the LANs or servers to act as DHCP relay agents.
  • How many DHCP servers are required? Consider that Microsoft DHCP servers do not share information with each other. Therefore, it is necessary to create unique IP address scopes for each server to assign to clients.
  • What IP addressing options will clients obtain from a DHCP server? The IP addressing options determine how to configure the DHCP server, and whether the options should be created for all of the clients in the internet-work, clients on a specific subnet, or individual clients. The IP addressing options might include default gateway addresses, DNS server addresses, WINS server addresses, and other TCP/IP parameters, depending on your network configuration.

To install a DHCP server, use the following procedure:

  1. On a computer runnng Windows 2000 Server, log on as Administrator.
  2. Click Start, point to Settings, and click Control Panel.
  3. Double-click the Add/Remove Programs icon, then click Add/Remove Windows Components to activate the Windows Components Wizard.
  4. In the Components list, select Networking Services.
  5. Click Details.
  6. In the Subcomponents Of Networking Services list, select the Dynamic Host Configuration Protocol (DHCP) check box.
  7. Click OK, then click Next. If prompted, type the full path to the Windows 2000 distribution files and click Continue. Required files are then copied to your hard disk.
  8. Click Finish to close the Windows Components Wizard.
The computer running the DHCP Server service should not itself be a DHCP client, even if you have other DHCP servers on the network. You should configure the DHCP server computers manually with static IP addresses, subnet masks, and other TCP/IP configuration parameters.

DHCP Relay Agent

A relay agent is a small program that relays DHCP and BOOTP messages between clients and servers on different subnets. A multisegment network requires a relay agent because DHCP relies heavily on broadcast transmissions, which are limited to the LAN on which they originate. When a router running a DHCP relay agent receives broadcasts from DHCP clients, it relays them to DHCP servers on other networks. This enables a single DHCP server to support clients on multiple LANs. Many of the dedicated router products on the market can function as DHCP or BOOTP relay agents. The relay agent functionality is identical for DHCP and BOOTP, so if your router can function as a BOOTP relay agent, you can use it with DHCP as well. The DHCP Relay Agent component provided with Windows 2000 is a BOOTP relay agent that relays DHCP messages between DHCP clients and DHCP servers on different networks.

You cannot configure a server running the DHCP service to function as a DHCP relay agent as well.

To add the DHCP Relay Agent to a Windows 2000 router, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, select Routing And Remote Access.
  2. In the console tree, click Server name\IP Routing\General.
  3. Right-click General and, from the pop-up menu, choose New Routing Protocol to display the Select Routing Protocol dialog box.
  4. In the Select Routing Protocol dialog box, select DHCP Relay Agent, and then click OK.

Exercise 14.1: DHCP Message Types

  1. Place the following DHCP message types in the order in which a successful IP address assignment procedure uses them.
    1. DHCPACK
    2. DHCPOFFER
    3. DHCPREQUEST
    4. DHCPDISCOVER
  2. Place the following DHCP message types in the proper order for an unsuccessful attempt to renew an IP address lease.
    1. DHCPDISCOVER
    2. DHCPREQUEST (broadcast)
    3. DHCPREQUEST (unicast)
    4. DHCPNAK
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. What happens to a DHCP client when its attempts to renew its IP address lease fail and the lease expires?
  2. Which of the following message types is not used during the DHCP lease assignment process?
    1. DHCPDISCOVER
    2. DHCPRELEASE
    3. DHCPOFFER
    4. DHCPREQUEST
  3. What is the name of the time during the lease renewal process when a DHCP client begins broadcasting DHCPREQUEST messages?
    1. Lease identification cookie
    2. Rebinding time value (T1)
    3. Renewal time value (T2)
    4. Init value

Lesson Summary

  • Dynamic Host Configuration Protocol (DHCP) is a combination of a service and a protocol that enables client computers to automatically retrieve Transmission Control Protocol/Internet Protocol (TCP/IP) configuration settings from a server on the network.
  • DHCP can allocate IP addresses in three ways: by supplying a preconfigured address to a specific computer (manual allocation), by supplying computers with permanent addresses from a pool (automatic allocation), and by leasing addresses from a pool to computers and reclaiming them after the lease expires (dynamic allocation).
  • DHCP clients request an address assignment by broadcasting messages to the DHCP servers on the network. The servers respond with address offers, one of which the client accepts.
  • DHCP clients periodically renew their address leases by initiating a new transaction with the DHCP server. If the lease expires without a renewal, TCP/IP communications on the client computer cease (except for DHCP messages).
  • A DHCP relay agent propagates DHCP messages to servers on other networks, enabling a single DHCP server to support clients on multiple LANs.


Lesson 2: Configuring a DHCP Server

In this lesson, you learn how to configure the DHCP service on a Windows 2000 server.

After this lesson, you will be able to

  • Authorize a DHCP server
  • Create a scope
  • Configure DHCP options
  • Activate a scope

Estimated lesson time: 20 minutes

Installing and Configuring a DHCP Server

Once you have installed the Microsoft DHCP Server service on a computer running Windows 2000 Server, you must configure it before it can assign TCP/IP parameters to clients. The general steps for implementing DHCP are as follows:

  • Install the Microsoft DHCP Server service.
  • Authorize the DHCP server.
  • Create an IP address scope and activate it.
  • Configure DHCP options to be delivered to clients with IP addresses.

Authorizing a DHCP Server

When configured correctly and authorized for use on a network, DHCP servers provide a useful and intended administrative service. However, when a misconfigured or unauthorized DHCP server, also known as a rogue server, is introduced onto a network, it can cause problems. For example, a rogue server might begin leasing incorrect IP addresses to clients or negatively acknowledging DHCP clients that are attempting to renew their address leases. Either of these conditions can produce further problems for DHCP-enabled clients. For example, clients that obtain an IP address lease from an unauthorized server can fail to locate valid domain controllers, preventing the clients from successfully logging on to the network.

To avoid these problems on a Windows 2000 network, DHCP servers must be authorized in Microsoft Active Directory service before they can service clients. This avoids most of the accidental damage caused by running DHCP servers with incorrect configurations or correct configurations on the wrong network.

For the authorization process to work properly, it is important that the first DHCP server introduced onto your network participate in the Active Directory service. This requires that the server be installed as either a domain controller or a member server before you install DHCP. When you are planning for or actively deploying Active Directory services, it is important that you do not install your first DHCP server computer as a stand-alone server.

The authorization process for DHCP server computers in Active Directory service depends on the installed role of the server on your network. For Windows 2000 Server (as in earlier versions) there are three roles or server types for which each server computer can be installed, which are as follows:

  • Domain controller. The computer keeps and maintains a copy of the Active Directory service database and provides secure account management for domain member users and computers.
  • Member server. The computer is not operating as a domain controller but has joined a domain in which it has a membership account in the Active Directory service database.
  • Stand-alone server. The computer is not operating as a domain controller or a member server in a domain.

All computers operating as DHCP servers must be either domain controllers or domain member servers before they can be authorized in the directory service and provide DHCP service to clients.

To authorize a DHCP server in Active Directory service, use the following procedure:

  1. Log on to the network using the DHCP server computer with an account that has enterprise administrative privileges or one that has been delegated authority to authorize DHCP servers for your enterprise. Typically, you can use an account that has membership in the Enterprise Administrators group. The account you use must have the Full Control permission for the NetServices container object stored in the enterprise root of the Active Directory service.
  2. Install the DHCP service on this computer if necessary.
  3. Click Start and, from the Administrative Tools program group, choose DHCP to open the DHCP console.
  4. From the Action menu, choose Manage Authorized Servers to display the Manage Authorized Servers dialog box, shown in Figure 14.4.
  5. Click Authorize to open the Authorize DHCP Server dialog.
  6. Type the name or IP address of the DHCP server to be authorized, then click OK. The console displays a DHCP message box prompting you to confirm the authorization of the DHCP server you specified.
  7. Click Yes to close the DHCP message box.
  8. Click Close to close the Manage Authorized Servers dialog box.
Figure 14.4 The Manage Authorized Servers dialog box

When the DHCP service starts on a Windows 2000 server, the computer accesses Active Directory service to see if it is in the list of authorized DHCP servers. If the server is authorized, it sends out DHCPINFORM messages to find out if there are other DHCP servers running and makes sure that they are authorized as well. If the server fails to connect to Active Directory service, it assumes that it is not authorized and does not respond to client requests. Likewise, if the server does connect to Active Directory service but does not find itself in the authorized list, it does not respond to clients. If the server does find itself in the authorized list, it starts to service client requests.

Creating a DHCP Scope

Before a DHCP server can lease IP addresses to DHCP clients, you must create a scope, which is a pool of valid IP addresses available for lease to DHCP clients. After you have installed the DHCP service and it is running, the next step is to create a scope.

When creating a DHCP scope, consider the following points:

  • You must create at least one scope for every DHCP server.
  • You must exclude any static IP addresses you manually assign from the scope.
  • You must create a separate scope for each IP subnet on your network (but not necessarily on the same DHCP server).
  • You can only create one scope for each subnet on a particular DHCP server.
  • DHCP servers do not share scope information. When you create scopes on multiple DHCP servers, make sure that the same IP addresses do not exist in more than one scope, to prevent duplicate IP addressing.

Depending on the starting and ending IP addresses for your scope, the DHCP console suggests a default subnet mask useful for most networks. If you know a different subnet mask is required for your network, you can modify the value as needed.

To create a new scope, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, choose DHCP to open the DHCP console.
  2. In the console tree, right-click the DHCP server on which you want to create the scope. From the pop-up menu, choose New Scope to launch the New Scope Wizard.
  3. Click Next to bypass the Welcome page and display the Scope Name page.
  4. Type a name to be used to identify the scope in the Name text box, and a description, if desired. Click Next, to proceed to the IP Address Range page, shown in Figure 14.5.

    Figure 14.5 The IP Address Range page of the New Scope Wizard
  5. In the Start IP Address and End IP Address text boxes, enter the range of addresses that you want the scope to assign to DHCP clients. The range you enter should include all of the addresses you want to assign to the subnet. You are given the opportunity to exclude specific addresses from the range later.
  6. Specify the subnet mask to be used with the IP addresses in the range you selected, either by indicating the number of network identifier bits in the Length box, or by typing the mask in the Subnet Mask text box. Changing the value in the Length box automatically modifies the Subnet Mask value.
  7. Click Next to proceed to the Add Exclusions page.
  8. In the Start IP Address and End IP Address text boxes, enter a range of addresses that you want to exclude from the scope range you specified earlier and click Add to insert the range into the Excluded Address Range list. To exclude a single address from the scope, enter the same address in both the Start IP Address and End IP Address text boxes.
  9. Repeat Step 8 to exclude as many addresses from the scope as necessary. Click Next to proceed to the Lease Duration page, shown in Figure 14.6.

    Figure 14.6 The Lease Duration page of the New Scope Wizard
  10. Specify the length for which the DHCP clients using this scope should lease the IP addresses they are assigned by the server, using the Days, Hours, and Minutes boxes. Use a shorter lease duration if IP addresses are in short supply; use a longer lease duration to minimize the amount of network traffic generated by DHCP. Click Next to proceed to the Configure DHCP Options page.
  11. Select No, I Will Configure These Options Later and click Next to proceed to the Completing the New Scope Wizard page.
    Selecting Yes, I Want To Configure These Options Now causes the wizard to display four additional pages, which enable you to configure the router, domain name, DNS server, and WINS server options, and also activate the scope. You can also configure these options, and many others, after you create the scope, as described in the next section.
  12. Click Finish to create the scope.

Managing DHCP Scopes

After you define a scope, it appears in the DHCP console with four subheadings (see Figure 14.7), which are as follows:

  • Address Pool. Lists the IP addresses in the scope and enables you to create additional exclusion ranges
  • Address Leases. Lists the addresses that are currently leased by clients on the network
  • Reservations. Enables you to create IP address assignments for specific computers on the network, such as Web servers, which must have permanently assigned IP addresses
  • Scope Options. Enables you to configure DHCP options that are assigned to all clients obtaining IP addresses from the scope
Figure 14.7 The DHCP console and the subheadings of a new scope

Configuring Additional Options

You configure DHCP options to supply client computers with TCP/IP configuration parameters in addition to IP addresses and subnet masks. Microsoft DHCP Server supports a large assortment of options, the most commonly used of which appear in the following list, along with their option numbers:

  • 003 Router. Specifies the clients' default gateway address, that is, the IP address of the router the client should use to access other networks
  • 006 DNS Servers. Specifies the IP address of the DNS servers the clients should use to resolve host and domain names into IP addresses
  • 015 DNS Domain Name. Specifies the DNS domain name that clients should use by default for name resolutions
  • 044 WINS/NBNS Servers. Specifies the IP addresses of the WINS servers that clients should use to resolve Network Basic Input/Output System (NetBIOS) names into IP addresses
  • 046 WINS/NBT Node Type. Specifies the type of NetBIOS over TCP/IP name resolution that the clients should use

You can configure DHCP options at either the server or the scope level. The options you configure for a server are applied to all of the DHCP clients serviced by all of the scopes on that server. The options configured for a scope are applied only to the clients receiving addresses from that scope. To configure DHCP options for a server, right-click the Server Options heading beneath the server and, from the pop-up menu, choose Configure Options. To configure options for a scope, expand the scope to display the Scope Options heading, right-click it, and from the pop-up menu, choose Configure Options. The DHCP console then displays a Server Options or Scope Options dialog box, which are identical except for the title (see Figure 14.8).

Figure 14.8 The DHCP Scope Options dialog box

To configure a DHCP option, view the Available Options list and select the check box next to one of the options. When you select an option, controls specific to that option appear in the dialog box, as shown in Figure 14.9. You use these controls to specify server addresses or configure other properties of the option. When you have configured all of the options for the scope or server, click OK.

Figure 14.9 The Router controls in the Scope Options dialog box

Activating a Scope

Once you have created a scope and configured its options, you must activate the scope before it can start servicing clients, if you have not done so already with the New Scope Wizard. To activate a scope, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the DHCP console.
  2. Right-click the scope you want to activate and, from the pop-up menu, choose Activate.

Once the scope is activated, you can deactivate it at any time, in the same way. This enables you to stop a scope from servicing clients without having to stop the whole server.

Implementing Multiple DHCP Servers

If your internetwork requires multiple DHCP servers, it is necessary to create a unique scope for each subnet on each server. Overlapping addresses in scopes you create on different DHCP servers can result in IP address duplication. To ensure that clients can lease IP addresses in the event of a server failure, it is also important to have multiple scopes for each subnet distributed among the DHCP servers in the internetwork. Consider the following guidelines when planning your DHCP server strategy:

  • Each DHCP server should have a scope containing approximately 75 percent of the available IP addresses for the local subnet.
  • Each DHCP server should have a scope for each remote subnet containing approximately 25 percent of the available IP addresses for a subnet.

When a client's DHCP server is unavailable, the client can still receive an address lease from another DHCP server on a different subnet, assuming the router connecting the networks is a DHCP relay agent.

Exercise 14.2: Configuring a DHCP Server

In this exercise, you prepare a DHCP server for operation by creating a scope and configuring the DHCP options commonly used by computers running Windows. This exercise assumes that you have a DHCP server already installed and authorized in Active Directory service.

Procedure 1: Preparing a DHCP Server for Operation

To prepare a DHCP server for operation, complete the following steps:

  1. Log on to the computer running the Microsoft DHCP Server service as Administrator.
  2. Click Start and, from the Administrative Tools program group, open the DHCP console.
  3. Right-click your server name and, from the pop-up menu, choose New Scope. Click Next to bypass the Welcome page.
  4. Type test scope in the Name text box and click Next.
  5. Type 192.168.5.10 in the Start IP Address text box and 192.168.5.90 in the End IP Address text box. What class are these IP addresses?
  6. Change the value in the Length box to 24 and click Next. What does this Length value signify? What happens to the Subnet Mask value?
  7. Type 192.168.5.50 in the Start IP Address text box and 192.168.5.60 in the End IP Address text box. Click Add. What happens?
  8. Click Next.
  9. Change the value of the Days selector to 30 and click Next.
  10. Make sure that Yes, I Want To Configure These Options Now is selected. Click Next.
  11. In the Router (Default Gateway) page, type 192.168.5.1 in the IP Address text box and click Add. Then click Next.
  12. In the Domain Name And DNS Servers page, type 192.168.2.10 in the IP Address text box and click Add. Then click Next.
  13. Click Next again to bypass the WINS Servers page.
  14. In the Activate Scope page, select No, I Will Activate This Scope Later and then click Next.
  15. Click Finish to create the scope.
In this exercise, you do not activate the new scope, so it does not take effect on your network and possibly cause client configuration problems. If you are working on a lab network and have the permission of the administrator, you can activate the scope and test it by restarting a Windows workstation configured to use DHCP.
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. What tool do you use to manage DHCP servers in Windows 2000?
  2. Which of the following DHCP message types is used for communication between DHCP servers?
    1. DHCPDISCOVER
    2. DHCPINFORM
    3. DHCPRELEASE
    4. DHCPACK
  3. How does Microsoft DHCP Server enable you to select any group of addresses for a scope, despite the fact that you can only specify one range of IP addresses per subnet?

Lesson Summary

  • On an Active Directory network Dynamic Host Configuration Protocol (DHCP) servers must be authorized before they can service clients.
  • The DHCP service must be installed on a domain controller or a member server to be authorized.
  • To create a scope, you specify a range of Internet Protocol (IP) addresses that you want to assign to clients.
  • You can exclude single addresses or ranges of addresses from a scope to accommodate static address assignments.
  • You can configure DHCP options, such as routers and Domain Name System (DNS) servers, for a scope or for a server.
  • After creating a scope, you must activate it before it can service clients.


Lesson 3: Troubleshooting DHCP

The most common DHCP client problem is a failure to obtain an IP address or other configuration parameters from the DHCP server during system startup. The most common DHCP server problems are the inability to start the service on the network in a Windows 2000 or Active Directory environment and the failure of clients to obtain TCP/IP configuration parameters from a working server. In this lesson, you learn how to troubleshoot DHCP clients and DHCP servers.

After this lesson, you will be able to

  • Identify and solve DHCP client problems
  • Identify and solve DHCP server problems

Estimated lesson time: 20 minutes

Preventing DHCP Problems

Many DHCP problems involve incorrect or missing configuration details. To help prevent the most common types of problems, you should do the following:

  • Use the 75/25 design rule for balancing scope distribution of addresses where multiple DHCP servers are deployed to service the same scope. Using more than one DHCP server on the same subnet provides increased fault tolerance for the DHCP clients located on that subnet. With two DHCP servers, if one server is unavailable, the other server can take its place and continue to lease new addresses or renew existing clients.
  • Use superscopes for multiple DHCP servers on each subnet in a LAN environment. A superscope enables a DHCP server to provide leases from more than one scope to clients on a single physical network. When each DHCP client starts, it broadcasts a DHCPDISCOVER message on its local network to attempt to find a DHCP server. Because DHCP clients use broadcasts during their initial startup, you cannot predict which server will respond to a client's request if more than one DHCP server is active on the same subnet.
  • Use server-side conflict detection on DHCP servers only when it is needed. Conflict detection can be used by either DHCP servers or clients to determine whether an IP address is already in use on the network before leasing or using the address.
  • Create reservations on all DHCP servers that can potentially service the reserved client. You can use a reservation to ensure that a DHCP client computer always receives the same IP address. If a client using a reservation can conceivably contact more than one DHCP server during its startup, you should create an identical reservation for that client on each of the DHCP servers.
  • For server performance, remember that DHCP is disk-intensive and purchase hardware with optimal disk performance characteristics. DHCP causes frequent and intensive activity on server hard disks. To provide the best performance, consider RAID 0 or RAID 5 solutions when purchasing hardware for your server computer.
  • Keep audit logging enabled for use in troubleshooting. By default, the DHCP service enables audit logging of service-related events. With Windows 2000 Server, audit logging provides for a long-term service monitoring tool that makes limited and safe use of server disk resources.
  • Integrate DHCP with other services, such as WINS and DNS. WINS and DNS can both be used for registering dynamic name-to-address mappings on your network. To provide name resolution services, you must plan for inter-operability of DHCP with these services. Most network administrators implementing DHCP also plan a strategy for implementing DNS and WINS servers.
  • Use the appropriate number of DHCP servers for the number of DHCP-enabled clients on your network. On a small network, such as a single LAN, one DHCP server can adequately serve all of the DHCP-enabled clients. For routed networks, the number of servers you need increases, depending on several factors, including the number of DHCP-enabled clients, the transmission speed between network segments, the speed of wide area network links (if any), the IP address class of the network, and whether DHCP service is used throughout the enterprise network or only on selected physical networks.

Troubleshooting DHCP Clients

Most DHCP-related problems start as a failed IP configuration attempt at a client, so it is a good practice to start there. After you have determined that a DHCP-related problem does not originate at the client, check the system event log and DHCP server audit logs for possible clues. When the DHCP service does not start, these logs generally explain the source of the service failure or shutdown. Further, you can use the Ipconfig utility at the command prompt to get information about the configured TCP/IP parameters on the computer.

The following sections describe common symptoms for DHCP client problems. When a client fails to obtain a TCP/IP configuration, you can use this information to quickly identify the source of the problem.

Invalid IP Address Configuration

If a DHCP client does not have an IP address configured or has an IP address configured as 168.254.x.x, that means that the client was not able to contact a DHCP server and obtain an IP address lease. This is either because of a network communications failure or because the DHCP server was unavailable. If this occurs, you should verify that the client computer has a valid, functioning network connection.

First, check that all of the client's network-related hardware devices, such as the cables and network interface adapters, are installed and working properly. Next, check to see that all of the necessary networking software components are installed in the client computer, including the network interface adapter driver, the Client for Microsoft Networks module, and the Internet Protocol (TCP/IP) module. In the Internet Protocol (TCP/IP) Properties dialog box, make sure that Obtain An IP Address Automatically is selected.

One method for checking the networking capabilities of the client computer is to install the NetBIOS Enhanced User Interface (NetBEUI) protocol module. NetBEUI requires no configuration, so simply installing it should enable the computer to communicate with other NetBEUI clients on the network. If the computer can communicate over the network using NetBEUI, then you know that the problem lies in the TCP/IP implementation or configuration. If the computer cannot communicate using NetBEUI (assuming that there are other NetBEUI systems on the LAN), then you know that the problem lies elsewhere, such as in the network interface adapter, the other networking software components, or the network itself.

Missing Configuration Settings

If a DHCP client is missing configuration settings, the client might be missing DHCP options in its leased configuration, either because the DHCP server is not configured to supply those options, or because the client does not support the options distributed by the server. If this problem occurs on Microsoft DHCP clients, verify that the most commonly used and supported options have been configured at either the server or scope level of option assignment. Microsoft DHCP Server includes support for numerous options that Microsoft DHCP clients cannot use. These options are intended for DHCP clients running other operating systems. Check the DHCP option settings on the server, and make sure that you have selected the appropriate options for your clients. In most cases, the options listed in the "Configuring Additional Options" section in Lesson 2 of this chapter are the only ones you need for the DHCP clients on computers running Windows.

DHCP Servers Do Not Provide IP Addresses

If DHCP clients are able to access the network, but are still unable to obtain IP addresses from a DHCP server, there are several possible causes of the problem. One potential cause is a change in the IP address of the DHCP server. A DHCP server can only service requests for a scope that has a network identifier that is the same as the network identifier of its own IP address. Make sure that the DHCP server IP address falls in the same network range as the scope it is servicing. For example, a server with an IP address in the 192.168.0.0 network cannot assign addresses from scope 10.0.0.0 unless superscopes are used.

Another possible cause of the problem is that the DHCP clients are located on a different LAN than the DHCP server, and must go through a router to obtain IP addresses. A DHCP server can provide IP addresses to client computers on other LANs only if a DHCP relay agent is available. Completing the following steps might correct this problem:

  1. Configure a DHCP/BOOTP relay agent on the LAN where the clients are located. The relay agent can be on the router itself or on a Windows 2000 Server computer running the DHCP Relay Agent service.
  2. At the DHCP server, configure a scope to match the network address on the other side of the router where the affected clients are located.
  3. In the scope, make sure that the subnet mask is correct for the remote network.
  4. Do not include this scope (that is, the one for the remote network) in superscopes configured for use on the same local subnet or segment where the DHCP server resides.

Another possibility is that multiple DHCP servers exist on the same LAN. Make sure that you do not configure multiple DHCP servers on the same LAN with overlapping scopes. You might want to rule out the possibility that one of the DHCP servers in question is a computer running Microsoft Small Business Server. By design, the DHCP service in Small Business Server automatically stops when it detects another DHCP server on the LAN.

Troubleshooting DHCP Servers

When a DHCP server fails to provide leases to its clients, the failure most often is discovered by clients in one of three ways:

  1. The client might be configured to use an IP address not provided by the server.
  2. The server sends a negative response back to the client, and the client displays an error message indicating that a DHCP server could not be found.
  3. The server leases the client an address but the client appears to have other network configuration-based problems, such as the inability to register or resolve DNS or NetBIOS names, or to perceive computers beyond its local network.

The first troubleshooting task is to make sure that the DHCP service is running. You can verify this by opening the DHCP console and attempting to access the server, or by opening the Computer Management console and looking at the Services list under Services and Applications. If the DHCP Server service is not started, you can attempt to start it manually using the Start Service button in the console toolbar. However, be sure to take notice of the service's startup type. If the startup type is set to Manual, then it is quite possible that the server computer was restarted and no one started the DHCP Server service. If the startup type is automatic and the service is not running, however, there must be a reason. Either the service failed to start when the computer started, someone manually stopped the service, or it has halted of its own accord. Check the logs in Event Viewer to determine if the server failed to start or stopped because of a problem elsewhere in the computer, such as a memory shortage.

DHCP Relay Agent Service Is Installed But Not Working

The DHCP Relay Agent service is not designed to run on the same computer as the DHCP Server service. Because both of these services listen for and respond to BOOTP and DHCP messages sent using UDP ports 67 and 68, neither service works reliably if both are installed on the same computer. To solve this problem, install the DHCP Server service and the DHCP Relay Agent service on separate computers.

DHCP Console Incorrectly Reports Lease Expirations

When the DHCP console displays the lease expiration time for reserved clients for a scope, it indicates one of the following:

  • If the scope lease time is set to an infinite lease time, the reserved client's lease is also shown as infinite.
  • If the scope lease time is set to a finite length of time (such as eight days), the reserved client's lease uses this same lease time.

The lease term of a DHCP reserved client is determined by the lease assigned to the reservation. To create reserved clients with unlimited lease durations, create a scope with an unlimited lease duration and add reservations to that scope.

DHCP Server Uses Broadcasts to Respond to All Client Messages

The DHCP server uses broadcast transmissions to respond to all client configuration request messages, regardless of how each DHCP client has set the broadcast bit flag. DHCP clients can set the broadcast flag (the first bit in the 16-bit flags field in the DHCP message header) when sending DHCPDISCOVER messages to indicate to the DHCP server that it should address its DHCPOFFER messages to the limited broadcast address (255.255.255.255).

By default, the DHCP server in Microsoft Windows NT Server 3.51 and earlier versions ignored the broadcast flag in DHCPDISCOVER messages and sent all DHCPOFFER replies as broadcasts. This behavior is implemented on the server to avoid problems that can result from clients not being able to receive or process a unicast response without a complete TCP/IP configuration.

Starting with Microsoft Windows NT Server 4, the DHCP service still attempts to transmit all DHCP responses to the limited broadcast address, unless support for unicast responses is explicitly enabled by setting the value of the IgnoreBroadcastFlag registry entry to 1. This registry entry is located in HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DHCPServer\ Parameters\IgnoreBroadcastFlag. When set to 1, the computer ignores the broadcast flag in client requests and broadcasts all DHCPOFFER responses. When the registry entry is set to 0, the server adjusts its transmission behavior (whether to broadcast or not) based on the value of the broadcast bit flag in the client's DHCPDISCOVER request. If this flag is set in the request, the server transmits its responses to the limited local broadcast address. If the flag is not set in the request, the server transmits its responses directly to the client as unicasts.

DHCP Server Fails to Issue Address Leases for a New Scope

There are situations in which you might want to assign new IP addresses to all of the DHCP clients on a particular network. You might have obtained a registered class of IP addresses for your network, or you might be changing the address class to accommodate more computers or more networks. To do this, you create a new scope on your DHCP server containing a range of new addresses. In this type of situation, you want clients to obtain leases in the new scope instead of using the old scope to obtain or renew their leases. Once all clients are actively obtaining leases in the new scope, you intend to remove the existing scope. However, when you activate the new scope, you find that the DHCP clients do not obtain leases from the newly defined scope.

When superscopes are not available or not used, only a single DHCP scope can be active on the network at one time. If there is more than one scope defined and activated on the DHCP server, the server uses only one scope to provide leases to clients. The active scope that the DHCP server used for distributing leases is determined by the network identifier in the first IP address assigned to the DHCP server's network interface adapter. The DHCP server always uses the scope with the same network identifier as its own IP address. You can configure additional IP addresses for a network interface using the IP Settings tab in the Advanced TCP/IP Settings dialog box, but these addresses have no effect on the DHCP server's scope selection.

You can resolve this problem in the following ways:

  • Configure the DHCP server to use a superscope that includes the old scope and the new scope.
  • Change the primary IP address, that is, the address assigned in the Internet Protocol (TCP/IP) Properties dialog box, for the DHCP server's network adapter to an IP address that has the same network identifier as the new scope. If necessary, you can maintain the prior address that was first assigned as an active IP address for the server computer by moving it to the list of multiple IP addresses maintained in the Advanced TCP/IP Properties tab.

Monitoring Server Performance

Because DHCP servers are of critical importance in most environments, monitoring the performance of servers can help in troubleshooting cases in which server performance degradation occurs. For Windows 2000 Server, the DHCP service includes a set of performance counters that you can use to monitor various types of server activity. By default, these counters are available in the System Monitor application after the DHCP service is installed. The DHCP server counters can monitor the following parameters:

  • All types of DHCP messages sent and received by the DHCP service
  • The average amount of processing time spent by the DHCP server per message packet sent and received
  • The number of message packets dropped because of internal delays on the DHCP server computer

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next chapter. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. How can you force a DHCP server to assign new IP addresses with a different network identifier to all of the clients on the network?
  2. What type of messages, broadcast or unicast, do Microsoft DHCP servers use to send DHCPOFFER messages in response to DHCPDISCOVER messages, by default?
  3. What is the most common symptom of DHCP-related problems?

Lesson Summary

  • Most Dynamic Host Configuration Protocol (DHCP) problems manifest as a failure of DHCP clients to obtain Internet Protocol (IP) addresses and other Transmission Control Protocol/Internet Protocol (TCP/IP) configuration parameters from a DHCP server.
  • A DHCP client with an IP address of 168.254.x.x has failed to contact a DHCP server and has instead had an address assigned by the Windows 2000 Automatic Private IP Addressing feature.
  • A DHCP server can only service requests for a scope with the same network identifier as its own IP address.
  • The Microsoft DHCP Server service always responds to DHCPDISCOVER messages with broadcast transmissions, unless you change its default behavior by modifying the Windows 2000 registry.
  • A DHCP server configured with multiple scopes uses the network identifier of its own IP address to determine which scope to use when servicing clients.


Windows Name Resolution

About This Chapter

As part of the Microsoft Windows installation process, you specify a name by which the computer is known to the network. The Windows setup program refers to this as a computer name, but in actuality, it is a Network Basic Input/Output System (NetBIOS) name. To use NetBIOS names on a Transmission Control Protocol/Internet Protocol (TCP/IP) network, there must be a mechanism that resolves the names into the Internet Protocol (IP) addresses needed for TCP/IP communication. This chapter examines the various types of NetBIOS name resolution mechanisms provided by the Windows operating systems and how to use them on your network.

Before You Begin

This chapter requires a basic understanding of Windows and TCP/IP network communications. To perform the exercises in this chapter, you need a lab network with a Microsoft Windows 2000 server running Dynamic Host Configuration Protocol (DHCP) and a client computer running Windows 2000.


Lesson 1: Understanding Windows Name Resolution

Name resolution is a basic principle of TCP/IP communications. All of the TCP/IP messages transmitted over a network use IP addresses to identify the computers that originated them and for which they are destined. Although IP addresses are easily handled by computers, they are difficult for humans to remember, and naming systems have been developed over the years to create more user-friendly identifiers for computers and other network elements. The naming system used by Windows is based on NetBIOS. This lesson examines the various methods that a Windows computer can use to resolve NetBIOS names into IP addresses.

After this lesson, you will be able to

  • Describe the NetBIOS name resolution mechanisms included in the Windows operating systems
  • Create an LMHOSTS file
  • List the NetBIOS over TCP/IP node types

Estimated lesson time: 10 minutes

When Microsoft first introduced networking into its operating system products, such as Microsoft Windows for Workgroups and Microsoft Windows NT 3.1, they adopted the NetBIOS namespace as a convenient method for providing computers with friendly names. A NetBIOS name is 16 characters long, with Windows reserving the sixteenth character for a code identifying the type of device to which the name is assigned. This leaves 15 usable characters for the NetBIOS name, which you assign during installation of the operating system. These versions of Windows used NetBIOS names in conjunction with the NetBIOS Enhanced User Interface (NetBEUI) protocol to provide basic local area networking services.

In later years, when Microsoft adopted TCP/IP as the default networking protocols for Windows, NetBEUI was no longer necessary (although it is still an option), but the NetBIOS names remained. Microsoft implemented standards that define the use of NetBIOS Over TCP/IP (NetBT), which call for a mechanism that can resolve the NetBIOS names into the IP addresses needed for TCP/IP communications. Windows has introduced several NetBIOS name resolution mechanisms over the years, all of which are still available in Windows 2000, including the following:

  • NetBIOS name cache
  • Network broadcasts
  • LMHOSTS files
  • Windows Internet Naming Service (WINS)
  • Active Directory service

Early versions of Windows NT rely on network broadcasts and LMHOSTS files, but in later versions up to Microsoft Windows NT 4, WINS is generally the NetBIOS name resolution mechanism of choice for all but small, informal networks. However, Windows 2000 represents a major departure from this progression of name resolution mechanisms. Active Directory service, included with Windows 2000, relies on the Domain Name System to handle name registration and resolution tasks, making WINS and the other mechanisms obsolete on a Windows 2000-only network.

Windows 2000 computers continue to maintain NetBIOS equivalents to the DNS names, however, and Windows 2000 Server still includes a WINS server to support computers on the network that are running earlier versions of Windows. If your network includes computers running Windows NT, Microsoft 98, or Microsoft 95, you must continue to provide a means of registering and resolving their NetBIOS names so that they can interact with the Windows 2000 computers.

The following sections examine the various types of NetBIOS name resolution mechanisms that computers running pre-Windows 2000 operating systems can use.

Understanding the NetBIOS Name Cache

No matter what name resolution mechanism they use, Windows computers always maintain a cache of the NetBIOS names they have recently resolved and their equivalent IP addresses. When the computer encounters a NetBIOS name that needs resolving, it always checks the NetBIOS name cache before using any other name resolution mechanism. Because the cache is stored in memory, it is by far the fastest method available, and it generates no network traffic. Of course, keeping the cache in memory means that the cache is emptied when the system restarts, and cache entries expire after a relatively short interval, even without a restart, so that the system does not use outdated information.

To view the contents of the NetBIOS name cache, you use the Nbtstat.exe utility with the -c parameter, to produce a display like the following:

c:\>nbtstat -c
Node IpAddress: [192.168.2.5] Scope Id: []
               NetBIOS Remote Cache Name Table
     Name               Type	HostAddress		Life [sec]
------------------------------
CZ3             <20>    UNIQUE	192.168.2.3		360
CZ1             <20>    UNIQUE	192.168.2.10		360
CZ1             <00>    UNIQUE	192.168.2.10		360
CZ1             <03>    UNIQUE	192.168.2.10		360
It is also possible to preload entries into the NetBIOS name cache using the #PRE tag in an LMHOSTS file, as discussed later in this lesson. Preloaded entries do not expire, but they must be reloaded every time the system starts.

Understanding Broadcast Name Resolution

When WINS servers are not available, computers running pre-Windows 2000 operating systems use broadcast messages to resolve NetBIOS names into IP addresses. This method is simple and reasonably efficient. When the computer encounters the NetBIOS name of another computer on the network, it generates a series of NAME QUERY REQUEST messages and transmits them as broadcasts to all of the other computers on the local network. The computer using the NetBIOS name specified in the query message must respond by transmitting a POSITIVE NAME QUERY RESPONSE message back to the sender, containing its IP address. The sender can then use the IP address to send unicast messages to the destination computer.

There are two main problems with the broadcast name resolution method. First, broadcasts are useful only for resolving the names of computers on the local network. Broadcast transmissions are restricted by the boundaries of the local area network (LAN) on which they originate, so Windows computers cannot use this method to resolve the names of computers on other LANs, even if they are connected by routers. In the days before the use of WINS became common, network administrators would use broadcasts in combination with an LMHOSTS file, with the latter dedicated to resolution of NetBIOS names only on different LANs. The second problem is that this method can generate an excessive number of broadcast transmissions on the network, forcing the network interface adapters on all of the network's computers to accept, examine, and discard a large number of messages that are destined for other computers. The resolution to this problem is to install a WINS server, which uses only unicast transmissions.

Using LMHOSTS Files

In the early days of the TCP/IP protocols, when the protocol developers recognized the need for user-friendly computer names (called host names in TCP/IP terminology), they began by using a simple lookup table called a HOSTS file for name resolution. A HOSTS file is simply a text file containing a list of host names and their equivalent IP addresses. When TCP/IP computers encounter a host name in an application, they look it up in the HOSTS file and discover the IP addresses associated with that name. An LMHOSTS file works for NetBIOS names using the same basic concept.

The advantages of LMHOSTS over broadcast name resolution are that it is fast, because it only requires a disk read and no network communication, and that it can resolve the NetBIOS name of a computer anywhere on an internetwork. On networks using broadcasts as their primary NetBIOS name resolution mechanism, you can use an LMHOSTS file to resolve the names of servers located on different LANs.

Despite these advantages, however, LMHOSTS files, like the HOSTS files before them, suffer from two profound shortcomings. The first one is the fact that someone must manually update the LMHOST file when the network changes. The second is that each computer must have its own copy of the file. For these reasons, the LMHOSTS file is the least popular of the NetBIOS name resolution methods included with Windows.

An LMHOSTS file consists of entries containing NetBIOS names and their IP addresses, as in the following examples:

    192.168.94.97     rhino

    192.168.94.123    popular

    192.168.94.117    localsrv

You can also create several different types of entries with keywords that perform special functions, as listed in Table 15.1.

Table 15.1 LMHOSTS Keywords and Their Functions

Keyword | Description
\0xnn | Provides support for nonprinting characters in NetBIOS names. Enclose the NetBIOS name in double quotation marks and use \0xnn notation to specify a hexadecimal value for the character. This enables custom applications that use special names to function properly in routed topologies. Note that the hexadecimal notation applies only to one character in the name. The name should be padded with blanks so that the special character is last in the string (character 16).
#BEGIN_ALTERNATE | Used to group multiple #INCLUDE statements. Any single successful #INCLUDE statement causes the group to succeed.
#END_ALTERNATE | Used to mark the end of an #INCLUDE statement grouping.
#DOM:<domain> | Part of the computer name-to-IP-address mapping entry that indicates that the IP address belongs to a domain controller in the domain specified by <domain>. This keyword affects how the Browser and Logon services behave in a routed TCP/IP environment. To preload a #DOM entry, you must first add the #PRE keyword to the line. #DOM groups are limited to 25 members.
#INCLUDE <filename> | Forces the system to seek the specified <filename> and parse it as if it were local. Specifying a Universal Naming Convention (UNC) <filename> enables you to use a centralized LMHOSTS file on a server. If the server on which the specified <filename> exists is located on another LAN, you must add a preloaded entry for the server (using the #PRE keyword) before the entry in the #INCLUDE section.
#MH | Part of the computer name-to-IP-address mapping entry that defines the entry as a unique name that can have more than one address. The maximum number of addresses that can be assigned to a unique name is 25. The number of entries is equal to the number of network interface adapters in a multihomed computer.
#PRE | Part of the computer name-to-IP-address mapping entry that causes that entry to be preloaded into the name cache. (By default, entries are not preloaded into the name cache but are parsed only after WINS and name query broadcasts fail to resolve a name.) The #PRE keyword must be appended for entries that also appear in #INCLUDE statements; otherwise, the entry in the #INCLUDE statement is ignored.
#SG | Part of the computer name-to-IP-address mapping entry that associates that entry with a user-defined special (Internet) group specified by <name>. The #SG keyword defines Internet groups by using a NetBIOS name that has 0x20 in the sixteenth byte. A special group is limited to 25 members.

Some examples of LMHOSTS entries using these keywords are as follows:

    192.168.94.97	rhino		#PRE #DOM:networking	#net group's DC

    192.168.94.102	"appname	\0x14"	#special app
                    server

    192.168.94.123	popular		#PRE	#source server

    192.168.94.117	localsrv		#PRE	#needed for the
                    include

#BEGIN_ALTERNATE

#INCLUDE \\localsrv\public\lmhosts

#INCLUDE \\rhino\public\lmhosts

#END_ALTERNATE

Introducing WINS

WINS is a NetBIOS name server that runs as a service on Windows 2000 and Windows NT servers that enables network clients to resolve NetBIOS names into IP addresses by sending a single unicast message to a WINS server, rather than broadcast messages to the entire network. For more information about WINS, see Lesson 2 of this chapter.

Registering Names

Name registration is the process that makes name resolution possible. All of the NetBIOS name resolution mechanisms included in the Windows operating systems have a means of establishing the NetBIOS names on the network and associating them with specific IP addresses. For an LMHOSTS file, the name registration process occurs when the user or administrator manually creates the entries in the file.

On a network that uses broadcasts for name resolution, the name registration process occurs when each computer on the network starts and transmits a series of NAME REGISTRATION REQUEST messages as broadcasts. The computer is, in essence, announcing its name and checking to see that no other computer is already using that name. If there is a duplicate name, the computer using it sends a NEGATIVE NAME REGISTRATION RESPONSE message back to the sender, and the user is forced to select another NetBIOS name. If the computer does not receive any replies, it assumes possession of the name.

The WINS name registration process also occurs during system startup, as described in Lesson 2 of this chapter.

Windows Node Types

The NetBIOS name registration and resolution mechanisms used by a computer running a pre-Windows 2000 operating system are determined by the system's node type. The NetBT standards define three node types, as follows:

  • B node. Uses only broadcasts for name registration and resolution.
  • P node. Uses only NetBIOS name servers for name registration and resolution.
  • M node. Uses only broadcasts for name registration. For name resolution, uses broadcasts first and switches to a NetBIOS name server if the broadcast method fails to resolve the name.

These node types are abstract examples of the name registration and resolution behaviors of a generic network client, but they do not fit well into the Windows NetBT implementation. Both B node and P node computers use a single NetBIOS name resolution mechanism, and if that mechanism fails, the name is not resolved and the client cannot communicate with the named computer. The B node type makes no provision for names belonging to computers on other networks, and the P node type has no fallback if the NetBIOS name server fails. The M node type uses the NetBIOS name server as a fallback for the broadcast method, but this makes little sense when the NetBIOS name server (such as WINS) can completely replace broadcasts.

As a result, Microsoft has developed some node types of its own, as follows:

  • Modified B node. Uses only broadcasts for name registration. For name resolution, it uses broadcasts first and switches to an LMHOSTS file if the broadcast method fails. This is the default node type for a Windows computer that is not a WINS client. The use of LMHOSTS as a fallback makes it possible to resolve the names of computers on other networks when broadcasts fail to resolve them.
  • H node. Uses only NetBIOS name server (WINS) for name registration. For name resolution, it uses NetBIOS name servers first, and if they fail or are unavailable, it switches to broadcasts. The computer then reverts back to NetBIOS name servers as soon as they are available. This is the default node type for a Windows computer configured to use WINS.
  • Microsoft enhanced H node. A variation on the H node type that adds LMHOSTS, DNS queries, and HOSTS files as fallbacks to the NetBIOS name servers and broadcasts defined in the H node type. Computers running Windows NT and Windows 2000 can use all of these name resolution methods.

Exercise 15.1: NetBIOS Name Resolution Concepts

Match the terms in the left column with the appropriate descriptions in the right column.

  1. M node
  2. NetBIOS name cache
  3. Broadcast name resolution
  4. H node
  5. LMHOSTS
  1. Default name resolution mechanism for Windows computers not configured to use WINS
  2. Uses broadcast name resolution, with WINS as a fallback
  3. Fallback name resolution mechanism for a modified B node computer
  4. First name resolution mechanism used by all Windows computers
  5. Uses WINS name resolution, with broadcasts as a fallback
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Which of the following name resolution mechanisms can only resolve the names of computers on the local network?
    1. LMHOSTS
    2. Broadcast name resolution
    3. WINS
    4. NetBIOS name cache
  2. Which of the following is the fastest NetBIOS name resolution mechanism?
    1. LMHOSTS
    2. Broadcast name resolution
    3. WINS
    4. NetBIOS name cache
  3. Which of the following node types can use an LMHOSTS file for NetBIOS name resolution?
    1. H node
    2. B node
    3. Modified B node
    4. M node

Lesson Summary

  • Windows computers use Network Basic Input/Output System (NetBIOS) names to identify themselves on the network.
  • To use NetBIOS names on a Transmission Control Protocol (TCP/IP) network, there must be a mechanism available to resolve NetBIOS names into Internet Protocol (IP) addresses.
  • Versions of Windows prior to Windows 2000 can use several different name resolution mechanisms, including broadcasts, LMHOSTS files, and Windows Internet Naming System (WINS).
  • Windows 2000 computers use Active Directory service and Domain Name System (DNS) for name resolution.
  • Windows 2000 Server includes a WINS server only to support pre-Windows 2000 clients.


Lesson 2: Using WINS

This lesson explains the purpose and function of WINS and name registration. It also covers the WINS server and client configuration, support for non-WINS clients, and how to use the DHCP snap-in to configure WINS on a DHCP client computer.

After this lesson, you will be able to

  • Explain the purpose and functions of WINS, including name registration, name resolution, name renewals, and name releases
  • Install WINS on a Windows 2000 server
  • Create static mappings
  • Understand the function of a WINS proxy agent

Estimated lesson time: 35 minutes

Introduction to WINS

In a mixed network environment, down-level clients, such as computers running Windows 98 or Windows NT 4, use NetBIOS names to communicate. As a result, a Windows 2000 network running TCP/IP with down-level clients requires a means of resolving NetBIOS names to IP addresses. WINS is an enhanced NetBIOS name server that registers NetBIOS computer names and resolves them into the IP addresses needed for TCP/IP communication. WINS also provides a dynamic database that maintains mappings of computer names to IP addresses.

The WINS Name Resolution Process

The WINS name resolution process enables WINS clients to retrieve the IP addresses associated with NetBIOS names far more efficiently than any of the other name resolution mechanisms provided by Windows. When a WINS client initiates a NetBIOS command to communicate with another network resource, it first checks its NetBIOS name cache to see if there is an entry for the desired name. If the client cannot resolve the name from its cache, it transmits a NAME QUERY REQUEST message to its primary WINS server. All WINS communications use directed datagrams over User Datagram Protocol (UDP) port 137 (NetBIOS Name Service). The WINS server searches its database for a NetBIOS name-to-IP-address mapping for the destination resource, and returns the IP address to the WINS client in a POSITIVE NAME QUERY RESPONSE message. A NEGATIVE NAME QUERY RESPONSE message indicates that the requested name does not exist in the WINS database.

If the server experiences a delay in responding to the client's request, it may send a series of WAIT FOR ACKNOWLEDGEMENT RESPONSE (WACK) messages to prevent the client from timing out. If the client receives no response at all from the WINS server after a given amount of time, it switches to the secondary WINS server that it is configured to use (if there is one), and transmits another series of NAME QUERY REQUEST messages. If there is still no response, or if either server transmits a NEGATIVE NAME QUERY RESPONSE message, the client switches to an alternate NetBIOS name resolution mechanism, such as broadcast query messages, as defined by its node type.

The query messages generated by WINS clients are all but identical to those used by the broadcast name resolution method, except that the client sends them to the server as unicasts, and not broadcasts. Because there are only two computers involved in the transaction, this reduces the amount of network traffic generated by the name resolution process. Also, because unicast transmissions are not subject to LAN boundaries as broadcasts are, a WINS client can communicate with a WINS server anywhere on the internetwork.

WINS Name Registration

Each WINS client is configured with the IP address of a primary WINS server and, optionally, a secondary WINS server. When a client starts, it registers its NetBIOS name and IP address by sending a NAME REGISTRATION REQUEST message directly to the configured WINS server. If the WINS server is available and another WINS client has not registered the name already, the WINS server returns a POSITIVE NAME REGISTRATION RESPONSE message to the client. This message includes the amount of time that the NetBIOS name is registered to the client, specified as the Time to Live (TTL). In addition, the WINS server stores the client's NetBIOS name-to-IP-address mapping in its database.

The WINS TTL value has no relationship to the Time to Live field in the IP header.

One of the advantages of WINS over other types of name servers, such as DNS, is that a WINS client automatically updates the WINS server database whenever its IP address changes. For example, when you move a client computer to a different subnet and DHCP assigns it a new address, the WINS database is automatically updated with the new information.

When a WINS client attempts to register a name that is already in the WINS database, the WINS server performs a name challenge procedure by transmitting a series of NAME QUERY REQUEST messages to the current owner of the name, using all of the IP addresses associated with it. If the name's current owner responds to the server with a POSITIVE NAME QUERY RESPONSE message, then the server sends a NEGATIVE NAME REGISTRATION RESPONSE message to the new applicant, denying the name registration and forcing the client to choose a new NetBIOS name. If the WINS server does not receive a response after transmitting three messages at 500-millisecond intervals, or if the currently registered name owner responds with a NEGATIVE NAME QUERY RESPONSE message, indicating that it is no longer using the name, the server purges the name from its database and assigns it to the new client.

WINS Name Renewal

WINS servers register all NetBIOS names for a specified interval, the TTL, which is six days by default. Other computers can then use the same name later if the original owner stops using it. Because the WINS NetBIOS name registrations are temporary, WINS clients must renew their names or the leases will expire.

Each time a WINS client computer restarts and registers its name with the WINS server, the TTL interval is reset. If the client remains logged on to the network continuously for half of the TTL interval (three days, by default), it begins transmitting NAME REFRESH REQUEST messages to the WINS server. The server then replies with a POSITIVE NAME REFRESH RESPONSE message, which resets the TTL timer, or with a NEGATIVE NAME REFRESH RESPONSE message, which cancels the name registration and forces the client to register a different NetBIOS name.

If the client receives no response from the server, it repeats its request every two minutes until half of the remaining TTL interval has passed. The client then switches to the secondary WINS server specified in its configuration and transmits the same NAME REFRESH REQUEST messages. Once again, if the client receives no response, it retransmits every two minutes until half of the remaining TTL interval has expired. The renewal process continues in this way, switching WINS servers every time the client reaches half of the remaining TTL value. If the TTL period expires without the client receiving a response from a WINS server, the client reverts to broadcast name registration.

WINS Name Release

As part of a WINS client's system shutdown sequence, the computer transmits a NAME RELEASE REQUEST message to the WINS server, indicating that it is no longer using its registered NetBIOS name. This enables the WINS server to reassign the name to another client that might attempt to register it. The server responds to the request with either a POSITIVE NAME RELEASE RESPONSE message, indicating that the server has successfully released the name, or a NEGATIVE NAME RELEASE RESPONSE message, which only occurs when the record for the NetBIOS name contains a different IP address than that of the computer sending the message.

Installing a WINS Server

WINS is supplied with the Windows 2000 Server operating system, but it is not installed by default. You can opt to install WINS with the operating system, or you can install it separately later, using the Add/Remove Programs Control Panel. Although a WINS server requires a computer running Windows 2000 Server, the server does not have to be a domain controller. In addition, the server should be configured with a static IP address, subnet mask, and default gateway. Do not use DHCP to configure the TCP/IP configuration parameters for a WINS server.

To install the WINS service, use the following procedure:

  1. On a computer running Windows 2000 Server, log on as Administrator.
  2. Click Start, point to Settings, and click Control Panel.
  3. Double-click the Add/Remove Programs icon, then click Add/Remove Windows Components to activate the Windows Components Wizard (see Figure 15.1).

    Figure 15.1 The Windows Components page of the Windows Components Wizard
  4. In the Components list, scroll down to and select Networking Services.
  5. Click Details to open the Networking Services dialog box.
  6. In the Subcomponents Of Networking Services list, shown in Figure 15.2, select the Windows Internet Name Service (WINS) check box.

    Figure 15.2 The Subcomponents Of Networking Services list in the Networking Services dialog box
  7. Click OK, then click Next. If prompted, type the full path to the Windows 2000 distribution files and click Continue. Required files are copied to your hard disk.
  8. Click Finish to close the Windows Components Wizard.
After you install the WINS Service on the computer running Windows 2000 Server, you should configure the server to function as a WINS client (as described later in this lesson), with itself as the WINS server.

When you install WINS on a computer running Windows 2000, the WINS snap-in, as shown in Figure 15.3, is added to the Administrative Tools program group. The WINS snap-in provides access to detailed information about the WINS servers on a network, enables you to view the contents of the WINS database and search for specific entries, and enables you to perform all WINS management and configuration tasks. You can access the WINS snap-in as a stand-alone Microsoft Management Console (MMC) or through the Computer Management console, under Services and Applications.

Figure 15.3 The WINS snap-in

Configuring a Windows 2000 WINS Client

Although Windows 2000 does not need WINS to access other Windows 2000 resources on the network, it does need it to access resources on computers running earlier versions of Windows. You must also configure the WINS server itself to be a WINS client.

To configure a Windows 2000 computer to function as a WINS client, use the following procedure:

  1. Log on as Administrator.
  2. Click Start, point to Settings, and click Networking And Dial-Up Connections.
  3. Right-click the Local Area Connection icon and, from the pop-up menu, choose Properties to display the Local Area Connection Properties dialog box.
  4. Select Internet Protocol (TCP/IP) and click Properties to display the Internet Protocol (TCP/IP) Properties dialog box, illustrated in Figure 15.4.

    Figure 15.4 The Internet Protocol (TCP/IP) Properties dialog box
  5. Click Advanced to display the Advanced TCP/IP Settings dialog box and then click the WINS tab, as shown in Figure 15.5.

    Figure 15.5 The WINS tab of the Advanced TCP/IP Settings dialog box
  6. Click Add to display the TCP/IP WINS Server dialog box.
  7. Type the IP address of a WINS server on your network in the WINS server text box and click Add.
  8. Repeat Steps 6 and 7 to add a secondary WINS server to the configuration, if desired.
  9. Click OK to close the Advanced TCP/IP Settings dialog box.
  10. Click OK to close the Internet Protocol (TCP/IP) Properties dialog box.
  11. Click OK to close the Local Area Connection Properties dialog box.

Supporting Non-WINS Clients

In a WINS environment, you can provide support for non-WINS clients in two ways: by using static mappings and by configuring a WINS proxy agent, as described in the following sections.

Using Static Mappings

On a network that includes non-WINS clients, you can configure a static NetBIOS name-to-IP-address mapping for each non-WINS client. This ensures that WINS clients can resolve the NetBIOS names of the non-WINS computers.

If you have DHCP clients that require static mappings, you must create IP address reservations for them on the DHCP server so that their IP addresses are always the same.

To configure a static mapping for non-WINS clients, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the WINS console.
  2. Expand the icon for your WINS server and select Active Registrations.
  3. From the Action menu, select New Static Mapping, to display the New Static Mapping dialog box, as shown in Figure 15.6.

    Figure 15.6 The New Static Mapping dialog box
  4. Type the NetBIOS Name of the computer you want to create a mapping for in the Computer Name text box.
  5. Select the type of mapping you want to create in the Type drop-down list. The available options are as follows:
    • Unique. A unique name that maps to a single IP address.
    • Group. A name that maps to a group. When adding an entry to a group using the WINS snap-in, enter the computer name and IP address. The IP addresses of group members are not stored in the WINS database, so there is no limit to the number of members you can add.
    • Domain Name. A NetBIOS name-to-IP-address mapping with 0x1C as the sixteenth byte. A domain group stores up to 25 addresses for members. For registrations after the address limit has been reached, WINS overwrites a replica address or, if none is present, the oldest registration.
    • Internet Group. User-defined groups that you use to group resources, such as printers, for reference and browsing. An Internet group can store up to 25 addresses for members. A dynamic member, however, does not replace a static member that you add by using the WINS snap-in or by importing the LMHOSTS file.
    • Multihomed. A unique name that can have more than one address. Use this option for computers with multiple network adapter cards. You can register up to 25 multihomed addresses. For registrations after the address limit has been reached, WINS overwrites a replica address or, if none is present, it overwrites the oldest registration.
  6. Type the IP address that you want to map to the NetBIOS name you selected in the IP Address text box.
  7. Click OK to create the static mapping.
The WINS snap-in adds a static mapping to the WINS database when you click OK. If you enter incorrect information for a static mapping, you must delete that mapping and then create a new one.

Configuring a WINS Proxy Agent

A WINS proxy agent extends the name resolution capabilities of the WINS server to non-WINS clients by listening for broadcast name registration and name resolution requests and then forwarding them to a WINS server. When a non-WINS client broadcasts a NAME REGISTRATION REQUEST message, the WINS proxy agent forwards the request to the WINS server to verify that no other WINS client has registered that name. The WINS server does not register the NetBIOS name, it only verifies it. When a WINS proxy agent detects a NAME QUERY REQUEST broadcast, it checks its NetBIOS name cache and attempts to resolve the name. If the name is not in the cache, the proxy agent sends the request to a WINS server. The WINS server then responds to the WINS proxy agent with the IP address for the requested NetBIOS name. The WINS proxy agent returns this information to the non-WINS client.

To configure a WINS proxy agent, edit the registry on a WINS client computer by setting the value for the EnableProxy entry to 1, and then restart the computer. The EnableProxy entry is located in the registry under the subkey HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters.

Exercise 15.2: Installing and Configuring WINS

In this exercise, you install WINS on your Windows 2000 server, and then configure your DHCP server to provide a primary WINS server address to clients on the network.

Procedure 1: Installing WINS

To install WINS on a Windows 2000 server, complete the following steps:

  1. Log on to the server as Administrator.
  2. Click Start, point to Settings, and then click Control Panel.
  3. Double-click Add/Remove Programs to display the Add/Remove Programs dialog box.
  4. Click Add/Remote Windows Components in the left pane to activate the Windows Components Wizard.
  5. In the Components list, select Networking Services, but do not select or clear the check box to the left of this option.
  6. Click Details to display the Networking Services dialog box.
  7. In the Subcomponents Of Networking Services list, select the Windows Internet Naming Service (WINS) check box.
  8. Click OK to display the Windows Components page.
  9. Click Next. The Configuring Components page makes the configuration changes you requested. A File Copy box appears as WINS files are copied into the operating system folders. Insert the Windows 2000 Server CD-ROM into the drive if you are prompted to do so. The Completing The Windows Components Wizard page appears.
  10. Click Finish.
  11. Close the Add/Remove Programs window.
  12. Close Control Panel.

Procedure 2: Configuring DHCP to Support WINS

In this procedure, you configure the DHCP service to deliver a WINS server address to DHCP clients on the network. This procedure assumes that the DHCP service is already installed and configured with a scope on your server. To give you practice with setting server options, you use the server options node. These settings could also be configured as scope options if you want them to apply only to a specific scope or even to a specific DHCP client.

  1. Click Start and, from the Administrative Tools program group, open the DHCP console.
  2. In the console tree, right-click the Server Options icon and, from the pop-up menu, choose Configure Options to open the Server Options dialog box.
  3. Scroll down to 044 WINS/NBNS Servers, and then select this check box.
  4. In the Server Name text box, type the name of your WINS server, and then click Resolve. What happens?
  5. Click Add.
  6. In the Available Options list, scroll down to 046 WINS/NBT Node Type and select this check box.
  7. In the Byte text box, type 8 so that the text box entry reads 0x8. 0x8 sets the node type to H node. What does this mean?
  8. Click OK. What happens?
  9. Close the DHCP console.

Procedure 3: Testing WINS Settings (Optional)

In this procedure, you release and renew the DHCP lease on a client workstation. Then you load the WINS console on your server to verify the registration of the client in the WINS database.

  1. On a Windows 2000 DHCP client workstation connected to the same network as your WINS/DHCP server, open a command prompt.
  2. Type ipconfig /release, and then press Enter. What happens?
  3. Type ipconfig /renew, and then press Enter. What happens?
  4. Type ipconfig /all | more, and then press Enter.
  5. Press Enter as necessary so that you can see the settings for <adapter type> adapter Local Area Connection.
  6. Notice that Node Type is set to Hybrid. Hybrid is equivalent to H node. Also notice that the primary WINS server is set to the IP address of your WINS server.
  7. Close the command prompt on the client.
  8. On your WINS server, click Start, point to Programs and, from the Administrative Tools program group, select WINS to display the WINS snap-in.
  9. Maximize the WINS snap-in.
  10. Expand the icon for your WINS server and then click Active Registrations.
  11. From the Action menu, select Find By Name to display the Find By Name dialog box.
  12. In the Find Names Beginning With text box, type the first three letters of the client computer and then click Find Now.

    Under Record Name, your client appears with three entries, which are the services that broadcast the client's name onto the network. The first entry, 00h, is the NetBIOS computer name. 03h is used for sending and receiving broadcast messages. 20h is used for share access by other computers on the network.

  13. Close the WINS snap-in.
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next chapter. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. List two reasons why WINS is an improvement over the broadcast name resolution method.
  2. What is the name of the property that determines when a WINS client should renew its name registration?
  3. When does a WINS name release occur?

Lesson Summary

  • Windows Internet Naming Service (WINS) is a Network Basic Input/Output System (NetBIOS) name server application that can provide NetBIOS name registration and resolution services for an entire Windows network.
  • WINS is an improvement over broadcast name resolution because it uses only unicast transmissions, which reduces the amount of network traffic generated by the name resolution process.
  • Windows 2000 no longer uses WINS to resolve the names of other Windows 2000 computers, but it is still included with Windows 2000 Server to support clients running earlier versions of Windows.
  • Static mappings enable WINS clients to resolve the NetBIOS names of non-WINS computers.
  • A WINS proxy agent relays broadcast name registration and resolution messages to a WINS server.


Domain Name System

About This Chapter

The Domain Name System (DNS) is a distributed database used on Transmission Control Protocol/Internet Protocol (TCP/IP) networks to translate computer names (host names) to Internet Protocol (IP) addresses. For Microsoft Windows 2000 Server, the DNS service has been carefully integrated into the design and implementation of Active Directory service. When deploying Active Directory service and Windows 2000 Server together, DNS name resolution is needed to locate Windows 2000 domain controllers. The Netlogon service uses DNS server support for the service (SRV) resource record to provide registration of domain controllers in your DNS domain namespace. Active Directory service can also be used to store, integrate, and replicate zones. This chapter introduces you to DNS name resolution and zones. It also explores the benefits of using Active Directory service integrated zones and provides practice in installing DNS and configuring zones. Finally, this chapter provides information on troubleshooting an Active Directory DNS configuration.

Before You Begin

This chapter requires a basic understanding of the TCP/IP protocols, as described in Lesson 1 of Chapter 13, "TCP/IP Administration." To perform the exercises in this chapter, you must have a Windows 2000 Server computer connected to a TCP/IP network.


Lesson 1: Understanding DNS

In Chapter 15, "Windows Name Resolution," you learned how Windows computers register and resolve Network Basic Input/Output System (NetBIOS) names using a variety of different mechanisms. DNS is another name resolution mechanism that TCP/IP computers use to resolve host names and domain names into IP addresses. This lesson introduces you to DNS and the name resolution process, and describes the procedure for installing the Microsoft DNS Server service.

After this lesson, you will be able to

  • Explain the function of DNS and its components
  • Explain the name resolution process
  • Install the DNS service

Estimated lesson time: 30 minutes

Introduction to DNS

DNS is most commonly associated with the Internet. However, private networks use DNS extensively to resolve computer host names and to locate computers within their local networks and the Internet. DNS name resolution is different than the name resolution provided by the Windows Internet Naming Service (WINS). WINS resolves the NetBIOS names used on Windows networks into IP addresses, whereas DNS resolves the host names used on all types of TCP/IP networks into IP addresses. Host names resolved using DNS or other means provide the following benefits:

  • Host names are user-friendly, which means they are easier to remember than IP addresses.
  • Host names remain more constant than IP addresses. An IP address for a server can change, but the server name remains the same.
  • Host names enable users to connect to local servers by using the same naming convention as the Internet.

Domain Namespace

The domain namespace is the naming scheme that provides the hierarchical structure for the DNS database. The basic structural unit of the DNS namespace is the domain, and each domain consists of a number of hosts. Domains are associated with IP network identifiers, and hosts with full IP addresses containing the network identifier of the domain in which they are located.

The DNS database is indexed by names, not addresses; therefore, each domain must have a name. As you add domains to the hierarchy, the name of the parent domain is appended to its child domain (called a subdomain). Consequently, a domain's name identifies its position in the DNS hierarchy. For example, in Figure 16.1, the domain name sales.microsoft.com identifies the sales domain as a subdomain of the microsoft domain and microsoft as a subdomain of the com domain. As the figure illustrates, the hierarchical structure of the domain namespace consists of a root domain, top-level domains, second-level domains, and host names, at minimum. Additional domain levels are possible, as long as the names remain within the limits established by the DNS standards. These elements are described in the following sections.

Figure 16.1 The hierarchical structure of the DNS namespace
The term domain, in the context of DNS, has a different meaning than it does when used in the Microsoft Windows 2000 and Microsoft Windows NT directory services. A Windows 2000 domain is a grouping of Windows computers and devices that are administered as a unit. In DNS, a domain is a group of hosts and possibly subdomains that represent a partition in the DNS database.

Root Domain

The root domain is at the top of the DNS hierarchy and is represented as a period (.). Although it is rarely written as such, every fully qualified domain name (FQDN) should technically end with a period, representing the root domain, as in the following example:

sales.microsoft.com.

Top-Level Domains

Top-level domains are codes, usually consisting of two, three, or four characters, that represent either the type of resources the domain contains or the location of the domains. Top-level domains can contain second-level domains and (more rarely) host names.

The seven original top-level domains, and the resources they represent, are as follows:

  • com Commercial organizations
  • edu Four-year, degree-granting educational institutions in North America
  • gov United States government institutions
  • int Organizations established by international treaty
  • mil United States military applications
  • net Networking organizations
  • org Noncommercial organizations

In addition, most of the countries of the world are represented by two-letter top-level domain names, such as fr for France and de for Germany (Deutschland). There are also a number of new top-level domains, such as biz and info, that are currently in the process of being introduced. These new top-level domains are attempts to address the problem of name depletion in the com top-level domain, which is by far the most popular.

Second-Level Domains

Internet registrars, such as Network Solutions, Inc., and many others, are in the business of registering second-level domain names to individuals and organizations for use on the Internet. The establishment of a top-level domain is a complicated process requiring agreement from many parties, but there are millions of second-level domains, which anyone can register for a small annual fee. A second-level domain can contain both hosts and subdomains. For example, the microsoft.com domain can contain computers such as ftp.microsoft.com and subdomains such as sales.microsoft.com. The subdomain sales.microsoft.com can contain hosts such as printerserver1.sales.microsoft.com.

The administrative structure of the DNS namespace is similar to that of the IP addressing system. Once you obtain an IP network address, you are free to create host addresses on that network. In the same way, once you register a second-level domain name with one of the Internet registrars, you are free to create as many subdomains and hosts as you wish in that domain.

Host Names

Host names refer to specific computers or other TCP/IP devices on the Internet or a private network. For example, in Figure 16.1, Computer1 is a host name. A host name is the leftmost portion of an FQDN, which describes the exact position of a host within the domain hierarchy. In the figure, Computer1.sales.microsoft.com. (including the end period, which represents the root domain) is an FQDN.

DNS uses a host's FQDN to resolve a name to an IP address.

The DNS host name assigned to a Windows computer does not have to be the same as its NetBIOS computer name (although it is usually more convenient that way). By default, Windows 2000 uses the computer's NetBIOS name for the host name, replacing invalid characters, such as the underscore ( _ ), with a hyphen (-).

Domain Naming Guidelines

When you create subdomains and hosts within your own second-level domain, consider the following domain guidelines and standard naming conventions:

  • Limit the number of domain levels. Typically, DNS host entries should be three or four levels down the DNS hierarchy and no more than five levels down the hierarchy. As the number of levels increases, so do the administrative tasks.
  • Use unique names. Each subdomain must have a unique name within its parent domain to ensure that the name is unique throughout the DNS namespace.
  • Use simple names. Simple and precise domain names are easier for users to remember and they enable users to search intuitively and locate Web sites or other computers on the Internet or an intranet.
  • Avoid lengthy domain names. Domain names can be up to 63 characters, including the periods. The total length of an FQDN cannot exceed 255 characters. DNS names are not case-sensitive.
  • Use standard DNS characters. Windows 2000 supports the following standard DNS characters: A through Z, a through z, 0 through 9, and the hyphen (-).

Zones

A zone represents a discrete portion of the namespace for a particular domain. Zones provide a way to partition the domain namespace into manageable sections. You can create multiple zones in the namespace of a domain to distribute administrative tasks to different users or groups. For example, Figure 16.2 depicts the microsoft.com domain namespace divided into two zones. The two zones enable one administrator to manage the microsoft.com and sales.microsoft.com domains and another administrator to manage the development.microsoft.com domain. A zone must encompass a contiguous area of a domain's namespace. For example, as Figure 16.2 shows, you can create a zone for sales.microsoft.com and the parent domain microsoft.com because these zones are contiguous. However, you cannot create a zone that consists of only the sales.microsoft.com domain and the development.microsoft.com domain because these two domains are not contiguous.

Figure 16.2 Domain namespace divided into zones

The name-to-IP-address mappings for a zone are stored in the zone database file. Each zone is anchored to a specific domain, referred to as the zone's root domain. The zone database file does not necessarily contain information for all subdomains of the zone's root domain, only those within the zone.

In Figure 16.2, the root domain for Zone 1 is microsoft.com, and its zone file contains the name-to-IP-address mappings for the microsoft.com and sales.microsoft.com domains. The root domain for Zone 2 is development.microsoft.com, and its zone file contains the name-to-IP-address mappings for the development.microsoft.com domain only. The zone file for Zone 1 does not contain the name-to-IP-address mappings for the development.microsoft.com domain, although development is a subdomain of the microsoft.com domain.

Name Servers

A DNS name server stores the zone database file. Name servers can store data for one zone or multiple zones. A name server is said to have authority for the domain namespace that the zone encompasses.

There must be at least one name server for a zone. However, a zone can have multiple name servers associated with it. One of these servers contains the master zone database file, which is also referred to as the primary zone database file, for that zone. When you make changes to a zone, such as adding subdomains or hosts, you modify the primary zone database file. Any other name servers associated with the zone act as backups to the name server containing the primary zone database file. These name servers contain a secondary zone database file. Having multiple name servers provides several advantages, including the following:

  • Performing zone transfers. The additional name servers obtain a copy of the zone database file from the name server that contains the primary database zone file. This is called a zone transfer. These name servers periodically query the name server containing the primary zone database file for updated zone data.
  • Providing redundancy. If the name server containing the primary zone database file fails, the additional name servers can provide the name resolution service to the network.
  • Improving access speed for remote locations. If a number of clients are in remote locations, you can use additional name servers to reduce the query traffic across slow wide area network (WAN) links.
  • Reducing loads. The additional name servers reduce the load on the name server containing the primary zone database file. Windows 2000 also supports directory-integrated zone storage by using the Active Directory database to store the zone information. Zones stored in this way are located in the Active Directory tree under the domain object container. Each directory-integrated zone is stored in a DNS zone container object identified by the name you choose for the zone when you create it.

Overview of the Name Resolution Process

Name resolution is the process of converting host names or domain names to IP addresses. Name resolution is similar to looking up a name in a telephone book, where the name is associated with a telephone number. For example, when you connect to the Microsoft Web site, you use the name www.microsoft.com, which represents a particular computer (www) in a second-level domain (microsoft.com). Before sending any messages to the www.microsoft.com server, your Web browser uses DNS to resolve the name www.microsoft.com to its associated IP address. The mapping of names to IP addresses is stored in the DNS distributed database. The DNS database is said to be distributed because its information is stored in zones located on DNS name servers all over the Internet. The address mapping for www.microsoft.com comes from the DNS server that is the authority for the microsoft.com domain.

DNS name servers resolve forward and reverse lookup queries. A forward lookup query resolves a name to an IP address. A reverse lookup query resolves an IP address to a name. A name server can resolve a query only for names in a zone for which it has authority. If a name server cannot resolve the query, it passes the query to other name servers that can resolve the query. The first name server then caches the query results to reduce the DNS traffic on the network.

Forward Lookup Query

The DNS Service uses a client/server model for name resolution. To resolve a forward lookup query, a client passes a query to a local name server. The local name server either resolves the query itself or transmits its own query to another name server for resolution. The forward lookup process for a host name occurs as follows, and is illustrated in Figure 16.3:

Figure 16.3 Resolving a forward lookup query
  1. The DNS client (called a resolver) passes a forward lookup query for www.microsoft.com to its local name server, the address for which is specified in its TCP/IP configuration.
  2. The local name server checks its zone database file to determine whether it contains the name-to-IP address mapping for the client's query. Because the local name server does not have authority for the microsoft.com domain, it passes the query to one of the DNS root servers, requesting resolution of the host name. The root name server sends back a referral to the name servers that are authoritative for the com top-level domain.
  3. The local name server sends a query to a com name server, which responds with a referral to the name servers that are authoritative for the microsoft.com domain.
  4. The local name server sends a query to the name server for microsoft.com. Because the Microsoft name server has authority for that portion of the domain namespace, it returns the IP address for www.microsoft.com to the local name server.
  5. The local name server sends the IP address for www.microsoft.com to the client.
  6. The name resolution is complete, and the client can now access www.microsoft.com by its IP address.
In many instances, the forward lookup procedure is shortened considerably, either by the use of cached DNS information (as described in the next section), or by the combination of name server roles. For example, the root name servers for the DNS are also the authoritative servers for com and several other top-level domains. This means that the initial query sent to the root name server results in a single reply containing the microsoft.com name server address, rather than requiring two separate exchanges.

Name Server Caching

When a name server is processing a query, it might need to send out several queries to find the answer. With each query, the name server discovers other name servers that have authority for a portion of the domain namespace. The name server caches these query results to reduce network traffic.

When a name server receives a query result, the name server caches the query result for a specified amount of time, referred to as its Time to Live (TTL). The zone that provided the query results specifies the length of the TTL interval. On Microsoft DNS Server, you configure the TTL using the DNS console. The default TTL value is 60 minutes. Once the name server caches the query result, the TTL starts counting down from its original value. When the TTL expires, the name server deletes the query result from its cache. Caching query results enables the name server to quickly resolve other queries to the same portion of the domain namespace.

Use shorter TTL values to help ensure that data about the domain namespace is more current across the network. Although shorter TTL values increase the load on name servers and longer TTL values decrease the time required to resolve information, the client does not receive the updated information until the TTL expires and a new query to that portion of the domain namespace is resolved.

Reverse Lookup Query

A reverse lookup query maps an IP address to a name. Troubleshooting tools, such as the Nslookup command-line utility, use reverse lookup queries to report back host names. Additionally, certain applications implement security based on the ability to connect to names, not IP addresses. Because the DNS distributed database is indexed by name and not by IP address, a reverse lookup query performed using the standard domain structure would require an exhaustive search of every domain name. To solve this problem, a special domain called in-addr.arpa was created.

The in-addr.arpa domain follows the same hierarchical naming scheme as the rest of the domain namespace; however, it is based on IP addresses, not domain names, using the following guidelines:

  • Subdomains are named after the numbers in the dotted-decimal representation of IP addresses.
  • The order of the IP address octets is reversed because the top of the domain hierarchy appears at the right side of a host name, whereas the top of the IP address hierarchy is on the left.
  • Companies administer subdomains of the in-addr.arpa domain based on their assigned IP addresses and subnet mask.

    For example, a company that has an assigned IP address range of 169.254.16.0 to 169.254.16.255 with a subnet mask of 255.255.255.0 has authority over the 16.254.169.in-addr.arpa domain, as shown in Figure 16.4.

    Figure 16.4 The in-addr.arpa domain

Installing the DNS Service

Microsoft Windows 2000 Server includes a DNS Server service that can interact with other DNS servers on your private network or on the Internet, no matter what operating system or DNS server product they use. You typically install Microsoft DNS Server in one of three ways: by selecting it during operating system installation, by manually installing it using the Add/Remove Programs Control Panel, or by permitting the Active Directory Installation Wizard to install and configure it for you.

To use Active Directory, you must have a DNS server on your network that supports a special SRV resource record (as described in Lesson 3 of this chapter). Active Directory service relies on the DNS namespace in the same way that previous versions of Windows rely on the NetBIOS namespace.

As with Dynamic Host Configuration Protocol (DHCP) and WINS, you should configure the computer running Microsoft DNS Server with a static IP address, not one assigned by a DHCP server. In addition, you should configure the server's TCP/IP properties so that the DNS settings point back to the server. In other words, the DNS server should use itself as its DNS server.

To install Microsoft DNS Server, use the following procedure:

  1. On a computer running Windows 2000 Server, log on as Administrator.
  2. Click Start, point to Settings, and click Control Panel.
  3. Double-click the Add/Remove Programs icon, then click Add/Remove Windows Components to display the Windows Components page of the Windows Components Wizard, as shown in Figure 16.5.

    Figure 16.5 The Windows Components page
  4. In the Components list, select Networking Services.
  5. Click Details to display the Networking Services dialog box.
  6. In the Subcomponents Of Networking Services list, select the Domain Name System (DNS) check box.
  7. Click OK, then click Next. If prompted, type the full path to the Windows 2000 distribution files and click Continue. Required files are copied to your hard disk.
  8. Click Finish to close the Windows Components Wizard.

The DNS installation process does the following:

  • Installs the DNS console and adds a shortcut to the Administrative Tools program group on the Start menu. You use the DNS console to manage local and remote DNS name servers.
  • Adds the following key for the DNS Service to the Windows 2000 registry:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DNS

  • Creates the \systemroot\System32\DNS folder (C:\Winnt\System32\DNS, by default), which contains the DNS database files. Generally, you do not need to edit the DNS database files. However, you might use them to troubleshoot DNS. The DNS service provides a set of sample files, which are added to the \systemroot\System32\DNS\Samples folder after you have installed the DNS service.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. What is the function of a forward lookup query? A reverse lookup query?
  2. What is the portion of the DNS namespace that is stored in a DNS name server?
    1. A host
    2. A domain
    3. A zone
    4. A root name
  3. In which of the following domains would you find IP-address-to-name mapping information about a computer with the name www.wingtipshoes.com and the IP address 192.168.54.128?
    1. in-addr.arpa.192.168.54.128
    2. 128.54.168.192.arpa.in-addr
    3. 192.168.54.128.in-addr.arpa
    4. 128.54.168.192.in-addr.arpa

Lesson Summary

  • DNS name resolution is the process of resolving host and domain names to IP addresses.
  • The DNS namespace consists of multiple levels of domains, each of which can contain subdomains and hosts.
  • A DNS name server contains one or more zones, each of which is a segment of the DNS namespace consisting of one or more domains.
  • DNS servers can perform two types of name resolutions: forward lookup queries, which are name-to-IP-address resolutions, and reverse lookup queries, which are IP-address-to-name resolutions.
  • You can install Microsoft DNS Server manually, using the Windows Control Panel, or automatically, either with the operating system or with Active Directory service.


Lesson 2: Creating Zones

DNS servers enable you to divide the DNS namespace into zones that store name information about one or more DNS domains. The zone becomes the authoritative source for information about each DNS domain name included in it. This lesson introduces you to DNS zones and how to create and configure them in Microsoft DNS Server.

After this lesson, you will be able to

  • Identify zone types
  • List the benefits of Active Directory integrated zones
  • Create zones
  • Explain zone delegation
  • Configure Dynamic Domain Name System (DDNS) for a zone

Estimated lesson time: 30 minutes

Zone Planning

When you install a DNS server for the purpose of servicing a domain, you must always create at least one zone. You can create a single zone that contains the entire area of the DNS space for which you are the authority, or you can choose to divide your domain by creating multiple subdomains and placing them in different zones. You might want to divide your domain into zones for the following reasons:

  • Administrative delegation. When you create multiple zones, you can grant different users permission to manage them, thus dividing up the DNS administration chores.
  • Performance enhancement. Creating multiple zones and storing them on different DNS servers can divide the name resolution traffic burden among your computers or local area networks (LANs).
  • Fault tolerance. Dividing your domain into zones stored on different servers enables DNS to continue servicing clients, even when a server fails.
  • Namespace expansion. Creating subdomains in different zones is an easy way to accommodate the opening of a new branch office or site.

Creating a Zone

To create a zone in Microsoft DNS Server, you use the DNS snap-in, which is accessible in the DNS console, found in Windows 2000's Administrative Tools program group, or through the Computer Management console, under the Services And Applications icon. You can use the DNS console to manage all of the DNS servers on your network. To run the DNS console from a Windows 2000 computer that is not running the DNS Server service, you can install the Adminpak.msi package from the \I386 folder on the Windows 2000 Server installation CD-ROM.

To create a zone, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, select DNS.
  2. Expand the DNS server.
  3. Right-click the Forward Lookup Zone folder and, from the pop-up menu, choose New Zone to launch the New Zone Wizard.

    Forward lookup zones contain name-to-IP-address mappings and reverse lookup zones contain IP-address-to-name mappings. You must create each type of zone separately if you want clients to be able to perform both forward and reverse lookups. Later, when you create resource records in the forward lookup zone, the DNS console enables you to create reverse lookup records at the same time, provided you have already created an appropriate reverse lookup zone.

    When you install Active Directory service using the Active Directory Installation Wizard and allow the wizard to install and configure your DNS server, the wizard automatically creates a forward lookup zone based on the DNS name you specified for the server.
  4. Click Next to bypass the Welcome page and proceed to the Zone Type page.
  5. Select the type of zone you want to create by selecting the appropriate option. Then, click Next to proceed to the Zone Name page. The available zone types are as follows:
    • Active Directory-integrated. An Active Directory-integrated zone is the master copy of a new zone. The zone uses the Active Directory database to store and replicate the zone files.
    • Standard primary. A standard primary zone is the master copy of a new zone stored in a standard text file. You administer and maintain a primary zone on the computer where you created the zone.
    • Standard secondary. A standard secondary zone is a replica of an existing zone. Secondary zones are read-only and are stored in standard text files. You must create a primary zone before you can create a secondary zone. When creating a secondary zone, you specify the DNS server, called the master server, that will transfer zone information to the name server containing the standard secondary zone. You create a secondary zone to provide fault tolerance and to reduce the traffic load on the name server containing the primary zone database file.
  6. Type the name you want to assign to the zone in the Name text box. Click Next to proceed to the Zone File page.

    Typically, a zone is named after the highest domain in the hierarchy that the zone encompasses-that is, the root domain for the zone. For example, for a zone that encompasses both the microsoft.com and sales.microsoft.com domains, the zone name would be microsoft.com.

    If you elected to create an Active Directory-integrated zone, the configuration process of completing and clicking Next takes you to the Completing The New Zone Wizard page. Proceed to Step 9.
  7. If you elected to create a standard primary zone, you must specify the name of the text file in which you want to store the zone database. By default, the New Zone Wizard offers to create a file named for the zone, with a .dns extension. When migrating a zone from another server, you can import the existing zone file. To use an existing DNS database file instead of creating a new one, select Use This Existing File and type the name of the file you want to use in the text box provided. The file you specify must already exist in the \systemroot\System32\DNS folder (C:\Winnt\System32\DNS, by default).

    This page does not appear if you elected to create an Active Directory-integrated zone because the DNS information is stored in the Active Directory database, and no information is needed, or a standard secondary zone. Click Next to proceed to the next page.

  8. If you elected to create a standard secondary zone, the Master DNS Servers page appears, as shown in Figure 16.6. Type the IP address of the DNS server containing the master zone database file for the zone in the IP Address text box, or click Browse to select a server, and then click Add. You can repeat this process to add more DNS servers to the list. Click Next to continue.

    Figure 16.6 The Master DNS Servers page in the New Zone Wizard
  9. In the Completing The New Zone Wizard screen, click Finish to close the wizard and create the zone, using the parameters you provided.

When you create a reverse lookup zone, the procedure is largely the same, except for the addition of a Reverse Lookup Zone page, shown in Figure 16.7, where you specify the network identifier for the reverse lookup zone you want to create. When you type the network identifier part of an IP address, the wizard automatically reverses the order of the bytes and adds the in-addr.arpa domain name, as shown in the Reverse Lookup Zone Name text box.

Figure 16.7 The Reverse Lookup Zone page in the New Zone Wizard

Creating Active Directory-Integrated Zones

For networks deploying DNS to support Active Directory service, directory- integrated primary zones are strongly recommended and provide the following benefits:

  • Multiple-master update and enhanced security based on the capabilities of Active Directory service.

    In a standard zone storage model, DNS updates are conducted based on a single-master update model. In this model, a single authoritative DNS server for a zone is designated as the primary source for the zone. This server maintains the master copy of the zone in a local text file. With this model, the primary server for the zone represents a single fixed point of failure. If this server is not available, update requests from DNS clients are not processed for the zone.

    With directory-integrated storage, dynamic updates to DNS are performed based on a multiple-master update model. In this model, any authoritative DNS server (such as a domain controller running the DNS Server service) can function as the primary source for the zone. Because the master copy of the zone is maintained in the Active Directory database, which is fully replicated to all domain controllers, the zone can be updated by the DNS Server service at any domain controller in the domain. With the multiple-master update model, any of the primary servers for the directory-integrated zone can process requests from DNS clients to update the zone as long as a domain controller is available on the network.

    Also, when using directory-integrated zones, you can use access control lists (ACLs) to provide granular access to either the zone or a specified resource record in the zone. For example, you can use the ACL for a specific domain name in the zone to specify that only certain DNS clients be permitted to perform dynamic updates, or to authorize only a secure group such as domain administrators with permissions for updating zone or record properties. This security feature is not available with standard primary zones.

  • Zones are replicated and synchronized to new domain controllers automatically whenever a new zone is added to an Active Directory domain.

    Although you can selectively remove the DNS Server service from a domain controller, the directory-integrated zones are already stored at each domain controller, so zone storage and management do not require additional resources. Also, the methods used to synchronize the directory-stored information offer performance improvement over standard zone update methods, which can potentially require transfer of the entire zone.

  • Simplified planning and administration for both DNS and Active Directory service.

    When namespaces are stored and replicated separately (for example, one for DNS storage and replication and another for Active Directory service), an additional level of administrative complexity is added to the planning and design process for your network. By integrating DNS storage into Active Directory service, you can unify the management of storage and replication for both DNS and Active Directory information into a single administrative entity.

  • Directory replication is faster and more efficient than standard DNS replication.

    Because Active Directory replication processing is performed on a per- property basis, only the relevant changes are propagated to the other domain controllers. This enables the updates for directory-stored zones to occur using smaller network data transfers.

Delegating Zones

A zone starts as the storage database for a single DNS domain name. If you add subdomains below the domain you used to create the zone, these subdomains can either be part of the same zone or part of another zone. Once you add a sub-domain, you can configure it to be managed and included as part of the original zone records, or delegated away to another zone created to support the subdomain.

For example, Figure 16.8 shows the microsoft.com domain. When the microsoft.com domain is first created at a single server, it is configured as a single zone containing the information for the entire microsoft.com namespace. If, at a later time, the microsoft.com domain is expanded by the addition of subdomains, those subdomains must either be included in the microsoft.com zone or delegated away to another zone. In the figure, the example subdomain was added to the microsoft.com domain, and the example.microsoft.com zone was created to support the example.microsoft.com subdomain.

Figure 16.8 Delegating a new subdomain to a new zone

When you delegate zones within a namespace, you must also create Start of Authority (SOA) resource records to point to the authoritative DNS server for the new zone. This is necessary both to transfer authority and to provide correct referrals to other DNS servers and clients of the servers being made authoritative for the new zone. The New Delegation Wizard is available to assist in delegation of zones.

For more information about creating SOA and other resource records, see Lesson 3 of this chapter.

To create a zone delegation, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the DNS console.
  2. In the DNS console tree, right-click the subdomain for which you want to create a zone delegation and, from the pop-up menu, choose New Delegation to launch the New Delegation Wizard.
  3. Click Next to bypass the Welcome page and display the Delegated Domain Name page.
  4. Enter the name of the subdomain you want to create. The wizard automatically displays the FQDN for the name you specify.
  5. Click Next to proceed to the Name Servers page, shown in Figure 16.9.

    Figure 16.9 The Name Servers page of the New Delegation Wizard
  6. Click Add to display the New Resource Record dialog box, shown in Figure 16.10.

    Figure 16.10 The New Resource Record dialog box
  7. Type the name of the server to host the delegated zone in the Server Name text box and click Resolve to obtain its IP address, or click Browse to select a server. Then click OK to close the dialog box.
  8. Click Next in the Name Servers page, then click Finish.
You must create all of the domains (or subdomains) that appear as part of the applicable zone delegation in the current zone prior to performing the delegation.

Configuring Dynamic DNS

The DNS service includes a dynamic update capability, called Dynamic DNS (DDNS). Until DDNS was developed, name registration on a DNS server was strictly manual; an administrator had to manually update the zone database file on the primary name server. With DDNS, name servers and clients within a network automatically update the zone database files.

You can configure a list of authorized servers to initiate dynamic updates. This list can include secondary name servers, domain controllers, and other servers that perform network registration for clients, such as servers running the DHCP service or WINS.

DDNS interacts with the DHCP Server service to maintain synchronized name-to-IP-address mappings for network hosts. By default, the DHCP Server service enables clients to add their own Host (A) resource records to the zone, and the DHCP service adds the Pointer (PTR) resource record to the zone. The DHCP service cleans up both the A and PTR resource records in the zone when the lease expires.

To configure a zone for DDNS, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the DHCP console.
  2. Right-click the forward or reverse lookup zone that you want to configure and, from the pop-up menu, choose Properties.
  3. In the General tab, in the Allow Dynamic Updates list, choose one of the following options:
    • No. Does not allow dynamic updates for this zone.
    • Yes. Allows all DDNS update requests for this zone.
    • Only Secure Updates. Allows only DDNS updates that use secure DNS for this zone. This is the preferred option.

      The Only Secure Updates option only appears if the zone type is Active Directory-integrated. If you select the Only Secure Updates option, the requester's permission to update the records in the zone database is tested using mechanisms specified in a subsequent secure DNS update protocol.

  4. Click OK.

Exercise 16.1: Configuring Zones

In this exercise, you create zones on a DNS server. In the first two procedures, you create forward and reverse lookup zones for the DNS service. In Procedure 3 you configure the zones you created in Procedures 1 and 2 for DDNS.

Procedure 1: Creating a Forward Lookup Zone

To create a forward lookup zone, complete the following steps:

  1. Click Start and, from the Administrative Tools program group, select DNS to open the DNS console.
  2. Double-click the name of your computer to display the Forward Lookup Zones and Reverse Lookup Zones folders.
  3. Right-click the icon for your server and, from the pop-up menu, choose New Zone to activate the New Zone Wizard.
  4. Click Next to display the Zone Type page.
  5. Ensure that Standard Primary is selected, and then click Next to display the Forward Or Reverse Lookup Zone page.
  6. Ensure that Forward Lookup Zone is selected, and then click Next to display the Zone Name page.
  7. Type training.microsoft.com in the Name text box and click Next to display the Zone File page. (If you are on a network, check with your network administrator to make sure it is OK to use this as your DNS domain name.)
  8. Ensure that Create A New File With This File Name is selected and that the name of the file to be created is Training.microsoft.com.dns. (If you did not use training.microsoft.com as the domain name in Step 7, this will be the domain name you typed in Step 7 with a .dns extension.)
  9. Click Next to display the New Zone Wizard page.
  10. Click Finish.

Procedure 2: Creating a Reverse Lookup Zone

To create a reverse lookup zone, complete the following steps:

  1. Right-click the icon for your server and, from the pop-up menu, choose New Zone to activate the New Zone Wizard.
  2. Click Next to display the Zone Type page.
  3. Ensure that Standard Primary is selected, and then click Next to display the Forward Or Reverse Lookup Zone page.
  4. Ensure that Reverse Lookup Zone is selected, and then click Next to display the Reverse Lookup Zone page.
  5. Ensure that Network ID is selected, and type the network identifier for your network's IP addresses in the Network ID text box. For example, if the IP address of your server is 192.168.18.43, with a subnet mask of 255.255.255.0, type 192.168.18 in the Network ID text box.What happens when you enter the network identifier?
  6. Click Next to display the Zone File page.
  7. Ensure that Create A New File With This File Name is selected. What value appears in the box provided?
  8. Click Next to display the Completing The New Zone Wizard page.
  9. Review the information in the Completing The New Zone Wizard page, then click Finish.

Procedure 3: Configuring Zones to Use DDNS

To configure the DNS service to allow dynamic updates for forward and reverse lookup zones, complete the following steps:

  1. In the DNS console tree, double-click the icon representing your server.
  2. Double-click Forward Lookup Zones, and then double-click training.microsoft.com. (If you did not use training.microsoft.com as your DNS domain name, double-click your DNS domain name.)
  3. Right-click training.microsoft.com (or your DNS domain name) and, from the pop-up menu, choose Properties to display the training.microsoft.com Properties dialog box. (If you did not use training.microsoft.com as your DNS domain name, the name of the dialog box reflects your DNS domain name.)
  4. In the Allow Dynamic Updates list in the General tab, select Yes, and click OK. This configures DDNS for the forward lookup zone.
  5. Double-click Reverse Lookup Zones.
  6. Right-click the reverse lookup zone you created in Procedure 2 and, from the pop-up menu, choose Properties to display the Properties dialog box for your subnet.
  7. In the Allow Dynamic Updates list in the General tab, select Yes, then click OK. This configures DDNS for the reverse lookup zone.
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. What are the advantages of using the Active Directory-integrated zone type?
  2. What must be done when you delegate zones within a namespace?
  3. How does DDNS improve the efficiency of Microsoft DNS Server?

Lesson Summary

  • Domain Name System (DNS) servers enable you to divide the DNS namespace into zones that store name information about one or more DNS domains.
  • DNS servers can have forward lookup zones for name-to-IP-address mappings, and reverse lookup zones for IP-address-to-name mappings.
  • You can create three types of zones: Active Directory-integrated zones, standard primary zones, and standard secondary zones.
  • Dynamic DNS (DDNS) enables computers on the network to automatically modify their resource records, preventing administrators from having to change them manually.
  • Delegating zones enables you to accommodate the creation of new subdomains by adding them to different zones.


Lesson 3: Managing Resource Records

The actual information in a DNS zone database file is stored in units called resource records. Resource records are entries in the zone database file that associate DNS domain names to related data for a given network resource, such as an IP address. This lesson examines the various types of resource records used in the DNS database and the process of creating them using Microsoft DNS Server.

After this lesson, you will be able to

  • List the most commonly used DNS resource records
  • View the contents of a resource record
  • Create a resource record

Estimated lesson time: 10 minutes

Understanding Resource Record Types

There are many different types of resource records. When you create a zone, DNS automatically adds two resource records to the zone: the Start of Authority (SOA) record and the Name Server (NS) record. The functions of these resource records, as well as those of the other most common types of records, are as follows:

  • Start of Authority (SOA). Identifies which name server is the authoritative source of information for data within this domain. The first record in the zone database file must be the SOA record.
  • Name Server (NS). Lists the name servers that are assigned to a particular domain.
  • Host (A). Lists the host name-to-IP-address mappings for a forward lookup zone.
  • Alias (CNAME). Creates an alias, or alternate name, for the specified host name. You can create a Canonical Name (CNAME) record to use more than one name to point to a single IP address. For example, you can host a File Transfer Protocol (FTP) server, such as ftp.microsoft.com, and a Web server, such as www.microsoft.com, on the same computer by creating an A record in the microsoft.com domain for the host name www and a CNAME record equating the host name ftp with the A record for www.
  • Host Information (HINFO). Identifies the CPU and operating system used by the host. You can use this record type as a low-cost resource-tracking tool.
  • Mail Exchanger (MX). Identifies which mail server to contact for a specified domain and in what order to use each mail host.
  • Pointer (PTR). Points to another part of the domain namespace. For example, in a reverse lookup zone, PTR records contain IP-address-to-name mappings.
  • Service (SRV). Identifies which servers are hosting a particular service. For example, if a Windows 2000 client needs to find an Active Directory domain controller to validate logon requests, the client can send a query to the DNS server to obtain a list of domain controllers and their associated IP addresses.

Viewing Resource Records

To view the information in a resource record, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the DNS console.
  2. In the DNS console tree, click the zone for which you want to view a resource record.
  3. In the details pane, right-click the record you want to view and, from the pop-up menu, choose Properties to display the Properties dialog box.
  4. View the properties specific to the record you selected.

    The Properties dialog box for each resource record contains a tab that is named for the record type, which contains the information stored in that particular type of record. For example, the Properties dialog box for an A record (see Figure 16.11) contains only the IP address associated with the record's host name. By contrast, the Properties dialog box for an SOA record (see Figure 16.12) contains a large number of configuration parameters, including the TTL for the zone.

    Figure 16.11 The Properties dialog box for a Host (A) record
  5. When you have finished viewing the record, click OK.

    Figure 16.12 The Properties dialog box for a Start of Authority (SOA) record

Creating Resource Records

The process of creating a resource record varies depending on the type of record you want to create. Different resource record types contain different types and amounts of information. Creating an A record is simply a matter of supplying a host name and an IP address, whereas other record types contain a lot more data. SOA records, for example, contain many different parameters, but you do not have to create them manually with Microsoft DNS Server. To create a new resource record in the DNS console, right-click the zone in which you want to locate the record and choose the appropriate command from the pop-up menu.

The pop-up menu commands vary depending on whether you have selected a forward lookup zone or a reverse lookup zone. When you choose Other New Records from the pop-up menu, the DNS console open the Resource Record Type dialog box, (see Figure 16.13), which contains a list of all the resource records you can create.

Figure 16.13 The Resource Record Type dialog box

Once you select a record type, you see a New Resource Record dialog box, shown in Figure 16.14, which contains fields for the information carried by that type of record. After supplying the requested information in the boxes provided, click OK to create the record, which appears in the details pane of the DNS console under the appropriate zone.

Figure 16.14 The New Resource Record dialog box for a Host (A) record

Exercise 16.2: Adding Resource Records

In this exercise, you practice adding resource records for forward and reverse lookup zones.

Procedure 1: Creating a Host Record

To add a Host record to the zone you created in Exercise 16.1, complete the following steps:

  1. Click Start and, from the Administrative Tools program group, select DNS to display the DNS console.
  2. Double-click the name of your computer to diplay the Forward Lookup Zones and Reverse Lookup Zones folders.
  3. Double-click the Forward Lookup Zones folder to display the zones on the server.
  4. Right-click the zone you created in Exercise 16.1, Procedure 1 and, from the pop-up menu, choose New Host. What happens?
  5. Type server1 in the Name text box.
  6. Type a valid, unused IP address on your network in the IP Address text box.
  7. Click Add Host.
  8. Type server2 in the Name text box.
  9. Type a different, valid, unused IP address on your network in the IP Address text box.
  10. Select the Create Associated Pointer (PTR) Record check box.
  11. Click Add Host.
  12. Click Done.

Procedure 2: Viewing Resource Records

To view the resource records you just created, complete the following steps:

  1. From the Action menu, select Refresh.
  2. Click the icon for the forward lookup zone in which you created the Host (A) resource records. What do you see in the zone?
  3. Click the icon for the reverse lookup zone corresponding to the forward lookup zone you created. What do you see and why?

Procedure 3: Creating a PTR Record Manually

To create a PTR resource record for the host name server1, complete the following steps:

  1. In the console tree, click Reverse Lookup Zones.
  2. Right-click the zone you created in Exercise 16.1, Procedure 2 and, from the pop-up menu, choose New Pointer to display the New Resource Record dialog box.
  3. Enter the host identifier you assigned to the server1 resource record in the Host IP Number text box.
  4. In the Host Name text box, type server1.microsoft.com. Remember to include the trailing period.
  5. Click OK. A Pointer record appears in the details pane.
  6. Close the DNS console.
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. What type of resource record do you create to represent a domain controller on a Windows 2000 network?
  2. Which two types of resource records can contain the same IP address and host name?
    1. SOA and A
    2. PTR and A
    3. A and CNAME
    4. PTR and CNAME
  3. Which resource records are created automatically by the DNS console when you create a forward lookup zone?

Lesson Summary

  • A Domain Name System (DNS) zone database file can contain many different types of resource records, including Host (A), Pointer (PTR), and Alias (CNAME) records.
  • The information stored in the various resource record types varies, depending on the record type.
  • Host (A) records contain the basic name-to-IP-address mappings that DNS uses to resolve names.
  • Pointer (PTR) records contain the IP-address-to-name mappings used for reverse name lookups.
  • Mail Exchanger (MX) and Service (SRV) records identify the mail servers and domain controllers on a Windows network, respectively.


Lesson 4: Troubleshooting DNS

This lesson explains the monitoring options available for DNS servers, and also describes some of the problems you might encounter that relate to the use of DNS with Active Directory service and possible solutions to these problems.

After this lesson, you will be able to

  • Monitor DNS server
  • Troubleshoot DNS configuration for Active Directory service

Estimated lesson time: 10 minutes

Monitoring DNS Servers

Windows 2000 Server includes three options for monitoring DNS servers:

  • Submitting queries to the server
  • Default logging of DNS server event messages to the DNS server log
  • Optional debug options for trace logging to a text file on the DNS server computer

Querying the DNS Server

The DNS snap-in allows you to monitor the DNS Server service. Select the name server, and then from the Action menu, choose Properties. In the Properties dialog box, click the Monitoring tab. You can test the name server by performing two types of queries:

  • Simple query. Select this type of query to perform a simple query test of the DNS server. This is a local test that uses the DNS client on this computer to query the name server.
  • Recursive query. Select this type of query to perform a more complex, recursive query test of the name server. This query tests the name server by forwarding a recursive query to another name server.

DNS Server Event Logging

For Windows 2000 Server, DNS server event messages are kept separate from events generated by other applications and services in the DNS server log, which you can examine using Event Viewer. The DNS server log contains basic predetermined events logged by the DNS Server service, such as when the DNS server starts and stops.

You can also use Event Viewer to view and monitor client-related DNS events. These events appear in the system log and are generated by the DNS client service on all computers running Windows 2000.

Debug Options

The DNS console also enables you to set additional logging options to create a temporary trace log as a text-based file of DNS server activity for debugging purposes. To do this, right-click a DNS server in the console and, from the pop-up menu, select Properties. In the Properties dialog box, click the Logging tab, shown in Figure 16.15. The information for the options you selected is stored in the Dns.log file in the \systemroot\System32\dns folder (C:\Winnt\System32\dns, by default).

Figure 16.15 The Logging tab of a DNS server's Properties dialog box

You can select any or all of the following options to control which activities are tracked in the log:

  • Query. Logs queries received by the DNS Server service from clients
  • Notify. Logs notification messages received by the DNS Server service from other servers
  • Update. Logs dynamic updates received by the DNS Server service from other computers
  • Questions. Logs the contents of the question section for each DNS query message processed by the DNS Server service
  • Answers. Logs the contents of the answer section for each DNS query message processed by the DNS Server service
  • Send. Logs the number of DNS query messages sent by the DNS Server service
  • Receive. Logs the number of DNS query messages received by the DNS Server service
  • UDP. Logs the number of DNS requests received by the DNS Server service over a User Datagram Protocol (UDP) port
  • TCP. Logs the number of DNS requests received by the DNS Server service over a TCP port
  • Full Packets. Logs the number of full packets written and sent by the DNS Server service
  • Write Through. Logs the number of packets written through by the DNS Server service and back to the zone

By default, all debug logging options are disabled. When selectively enabled, the DNS Server service can perform additional trace-level logging of selected types of events or messages for general troubleshooting and debugging of the server. Debug logging can be resource-intensive, however, affecting overall server performance and consuming disk space. Therefore, you should only use it temporarily when more detailed information about server performance is needed.

DNS Troubleshooting Scenarios

Table 16.1 describes some zone problems you might encounter and possible solutions to these problems.

Table 16.1 Troubleshooting Scenarios for Zone Problems

Symptom: A zone transfer fails to occur

Cause | Solution
The DNS Server service is stopped or the zone is paused. | Verify that the master (source) and secondary (destination) DNS servers involved in completing transfer of the zone are both started and that the zone is not paused at either server.
The DNS servers used during a transfer do not have network connectivity with each other. | Eliminate the possibility of a basic network connectivity problem between the two servers. Using the Ping command, ping each DNS server by its IP address from its remote counterpart. Both Ping tests should succeed. If not, investigate and resolve intermediate network connectivity issues.
The SOA serial number is the same at both the source and destination servers. Because the value is the same at both servers, no zone transfer occurs between the servers. | Using the DNS console, perform the following tasks: In the Start Of Authority (SOA) tab, increase the value of the serial number for the zone at the master server (source) to a number greater than the value at the applicable secondary server (destination). Initiate zone transfer at the secondary server.
The master server (source) and its targeted secondary server (destination) are having interoperability-related problems. | Investigate possible causes for any problems related to interoperability between Windows 2000 DNS servers and other DNS servers running different implementations, such as an older version of the Berkeley Internet Name Domain (BIND) distribution.
The zone has resource records or other data that cannot be interpreted by the DNS server. | Verify that the zone does not contain incompatible data, such as unsupported resource record types or data errors. Also, verify that the server has not been configured in advance to prevent loading a zone when bad data is found and investigate its method for checking names. These settings can be configured using the DNS console.
Authoritative zone data is incorrect. | If a zone transfer continues to fail, ensure that the zone does not contain nonstandard data. To determine if erroneous zone data is a likely source for a failed zone transfer, look in the DNS server event log for messages.

Symptom: Zone delegation does not function properly

Cause | Solution
Zone delegations are not configured correctly. | Review how zone delegations are used and revise your zone configurations as needed.

Table 16.2 describes some problems you might encounter with dynamic updates and possible solutions to these problems.

Table 16.2 Troubleshooting Scenarios for Dynamic Updates

Symptom: The client is not performing dynamic updates

Cause | Solution
The client (or its DHCP server) does not support the use of the DDNS update protocol. | Verify that your clients or servers support the DDNS update protocol using the options for dynamic update support provided in Windows 2000. For client computers to be registered and updated dynamically with a DNS server, either install or upgrade client computers to Windows 2000 or install and use a Windows 2000 DHCP server on your network to lease addresses to client computers.
The client was not able to register and update with the DNS server because of missing or incomplete DNS configuration. | Verify that the client is fully and correctly configured for DNS, and update its configuration as needed. To update the DNS configuration for a client, either configure a primary DNS suffix at the client computer for static TCP/IP clients or configure a connection-specific DNS suffix for use at one of the installed network connections at the client computer.
The DNS client attempted to update its information with the DNS server but failed because of a problem related to the server. | If a client can reach its preferred and alternate DNS servers as configured, it is likely that the cause of its failed updates can be found elsewhere. At Windows 2000 client computers, use Event Viewer to check the System log for any event messages that explain why attempts by the client to dynamically update its Host (A) or Pointer (PTR) resource records failed.
The DNS server does not support dynamic updates. | Verify that the DNS server used by the client can support the DDNS update protocol. For Windows DNS servers, only Windows 2000 DNS servers support dynamic updates. The DNS server provided with Microsoft Windows NT Server 4 does not.
The DNS server supports dynamic updates but is not configured to accept them. | Verify that the primary zone where clients require updates is configured to allow dynamic updates. For Windows 2000 DNS servers, the default for a new primary zone is to not accept dynamic updates. At the DNS server that loads the applicable primary zone, modify zone properties to allow updates.
The zone database is not available. | Verify that the zone exists. Verify that the zone is available for update. For a standard primary zone, verify that the zone file exists at the server and that the zone is not paused. Secondary zones do not support dynamic updates. For Active Directory-integrated zones, verify that the DNS server is running as a domain controller and has access to the Active Directory database where zone data is stored.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next chapter. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. What is the difference between a simple query and a recursive query?
  2. Give three reasons why a zone transfer might fail to occur.
  3. What is the first thing to check if DDNS updates fail to occur?

Lesson Summary

  • The Monitor tab in a Domain Name System (DNS) server's Properties dialog box enables you to send simple and recursive queries to the server.
  • Event Viewer contains a separate DNS Server log on Windows 2000 Server computers with the DNS Server service installed.
  • The Logging tab in a DNS server's Properties dialog box enables you to select specific server activities to monitor in a separate log file.
  • Zone transfers can fail for a variety of reasons, including network failures and bad or unsupported data stored in the zone database.
  • One of the common causes of dynamic update failures is lack of support for the dynamic update protocol by all of the computers involved.


Managing Internet Information Services

About This Chapter

Microsoft Windows 2000 Server includes an updated version of Internet Information Services (IIS version 5). IIS runs as an enterprise service within Windows 2000 and uses other services provided by Windows 2000, such as security and Active Directory services. IIS improves the Web server's reliability, performance, management, security, and application services. Many of these improvements result from the way IIS incorporates new operating system features in Windows 2000. This chapter explains how to install, configure, and troubleshoot IIS.

Before You Begin

This chapter requires a basic understanding of Transmission Control Protocol/Internet Protocol (TCP/IP) communications, as described in Chapter 13, "TCP/IP Administration." To perform the exercises in this chapter, you must have a computer running Windows 2000 Server on a TCP/IP network, with IIS and Certificate Services installed.


Lesson 1: Creating Web Sites and FTP Sites

Windows 2000 Server installs a basic IIS configuration with the operating system by default. You can modify this configuration by selecting or deselecting IIS components during the Windows 2000 setup, or by using the Add/Remove Programs Control Panel tool after the installation is completed. This lesson describes the procedures for installing and adding components to IIS, as well as creating new Web sites and File Transfer Protocol (FTP) sites.

After this lesson, you will be able to

  • Install IIS components
  • Create new Web sites and FTP sites
  • Configure site properties

Estimated lesson time: 30 minutes

Installing IIS

IIS is an integral component of the Windows 2000 Server operating system. When performing a clean installation of Windows 2000 Server, IIS is installed by default, with the following components:

  • Common Files
  • Documentation
  • Microsoft FrontPage 2000 Server Extensions
  • Internet Information Services Snap-In
  • Internet Services Manager (HTML)
  • SMTP Service
  • World Wide Web Server

When you upgrade from Microsoft Windows NT, Microsoft Windows 98, or Microsoft Windows 95 to Windows 2000, the setup program attempts to detect a previous version of IIS, Microsoft Peer Web Services, or Personal Web Server. If the program detects one of these, it installs IIS. You cannot prevent an upgrade to IIS 5 if a previous version of IIS, Peer Web Services, or Personal Web Server is detected. However, IIS is not installed if none of these legacy services are detected.

When installing IIS, either as an upgrade or as a clean install, the setup program verifies that the TCP/IP protocol suite is installed. If TCP/IP is not found, the Setup program installs it automatically and configures it to obtain an IP address and other configuration settings using Dynamic Host Configuration Protocol (DHCP). To install IIS on a computer running Windows 2000 Server on which IIS was not selected during the operating system setup, or to install additional components on an existing IIS server, use the following procedure:

  1. On a computer running Windows 2000 Server, log on as Administrator.
  2. Click Start, point to Settings, and click Control Panel.
  3. Double-click the Add/Remove Programs tool, then click Add/Remove Windows Components to activate the Windows Components Wizard, shown in Figure 17.1.

    Figure 17.1 The Windows Components page of the Windows Components Wizard
  4. In the Components list, select Internet Information Services (IIS).
  5. Click Details.
  6. In the Internet Information Services dialog box, in the Subcomponents Of Internet Information Services (IIS) list, shown in Figure 17.2, select the check boxes next to the components you want to install.

    Figure 17.2 The Subcomponents Of Internet Information Services (IIS) list

    The available components are as follows:

    • Common Files. The IIS program files needed to run any of the other components
    • Documentation. Provides help files and other documentation on IIS server administration and Web application development
    • File Transfer Protocol (FTP) Server. Enables you to create FTP sites, from which users can upload and download files
    • FrontPage 2000 Server Extensions. Enables you to create and manage Web sites using development tools like Microsoft FrontPage and Visual InterDev
    • Internet Information Services Snap-In. A Microsoft Management Console (MMC) snap-in that provides the primary IIS administration interface
    • Internet Services Manager (HTML). An administrative interface based on Hypertext Markup Language (HTML), enabling you to manage IIS using any supported Web browser
    • NNTP Service. Provides support for the Network News Transfer Protocol (NNTP), which you can use to provide IIS users with Usenet news feeds
    • SMTP Service. Provides support for the Simple Mail Transfer Protocol (SMTP), which various applications use to send e-mail messages
    • Visual InterDev RAD Remote Deployment Support. Enables the remote deployment of applications on the IIS Web server
    • World Wide Web Server. Enables you to create Web sites that users can access from a browser such as Microsoft Internet Explorer

    To provide a functional IIS installation, you should select, at the very least, the Common Files, Internet Information Services Snap-In, and World Wide Web Server components.

  7. Click OK, then click Next. If prompted, type the full path to the Windows 2000 distribution files and click Continue. You might be required to insert the Windows 2000 CD. Required files are copied to your hard disk.
  8. Click Finish to close the Windows Components Wizard.
By default, Windows 2000 does not install the FTP service in IIS. If you want to run an FTP site on your server, you must use this procedure to add the File Transfer Protocol (FTP) Server component.

After a default IIS installation, when you launch the Internet Information Services snap-in, you see that three components have been added to the console tree: the Default Web Site, the Administration Web Site, and the Default SMTP Virtual Server. The Default Web Site icon represents the primary public Web site hosted by your server. If you only intend to host a single site, you can use this one, but you can also create additional Web site icons to host multiple sites on a single server. The default Web site is configured to provide anonymous access, meaning that any users can connect to it, regardless of the browsers they are running and whether they have Windows 2000 user accounts. You can also use the Internet Information Services snap-in to modify the security properties of the site and restrict access to certain users.

The Administration Web Site icon represents a protected site that you can use to configure IIS from a browser on a remote computer. This site is an example of how IIS can host multiple sites on one server, as it is completely independent from the default site, with its own content and security settings. Unlike the default site, the administration site is protected in several ways to prevent unauthorized users from accessing the core IIS configuration interface. For more information about the security mechanisms you can use to restrict access to your Web sites, see Lesson 3 later in this chapter.

Getting Started

Whether your site is on an intranet or the Internet, the principles of providing content using IIS are the same. You place your Web files in folders on your server so that users can establish a Hypertext Transfer Protocol (HTTP) connection and view your files with a Web browser. But beyond simply storing the files on your server, you must manage how your site is deployed, and more important, how your site evolves.

You should set up your Web sites by indicating which folders contain the documents that you want to publish. The Web server cannot publish documents that are not within these specified folders. Therefore, the first step in deploying a Web site should be to determine how you want your files organized. You then use the Internet Information Services snap-in, or the Internet Services Manager (HTML) interface to identify which folders (called directories in the snap-in and HTML interface) are part of the site.

If you want to get started right away without creating a special folder structure and your files are all located on the same hard disk of the computer running IIS, you can publish your documents immediately by copying your Web files into the home folder of the default Web site. When you install IIS, the home folder of the default IIS Web site is configured as \Inetpub\wwwroot (C:\ Inetpub\wwwroot by default). When you copy Web files into this folder, they become available at the root of the site. Intranet users can then access these files by using any of the following Uniform Resource Locators (URLs):

  • http://computer_name/file_name
  • http://fully_qualified_domain_name/file_name
  • http://IP_address/file_name

where computer_name, fully_qualified_domain_name, and IP_address identify the Web server. If you copy a file called Default.htm or Default.asp into the home folder, that file becomes the home page for the default Web site. You can also modify the site configuration to use a different default filename.

Creating Sites

Originally, each domain name, such as www.microsoft.com, represented an individual computer. Today, however, many Web server products, including IIS 5, can host multiple Web sites or FTP sites simultaneously on a single computer, with each Web site hosting one or more domain names. Because each site mimics the appearance of an individual computer to Web clients, the sites are sometimes referred to as virtual servers.

Whether your Windows 2000 server is on an intranet or the Internet, you can create multiple Web sites and FTP sites on one computer in three ways, as follows:

  • Use a nonstandard port number with the IP address
  • Use multiple IP addresses, each having its own network adapter card, or all on the same network card
  • Assign multiple Web sites to one network adapter card by using host header names

The example in Figure 17.3 illustrates an intranet scenario where the system administrator has installed Windows 2000 Server with IIS on the company's server, resulting in one default Web site: http://CompanyServer. The system administrator then creates two additional Web sites, one for each of two departments: marketing and human resources.

Although hosted on the same computer, CompanyServer, Marketing, and HumanResources each appear to be a unique Web site. These departmental sites have the same security options as they would if they existed on separate computers because each site has its own access and administration permission settings. In addition, you can distribute the administrative tasks for the various sites to members of each department.

Figure 17.3 An intranet Web server with multiple sites

Creating a Web Site

To create a new Web site on an existing IIS installation, use the following procedure:

  1. Log on to a Windows 2000 server running IIS as Administrator.
  2. Click Start and, from the Administrative Tools program group, select Internet Services Manager to open the Internet Information Services snap-in.
  3. Right-click the icon for your server in the console tree, point to New and, from the pop-up menu, choose Web Site to launch the Web Site Creation Wizard.
  4. Click Next to bypass the Welcome page and display the Web Site Description page.
  5. In the Description text box, type the name you want to use to identify the site in the Internet Information Services console tree, and click Next to proceed to the IP Address And Port Settings page, shown in Figure 17.4.

    Figure 17.4 The IP Address And Port Settings page of the Web Site Creation Wizard
  6. In the Enter The IP Address To Use For This Web Site list box, select the IP address that client browsers will use to connect to the site.

    This list box contains the IP addresses that your server is currently configured to use, plus an All Unassigned option. If you want to use IP addresses to distinguish among the Web sites running on your IIS server, select one of the supplied addresses. If you plan to use another mechanism to distinguish the sites, select All Unassigned.

  7. Specify a port number for the site in the TCP Port This Web Site Should Use text box.

    By default, HTTP uses TCP port 80, and all browsers automatically use this port when connecting to a Web server. To use port numbers to distinguish among multiple sites running on one server, assign a different port number to each site and instruct your clients to specify the port number in their URLs, as in: http://CompanyServer:82.

  8. Type the host header name you want this site to use (if any) in the Host Header For This Site text box.

    By specifying a host header name for a site, you can distinguish among Web sites running on the same server using a single IP address and port number. For example, specifying Marketing as the host header name enables clients to access this site using the URL http://Marketing. If you do not want to use host headers to distinguish your sites, leave this box blank.

  9. Click Next to proceed to the Web Site Home Directory page.
  10. Enter the path to the folder you want the site to use as its home directory in the Path text box. You can specify a path containing either a drive letter, such as C:\Documents, or a Universal Naming Convention (UNC) path name, such as \\server1\Documents. If the path you enter is located on another computer, the wizard displays a Web Site Security Credentials page in which you must enter the user name and password that the server should use to access the folder.

    If you want to prevent anonymous access to the new site, clear the Allow Anonymous Access To This Web Site check box. Click Next to proceed to the Web Site Access Permissions page.

  11. Specify the permissions you want to grant users to the files in the home directory using the check boxes provided. Click Next to complete the wizard.
  12. Click Finish to create the new Web site.

Creating an FTP Site

To create a new FTP site on an IIS installation with the File Transfer Protocol (FTP) Server module installed, use the following procedure:

  1. Log on to a Windows 2000 server running IIS as Administrator.
  2. Click Start and, from the Administrative Tools program group, select Internet Services Manager to open the Internet Information Services snap-in.
  3. Right-click the icon for your server in the console tree, point to New and, from the pop-up menu, choose FTP Site to launch the FTP Site Creation Wizard.
  4. Click Next to bypass the Welcome screen and display the FTP Site Description page.
  5. In the Description text box, type the name you want to use to identify the site in the Internet Information Services console tree, and click Next to proceed to the IP Address And Port Settings page, as shown in Figure 17.5.

    Figure 17.5 The IP Address And Port Settings page of the FTP Site Creation Wizard
  6. In the IP Address list box, select the IP address that client browsers will use to connect to the site.

    This list box contains the IP addresses that your server is currently configured to use, plus an (All Unassigned) option. If you want to use IP addresses to distinguish among the FTP sites running on your IIS server, select one of the supplied addresses. If you plan to use another mechanism to distinguish the sites, select All Unassigned.

  7. Specify a port number for the site in the TCP Port text box.

    By default, FTP uses TCP port 21 as its control port, and all FTP clients automatically use this port when connecting to an FTP server. To use port numbers to distinguish among multiple sites running on one server, assign a different port number to each site and instruct your clients to specify the port number in their FTP clients.

  8. Click Next to proceed to the FTP Site Home Directory page.
  9. Enter the path to the folder you want the site to use as its home directory in the Path text box. You can specify a path containing either a drive letter, such as C:\Documents, or a UNC path name, such as \\server1\Documents. If the path you enter is located on another computer, the wizard displays an FTP Site Security Credentials page in which you must enter the user name and password that the server should use to access the folder. Click Next to proceed to the FTP Site Access Permissions page.
  10. Specify the permissions you want to grant users to the files in the home directory, using the check boxes provided. Click Next to complete the wizard.
  11. Click Finish to create the new FTP site.

Administering Web Sites and FTP Sites

During the installation of IIS, default values are assigned to the various properties of the server and its sites. You can use the default settings provided by IIS, or you can customize these settings to suit your Web publishing needs. You might be able to provide additional value, better performance, and improved security by making adjustments to the default property settings.

You can set properties at the site level, the folder level, or the file level. Settings at higher levels (such as the site level) are automatically inherited by the lower levels (such as the folder level), just as Windows 2000 permissions are inherited. Once you have modified a property on an individual site, folder, or file, later changes to the master defaults do not override the individual setting. Instead, you receive a warning message asking whether you want to change the individual site, folder, or file setting to match the new defaults.

Properties for a site are displayed in the Properties dialog box for that site and stored in a database called the metabase (the IIS version of the registry). Some properties have a value that takes the form of a list. For example, the value of the default document can be a list of documents to be loaded when users do not specify a file in a URL. Custom error messages, TCP/IP access control permissions, script mappings, and Multipurpose Internet Mail Extensions (MIME) mappings are other examples of properties stored in a list format. Although these lists have multiple entries, IIS treats the entire list as a single property. If you edit a list on the folder level and then make a global change on the site level, the list at the folder level is completely replaced with the new list from the site level; the two lists are not merged.

You access the master properties, server extensions, bandwidth throttling, and MIME mapping for an IIS server from the Properties dialog box of a computer node in the Internet Information Services snap-in. Figure 17.6 shows the WWW Service Master Properties dialog box, accessed by clicking Edit in the Master Properties box of a computer node's Properties dialog box.

Figure 17.6 The WWW Service Master Properties dialog box

Starting and Stopping Services and Sites

By default, IIS services are configured to start automatically with Windows 2000, as are IIS sites. You can use the controls provided in the Internet Information Services snap-in to start, stop, or pause particular sites. Stopping a site halts any current connections in progress and clears them from the computer's memory. Pausing a site prevents the server from accepting new connections but does not affect requests that are already being processed.

To start, stop, or pause a site, select a site object in the console tree of the Internet Information Services snap-in, and then click the Start Item, Stop Item, or Pause Item button on the toolbar. If the site is currently started, the Start item will not be available for selection; the same logic applies for sites that are stopped.

If a site stops unexpectedly, the Internet Information Services snap-in might not correctly indicate the state of the site. Before restarting, click Stop, and then click Start to restart the site. You can also try clicking Refresh from the Action menu to determine the state of the site.

In IIS, you can also stop, start, or restart all of the IIS services or reboot the server from within the Internet Information Services snap-in. The stop, start, and restart functions are a useful alternative to rebooting the server when applications function improperly or become unavailable. Rebooting the server should be your last troubleshooting option.

The restart function conveniently stops and starts all of the IIS services, effectively resetting them. To restart IIS, right-click the server node in the console tree and, from the pop-up menu, choose Restart IIS to display the Stop/Start/Reboot dialog box, as shown in Figure 17.7. In the What Do You Want IIS To Do list box, select Restart Internet Services for your server. You can also start or stop all of the IIS services at once, or select Reboot to shut down the computer and restart it.

Figure 17.7 Restarting Internet Services
You should use the Internet Information Services snap-in to restart the IIS services, not the Services under the Services And Applications snap-in in the Computer Management console. Because several Internet services run in one process, Internet services shut down and restart differently than other Windows services.

Defining Home Directories

Each Web site and FTP site must have a home directory, like the one you specified in the procedure for creating a new site, earlier in this lesson. The home directory is the central location for your published pages. On a Web site, the home directory typically contains a home page file that welcomes Web browser users and contains links to the other pages in your site. You can specify more than one default document for a single site; IIS displays the first default document it finds as listed in order under the Documents tab in the sites properties. The home directory is mapped to your site's domain name, the name of the IIS server, or its IP address, whichever one the user employs in the URL to access the site. For example, if your site's Internet domain name is www.microsoft.com and your home directory is C:\Website\Microsoft, browsers use the URL http://www.microsoft.com to access the files in the home directory. On an intranet, if your server name is AcctServer, browsers can use the URL http://acctserver to access the files in the home directory.

IIS creates a default home directory when you install IIS, and you specify one when you create a new Web site. If you are setting up both a Web site and an FTP site on the same computer, you should specify a different home directory for each service (WWW and FTP). The default home directory for the WWW service is \InetPub\Wwwroot. The default home directory for the FTP service is \InetPub\Ftproot. You can change these defaults as needed to create a home directory anywhere on your network.

To change the home directory for a Web site or FTP site, you open its Properties dialog box by right-clicking the site in the console tree of the Internet Information Services snap-in. From the pop-up menu, choose Properties. Click the Home Directory tab to display the controls shown in Figure 17.8. By selecting the appropriate option, you can create a home directory out of a folder located on the computer, out of a shared network folder on another computer, or out of a directory identified by a URL. You then specify the local path, share name, or URL in the Local Path text box.

Figure 17.8 The Home Directory tab of a Web site's Properties dialog box

Defining a Default Document

When a client connects to a Web site using a browser, the Web server is typically configured to transmit a home page file that provides the user's entry into the site. This home page file is called the default document for the site. The default document can be an HTML file, an Active Server Page (ASP) script, or any other type of file. The Web server identifies the default document solely by its name, which is specified as a property of the Web site.

By default, an IIS Web site uses the Default.htm and Default.asp files as the default documents for each new site you create. If a file called Default.htm exists on the site's home directory, the Web server transmits it automatically to clients that do not specify a filename in their URLs. If there is no Default.htm file, then the server looks for a Default.asp file. If none of the files listed as the default documents for the site exists, then the server either returns an error to the client or sends a list of the home directory contents, depending on whether the site is configured to support directory browsing. Directory browsing is not enabled by default.

To configure the default documents for a Web site, you open the site's Properties dialog box and click the Documents tab to display the controls shown in Figure 17.9. To add a new filename to the list, click Add and type a filename in the Add Default Document dialog box, then click OK. You can also remove an existing file from the list by selecting it and clicking Remove. To modify the order in which the server looks for the default documents, use the up and down arrow buttons.

Figure 17.9 The Documents tab of a Web site's Properties dialog box
All Microsoft Web server products use Default.htm and Default.asp as the default documents for their Web sites, whereas UNIX servers generally use index.html or index.htm. When you are creating your own Web sites, the filename that you use for the home page is inconsequential, as long as the server is configured to supply it to clients as the default document. Using default document names other than those of accepted standards adds a small layer of security if the site is not to be publicly available.

Exercise 17.1: Creating a Private Web Site

In this exercise, you create a new, private Web site on your IIS server and distinguish between it and the default site by using a different port number. You then use a client browser to access the two sites. This exercise assumes that you have a Windows 2000 Server with IIS installed in its default configuration.

Procedure 1: Creating Web Content

To create a home directory for your new Web site and place HTML files for both sites in the appropriate locations, complete the following steps:

  1. Log on to the Windows 2000 server as Administrator.
  2. Create a text file called Default.htm containing the following HTML code and save it in the \systemroot\Inetpub\wwwroot directory on the server's system drive (typically drive C):
        <HTML><BODY>
        <H1>Welcome to the public Web site.</H1>
        </BODY></HTML>
  3. Create a folder called \Home on your server's system drive.
  4. Create a text file called Index.html containing the following HTML code and save it in the \Home folder you just created:
        <HTML><BODY>
        <H1>Welcome to the secret Web site.</H1>
        </BODY></HTML>

Procedure 2: Creating a New Web Site

To create a second Web site on your IIS server, complete the following steps:

  1. Click Start and, from the Administrative Tools program group, open the Internet Information Services console.
  2. Right-click your server in the console tree, point to New and, from the pop-up menu, choose Web to launch the Web Site Creation Wizard. Click Next.
  3. Type Secret Site in the Description text box and click Next to display the IP Address And Port Settings page. What is the default TCP port value for the site? Why must it be changed?
  4. Type 82 in the TCP Port This Web Site Should Use text box and click Next to display the Web Site Home Directory page.
  5. Type the path to the \Home directory you created in Procedure 1 (such as C:\Home) in the Path text box and click Next.
  6. Click Next to use the default Web site access permissions, and click Finish to create the new site.

Procedure 3: Accessing Your Web Sites

To access the Web sites you just created, using a client browser, complete the following steps:

This procedure uses the IP address 127.0.0.1 in its browser URLs. This is a special-purpose IP address called the loopback address, which causes the computer to transmit its messages to itself. This enables you to access your Web sites using a browser running on the same computer, regardless of its actual IP address. If you want to access the Web sites from a browser running on another computer on your network, replace 127.0.0.1 with the Network Input/Output System (NetBIOS) name or IP address of your server.
  1. Start Internet Explorer on your Windows 2000 server.
  2. Type the URL http://127.0.0.1 in the Address box and click Go. What do you see? What does this indicate?
  3. Type the URL http://127.0.0.1:82 in the Address box and click Go. What do you see? Why?
  4. Open the Internet Information Services console.
  5. Right-click the Secret Site object and, from the pop-up menu, choose Properties.
  6. Click the Documents tab.
  7. Select the Default.htm entry in the Enable Default Document list and click Remove. Do the same for the Default.asp file.
  8. Click Add, type index.html in the Enable Default Document Name text box, and click OK.
  9. Click OK to close the Properties dialog box.
  10. Return to Internet Explorer and click the Refresh button. What happens now? Why?
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. List the three methods for distinguishing among multiple Web sites on a single server.
  2. What happens when IIS fails to find a file with the designated default document name in a Web site's home directory?
  3. Which of the following does not appear in the console tree of the Internet Information Services snap-in on a default IIS installation?
    1. Default FTP Site
    2. Default Web Site
    3. Administration Web Site
    4. Default SMTP Virtual Server

Lesson Summary

  • Internet Information Services (IIS) 5 is installed with Windows 2000 Server by default, using a standard configuration that includes a default Web site.
  • You can install additional IIS components, such as the File Transfer Protocol (FTP) Server, using the Add/Remove Programs Control Panel.
  • To create additional Web sites, you use the Web Site Creation Wizard in the Internet Information Services snap-in.
  • You can distinguish among sites using different IP addresses, port numbers, or host headers.
  • Each IIS site has a Properties dialog box that you can use to configure various operational parameters for the site.


Lesson 2: Creating Virtual Directories

The simplest possible IIS Web or FTP site is one in which all of the site's files are located in the home directories or subdirectories of the home directory. However, IIS also enables you to add files from other locations to your sites without moving them. These are called virtual directories. This lesson describes the process of creating and configuring virtual directories.

After this lesson, you will be able to

  • Create a virtual directory using the Internet Information Services snap-in
  • Create a virtual directory using Web Sharing
  • Redirect a Web request to another URL

Estimated lesson time: 20 minutes

Creating Virtual Directories

You can create a virtual directory to publish files on a site that come from a directory that is not contained within the site's home directory. In essence, a virtual directory is one that is not contained in the home directory but appears to client browsers as though it were. A virtual directory has an alias, a name that Web browsers use to access that directory. The alias does not have to be the same as the directory's own name, and it is usually shorter than the full path name of the directory, making it more convenient for users to type. The alias that you choose for the virtual directory becomes a subdirectory on the Web site or FTP site. For example, if you have a folder called D:\Documents\2001\MarketingCollateral on your server that you want to publish on an intranet Web site with the URL http://Marketing, you can create a virtual directory out of the folder and assign it the alias Docs. When clients access the intranet server, the contents of the D:\Documents\ 2001\MarketingCollateral folder appear on the site at the URL http://Marketing/Docs. Any subfolders in D:\Documents\2001\Marketing Collateral appear as subdirectories of http://Marketing/Docs on the Web site.

One of the main advantages of using virtual directories is that you can publish files from various locations on a single Web site without moving the files around. In the previous example, it might be impractical to move the D:\Documents\2001\MarketingCollateral folder to the Web server's home directory, because other users are accustomed to accessing the files at their original location using other programs. You can create as many virtual directories on a site as you need, enabling you to create a complete virtual directory structure out of folders located all over your network.

Aliases also provide an additional measure of security. Because users do not know where your files are physically located on the server, they cannot use that information to modify your files. In addition, aliases make it easier for you to move directories around in your site. Rather than changing the URL for the directory, you can simply change the mapping between the alias and the physical location of the directory.

To create a virtual directory on an IIS site Web or FTP site, use the following procedure:

  1. Log on to a Windows 2000 server running IIS as Administrator.
  2. Click Start and, from the Administrative Tools program group, select Internet Services Manager to open the Internet Information Services snap-in.
  3. Right-click a Web site or FTP site in the console tree, point to New and, from the pop-up menu, choose Virtual Directory to launch the Virtual Directory Creation Wizard.
  4. Click Next to bypass the Welcome page and display the Virtual Directory Alias page.
  5. Type the name for the virtual directory that you want clients to see in the Alias text box. Click Next to proceed to the Web Site Content Directory page.
  6. Type the path to the folder containing the files you want to publish in the Directory text box. You can specify a path containing either a drive letter, such as C:\Documents, or a UNC path name, such as \\server1\Documents. If the path you enter is located on another computer, the wizard displays a User Name And Password page in which you must enter the credentials that the server should use to access the folder.
  7. Click Next to proceed to the Access Permissions page.
  8. Specify the permissions you want to grant users to the files in the home directory using the check boxes provided. Click Next to complete the wizard.
  9. Click Finish to create the virtual directory.

Using Web Sharing

Windows 2000 Web Sharing is another method for creating virtual directories on a Web site, one that is easier for the typical user to perform using Windows Explorer instead of the Internet Information Services snap-in. Web Sharing is designed for users who want to share folders on a computer that is itself running IIS. You cannot create a virtual directory out of a folder on another computer using Web Sharing (as you can with the Internet Information Services snap-in), nor can you create a virtual directory on another IIS server.

To create a virtual directory with Web Sharing, use the following procedure:

  1. Open Windows Explorer and browse to the folder on a local drive that you want to share.
  2. Right-click the folder and, from the pop-up menu, choose Properties to display the Properties dialog box.
  3. Click the Web Sharing tab to display the controls.
  4. In the Share On drop-down list box, select the Web site on which you want to publish the folder.
  5. Select Share This Folder, select an alias, then click Edit Properties to display the Edit Alias dialog box shown in Figure 17.10.

    Figure 17.10 The Edit Alias dialog box
  6. Type the alias you want to use for the folder on the Web site in the Alias text box.

    By default, the name of the folder appears in the Alias text box, but you can change it as needed.

  7. In the Access Permissions and Application Permissions boxes, select the permissions you want to grant to users of the shared folder.
  8. Click OK. The alias appears in the Web Sharing tab in the Aliases list.

    You can click Add to create additional aliases for the same folder. Each alias you create appears as a separate subdirectory on the Web site.

  9. Click OK to close the Properties dialog box and create the virtual directory.
When you share a folder using Web Sharing, the folder's icon in Windows Explorer is not modified as it is when you create a Windows network share. The only way to tell that the folder is shared in Windows Explorer is to look at the Web Sharing tab of the folder's Properties dialog box.

Once you complete this procedure, you can see that the aliases you created appear under the Web site in the console tree of the Internet Information Services snap-in, just as if you created the virtual directory using the snap-in.

Redirecting Requests

When a browser requests a page on your Web site, the Web server locates the page identified by the URL and returns it to the browser. When you move a page on your Web site, you cannot always correct all of the links that refer to the previous URL of the page. To make sure that browsers can find the page at the new URL, you can instruct the Web server to give the browser the new URL. The browser uses the new URL to request the page again. This process is called redirecting a browser request or redirecting to another URL. Redirecting a request for a page is similar to using a forwarding address with a postal service. The forwarding address ensures that letters and packages addressed to your original residence are delivered to your new residence.

Redirecting a URL is also useful when you are updating your Web site and want to make a portion of the site temporarily unavailable, or when you have changed the name of a virtual directory and want links to files in the original virtual directory to access the same files in the new virtual directory.

You can use the Internet Information Services snap-in to redirect requests to a Web site, a virtual directory, or another directory. To redirect a request, use the following procedure:

  1. Log on to a Windows 2000 server running IIS as Administrator.
  2. Click Start and, from the Administrative Tools program group, select Internet Services Manager to open the Internet Information Services snap-in.
  3. Right-click the Web site, virtual directory, or directory you want to redirect and, from the pop-up menu, choose Properties to display the Properties dialog box.
  4. Click the Home Directory tab, shown in Figure 17.11, if you are redirecting a Web site; the Virtual Directory tab if you are redirecting a virtual directory; or the Directory Tab if you are redirecting a directory.

    Figure 17.11 The Home Directory tab of a Web site's Properties dialog box
  5. In the When Connecting To This Resource, The Content Should Come From options, select A Redirection To A URL.
  6. Notice that the tab changes to show the controls for URL redirection, as shown in Figure 17.12.

    Figure 17.12 The Home Directory tab of a Web site's Properties dialog box, with URL redirection controls
  7. Type the URL you want to redirect the site, virtual directory, or directory to in the Redirect To text box.
  8. Click the check boxes provided to enable the following options and send the client to:
    • The Exact URL Entered Above. This option causes IIS to redirect requests for all files and subfolders in the site, virtual directory, or directory to a single file at the URL specified in the Redirect To text box.
    • A Directory Below This One. This option enables you to redirect requests to the specified site, virtual directory, directory, or subdirectory of that location.
    • A Permanent Redirection For This Resource. Redirections are usually considered temporary. This option sends a status message to the client indicating that this redirection is permanent.
  9. Click OK.

Exercise 17.2: Creating Virtual Directories

In this exercise, you create two new virtual directories in different ways, and then access them using Internet Explorer. This exercise assumes that you have completed Exercise 17.1 in Lesson 1.

Procedure 1: Creating a Virtual Directory Using the IIS Snap-In

To create a virtual directory using the Virtual Directory Creation Wizard in the Internet Information Services snap-in, complete the following steps:

  1. Log on to the Windows 2000 server as Administrator.
  2. Click Start and, from the Administrative Tools program group, open the Internet Information Services console.
  3. Right-click the Default Web Site icon in the console tree, point to New and, from the pop-up menu, choose Virtual Directory.
  4. Click Next to bypass the Welcome To The Virtual Directory Creation Wizard page and display the Virtual Directory Alias page.
  5. In the Alias text box, type SecretSiteHome and click Next to display the Web Site Content Directory page.
  6. In the Directory text box, type the path to the \Home directory you created in Exercise 17.1, and click Next.

    What are the default permissions for the virtual directory?

  7. In the Access Permissions page, select the Browse check box and click Next.
  8. Click Finish to create the virtual directory.

Procedure 2: Creating a Virtual Directory Using Web Sharing

To create a virtual directory using Web Sharing in Windows Explorer, complete the following steps:

  1. Open Windows Explorer.
  2. Browse to the \Inetpub\Iissamples\Sdk\Asp\Docs directory on your system drive (typically C).
  3. Right-click the \Inetpub\Iissamples\Sdk\Asp\Docs directory and, from the pop-up menu, choose Properties.
  4. Click the Web Sharing tab.
  5. In the Share On drop-down list box, select Secret Site.
  6. Select Share This Folder.
  7. Type ASPsamples in the Alias text box.
  8. In the Application Permissions box, click None and then click OK.
  9. Click OK to close the Properties dialog box.
  10. Minimize Windows Explorer.

Procedure 3: Accessing Shared Directories

To access the two virtual directories you just created, complete the following steps:

  1. Open Internet Explorer.
  2. In the Address text box, type http://127.0.0.1/SecretSiteHome and click Go. What do you see? Why?
  3. In the Address text box, type http://127.0.0.1:82/ASPsamples/ColorPicker.asp and click Go. What do you see? Why?
  4. Return to Windows Explorer and open the Properties dialog box for the \Inetpub\Iissamples\Sdk\Asp\Docs folder.
  5. Click the Web Sharing tab.
  6. In the Share On drop-down list box, select Secret Site.
  7. In the Aliases list box, select ASPsamples and then click Edit Properties.
  8. In the Application Permissions box, select Scripts and then click OK twice.
  9. Switch back to Internet Explorer and click the Refresh button. What do you see now? Why?
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Compare a virtual directory to a Dfs root.
  2. How do virtual directories add security to a Web site?
  3. What is the purpose of redirecting a client request for a URL to another URL?

Lesson Summary

  • A virtual directory is a means of mapping a shared folder anywhere on the network to an alias on an Internet Information Services (IIS) server so that the folder appears to be part of a Web site or File Transfer Protocol (FTP) site.
  • Virtual directories are identified by aliases, which appear as subdirectories beneath a Web site's or FTP site's home directory.
  • To create a virtual directory in the Internet Information Services snap-in, you use the Virtual Directory Creation Wizard.
  • To create a virtual directory in Windows Explorer, you use the Web Sharing tab in the folder's Properties dialog box.
  • Request redirection is an IIS feature that enables you to forward client requests for a particular Uniform Resource Locator (URL) to another URL, which can help to prevent broken hyperlinks on your Web site.


Lesson 3: Managing Site Security

As it is with any networking service, security is an important part of IIS administration. This lesson examines the basic types of security provided by IIS and the tools you can use to implement them.

After this lesson, you will be able to

  • Create sites with alternative port numbers
  • Configure the various types of user authentication supported by IIS
  • Implement IP address and domain name restrictions
  • Configure a Web site to use Secure Sockets Layer (SSL)

Estimated lesson time: 50 minutes

IIS can use a variety of methods to prevent unauthorized users from accessing Web sites and FTP sites, including authentication, port assignments, IP address and domain name restrictions, and security protocols such as SSL. Most of these mechanisms are designed to block access to the sites, but the most powerful ones, the security protocols, also protect the data transferred by IIS servers and clients using encryption.

Using Port Assignments

One of the simplest and weakest forms of site protection is to use an alternate port number when creating the site. The HTTP and FTP protocols that govern Web and FTP communications, respectively, are both associated with well-known ports by the TCP/IP standards. The well-known port for Web (HTTP) communications is 80 and the standard port for FTP is 21. (FTP actually uses two well-known ports-21 for control traffic and 20 for data transmissions-but clients use the control port to establish the initial connection with the server.)

The use of these ports is so standardized that Web and FTP clients use them automatically, and as a result, most users are unaware of their existence. When you enter a URL in Internet Explorer, for example, you might type http://www.microsoft.com. Before sending an HTTP request to the Microsoft server, the browser resolves the name into an IP address using the Domain Name System (DNS) and also adds the port number 80 to the TCP/IP protocol header.

You can configure IIS to use a port number other than 80 for a Web site or 21 for an FTP site. However, this causes standard requests for site access sent by browsers to fail, unless they specify the correct port number. The standard URL notation for the port number is to append it to the domain name after a colon, as in http://www.microsoft.com:80. You can create extended URLs in the normal manner with the port number in place, as in http://www.microsoft.com:80/windows2000.

This provides limited protection for a site, because most users are not aware of port numbers at all, and even those who are aware of them do not know what port number you have assigned to the site. However, there is no mechanism to prevent knowledgeable users from repeatedly trying to connect using different port numbers, and there are software tools that can automate the process by sending requests to a range of port numbers until the right one is found. As a result, you should not consider this method for a site that requires serious protection, unless you use it in combination with other security mechanisms.

The administration Web site that IIS creates by default when you install it uses an alternative port number to distinguish it from the default Web site and to provide a measure of security. IIS chooses a port number at random when it creates the site. You can view the port number assigned to it by opening the site's Properties dialog box and looking at the TCP Port value in the Web Site tab, as shown in Figure 17.13. You can also use this control to modify the port number for any site.

Figure 17.13 The Web Site tab of a site's Properties dialog box
The Web Site Creation Wizard and the FTP Site Creation Wizard both enable you to specify an alternate port number for new sites as you create them, as shown in Lesson 1 of this chapter.

Using Authentication

Authentication is the most common mechanism used to restrict access to a Web site or FTP site. IIS supports four types of authentication, which are discussed in the following sections.

Anonymous Authentication

On the Internet, most Web sites and FTP sites are public and provide free access to all users. Although it is not apparent when you connect to this type of site, an authentication is taking place behind the scenes. IIS sites that are configured for anonymous access employ a user name and password configured at the server to provide site access to all users. Windows 2000 uses an account called IUSR_computername, where computername is replaced by the NetBIOS name of the computer running IIS, and a randomly chosen password for this purpose. This is a special account designed to provide anonymous users with limited access to Windows 2000 resources.

IIS enables anonymous access to the new Web sites you create using the Web Site Creation Wizard by default, but you can clear a check box to disable it while creating a site. To control anonymous access for an existing site, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Internet Information Services console.
  2. Right-click the Web site object you want to manage and, from the pop-up menu, choose Properties to display the Properties dialog box.
  3. Click the Directory Security tab to display the controls shown in Figure 17.14.

    Figure 17.14 The Directory Security tab of a Web site's Properties dialog box
  4. In the Anonymous Access And Authentication Control box, click Edit to open the Authentication Methods dialog box shown in Figure 17.15.

    Figure 17.15 The Authentication Methods dialog box
  5. Select the Anonymous Access check box to enable or disable anonymous access for the site.
  6. To modify the account used for anonymous access, click Edit to display the Anonymous User Account dialog box shown in Figure 17.16.
    There is rarely any reason to modify the account used for anonymous access, but the Internet Information Services console does make it possible.
    Figure 17.16 The Anonymous User Account dialog box
  7. Enter a user account name in the Username text box and, if desired, clear the Allow IIS To Control Password check box and specify a password in the Password text box. Click OK.
    If you elect to specify a different user name and password for anonymous access, you must be sure that the credentials you supply match those of an actual account on the computer running Windows 2000 or the Active Directory service.
  8. Click OK to close the Authentication Methods dialog box.
  9. Click OK to close the Properties dialog box.

Basic Authentication

Basic authentication provides more protection for a site than anonymous authentication, but it also creates a serious security problem. With basic authentication, every client must have a user account on the Web server and must supply a user name and password to access the site. The browser sends these credentials, including the password, to the Web server in clear text. This means that the password is unencrypted and can be intercepted by anyone running a protocol analyzer, like the Network Monitor application included with Windows 2000 Server. Anyone in possession of the user name and password can access the Web site and also log on to the server locally.

The advantage of basic authentication is that it is supported by all browsers running on any operating system. The disadvantage is, of course, the possibility that users' logon credentials can be compromised. If you enable basic authentication on your Web sites, it is important that your users access the sites with accounts that do not have high-level permissions, or use a security certificate, to encrypt the transmissions. For example, you should never use an administrative account to log on to a Web server with basic authentication and no certificate, because you endanger not just the Web site, but the entire server.

To enable basic authentication for a Web site, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Internet Information Services console.
  2. Right-click the Web site object you want to manage and, from the pop-up menu, choose Properties to display the Properties dialog box.
  3. Click the Directory Security tab.
  4. In the Anonymous Access And Authentication Control box, click Edit to open the Authentication Methods dialog box.
  5. Select the Basic Authentication (Password Is Sent In Clear Text) check box. An Internet Service Manager message box appears containing a warning about the use of unencrypted passwords, as shown in Figure 17.17.

    Figure 17.17 The Internet Service Manager message box
  6. Click Yes to close the message box.
  7. If you want users to authenticate to a domain other than the one in which the server resides, click Edit to open the Basic Authentication Domain dialog box, as shown in Figure 17.18. Otherwise, skip to Step 8.

    Figure 17.18 The Basic Authentication Domain dialog box
  8. Type the name of the domain in which you want to authenticate the Web site users in the Domain Name text box and click OK.
  9. Click OK to close the Authentication Methods dialog box.
  10. Click OK to close the Properties dialog box.

Digest Authentication

Digest authentication is based on a draft standard that enables Web clients to send logon credentials to the IIS server with the password encrypted. Digest authentication can also work with a proxy server, which integrated Windows authentication cannot. To use digest authentication with IIS, your server configuration must meet the following requirements:

  • The accounts that clients use to authenticate must be located in an Active Directory domain, not on a stand-alone server.
  • Each user account must have the Store Password Using Reversible Encryption option enabled in its user object properties. You configure this option in the Account tab of the user object's Properties dialog box in the Active Directory Users and Computers console (see Figure 17.19).
  • The IIS sites must be configured to use digest authentication.
Figure 17.19 The Account tab of a user object's Properties dialog box

To configure a Web site to use digest authentication, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Internet Information Services console.
  2. Right-click the Web site object you want to manage and, from the pop-up menu, choose Properties to display the Properties dialog box.
  3. Click the Directory Security tab.
  4. In the Anonymous Access And Authentication Control box, click Edit to open the Authentication Methods dialog box.
  5. Select the Digest Authentication For Windows Domain Servers check box. An IIS WWW Configuration message box appears containing a warning about the requirements for the use of digest authentication (see Figure 17.20).

    Figure 17.20 The IIS WWW Configuration message box
  6. Click Yes to close the message box.
  7. Click OK to close the Authentication Methods dialog box.
  8. Click OK to close the Properties dialog box.

Integrated Windows Authentication

Integrated Windows authentication (formerly known as Windows NT Challenge/Response authentication) is best suited for clients and servers located on the same intranet. The Web client uses the credentials with which the user logged on to the domain to authenticate itself to the IIS server, preventing the transmission of a password in any form. Only when the logon credentials are not sufficient to provide access to the Web site is the user prompted to supply a user name and password, which are transmitted in encrypted form.

To configure a Web site to use integrated Windows authentication, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Internet Information Services console.
  2. Right-click the Web site object you want to manage and, from the pop-up menu, choose Properties to display the Properties dialog box.
  3. Click the Directory Security tab.
  4. In the Anonymous Access And Authentication Control box, click Edit to open the Authentication Methods dialog box.
  5. Select the Integrated Windows Authentication check box.
  6. Click OK to close the Authentication Methods dialog box.
  7. Click OK to close the Properties dialog box.

Using IP Address and Domain Name Restrictions

Another method for restricting access to IIS sites is to specify the IP addresses and domain names that are to be granted or denied access. IIS uses this technique to restrict access to the administration Web site. By default, all addresses are denied access to the site except for the IP loopback address: 127.0.0.1. This means that only a user running a browser on the server itself can access the site.

You can control access to a site using IP address and domain restrictions in two ways. You can deny access to all addresses and domains except those you explicitly name or grant access to all addresses and domains except those you explicitly deny. The former provides a greater element of security, but can often require more maintenance, whereas the latter is preferable for a less secure but easily managed configuration.

To create IP address and domain name restrictions, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Internet Information Services console.
  2. Right-click the Web site object you want to manage and, from the pop-up menu, choose Properties to display the Properties dialog box.
  3. Click the Directory Security tab.
  4. In the IP Address And Domain Name Restrictions box, click Edit to display the IP Address And Domain Name Restrictions dialog box shown in Figure 17.21.

    Figure 17.21 The IP Address And Domain Name Restrictions dialog box
  5. Select either Granted Access or Denied Access to define the default behavior of the site.

    The Granted Access option enables all users to access the site except those you specify. The Denied Access option prevents all users from accessing the site except those you specify.

  6. Click Add to open the Grant Access On (see Figure 17.22) or Deny Access On dialog box.

    Figure 17.22 The Grant Access On dialog box
  7. Select the appropriate option to indicate whether you want to specify the address of a single computer, a group of computers, or a domain name.
  8. Type the identifier for the element you want to include in the exception list in the boxes provided.

    If you selected Single Computer, type the address of the computer in the IP Address text box. If you selected Group Of Computers, type the network address in the Network ID text box and the subnet mask for the network in the Subnet Mask text box. If you selected Domain Name, enter the name of the domain in the Domain Name text box.

  9. Click OK.
  10. Repeat Steps 8 and 9, if necessary, to create additional entries in the exceptions list.
  11. Click OK to close the IP Address And Domain Name Restrictions dialog box.
  12. Click OK to close the Properties dialog box.

Using Access Permissions

IIS permissions determine what users connected to a Web site or FTP site are permitted to do. For the most part, the Web is a read-only medium, but you can also use IIS permissions to specify whether users are allowed to execute scripts and programs on the site, and in special cases, whether they can write data to the Web server. FTP sites typically support both read and write access, but you can use IIS permissions to restrict an FTP site to read-only access.

As with the NT file system (NTFS), you can set permissions at any level of the IIS site hierarchy: the site level, the virtual directory level, or the directory level. Also like NTFS, the permissions you set at a particular level are inherited by the child elements beneath it.

To set permissions on a Web site, you open the Properties dialog box for the site, virtual directory, or directory you want to work with, and then click the Home Directory, Virtual Directory, or Directory tab, respectively.

To set permissions for the selected element select any or all of the following check boxes:

  • Script Source Access. Enables users to access the source code of scripts when the Read or Write permission is set
  • Read. Enables users to read or download files or subdirectories and their associated properties
  • Write. Enables users to upload files and their associated properties or to change content in a Write-enabled file
  • Directory Browsing. Enables users to see a hypertext listing of files and directories, but not virtual directories

In addition to these permissions, in the Execute Permissions drop-down list you can set the permission that specifies whether users can execute scripts only, scripts and executables, or neither.

Using SSL

The Secure Sockets Layer protocol enables you to configure your IIS sites not only to authenticate users, but also to encrypt the data transferred between client browsers and the IIS server. SSL is commonly used on Web sites, such as banking and e-commerce sites, that routinely require clients to transmit sensitive data. To use SSL on your IIS sites, you must first obtain a server certificate, which authenticates the identity of the server and contains the public keys used to encrypt the data that the server transmits. You can obtain a certificate from any one of several third-party companies, such as VeriSign, or you can issue one yourself using Windows 2000 Certificate Services and the Web Server Certificate Wizard in IIS.

Exercise 17.3: Accessing the Administration Web Site

In this exercise, you use the Internet Information Services snap-in to configure the security settings for the administration Web site. You then run Internet Service Manager (HTML) to test access capability to the site.

Procedure 1: Configuring the Administration Web Site with the Internet Information Services Snap-In

To use the Internet Information Services snap-in to configure the administration Web site, complete the following steps:

  1. Log on to your IIS server as Administrator.
  2. Click Start and, from the Administrative Tools program group, open the Internet Information Services console.
  3. In the console tree, expand the icon for your server and then expand the Administration Web Site icon.
  4. Right-click the Administration Web Site icon and, from the pop-up menu, choose Properties to display the Administration Web Suite Properties dialog box.
  5. With the Web Site tab active, record the TCP Port value appearing in the TCP Port text box. What does the value of this field signify?
  6. Click the Directory Security tab.
  7. In the Anonymous Access And Athentication Control box, click Edit to open the Authentication Methods dialog box.

    Notice that anonymous access is cleared for the administration Web site by default, basic authentication is not enabled, and integrated Windows authentication is enabled. This configuration means that a browser client connecting to the administration Web site must be running on a Windows computer and have a user account on the server or in its domain.

  8. Select the Digest Authentication For Windows Domain Servers check box.

    An IIS WWW Configuration message box appears, explaining that only Windows 2000 domain accounts can be used and that passwords must be stored as encrypted clear text.

  9. Click Yes.

    This provides additional security in your Windows 2000 domain, because it restricts site access to Windows 2000 domain user accounts only.

    To use this option, all user accounts accessing the Web site must have the Store Password Using Reversible Encryption option enabled in their user object Properties dialog boxes. If your Active Directory user objects do not use this option, and you cannot change them, do not enable digest authentication.
  10. Click OK to close the Authentication Methods dialog box.
  11. In the Administration Web Site Properties dialog box, in the IP Address And Domain Name Restrictions box, click Edit to display the IP Address And Domain Name Restrictions dialog box. What are the current settings in this dialog box, and what do they signify?
  12. Select Granted Access so that you can access the administration Web site from any computer in your training network. Click OK.

    For additional security, consider adding specific IP addresses, a network address, or a specific domain name that can access the administration Web site. This last option is resource intensive and not recommended for most implementations of IIS.

  13. Click OK to close the Administration Web Site Properties dialog box.

    The Inheritance Overrides dialog box appears and explains that the child node IISAdmin defines the value of Authentication Methods. You next override the currently configured value in favor of the value you configured for the Administration Web Site node.

  14. In the Child Nodes box, select IISAdmin and then click OK.

    The Inheritance Overrides dialog box appears again for the IISHelp child node.

  15. Select IISHelp and click OK.
  16. Close the Internet Information Services console.

Procedure 2: Configuring SSL Access to the Administration Web Site

To apply the SSL protocol to the administration Web site to establish secure communications when operating on this site, complete the following steps. To do this, you issue your own server certificate using Windows 2000 Certificate Services.

This procedure requires that your server be running Certificate Services, which is not installed with Windows 2000 Server by default. You must install this service before you can perform this procedure. After Certificate Services is installed, the server cannot be renamed, join a domain, or be removed from a domain.
  1. Log on to your IIS server as Administrator.
  2. Click Start and, from the Administrative Tools program group, open the Internet Information Services console.
  3. Right-click the Administration Web Site icon and, from the pop-up menu, choose Properties to open the Properties dialog box.
  4. Click the Directory Security tab.
  5. In the Secure Communications box, click Server Certificate to launch the Web Server Certificate Wizard.
  6. Click Next to bypass the Welcome page and display the Server Certificate page.
  7. Confirm that Create A New Certificate is selected and then click Next to display the Delayed Or Immediate Request page.
  8. Select Send The Request Immediately To An Online Certification Authority and then click Next to display the Name And Security Settings page.

    What is the name assigned to the certificate by default?

  9. Click Next to display the Organization Information page.
  10. In the Organization drop-down list box, type Microsoft Corporation and in the Organizational Unit drop-down list box, type Microsoft Press.
  11. Click Next to display the Your Site's Common Name page.
  12. In the Common Name text box, type servername.microsoft.com, where servername is the name of your server. Then, click Next to display the Geographical Information page.
  13. Do not change the value in the Country/Region drop-down list box.
  14. In the State/Province drop-down list box, type Washington and in the City/Locality drop-down list box, type Redmond.
  15. Click Next to display the Choose A Certification Authority page. The name of the certification authority on your server appears in the Certification Authorities drop-down list box.
  16. Click Next to display the Certificate Request Submission page.
  17. Read through the summary information in this page and then click Next to display the Completing The Web Server Certificate Wizard page.
  18. Click Finish.

    The Web Server Certificate Wizard closes and the Administration Web Site Properties dialog box reappears. Notice that the View Certificate and Edit buttons are now available in the Secure Communications box.

  19. In the Secure Communications box, click Edit to display the Secure Communications dialog box.
  20. Select the Require Secure Channel (SSL) check box.
  21. Verify that Ignore Client Certificates is selected and then Click OK.
  22. In the Properties dialog box, click the Web Site tab.
  23. In the SSL Port text box, type 5000.
  24. Click OK.
  25. Close the Internet Information Services snap-in.

Procedure 3: Testing Access to the Secured Administration Web Site

To test access to the administration Web site now that a server certificate and SSL have been configured for the site, complete the following steps:

  1. Click Start on your server and open the Run dialog box.
  2. In the Open text box, type http://127.0.0.1:<tcp_port> and then click OK.

    The tcp_port variable in this procedure must be replaced with the value you obtained in Procedure 1.

    Internet Explorer starts and displays a message explaining that the page must be viewed over a secure channel.

  3. In the Internet Explorer Address drop-down list box, type https://127.0.0.1:5000 and then click Go. The 5000 value is the SSL Port value you entered in the Web Site tab.

    A Security Alert message box appears, stating that you are about to view information over a secure connection.

  4. Select the In The Future Do Not Show This Warning check box and then click OK to display the Enter Network Password dialog box.
  5. In the User Name text box, type administrator. In the Password text box, type the password for the Administrator account.
  6. Select the Save This Password In Your Password List check box and then click OK. The Internet Services Manager (HTML) interface appears. How can you tell that the connection is secured?
  7. Close the Internet Services Manager (HTML) interface.
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Which of the following types of authentication require users to have Windows 2000 user accounts? (Choose all that apply.)
    1. Anonymous authentication
    2. Basic authentication
    3. Digest authentication
    4. Integrated Windows authentication
  2. How does using a different port number for a site make it more secure?
  3. List the default security mechanisms used by the IIS administration Web site.

Lesson Summary

  • Using a port number other than 80 for a Web site and 21 for a File Transfer Protocol (FTP) site provides a modest amount of additional security.
  • New Internet Information Services (IIS) Web sites are configured to use anonymous authentication by default, which enables any user to access the site.
  • Basic authentication enables any client to access a Web site by supplying a user name and password, but the password is transmitted over the network in unencrypted form (clear text).
  • Digest authentication transmits user credentials in encrypted form and requires users to have accounts in a Windows 2000 domain.
  • Integrated Windows authentication uses the credentials with which the user logged on to the computer to gain access to a Web site.
  • Secure Sockets Layer (SSL) is a security protocol that provides authentication and also encrypts the data transmitted over the network.


Lesson 4: Troubleshooting IIS

In this lesson, you review some of the most common problems that can prevent clients from connecting to an IIS Web server.

After this lesson, you will be able to

  • Troubleshoot basic IIS client connection problems

Estimated lesson time: 10 minutes

Table 17.1 contains some of the most common causes for client connection problems with IIS, along with possible solutions.

Table 17.1 Troubleshooting IIS Web Site Connection Problems

Symptom: Clients fail to connect to a Web site

Cause Solution

A network communications problem is preventing the connection.

Check communications between the client and the server by using the Ping utility to connect to the server's IP address and by checking the name resolution mechanism used to resolve the computer or DNS name in the URL to an IP address.

The site is operating with a TCP port number other than the default (80).

Append the correct port number to the domain or computer name in the browser URL (as in http://www.microsoft.com:82).

The Web site is not configured to use anonymous access.

  • Activate anonymous access in the site's Properties dialog box.
  • Supply the user with the credentials needed to connect to the site using another type of authentication.

The anonymous access account is improperly configured.

Make sure that:

  • The account used for anonymous access exists in the server's account database or in Active Directory service with the correct password.
  • The account used for anonymous access has the Log On Locally and Network Logon permissions.

The client does not have an appropriate user account for the authentication type the site is configured to use.

If the site is configured to use digest authentication or integrated Windows authentication only, the client must have a Windows 2000 user account. In the case of digest authentication, the client must have an Active Directory user account.

The site, virtual directory, or directory containing the requested file is not configured with the correct permissions.

If the default document or the requested file is a script or a program, the site, virtual directory, or directory must be configured with either the Scripts Only or Scripts and Executables permission, in addition to the Read permission.

The site requires an SSL connection.

If the site is configured to require a secured connection using SSL, the URL in the browser must use the https:// prefix instead of http:// and must include the appropriate SSL port number, as in https://secure.microsoft.com:5000.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next chapter. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. List two instances in which clients must supply port numbers in their URLs.
  2. Name the two rights that the anonymous authentication account must possess for logons to occur.
  3. What permissions are required for a client to access a Web site with a default document that takes the form of an ASP script?

Lesson Summary

  • Do not overlook the obvious in troubleshooting Web site connection problems. Check for network communication and networking hardware failures.
  • The type of authentication that the site is configured to use is a frequent source of logon failures.
  • Digest authentication and integrated Windows authentication require all Web client users to have Windows 2000 user accounts.
  • Sites that use scripts or programs must be configured with the appropriate permissions for clients to be able to run those scripts or programs.
  • Sites that require an SSL connection must have both the https:// prefix and the correct SSL port number (which is usually different from the HTTP port number).


Remote Client Access

About This Chapter

Microsoft Windows 2000 includes a variety of technologies that enable clients to connect to servers from remote locations with greater security. This chapter examines some of these technologies and describes how to deploy them on your network.

Before You Begin

This chapter requires a basic understanding of Transmission Control Protocol/Internet Protocol (TCP/IP) communications, as described in Chapter 13, "TCP/IP Administration." To perform the exercises in this chapter, you need two computers running Microsoft Windows 2000 on a network, at least one of which is running Microsoft Windows 2000 Server.


Lesson 1: Using Remote Access

Windows 2000 remote access technology enables remote clients to connect to corporate networks or to the Internet. This lesson provides an overview of remote access and discusses dial-in remote access connections, remote access security, and managing remote access. This lesson focuses on the Remote Access Service part of the Windows 2000 Routing and Remote Access Service (RRAS). Here-after, the acronym RAS is used to refer to the Remote Access Service component of RRAS.

After this lesson, you will be able to

  • Describe how remote access works, including dial-in remote access connections and remote access security
  • Configure and enable Windows 2000 RRAS
  • Manage remote access, including the management of users, addresses, and access
  • Create a remote access policy

Estimated lesson time: 35 minutes

Overview of Remote Access

In Windows 2000 RAS, remote access clients are connected to either the remote access server's resources only (which is sometimes called point-to-point remote access connectivity), or they are connected to the RAS server's resources and the resources of the network to which the server is connected (which is called point-to-LAN remote access connectivity). The latter type of connection enables remote access clients to access network resources as if they were physically attached to the network.

A Windows 2000 RAS server provides two remote access connection methods:

  • Dial-in remote access. With dial-in remote access, a remote access client uses the telecommunications infrastructure to create a temporary physical circuit to a port on a remote access server. Once the physical circuit is created, the rest of the connection parameters can be negotiated by the two computers.
  • Virtual private network (VPN) remote access. With VPN remote access, a client uses an Internet Protocol (IP) internetwork (typically the Internet) to create a virtual point-to-point connection with an RAS server acting as the VPN server. Once the virtual point-to-point connection is created, the rest of the connection parameters can be negotiated by the two computers.
This lesson focuses primarily on dial-in remote access; however, many topics also apply to VPN remote access. For more information about VPNs, see Lesson 2, later in this chapter.

Dial-in Remote Access Connections

A dial-in remote access connection consists of a remote access client, a remote access server, and a wide area networking (WAN) infrastructure, as shown in Figure 18.1. The physical or logical connection between the remote access server and the remote access client is facilitated by dial-in equipment installed at the client and server sites, and by the telecommunications infrastructure. The nature of the dial-in equipment and telecommunications infrastructure varies depending on the type of connection being made.

Figure 18.1 Elements of a dial-in remote access connection

The most common type of WAN connection used by RAS is the Public Switched Telephone Network (PSTN), also known as Plain Old Telephone Service (POTS). PSTN is the standard analog telephone system designed to carry only the minimal frequencies necessary to distinguish human voices. Because the PSTN was not designed for data transmissions, the maximum bit rate that a PSTN connection can support is limited. Dial-in equipment consists of an analog modem for the remote access client and the remote access server, as shown in Figure 18.2. For large organizations, the remote access server is attached to a modem bank that can contain dozens or hundreds of modems, each of which can service a different client. With analog modems at both ends of the connection, the maximum bit rate supported by PSTN connections is 33,600 bits per second, or 33.6 kilobits per second (Kbps). The 56-Kbps modems commonly used today require a digital connection on the server side, and are able to achieve higher transmission speeds for traffic from the server to the client. Client-to-server traffic is still limited to 33.6 Kbps, however.

Figure 18.2 Dial-in equipment and WAN infrastructure for PSTN connections

Other technologies, such as Integrated Services Digital Network (ISDN) and leased telephone lines, provide all-digital WAN services running at higher speeds, but these are permanent connections between two sites that require special installations and equipment. Generally speaking, the dial-in RAS architecture is the same, whatever type of WAN technology is providing the connection between the client and the server.

Remote Access Protocols

Remote access protocols control the establishment of connections and the transmission of data over the WAN links connecting RAS clients and servers. The operating system and local area network (LAN) protocols used on remote access clients and servers dictate which remote access protocol your clients can use. In nearly all cases, RAS connections use the Point-to-Point Protocol (PPP) for WAN communications, because PPP includes mechanisms that provide security and support for multiple protocols at the network layer. Older RAS protocols used with earlier Windows RAS implementations, such as the Serial Line Internet Protocol (SLIP) and Asynchronous NetBIOS Enhanced User Interface (NetBEUI), have fallen into disuse because they do not provide these features.

Once the WAN connection is established between the RAS client and server, the client can access server resources using PPP. For the client to access resources on the network to which the server is attached, the server functions as a router between the PPP connection and a standard LAN protocol, such as Ethernet or Token Ring. Both PPP and the LAN protocols provide support for all of the standard network layer protocols, such as TCP/IP, Internetwork Packet Exchange (IPX), NetBEUI, and AppleTalk. This enables the RAS client to access virtually any type of resource on the server's network, just as if the computer were directly connected to the LAN. The only perceivable difference is the speed of the connection, which is much slower than a standard LAN connection.

Remote Access Security

Windows 2000 remote access offers a wide range of security features, including secure user authentication, mutual authentication, data encryption, callback, caller ID, and remote access account lockout.

Secure User Authentication

Secure user authentication is obtained through the encrypted exchange of user credentials. This is possible through the use of the PPP remote access protocol along with one of the following authentication protocols:

  • Extensible Authentication Protocol (EAP)
  • Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) version 1 and version 2
  • Challenge Handshake Authentication Protocol (CHAP)
  • Shiva Password Authentication Protocol (SPAP)

You can configure an RAS server to require a secure authentication method. If the remote access client cannot support the required secure authentication, the connection is denied.

Mutual Authentication

Mutual authentication is obtained by authenticating both ends of the connection through the exchange of encrypted user credentials. This is possible through the use of PPP along with EAP-Transport Level Security (EAP-TLS) or MS-CHAP version 2. During mutual authentication, the remote access client authenticates itself to the RAS server, and then the RAS server authenticates itself to the remote access client.

Data Encryption

Data encryption encodes the data sent between the remote access client and the RAS server. However, remote access data encryption provides protection only on the WAN link between the RAS client and server. If end-to-end encryption is needed, such as between an RAS client and another computer on the server network, you can use the IP Security protocols (IPsec) to create an encrypted end-to-end connection after establishing the RAS connection.

Data encryption on a remote access connection is based on a secret encryption key known to the RAS server and the client. This shared secret key is generated during the user authentication process. Data encryption is possible over dial-in remote access links when using PPP along with EAP-TLS or MS-CHAP. As with authentication, you can configure the RAS server to require data encryption. If the remote access client cannot perform the required encryption, the connection attempt is rejected.

Callback

With callback, the remote client dials into the RAS server, authenticates itself, and then severs the connection. The server then calls the client back and re-establishes the connection. You can configure the server to call the client back at a preset number or a number specified by the client during the initial call. This enables a traveling user to dial in and have the RAS server call back the remote access client at the current location, saving telephone charges. When you configure the server to always call the client back at the same number, you prevent unauthorized users from connecting to the server using different telephone numbers.

Caller ID

RAS can use caller ID to verify that a call from a client is coming from a specified phone number. You configure caller ID as part of the dial-in properties of the user account. If the caller ID number of the incoming connection for that user does not match the configured caller ID, the connection is denied.

Remote Access Account Lockout

The remote access account lockout feature enabled in the registry on the server providing authentication specifies how many failed remote access authentication attempts a user is allowed before the server denies remote access. Remote access account lockout is especially important for VPN connections over the Internet. Malicious Internet users can attempt to access an organization's intranet by repeatedly sending credentials (a valid user name and a guessed password) during the VPN connection authentication process. With remote access account lockout enabled, this type of attack is thwarted after a specified number of failed attempts.

Configuring Routing and Remote Access

The Routing and Remote Access Service is responsible for all remote access functions in Windows 2000 Server. Although RRAS is installed with the operating system by default, you must configure and enable the service before you can perform the more specific tasks described in this chapter.

To configure RRAS as a remote access server, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Routing and Remote Access console.
  2. Right-click the node for your server in the console tree and, from the pop-up menu, choose Configure And Enable Routing And Remote Access to launch the Routing and Remote Access Server Setup Wizard.
  3. Click Next to bypass the Welcome page and proceed to the Common Configurations page.
  4. Select the option to configure an RRAS and click Next to proceed to the Remote Client Protocols page.
  5. Make sure that all of the protocols you want your remote access clients to be able to use appear in the Protocols list. If they do not, select No, I Need To Add Protocols and click Next. If all of the protocols you need are in the list, click Next to proceed to the IP Address Assignment page shown in Figure 18.3.

    Figure 18.3 The IP Address Assignment page of the Routing and Remote Access Server Setup Wizard
  6. If you want the server to assign addresses on its own or by using Dynamic Host Configuration Protocol (DHCP), select Automatically and then click Next to proceed to the Managing Multiple Remote Access Servers page, as shown in Figure 18.4. If you want to specify a range of addresses, select From A Specified Range Of Addresses, and then click Next to proceed to the Address Range Assignment. When completed click Next to proceed to the Managing Multiple Remote Access Servers page.

    Figure 18.4 The Managing Multiple Remote Access Servers page of the Routing and Remote Access Server Setup Wizard
  7. Select No, I Don't Want To Set Up This Server To Use RADIUS Now, and then click Next to proceed to the Completing The Routing And Remote Access Server Setup Wizard page.

    If you want to use RADIUS, select Yes, I Want To Use A RADIUS Server, and then click Next to proceed to the RADIUS Server Selection page.

  8. Click Finish to complete the configuration process.

Managing Remote Access

When managing remote access, you must take into consideration a variety of factors, such as where to store user account data, how to assign addresses to remote access clients, and who is to be permitted to create remote access connections. Remote access management includes managing users, addresses, and access, as described in the following sections.

Managing Users

Rather than maintaining separate user accounts for the same users on separate servers and trying to keep the accounts simultaneously current, most administrators set up a master account database in the Active Directory service or on a Remote Authentication Dial-In User Service (RADIUS) server. This enables the RAS server to send the authentication credentials to a central authenticating device.

Managing Addresses

For PPP connections, IP, IPX, and AppleTalk, addressing information must be allocated to remote access clients during the establishment of the connection. You can configure the Windows 2000 RAS server to allocate IP addresses, IPX network and node addresses, or AppleTalk network and node addresses.

Managing Access

In Windows 2000, an RAS server accepts connections based on the dial-in properties of each user account and the server's remote access policies. A remote access policy is a set of conditions and connection parameters that define the characteristics of the incoming connection and the set of constraints imposed on it. You can use remote access policies to impose connection parameters such as maximum session time, idle disconnect time, required secure authentication methods, and required encryption.

By creating multiple remote access policies, you can apply different sets of conditions to different remote access clients, or you can apply different requirements to the same remote access client based on the parameters of the connection attempt. For example, you can create multiple remote access policies that require clients to meet conditions like the following:

  • Allow or deny connections if the user account belongs to a specific group.
  • Define access times and maximum session times for different user accounts based on group membership.
  • Configure different authentication methods for dial-in and VPN remote access clients.
  • Configure different authentication or encryption settings for Point-to-Point Tunneling Protocol (PPTP) or Layer 2 Tunneling Protocol (L2TP) connections.

When you have multiple Windows 2000 remote access servers or VPN servers on which you want to use a centralized set of remote access policies, you can configure a Windows 2000 computer with the Internet Authentication Service (IAS) and then configure each server as a RADIUS client to the IAS server computer.

Windows 2000 RRAS and Windows 2000 IAS both use remote access policies to determine whether to accept or reject connection attempts. For Windows 2000 RRAS, you administer remote access policies using the Routing and Remote Access snap-in for Microsoft Management Console (MMC). For Windows 2000 IAS servers, you administer remote access policies using the Internet Authentication Service snap-in.

With remote access policies, you can grant remote access by configuring individual user accounts or by creating specific remote access policies, as described in the following sections.

Access by User Account

Each user account on a stand-alone Windows 2000 server or in the Active Directory database contains a set of dial-in properties that an RAS server uses when allowing or denying a connection attempt made by a user. For a stand-alone server, you set the dial-in properties using the Local Users and Groups snap-in by accessing the Dial-In tab of the user account's Properties dialog box. For an Active Directory-based server, you set the dial-in properties using the Active Directory Users and Computers console by accessing the Dial-In tab of the Properties dialog box for the user object, as shown in Figure 18.5.

The Dial-In tab includes the following options:

  • Remote Access Permission (Dial-In Or VPN). You use this property to specify whether remote access should be explicitly allowed, explicitly denied, or determined by remote access policies. If access is explicitly allowed, remote access policy conditions, user account properties, or profile properties can still deny the connection attempt. The Control Access Through Remote Access Policy option is available only on user accounts in a Windows 2000 native-mode domain or for local accounts on stand-alone Windows 2000 computers.
  • Verify Caller ID. If this check box is selected, the server verifies the caller's phone number using caller ID. If the caller's phone number does not match the configured phone number, the connection attempt is denied.
  • Callback Options. If this property is enabled, the server calls the client back during the connection establishment at a telephone number set by the caller or a specific telephone number set by the network administrator.
  • Assign A Static IP Address. If this check box is selected, you can assign a specific IP address to a user when a connection is made.
  • Apply Static Routes. If this check box is selected, you can define a series of static IP routes that are added to the routing table of the remote access server when a connection is made. This setting is designed for user accounts that Windows 2000 routers use for demand-dial routing.
Figure 18.5 The Dial-in tab of an Active Directory user's Properties dialog box
For a user account in a Microsoft Windows NT 4 domain or a Windows 2000 mixed-mode domain, only the Allow Access and Deny Access options in the Remote Access Permission (Dial-In Or VPN) box and the options in the Callback Options box are available.

Access by Policy

The access by policy administrative model is intended for Windows 2000 RAS servers that are either stand-alone servers or members of a Windows 2000 native-mode domain. To manage remote access by policy, in the Dial-In tab of the user's Properties dialog box, select the Control Access Through Remote Access Policy option, and then define the new remote access policies that allow or deny access based on your needs. You create and configure remote access policies either through RRAS or a RADIUS authentication provider. Figure 18.6 shows the Remote Access Policy node in the Routing and Remote Access snap-in.

Figure 18.6 The Remote Access Policies node in the Routing and Remote Access snap-in

The Remote Access Policies node appears in the Routing and Remote Access snap-in when the Authentication Provider field in the Security tab of the server's Properties dialog box is set to Windows Authentication. When the authentication provider is set to RADIUS Authentication, you configure policies from the RADIUS authentication provider interface instead.

To create a remote access policy, use the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Routing and Remote Access console.
  2. Right-click the Remote Access Policies node and, from the pop-up menu, select New Remote Access Policy to display the Add Remote Access Policy Wizard.
  3. Type the name by which the policy will be listed in the Routing and Remote Access snap-in in the Policy Friendly Name text box and click Next to proceed to the Conditions page of the Add Remote Access Policy Wizard shown in Figure 18.7.

    Figure 18.7 The Conditions page of the Add Remote Access Policy Wizard
  4. Click Add to add a condition. The Select Attribute dialog box opens.
  5. Select an entry from the Attribute Types list and click Add.

    A new dialog box opens, containing controls that are specific to the attribute type you selected.

  6. Configure the attribute you selected in its dialog box and click OK.
  7. Repeat Steps 4 through 6 to create additional conditions, if desired. Then, click Next to display the Permissions page of the Add Remote Access Policy Wizard shown in Figure 18.8.

    Figure 18.8 The Permissions page of the Add Remote Access Policy Wizard
  8. Select the appropriate option to specify whether you want to use the policy to grant or deny remote access permission, then click Next to display the User Profile page of the Add Remote Access Wizard.
  9. If desired, click Edit Profile to modify the dial-in profile for the users that match the conditions you specified.
  10. Click Finish to create the remote access policy.

A typical use of policy-based access is to allow access through group membership. For example, you create a Windows 2000 group with a name such as DialUpUsers, whose members are those users who are to be allowed dial-in remote access. You then create a remote access policy that grants dial-in remote access only to members of the DialUpUsers group.

When a user attempts a connection to the server, RAS accepts or rejects the connection attempt based on the following logic (policy evaluation order):

  1. The first policy in the ordered list of remote access policies is checked. If there are no policies, reject the connection attempt.
  2. If all the conditions of the policy do not match the connection attempt, go to the next policy. If there are no more policies, reject the connection attempt.
  3. If all the conditions of the policy match the connection attempt, check the remote access permission setting for the user attempting the connection.
    • If Deny Access is selected, reject the connection attempt.
    • If Allow Access is selected, apply the user account properties and profile properties.
      • If the connection attempt does not match the settings of the user account properties and profile properties, reject the connection attempt.
      • If the connection attempt matches the settings of the user account properties and profile properties, accept the connection attempt.
    • If Control Access Through Remote Access Policy is selected, check the remote access permission setting of the policy.
      • If Deny Remote Access Permission is selected, reject the connection attempt.
      • If Grant Remote Access Permission is selected, apply the user account properties and profile properties.
    • If the connection attempt does not match the settings of the user account properties and profile properties, reject the connection attempt.
    • If the connection attempt matches the settings of the user account properties and profile properties, accept the connection attempt.

Figure 18.9 shows the logic of remote access policies and user account settings.

Figure 18.9 Using remote access policies and user account settings to accept a connection attempt

Exercise 18.1: Configuring RAS Connections

In this exercise, you configure several user accounts to allow dial-in access to your RAS server and then connect to the server using those accounts. This exercise assumes that you have already set up Windows 2000 Server to function as a remote access server by configuring RRAS and equipping the computer with a modem and telephone line. You must also have created the user accounts listed in Exercise 7.1 and Exercise 7.3.

Procedure 1: Allowing and Denying Dial-In Access

To selectively allow or deny remote access to specific user accounts, complete the following steps:

  1. Click Start and, from the Administrative Tools program group, open the Active Directory Users and Computers console.
  2. Click the Users container in the console tree. The objects in the Sales OU appear in the details pane.
  3. Double-click the Mark Lee user object. The Mark Lee Properties dialog box appears.
  4. Click the Dial-In tab. The dial-in settings for Mark Lee appear.
  5. Select Allow Access and then click OK.
  6. Double-click John Kelly in the details pane and then click the Dial-In tab. The dial-in settings for John Kelly appear.
  7. Verify that Control Access Through Remote Access Policy is selected and then click OK.
  8. Double-click Stephanie Hooper in the details pane and then click the Dial-In tab. The dial-in settings for Stephanie Hooper appear.
  9. Select Deny Access and then click OK.
  10. Close the Active Directory Users and Computers console.

Procedure 2: Configuring a Dial-in Client and Accessing the RRAS Server (Optional)

To configure a second computer running Windows 2000 to act as a dial-in client and use it to connect to your server, complete the following steps. The computer must be equipped with a modem and its own telephone line to perform this procedure.

  1. Before starting the computer, disconnect its network cable.
  2. Start the computer.
  3. Log on to the local machine as Administrator.
  4. Click Start and, from the Settings group, select Network And Dial-Up Connections to display the Network And Dial-Up Connections window. Why does the Local Area Connection icon contain a red "X?"
  5. Double-click Make New Connection to activate the Network Connection Wizard.
  6. Click Next to proceed to the Network Connection Type page.
  7. Verify that Dial-In To Private Network is selected and then click Next to display the Phone Number To Dial page.
  8. Type the telephone number that the RRAS server modem is connected to in the Phone Number text box.
  9. Click Next to display the Connection Availability page.
  10. Click Next to accept the default setting, For All Users and to display the Internet Connection Sharing page.
  11. Click Next to display the Completing The Network Connection Wizard page.
  12. Type Test Connection and click Finish. The Connect Test Connection dialog box appears.
  13. In the User Name text box, type shooper and click Dial. What happens? Why?
  14. In the User Name text box, type mlee and then click Dial. What happens? Why?
  15. Select the Do Not Display The Message Again check box and then click OK.
  16. In the Network And Dial-Up Connection window, double-click Dial-Up Connection to display the Dial-Up Connection Status dialog box.
  17. Click Disconnect.
  18. Double-click Dial-In Connection.
  19. In the User Name text box, type jkelly and then click Dial. What happens? Why?
  20. On your RAS server, open the Routing and Remote Access console.
  21. Click the Remote Access Policies node in the console tree.
  22. In the details pane, double-click the Allow Access If Dial-In Permission Is Enabled policy to display the Allow Access If Dial-In Permission Is Enabled Properties dialog box.
  23. In the If A User Matches The Conditions box, select Grant Remote Access Permission and then click OK.
  24. On your dial-in client computer, in the User Name text box, click Dial to attempt another logon as jkelly. What happens? Why?
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. How does the RAS callback feature provide additional security?
  2. What are the four authentication protocols supported by Windows 2000 RAS?
  3. Which of the following is the primary protocol that Windows 2000 RAS uses for its WAN connections?
    1. SLIP
    2. PPP
    3. Asynchronous NetBEUI
    4. VPN

Lesson Summary

  • Windows 2000 remote access provides two different types of remote access connectivity: dial-in remote access and virtual private network (VPN) remote access.
  • A dial-in remote access connection consists of a remote access client, a remote access server, and a wide area network (WAN) infrastructure.
  • Remote access protocols, such as Point-to-Point Protocol (PPP), control the connection establishment and transmission of data over WAN links.
  • Windows 2000 remote access supports the following local area network (LAN) protocols: Transmission Control Protocol/Internet Protocol (TCP/IP), Internetwork Packet Exchange (IPX), AppleTalk, and NetBIOS Enhanced User Interface (NetBEUI).
  • Windows 2000 remote access offers a wide range of security features, including secure user authentication, mutual authentication, data encryption, callback, caller ID, and remote access account lockout.


Lesson 2: Using Virtual Private Networks

A VPN is a connection between two computers across an internetwork or the Internet that enables them to communicate in a manner that mimics the properties of a dedicated private network. In most cases, a VPN is functionally similar to a WAN technology, except that the Internet functions as the network medium. In this lesson, you will learn about VPNs in a routed environment and with the Internet.

After this lesson, you will be able to

  • Understand the concepts behind virtual private networking
  • Describe the functions of a tunneling protocol
  • Configure a VPN server
  • Configure a VPN client

Estimated lesson time: 30 minutes

Implementing a VPN

Virtual private networking was developed as a means to provide users with a relatively low-cost method for connecting to a network at a remote location, as shown in Figure 18.10. VPNs enable users working at home or on the road to connect securely to a remote corporate server using the routing infrastructure provided by a public internetwork such as the Internet. From the user's perspective, the VPN is a point-to-point connection between the user's computer and a corporate server. The nature of the intermediate internetwork (also called the transit internetwork) is irrelevant because it appears as if the data is being sent over a dedicated private link.

Figure 18.10 Virtual private networking

The traditional method of connecting to their office networks used by employees traveling in a distant city is dialing into an RAS server using a standard modem connection. However, this practice can result in considerable long distance telephone charges. A VPN enables both the client and server computers to connect to the Internet using a local Internet service provider (ISP), keeping the telephone charges to a minimum. The client then establishes a connection to the server across the Internet, and the server provides routed access to the corporate network. The connection across the transit internetwork appears to the user as a virtual network interface providing private network communication over a public internetwork, hence the term virtual private network.

The problem with using the Internet for private network communications in this manner is, of course, security. For the client and server to exchange confidential information over a public internetwork like the Internet, a mechanism for securing the data is needed. The method used by VPNs is called tunneling.

Tunneling Basics

Tunneling, also known as encapsulation, is a method of using an internetwork infrastructure to transfer a payload (see Figure 18.11). The payload may be the frames (or packets) generated by another protocol, such as PPP or even a LAN protocol, such as Ethernet. Instead of transmitting the frame as produced by the originating node, the frame is encapsulated with an additional header generated by a tunneling protocol. The additional header provides routing information so that the encapsulated payload can traverse the intermediate internetwork. The encapsulated packets are then routed between the tunnel endpoints over the transit internetwork. Once the encapsulated frames reach their destination on the transit internetwork, the frame is de-encapsulated and forwarded to its final destination.

Figure 18.11 A VPN tunnel

This entire process (the encapsulation and transmission of packets) is known as tunneling. The logical path by which the encapsulated packets travel through the transit internetwork is called a tunnel. The name is derived from the way that the tunneling protocol creates a secure conduit (or tunnel) between two points on the transit internetwork. The original frame produced by the sending computer passes through the tunnel without being accessed or modified in any way, so that the information inside remains intact. The tunneling protocol also encrypts the original frame. Therefore, even if someone intercepts the packets as they pass over the Internet, that person cannot read the information inside.

Tunnel Maintenance and Data Transfer

Tunneling protocols are responsible for two primary functions in a VPN: tunnel maintenance, which is the process of creating and managing the tunnel through the transit internetwork, and data transfer, which is the transmission of encapsulated data through the tunnel. The collective functionality of a tunnel maintenance protocol and a tunnel data transfer protocol is known as a tunneling protocol. For a tunnel to be established, both the tunnel client and the tunnel server must be using the same tunneling protocol. The two most popular tunneling protocols used in VPNs are PPTP and L2TP, which are discussed in more detail later in this lesson.

A tunnel maintenance protocol is the mechanism that VPN computers use to manage the tunnel. For some tunneling protocols, such as PPTP and L2TP, a tunnel is similar to a session: Both endpoints of the tunnel must agree to the tunnel and be aware of its presence. However, unlike a session, a tunnel does not guarantee reliable data delivery. Data transferred through the tunnel is typically sent by a datagram-based protocol such as the User Datagram Protocol (UDP) when L2TP is used, and a modified Generic Routing Encapsulation (GRE) protocol with PPTP. In some cases, the tunneling protocols use a separate protocol, such as the Transmission Control Protocol (TCP), for tunnel management.

Before they transfer any application data, a VPN client and server must create a tunnel. This process is initiated by the tunnel client, and the tunnel server at the other end receives the connection request. To create the tunnel, the two computers perform a connection establishment process similar to that used for a PPP connection. The tunnel server requests that the tunnel client authenticate itself. Once validated by the tunnel server, the connection is granted and the tunnel formed; data transfer across the tunnel can then begin.

A tunnel data transfer protocol encapsulates the data to be transferred through the tunnel. When the VPN client sends a payload to the server, the client adds a tunnel data transfer protocol header to the payload. The resulting encapsulated payload is transmitted across the transit internetwork and routed to the server. The server at the other end of the tunnel accepts the packets, removes the tunnel data transfer protocol header, and then forwards the payload to the appropriate destination on the private network. Information sent by the server to the VPN client behaves similarly.

For some tunneling technologies, such PPTP and L2TP, once the tunnel has been created, it must be maintained. Both ends of the tunnel must be aware of the status of the other end in case of a connection fault. Tunnel maintenance is typically performed through a keep-alive process that periodically polls the other end of the tunnel when no data is being transferred. Certain tunneling technologies also allow either end of the tunnel to gracefully terminate the tunnel through an exchange of tunnel termination messages.

Tunneling Protocols

The most popular tunneling protocols used to create VPNs are PPTP, L2TP, the IPsec, and IP-in-IP (IP-IP), as described in the following sections.

Point-to-Point Tunneling Protocol

PPTP is an extension of PPP that encapsulates PPP frames into IP datagrams for transmission over an IP internetwork such as the Internet. PPTP can also be used in private LAN-to-LAN networking. PPTP uses a TCP connection for tunnel maintenance and modified GRE-encapsulated PPP frames for tunneled data. The payloads of the encapsulated PPP frames can be encrypted and compressed.

PPTP tunnels must be authenticated using the same authentication mechanisms as PPP connections (Password Authentication Protocol [PAP], MS-CHAP, CHAP, or EAP). PPTP also inherits encryption and compression of PPP payloads from PPP. In Windows 2000, PPP encryption can be used only when the authentication protocol is EAP-TLS or MS-CHAP. PPP encryption provides confidentiality between the endpoints of the tunnel only. If stronger security or end-to-end security is needed, IPsec is the preferred tunneling protocol. Figure 18.12 shows a fully constructed PPTP packet, with the original application data encrypted and encapsulated by PPP, and then the PPP frame encapsulated in turn by the GRE and IP headers. The IP datagram is then packaged for transmission over the transit internetwork, inside another data-link layer frame.

Figure 18.12 PPTP packet showing the encrypted data being sent, including header and trailer information

Layer 2 Tunneling Protocol

L2TP is a combination of PPTP and Layer 2 Forwarding (L2F), a technology proposed by Cisco Corporation. L2TP is a hybrid of the best features of PPTP and L2F.

L2TP is a network protocol that encapsulates PPP frames to be sent over IP, X.25, frame relay, or Asynchronous Transfer Mode (ATM) networks. When utilizing IP as its datagram transport, L2TP can function as a tunneling protocol over the Internet, or it can be used in private LAN-to-LAN networking.

L2TP uses UDP and a series of L2TP messages for tunnel maintenance. L2TP also uses UDP to send L2TP-encapsulated PPP frames as the tunneled data. The payloads of encapsulated PPP frames can be both encrypted and compressed. Windows 2000 uses IPsec to encrypt the data inside L2TP packets instead of PPP encryption. However, it is possible for other implementations of L2TP to use PPP encryption. Figure 18.13 shows an L2TP packet prepared to be sent using IPsec authentication and encryption settings over a point-to-point WAN connection, such as a dial-in line. The processing steps are shown in the figure.

Figure 18.13 L2TP packet showing encrypted data with IPsec authentication, an additional IP header, and data-link header and trailer information

Steps 1 through 4 show normal processing prior to IPsec encapsulation. The application information becomes the payload of a PPP frame, which is then encapsulated by L2TP and UDP. Steps 5 through 7 show the IPsec processing, in which the entire UDP datagram is encapsulated and encrypted by IPsec's Encapsulating Security Payload (ESP) protocol. The remaining steps (8 through 10) show the normal encapsulation of the IPsec information in an IP datagram and a data-link layer frame, both of which are necessary to send the packet on the network to its final destination.

L2TP is similar to PPTP in function. An L2TP tunnel is created between the L2TP client and an L2TP server. The client may already be attached to an IP internetwork (such as a LAN) that can reach the tunnel server, or a client may have to dial into an ISP to establish IP connectivity (for dial-in Internet users).

Creation of L2TP tunnels must be authenticated using the same authentication mechanisms as PPP connections (PAP, MS-CHAP, CHAP, and EAP). L2TP inherits PPP compression but not encryption, because PPP encryption does not meet the security requirements of L2TP. PPP encryption could provide confidentiality but would not provide per packet authentication, integrity, or replay protection. Data encryption is provided by IPsec.

PPTP versus L2TP

Both PPTP and L2TP use PPP for point-to-point WAN connections to provide an initial envelope for the data, and then to append additional headers for transport through the transit internetwork. However, there are some differences between PPTP and L2TP, as follows:

  • PPTP requires that the transit internetwork use IP. L2TP requires only that the tunnel medium provide packet-oriented point-to-point connectivity. L2TP can run over IP (using UDP), frame relay permanent virtual circuits, X.25 virtual circuits, or ATM virtual circuits.
  • L2TP provides header compression capability. When header compression is enabled, L2TP operates with 4 bytes of overhead, compared to 6 bytes for PPTP.
  • L2TP also provides tunnel authentication, whereas PPTP does not. However, when either PPTP or L2TP is run over IPsec, it provides tunnel authentication, making Layer 2 tunnel authentication unnecessary.
  • PPTP uses PPP encryption and L2TP does not. Windows 2000's L2TP implementation requires IPsec for encryption.

IPsec

IPsec, a Layer 3 tunneling protocol, is a series of standards that support the secured transfer of information across an IP internetwork. The IPsec ESP protocol, when running in Tunnel mode, supports the encapsulation and encryption of entire IP datagrams for secure transfer across a private or public IP internetwork. With IPsec in Tunnel mode, a complete IP datagram is encapsulated and encrypted with ESP. The result is then encapsulated-using a plaintext IP header-and transmitted over the transit internetwork.

On receipt of the encrypted datagram, the tunnel server processes and discards the plaintext IP header and authenticates and decrypts the ESP and IP packet. The IP packet is then processed normally, which might include routing the packet to its final destination.

IP-IP

IP-in-IP, or IP-IP, is a simple Open Systems Interconnection (OSI) Layer 3 (network layer) tunneling technique. IP-IP creates a virtual network by encapsulating an IP packet with an additional IP header. The primary use of IP-IP is for tunneling multicast traffic over sections of a network that do not support multicast routing. The IP-IP packet structure consists of the outer IP header, the tunnel header, the inner IP header, and the IP payload.

The IP payload includes everything normally included in an IP datagram. This could be a TCP, UDP, or Internet Control Message Protocol (ICMP) header, plus application layer data. A limited form of tunnel maintenance is achieved using standard ICMP messages, which enable the tunnel to do tunnel maximum transmission unit (MTU) discovery and detect congestion and routing failures.

Integrating a VPN in a Routed Environment

In some corporate internetworks, the data of a particular department (such as the accounting or human resources department) is so sensitive that the department's LAN is physically disconnected from the rest of the corporate internetwork. Although this protects the department's data, it creates information accessibility problems for users that are not physically connected to that LAN.

VPNs enable the department's LAN to be physically connected to the corporate internetwork, but separated by a VPN server. Note that the VPN server is not acting as a router between the corporate internetwork and the department LAN. Users on the corporate internetwork having the appropriate credentials (based on a need-to-know policy within the company) can establish a VPN with the VPN server and gain access to the protected resources of the department. Additionally, all communication across the VPN can be encrypted for data confidentiality. For those users without proper credentials, the department LAN is essentially hidden from view.

Integrating VPN Servers with the Internet

Rather than having a remote user make a long distance call to a corporate or outsourced RAS server, the user calls his or her local ISP. Using the connection to the ISP, a VPN is created between the dial-in user and the corporate VPN server across the Internet (see Figure 18.14).

Figure 18.14 Remote access over the Internet

To connect a network over the Internet (see Figure 18.15), you have two options:

  • Branch office using dedicated lines. Rather than using conventional methods such as frame relay, both the branch office and the corporate hub routers are connected to the Internet using a local dedicated circuit and local ISP. Utilizing the local ISP connections, a VPN is created between the branch office router and corporate hub router across the Internet.
  • Branch office using a dial-in line. Rather than having a router at the branch office make a long distance call to an RAS server, the router at the branch office calls its local ISP. From the connection to the local ISP, a VPN is created between the branch office router and the corporate hub router across the Internet.
Figure 18.15 A VPN over the Internet

For VPN connections to be reliably available, the corporate hub router acting as a VPN server must be connected to a local ISP using a dedicated line. The VPN server must be listening 24 hours a day for incoming VPN traffic. Although this is possible with a dial-in connection, it is less reliable because dynamically assigned IP addresses are commonly used and the connection may not be persistent.

Managing Virtual Private Networking

In Lesson 1, you learned how to manage Windows 2000 remote access. In many ways, the management of VPNs is similar to managing remote access. Virtual private networking must be managed just like any other network resource, and VPN security issues must be managed carefully, particularly with Internet VPN connections.

Managing Users

Because it is not practical to have separate user accounts on separate servers for the same user, most administrators set up a master account database at a domain controller or on a RADIUS server. This enables the VPN server to send the authentication credentials to a central authenticating device. The same user account is thus used for both dial-in remote access and VPN-based remote access.

Managing Addresses and Name Servers

The VPN server must have IP addresses available to assign them to the VPN server's virtual interface and to VPN clients during the IP Control Protocol (IPCP) negotiation phase of the connection process. By default, the IP addresses assigned to VPN clients by Windows 2000-based VPN servers are obtained through DHCP. You can also configure a static IP address pool for address assignments. You must also configure the VPN server with the addresses of name resolution servers, such as Domain Name System (DNS) and Windows Internet Naming Service (WINS) server addresses, to assign to the VPN client during IPCP negotiation.

Managing Access

In Windows 2000, you configure the dial-in properties on user accounts and remote access policies to manage access for both dial-in networking and VPN connections. If you are managing remote access on a user basis, in the Dial-In tab of the user's Properties dialog box for those user accounts that are allowed to create VPN connections, select the Allow Access option.

If you are managing remote access on a group basis, select the Control Access Through Remote Access Policy option on all user accounts. Create a Windows 2000 group with members who are allowed to create VPN connections. If the VPN server allows only VPN connections, delete the default Allow Access If Dial-In Permission Is Enabled remote access policy and create a new policy with a descriptive name such as VPN Access If Member Of VPN-Allowed Group. Then, assign the Windows 2000 group to the policy. If the VPN server also allows dial-in networking remote access services, do not delete the default policy; instead move it so that it is the last policy to be evaluated.

Exercise 18.2: Creating a VPN Connection

In this exercise, you configure RRAS to function as a VPN server, and then configure a VPN client. Finally, you use the client to connect to the VPN server, establishing a secure connection on your local network.

Procedure 1: Configuring and Enabling an RRAS VPN Server

To configure RRAS to function as a VPN server, complete the following steps:

  1. Click Start and, from the Administrative Tools program group, open the Routing and Remote Access console.
  2. Right-click the node for your server in the console tree and, from the pop-up menu, choose Configure And Enable Routing And Remote Access to launch the Routing and Remote Access Server Setup Wizard.
  3. Click Next to bypass the Welcome page and proceed to the Common Configurations page.
  4. Select Virtual Private Network (VPN) Server and click Next to proceed to the Remote Client Protocols page.
  5. Make sure that TCP/IP appears in the Protocols list and that the Yes, All Of The Available Protocols Are On This List option is selected. Then, click Next to proceed to the Internet Connection page.
  6. In the Internet Connections list, select <No Internet Connection> and click Next to proceed to the IP Address Assignment page.
  7. Make sure the Automatically option is selected, and click Next to proceed to the Managing Multiple Remote Access Servers page.
  8. Make sure the No, I Don't Want To Set Up This Server To Use RADIUS Now option is selected and click Next to proceed to the Completing The Routing And Remote Access Server Setup Wizard page.
  9. Click Finish. A Routing And Remote Access message box appears, warning you of the need to configure a DHCP Relay Agent to support the relaying of DHCP messages from remote access clients.
  10. Click OK to complete the configuration, close the wizard, and start the RRAS service.

Procedure 2: Configuring a VPN Client

To configure a Windows 2000 workstation to function as a VPN client, complete the following steps. This procedure requires a second computer running Windows 2000 on the same network you configured as the VPN server in Procedure 1.

  1. Click Start and, from the Settings group, select Network And Dial-Up Connections to open the Network And Dial-Up Connections window.
  2. Double-click the Make New Connection icon to launch the Network Connection Wizard.
  3. Click Next to bypass the Welcome page and proceed to the Destination Address page.

    If you have a dial-in connection already configured on the workstation, the wizard displays a Public Network page, on which you can select the connection for the computer to dial before establishing the VPN connection. You do this when your client is connecting through the Internet, but it is not necessary for a local VPN connection, as in this procedure.

  4. Type the IP address of your VPN server in the Host Name Or IP Address text box and click Next to proceed to the Connection Availability page.

    If the Connection Availability page does not appear, proceed to Step 6.

  5. Make sure the For All Users option is selected and click Next to proceed to the Internet Connection Sharing page.

    By selecting the Only For Myself option in the Connection Availability page, you store the connection in your user profile, which prevents other users from accessing it.

  6. Click Next to proceed to the Completing The Network Connection Wizard page.
  7. Type VPN Connection and click Finish to create the connection. The Connect VPN Connection page appears. Click Cancel.

Procedure 3: Establishing a VPN Connection

To use the VPN client you just configured to connect to your VPN server on the local network, complete the following steps. This procedure requires you to have configured the user accounts as described in Exercise 18.1 earlier in this chapter.

  1. Click Start and, from the Settings group, select Network And Dial-Up Connections to open the Network and Dial-Up Connections window.
  2. Double-click the VPN Connection icon to display the Connect VPN Connection dialog box.
  3. Type shooper in the User Name text box and click Connect. What happens? Why?
  4. Click Cancel to abort the connection attempt.
  5. Double-click the VPN Connection icon to display the Connect VPN Connection dialog box.
  6. Type mlee in the User Name text box and click Connect. What happens? Why?
  7. Return to the computer running the RRAS service and in the Routing and Remote Access console, from the Action menu, select Refresh.
  8. Expand the Remote Access Clients node in the console tree. What do you see?
  9. In the Remote Access Clients list, double-click the mlee entry to display a Status dialog box. Notice that the statistics for the connection are displayed, including the number of bytes and frames transmitted and received by the server.
  10. Click Disconnect to close the VPN connection.
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. How is the Deny Access remote access permission (in mixed mode or native mode) similar in function to the native-mode domain default remote access policy?
  2. List the four tunneling protocols that VPNs can use.
  3. How does virtual private networking reduce the cost of supporting remote access clients?

Lesson Summary

  • A virtual private network (VPN) mimics the properties of a dedicated private network, allowing data to be transferred between two computers across an internetwork, such as the Internet.
  • Branch offices can use two different methods to connect to a network over the Internet: dedicated lines or dial-in lines.
  • VPNs use tunneling to transfer data. A tunneling protocol is made up of a tunnel maintenance protocol and a tunnel data transfer protocol.
  • You can also use VPNs to provide secured communication between computers on a local network.
  • The primary protocols used by Windows 2000 for VPN access are Point-to-Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP), Internet Protocol Security (IPsec), and IP-in-IP (IP-IP).


Lesson 3: Using NAT and ICS

Network address translation (NAT) enables private IP addresses to be translated into public IP addresses for traffic to and from the Internet. This keeps Internet traffic from passing directly to the internal network, while saving the small office or home office (SOHO) user the time and expense of obtaining and maintaining a public address range. Internet Connection Sharing (ICS) is a Windows 2000 feature that uses NAT to share a single Internet connection among all of the computers on a SOHO network.

ICS and NAT are features of Windows 2000 Server that are designed to connect SOHO networks to the Internet. ICS and NAT are not designed to do the following:

  • Directly connect separate private networks together
  • Connect networks within an intranet
  • Directly connect branch office networks to a corporate network
  • Connect branch office networks to a corporate network over the Internet

This lesson provides an overview of NAT and describes how to install ICS in Windows 2000.

After this lesson, you will be able to

  • Understand the functions of NAT and ICS
  • Describe how NAT works
  • Configure RRAS to use NAT
  • Enable the ICS feature of Windows 2000

Estimated lesson time: 40 minutes

Network Address Translation

Windows 2000 NAT enables computers on a small network, such as a SOHO, to share a single Internet connection with only a single public IP address. The computer on which NAT is installed can act as a network address translator, a simplified DHCP server, a DNS proxy, and a WINS proxy. By enabling host computers to share one or more publicly registered IP addresses, NAT helps conserve the public address space and prevents intrusion onto the private network by unauthorized Internet users.

Understanding Network Address Translation

NAT consists of the following components:

  • Translation component. The Windows 2000 router on which NAT is enabled, hereafter called the NAT computer, acts as a network address translator, translating the IP addresses and TCP/UDP port numbers of packets that are forwarded between the private network and the Internet.
  • Addressing component. The NAT computer provides IP address configuration information to the other computers on the home network. The addressing component is a simplified DHCP server that allocates an IP address, a subnet mask, a default gateway, and the IP address of a DNS server. You must configure computers on the home network as DHCP clients to receive the IP configuration automatically. The default TCP/IP configuration for computers running Windows 2000, Windows NT, Microsoft Windows 95, and Microsoft Windows 98 is as a DHCP client.
  • Name resolution component. The NAT computer becomes the DNS server for the other computers on the home network. When the NAT computer receives name resolution requests, it forwards them to the Internet-based DNS server that it is configured to use and returns the responses to the home network computer.

Routed and Translated Internet Connections

There are two types of connections to the Internet: routed and translated. When planning for a routed connection, you need a range of registered IP addresses from your ISP to use on the internal portion of your network. The ISP also supplies the address of DNS servers that your computers can use. You can either statically configure the IP address configuration on each computer or use a DHCP server to allocate the addresses automatically.

Once you have configured your network computers with registered IP addresses, you must have a router on your network for the computers to access the Internet. The router can be a dedicated device or a computer running Windows 2000 with two network interfaces, such as a network interface adapter for the internal network (10Base-T or 100Base-T Ethernet, for example) and an analog or ISDN modem, Digital Subscriber Line (DSL) or cable network connection, or a T-1 or other leased line. Once the router is functioning, the computers on your network become part of the Internet. Your users can access any Internet services they need, but more important, other users on the Internet can access the computers on your network.

The translated method, or NAT, also requires a router, but gives you a more secure network because the computers on your network use IP addresses from a range reserved for private network use. These addresses are completely hidden from the Internet, so outside users cannot access them. The computer that is sharing its Internet connection with the network, which uses NAT, does all of the Internet address translation needed to make it appear to the users of your private network that they are part of the Internet.

However, NAT does not have the ability to translate all payloads because some applications use IP addresses in other fields besides the standard TCP/IP header fields. For example, Kerberos and IPsec do not work with NAT, although all standard Internet applications, such as Web browsers and e-mail clients, do.

To keep resource costs to a minimum on a small network, only one server running Windows 2000 is needed. Depending on whether you are running a translated or routed connection, this single server can suffice for NAT, Automatic Private IP Addressing (APIPA), RAS, and DHCP.

How NAT Works

In Lesson 1 of Chapter 13, "TCP/IP Administration," you learned about the two types of IP addresses that you can use on your network: public (or registered) addresses and private addresses. If your intranet is not connected to the Internet, you can use any addresses you want, public or private, as long as every computer on your network has a unique address. Once your network is connected to the Internet, you must either use private addresses or public addresses that are registered to your organization. The entire purpose of NAT is to enable networks to use private addresses and still participate on the Internet. Any computer that has a private IP address is invisible to the Internet. It is only through an intervening service such as NAT that private network computers can access Internet servers and receive replies from them.

A network address translator is an IP router that can translate the IP addresses and TCP/UDP port numbers of packets as they are being forwarded. When a client application such as a Web browser running on a private network computer generates an Internet service request, it sends the resulting message packets to the router on the network providing access to the Internet. The client computer has a private IP address, which is reflected in the packet header fields. The router, because it is directly connected to the Internet, must have a registered IP address. On a simple routed network, the router forwards the packets to the server on the Internet to which they are addressed. The server can receive the requests and process them, but it cannot return replies directly to the client, because its IP address is private and, by definition, unreachable from the Internet.

On a translated network (see Figure 18.16), the router still has a registered IP address, but it is also running a NAT service. On receiving the requests from the client, the NAT service modifies the packet header fields by substituting its own registered IP address for the client's private address. The router then forwards the packets to the Internet server in the normal manner. The server processes the requests that seem to have originated from the router address and returns its replies to that address. The router then performs the same translation in reverse, substituting the client's private address for its own registered address, and transmits the reply packets to the client.

Figure 18.16 Using NAT to transparently connect an intranet to the Internet

To the client, it appears as though it is communicating directly with the Internet server. To the server, it appears as though it is communicating directly with a client using a registered address. To other users on the Internet, only the router appears to exist. The actual client is totally hidden and protected from unauthorized access.

Consider a small business network with multiple computers connecting to the Internet. A small business would normally have to obtain an ISP-allocated public IP address for each computer on its network. With NAT, however, the small business can use private addresses and have the NAT map the private addresses to a single public IP address allocated by its ISP. For example, if a small business is using the 192.168.0.0 private network for its intranet and has been granted the public IP address of 198.200.200.1 by its ISP, the NAT server can map all of the private IP addresses on network 192.168.0.0 to the public IP address 198.200.200.1.

Static and Dynamic Address Mapping

NAT can use either static or dynamic mapping. A static mapping is configured so that traffic is always mapped a specific way. You could map all traffic to and from a specific private network location to a specific Internet location. For instance, to set up a Web server on a computer on your private network, you create a static mapping that always maps the private IP address of the Web server to a particular public IP address, so that Internet users can always access the server at the same address.

Dynamic mappings are created when users on the private network initiate traffic with Internet locations, such as when a Web browser connects to a server on the Internet. The NAT service automatically adds these mappings to its mapping table and refreshes them with each use, so that it can successfully forward the replies from the server to the client. Dynamic mappings that are not refreshed are removed from the NAT mapping table after a specified amount of time. For TCP connections, the default time-out is 24 hours. For UDP traffic, the default time-out is 1 minute.

Proper Translation of Header Fields

By default, a NAT server translates IP addresses and TCP/UDP ports. These modifications to the IP datagram require the modification and recalculation of the following fields in the IP, TCP, and UDP headers:

  • Source IP address
  • TCP, UDP, and IP checksum
  • Source port

If the IP address and port information is only found in the IP and TCP/UDP headers, as it is with Hypertext Transfer Protocol (HTTP) or World Wide Web traffic, for example, NAT can translate the application protocol transparently. There are applications and protocols, however, that carry IP or port addressing information in places other than their headers. File Transfer Protocol (FTP), for example, stores IP addresses in the FTP header for the FTP port command. If the NAT server does not properly translate the IP address, connectivity problems can occur. Additionally, in the case of FTP, because the IP address is stored in dotted-decimal format, the number of digits in the FTP header's translated IP address is not predictable. The NAT server must be able to compensate.

NAT Editors

When the NAT server must translate and adjust the payload beyond the IP, TCP, and UDP headers, a NAT editor is required. A NAT editor is an installable component, transparent to end users, that can properly modify otherwise nontranslatable payloads so that they can be forwarded across a NAT. Windows 2000 includes built-in NAT editors for the following protocols:

  • FTP
  • ICMP
  • PPTP
  • NetBIOS over TCP/IP

Additionally, the NAT routing protocol includes proxy software for the following protocols:

  • H.323
  • Direct Play
  • Lightweight Directory Access Protocol (LDAP)-based Internet Locator Service (ILS) registration
  • Remote procedure call (RPC)

Implementing NAT

To implement NAT on a Windows 2000 server, you add NAT as a routing protocol in the Routing and Remote Access snap-in, a process that is simplified by the use of the Routing and Remote Access Server Setup Wizard. On a Windows 2000 server where RRAS is not yet configured and enabled, you can implement NAT for a dial-in connection to the Internet using the following procedure:

  1. Click Start and, from the Administrative Tools program group, open the Routing and Remote Access console.
  2. Right-click the node for your server in the console tree and, from the pop-up menu, choose Configure And Enable Routing And Remote Access to launch the Routing and Remote Access Server Setup Wizard.
  3. Click Next to bypass the Welcome page and proceed to the Common Configurations page.
  4. Select Internet Connection Server and then click Next to proceed to the Internet Connection Server Setup page.
  5. Select Set Up A Router With The Network Address Translation (NAT) Routing Protocol and then click Next to proceed to the Internet Connection page, as shown in Figure 18.17.

    Figure 18.17 The Internet Connection page of the Routing and Remote Access Server Setup Wizard
  6. Select Create A New Demand-Dial Internet Connection and then click Next to proceed to the Applying Changes page.

    If you plan to use dial-in connection to the Internet, select Create A New Demand-Dial Internet Connection. A demand-dial connection is one in which any attempt to access the Internet by a client on the network causes the server to dial in to the ISP and connect to the Internet. If your connection to the Internet is a permanent connection that appears in Windows 2000 as a LAN interface, such as a DSL or cable modem connection, select Use The Selected Internet Connection and select the network interface providing Internet access in the Internet Connection list.

  7. Click Next to launch the Demand Dial Interface Wizard.

    The Applying Changes page informs you that the Routing and Remote Access Server Setup Wizard is saving your settings and launching the new wizard to create a demand dial connection.

  8. Click Next to bypass the Welcome To The Demand Dial Interface Wizard page and proceed to the Interface Name page shown in Figure 18.18.

    Figure 18.18 The Interface Name page of the Demand Dial Interface Wizard
  9. Type a name for the new connection in the Interface Name text box and click Next to proceed to the Connection Type page.
  10. Select Connect Using A Modem, ISDN Adapter, Or Other Physical Device and then click Next to proceed to the Select A Device page shown in Figure 18.19.

    Figure 18.19 The Select A Device page of the Demand Dial Interface Wizard
  11. Select the modem or other installed device you want the computer to use to connect to the Internet and click Next to proceed to the Phone Number page.
  12. Type the number that you want the modem to dial in the Phone Number Or Address text box and click Next to proceed to the Protocols And Security page shown in Figure 18.20.

    Figure 18.20 The Protocols And Security page of the Demand Dial Interface Wizard
  13. Click Next to accept the default settings and proceed to the Dial Out Credentials page shown in Figure 18.21.

    Figure 18.21 The Dial Out Credentials page of the Demand Dial Interface Wizard
  14. Type the user name, domain name (if necessary), and password needed to connect to the ISP's server. Then click Next to proceed to the Completing The Demand Dial Interface Wizard page.
  15. Click Finish. The Demand Dial Interface Wizard closes and the Completing The Routing And Remote Access Server Setup Wizard page appears.
  16. Click Finish.

Internet Connection Sharing

ICS is a simplified implementation of NAT that you can use to easily connect your entire network to the Internet. ICS does not provide a configuration that is as customizable as installing NAT using RRAS, but the setup process is extremely simple and provides all the required features to connect a small network to the Internet using a dial-in connection. Because ICS provides a translated connection, all of the computers on the network can access Internet resources such as e-mail, Web sites, and FTP sites. ICS uses the following parameters when configuring the NAT server:

  • Single public IP address
  • Fixed address range for hosts
  • DNS proxy for name resolution
  • Automatic IP addressing

By enabling ICS on a network computer equipped with a dial-in connection to the Internet, you are providing NAT, addressing, and name resolution services for all computers on your network. After ICS is enabled and users verify their networking and Internet options, they can access the Internet using applications such as Microsoft Internet Explorer and Microsoft Outlook Express as if they were directly connected to the ISP. The ICS computer dials the ISP and creates the connection so that the user can reach the specified Web address or resource.

Before you enable ICS, consider the following:

  • You should not use ICS on a network with other Windows 2000 Server domain controllers, DNS servers, gateways, DHCP servers, or systems configured for static IP. These services can conflict with those provided by ICS, causing client configuration problems.
  • When you enable ICS, the network interface adapter connected to the private network is given a new IP address configuration. Existing TCP/IP connections on the ICS computer are lost and need to be reestablished.
  • To use the ICS feature, you must configure the computers on the private network to use the TCP/IP protocols and to obtain their TCP/IP settings from a DHCP server.
  • If the ICS computer is using a modem or ISDN to connect to the Internet, in the Sharing tab of the connection's Properties dialog box, you must select the Enable On-Demand Dialing check box.

To enable ICS for a dial-in Internet connection, use the following procedure:

  1. Click Start and, from the Settings group, select Network And Dial-In Connections.
  2. Right-click the dial-in connection you want to share and, from the pop-up menu, choose Properties to display the Properties dialog box.
  3. Click the Sharing tab, shown in Figure 18.22.
  4. Select the Enable Internet Connection Sharing For This Connection check box.
  5. If you want this connection to dial automatically when another computer on your home network attempts to access external resources, select the Enable On-Demand Dialing check box.
  6. Click OK to close the Properties dialog box.
Figure 18.22 The Sharing tab of a dial-in connection's Properties dialog box

Internet Connection Sharing and NAT

In Windows 2000 Server, you can configure a translated connection to the Internet by using either the ICS feature of Network and Dial-In Connections or the NAT routing protocol provided with RAS. Both ICS and NAT provide translation, addressing, and name resolution services to SOHO hosts.

As described in the previous section, ICS is designed to provide a translated connection to the Internet for all of the hosts on the network with a single configuration step (a single check box) on the computer running Windows 2000. However, once enabled, ICS does not permit further configuration beyond that of applications and services. For example, ICS is designed for a single IP address obtained from an ISP and does not allow you to change the range of IP addresses allocated to hosts.

The NAT routing protocol, by contrast, is designed to provide maximum flexibility in the configuration of the translated connection to the Internet. NAT requires additional configuration steps; however, each step of the configuration is customizable. NAT allows for ranges of IP addresses from the ISP and the configuration of the range of IP addresses allocated to hosts.

Table 18.1 summarizes the features and capabilities of ICS and NAT.

Table 18.1 ICS and NAT Features

ICS | NAT
Single check box configuration | Manual configuration
Single public IP address | Multiple public IP addresses
Fixed address range for internal hosts | Configurable address range for internal hosts
Single internal interface | Multiple internal interfaces

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Why is a translated network more secure than a routed network?
  2. What are the components of NAT?
  3. If a small business is using the 10.0.0.0 private network for its intranet and has been granted the public IP address of 198.200.200.1 by its ISP, to what public IP address does NAT map all private IP addresses being used on network 10.0.0.0?

Lesson Summary

  • Network address translation (NAT) is a service that enables computers with private Internet Protocol (IP) addresses to access Internet services, just as though they have registered IP addresses.
  • A NAT server works by modifying the headers of client request packets destined for the Internet, so that they appear to have originated at the NAT server's registered IP address. Internet servers receiving the packets respond to the NAT server, which relays the response to the client on the private network.
  • Windows 2000 includes a NAT implementation as part of its Routing and Remote Access Service.
  • You can use NAT with any routed connection to the Internet using a dial-in connection or a network interface adapter.
  • Internet Connection Sharing (ICS) is a subset of the NAT service that provides the same basic functions as NAT, but with a simplified configuration process and limited options.


Lesson 4: Using Terminal Services

Terminal Services provides thin-client access to Windows 2000 and the latest Windows-based applications for client computers. You can also use Terminal Services to access your desktop and installed applications from any supported client. Terminal Services is a built-in feature of Windows 2000 that enables network administrators to increase flexibility in application deployment, control computer management costs, and remotely administer network resources.

After this lesson, you will be able to

  • Understand the functions of the two Terminal Services modes
  • Install Terminal Services
  • Install a Terminal Services Licensing server

Estimated lesson time: 40 minutes

Overview of Terminal Services

Terminal Services is a client/server application that consists of a service that runs on a computer running Windows 2000 Server and a client program that can run on a number of client hardware devices, including personal computers, Microsoft Windows CE-based handheld PC, or dedicated terminals. Terminal Services enables all operating system functions, client application execution, data processing, and data storage to occur on the server. It also provides remote access to a server desktop through terminal emulation software.

The Terminal Services client is a small terminal emulation program that does nothing but provide the interface to the software running on the server. The client software sends keystrokes and mouse movements to the server. The server then performs all of the data manipulation locally and passes the resulting display back to the client. This approach enables the remote control of servers and centralized application management, minimizing network bandwidth requirements between the server and client.

Users can access Terminal Services over any TCP/IP connection including LAN, WAN, remote access, Internet, wireless, and VPN connections. The user experience is limited only by the slowest link in the connection, and the security of the link is governed by the TCP/IP deployment in the data center. Terminal Services can provide remote administration of network resources or a uniform experience to users in remote branch offices.

Terminal Services is a built-in feature of Windows 2000 Server. You can enable Terminal Services in one of two modes-Remote Administration and Application Server-as described in the following sections.

Remote Administration

Remote Administration gives administrators a powerful method for remotely administering any Windows 2000 Server computer on the network using any TCP/IP connection. You can administer file and print sharing, edit the registry from another computer on the network, or perform any task as if you were sitting at the console. You can also use Remote Administration mode to manage servers not normally compatible with the Application Server mode of Terminal Services, such as servers running the Cluster service.

Remote Administration mode installs only the remote access components of Terminal Services; it does not install the application sharing components. This means that you can use Remote Administration with very little overhead on mission-critical servers. Terminal Services allows a maximum of two concurrent Remote Administration connections. No additional licensing is required for those connections, and you do not need a license server.

Application Server

In Application Server mode, you can deploy and manage all of the applications used by the Terminal Services clients from a central location, saving the time and effort needed to deploy, maintain, and upgrade the applications on each client individually. After you deploy an application in Terminal Services, clients can run it using any available TCP/IP connection. The number of clients supported is limited only by the number of client access licenses you have purchased and the processing capabilities of the server.

You can install applications directly at the terminal server, or you can use remote installation. For example, you can use the Software Installation feature of group policies to publish Windows Installer application packages to a terminal server or a group of terminal servers. With the appropriate administrator privileges, you can install applications on a per server basis if the appropriate group policy setting is enabled.

Client licensing is required when deploying a terminal server as an Application Server, but not as a Remote Administration server. Each client computer, regardless of the protocol used to connect to terminal server, must have a Terminal Services client access license as well as the standard Windows 2000 client access license.

Installing Terminal Services

Terminal Services and the Terminal Licensing Server are not installed with Windows 2000 Server by default. You can install them during the operating system setup process or afterward using the Add/Remove Programs tool in Control Panel.

Terminal Services is a resource-intensive application, and is generally best used on a Windows 2000 member server rather than a domain controller. Whenever possible, you should also run Terminal Services on a server that provides other essential networking services, such as DHCP, DNS, and WINS.

To install Terminal Services on a computer running Windows 2000 Server, use the following procedure:

  1. Click Start and, from the Settings group, select Control Panel.
  2. Double-click Add/Remove Programs to open Add/Remove Programs.
  3. Click Add/Remove Windows Components to start the Windows Components Wizard (see Figure 18.23).

    Figure 18.23 The Windows Components page of the Windows Components Wizard
  4. In the Components list, select the Terminal Services check box. Click Next to proceed to the Terminal Services Setup page.
  5. Specify the Terminal Services mode you want to use: Remote Administration Mode or Application Server Mode, and click Next.

    When you select Application Server Mode and click Next, the wizard proceeds to a Terminal Services Setup page in which you choose the permissions the service should use for application compatibility, as shown in Figure 18.24. If you select Remote Administration Mode, proceed to Step 8.

    Figure 18.24 The permissions selection Terminal Services Setup page of the Windows Component Wizard
  6. Specify whether you want to use Windows 2000 permissions or permissions that are compatible with Terminal Server 4.0 users and click Next to proceed to the Terminal Services Setup cautions list, as shown in Figure 18.25.

    Figure 18.25 The cautions Terminal Services Setup page of the Windows Component Wizard
  7. Note the applications that appear in the list. These are applications that may not function properly in Application Server mode or that might be automatically removed from the system. Click Next to proceed to the Configuring Components page.
  8. The wizard copies the files needed to install Terminal Services and proceeds to the Completing The Windows Components Wizard page.
  9. Click Finish to complete the Terminal Services installation.
  10. Restart the computer when you are prompted to do so.

When you install Terminal Services on Windows 2000 Server, the Windows Component Wizard also installs additional administration tools in the Administrative Tools program group, including Terminal Services Manager, Terminal Services Configuration, and Terminal Services Client Creator. These tools are described in the following sections.

Terminal Services Manager

Terminal Services Manager is an MMC console that you can use to manage all of the Windows 2000 Terminal Services installations, anywhere on your network. Administrators can view current users, servers, and processes, as well as send messages to specific users, use the Remote Control feature, and terminate processes. Figure 18.26 shows the Terminal Services Manager console running inside a Terminal Services session.

Figure 18.26 Running Terminal Services Manager to manage Terminal Services

Terminal Services Configuration

Terminal Services Configuration is another MMC console that you use to manage your Remote Desktop Protocol (RDP) configuration. Modifications you make with this tool are global, unless you choose to inherit information from the same options located in the user configuration. Available options include setting connection encryption, logon settings, time-outs, the initial programs to run when a successful logon occurs, remote control options, Windows printer mapping, LPT port mapping, clipboard mapping, and applying these options to a specific LAN adapter.

Terminal Services Client Creator

The Terminal Services Client Creator is a simple utility that creates floppy disk sets for installing the Terminal Services Client software on other Windows computers. As shown in Figure 18.27, you can create disk sets for 16-bit Windows computers, such as those running Microsoft Windows for Workgroups, and for 32-bit Windows computers, such as those running Windows NT, Windows 98, and Windows 95. A suggested practice would be to make the client files available on an internal network. The default installed location for these files during the Client Creator install is C:\WINNT\system32\clients.

Figure 18.27 The Terminal Services Client Creator

Terminal Services Licensing

Terminal Services has its own method for licensing clients that log on to terminal servers. This method is separate from the licensing method for Windows 2000 Server clients. Terminal Services licensing includes four components: the Microsoft Clearinghouse, a Terminal Services Licensing server, the Terminal Services server itself, and client licenses.

Microsoft Clearinghouse

The Microsoft Clearinghouse is the database Microsoft maintains to activate license servers and to issue client license key packs to the license servers that request them. The Clearinghouse stores information about all activated license servers and client license key packs that have been issued. You can access the Clearinghouse through the Licensing Wizard in the Terminal Services Licensing snap-in.

Terminal Services Licensing Server

The Terminal Services Licensing server is separate from Terminal Services. It stores all of the Terminal Services client licenses that have been installed for a terminal server and tracks the licenses that have been issued to client computers or terminals. A terminal server must be able to connect to an activated license server before clients can be issued licenses.

Terminal Services Server

A Terminal Services server is the computer on which Terminal Services is enabled and running. This server provides clients with access to Windows-based applications running entirely on the server and supports multiple client sessions on the server. When clients log on to a terminal server, the server validates the client license. If a client does not have a license, the terminal server requests one for the client from the Terminal Services Licensing server.

Client Licenses

Each client computer or terminal that connects to a terminal server must have a valid client license. The client license is stored locally and presented to the terminal server each time the client connects to the server. The server validates the license, and then allows the client to connect.

Deploying a Terminal Services Licensing Server

Deploying a Terminal Services Licensing server includes installing the server, activating the server, and installing the licenses. The license server must be activated through the Microsoft Clearinghouse and loaded with client access licenses for distribution from the Clearinghouse. The license server is accessed by the terminal servers only to issue a new license, and need only be administered to obtain licenses from the Clearinghouse.

Terminal Services Licensing is installed separately from Terminal Services, and is not included in the default Windows 2000 Server configuration. You do not have to run Terminal Services Licensing on the same computer as Terminal Services, and in fact, it is often preferable to run it on a different server to conserve resources on the terminal server. A single activated license server can manage the licenses for multiple terminal servers.There are two types of license servers: a domain license server and an enterprise license server. Before installing the license server, consider which type you require:

  • Domain license server. This type of licensing server is appropriate if you want to maintain a separate license server for each domain. If you have workgroups or Windows NT 4 domains, a domain license server is the only type that you can install. Terminal servers can access domain license servers only if they are in the same domain as the license server. By default, a license server is installed as a domain license server.
  • Enterprise license server. This type of licensing server can serve terminal servers in any domain within a site, but the domain must be a Windows 2000 domain. An enterprise licensing server is appropriate if you have many domains. You can only install an enterprise license server using Add/Remove Programs; you cannot install one during the Windows 2000 Setup process.
In Windows 2000 domains, the domain license server must be installed on a domain controller. In workgroups or Windows NT 4 domains, the domain license server can be installed on any server. If you are planning to eventually migrate from a Windows for Workgroups or Windows NT 4 domain to a Windows 2000 domain, you might want to install the license server on a computer that can be promoted to a Windows 2000 domain controller.

When deciding where on your physical network to deploy your license server, consider how a terminal server discovers and communicates with a license server. When you enable Terminal Services, the terminal server begins polling the domain and Active Directory services looking for a license server. (In a workgroup environment, the terminal server broadcasts to all the servers in the workgroup on the same subnet.)

Installing a Terminal Services Licensing Server

To install Terminal Services Licensing, use the following procedure:

  1. Click Start and, from the settings group, select Control Panel.
  2. Double-click Add/Remove Programs.
  3. Click Add/Remove Windows Components to open the Windows Components Wizard.
  4. In the Components list, select the Terminal Services Licensing check box. Click Next to proceed to the Terminal Services Setup page.
  5. Select Application Server Mode and click Next to proceed to the Terminal Services Licensing Setup page shown in Figure 18.28.
  6. Select the appropriate option to specify whether you want to install an enterprise license server or a domain license server. If you want to install the server database in a folder other than the default, type the path to the folder in the Install License Server Database At This Location text box or click Browse to select a folder. Click Next to proceed to the Configuring Components page.
  7. The wizard copies the files needed to install Terminal Services Licensing and proceeds to the Completing The Windows Components Wizard page.
  8. Click Finish to complete the Terminal Services Licensing installation.
Figure 18.28 The Terminal Services Licensing Setup page of the Windows Components Wizard

When you install Terminal Services Licensing, the Windows Components Wizard adds the Terminal Services Licensing console to the computer's Administrative Tools program group. With this tool, you are able store and track Windows 2000 Terminal Services client access licenses. When clients log on to Terminal Services, Terminal Services validates the client license. If a client does not have a license or requires a replacement license, Terminal Services requests one from the license server. The license server provides a license from its pool of available licenses, and Terminal Services passes that license to the client. If there are no available licenses, the license server grants a temporary license for the client. After it is granted, each client license is associated with a particular computer or terminal.

Activating a License Server

You must enable a Windows 2000 Terminal Services Licensing server within 90 days of enabling Terminal Services in Application Server Mode, to identify the server and enable it to issue client licenses to your terminal servers. You activate a license server by using the Licensing Wizard, accessible in the Terminal Services Licensing console. If you have not activated the license server when the 90-day period ends, Terminal Services fails to operate.

Installing Licenses

Terminal Services licenses must be installed on your license server for the Internet connector setting to be enabled or for non-Windows 2000 clients to permanently access Windows 2000 Terminal Services. To obtain Windows 2000 Terminal Services client access licenses or Internet connector licenses, purchase them through your standard software procurement method. You can then install the licenses using the Licensing Wizard.

After you have installed your licenses, your license server can begin deploying them. Clients with 90-day temporary licenses are upgraded to a Terminal Services client access license the next time they log on (unless the number of client access licenses installed has exceeded the number of outstanding temporary licenses).

Deploying Terminal Services Clients

Client computers or terminals connect to a terminal server using a small client program installed on disk or in firmware. The choice of which client platform to use depends on the equipment currently installed on your network and the needs of your individual users. At a minimum, ensure that every client computer or terminal that you expect to connect to a terminal server is physically capable of hosting the client software and connecting over the network.

Windows-based client computers connecting to Terminal Services should have at least an 80386 microprocessor running at 33 MHz (although a 486/66 is recommended), a 16-bit VGA video card, and the Microsoft TCP/IP stack. The Terminal Services client runs on Microsoft Windows for Workgroups 3.11, Windows 95, Windows 98, Microsoft Windows NT 3.51 or later, and Windows 2000.

The Terminal Services client takes up only about 500 KB of disk space and typically uses approximately 4 MB of RAM when running. If client bitmap caching is enabled, another 10 MB of disk space might be used. For best performance, a computer running the Terminal Services client should have a total of 8 MB of physical RAM or more under Windows for Workgroups 3.11 or Windows 95, 24 MB or more for Windows 98, and 32 MB or more for Windows 2000 or Windows NT 3.51 and 4.0.

The RDP client software is installed by default as a subcomponent of Terminal Services. The client software is installed in the systemroot\System32\Clients\ Tsclient folder on the terminal server. There are two ways to deploy the client: by creating a file share to do the installation over the network, or by creating client installation disks using the Terminal Services Client Creator.

You can optimize the performance of Terminal Services by following these recommendations:

  • Disable the Active Desktop.
  • Disable smooth scrolling.
  • Minimize the use of graphics and animation, including animated graphics, screen savers, blinking cursors, and the animated Microsoft Office Assistant.
  • Avoid using bitmaps in wallpaper. In the Display Properties dialog box, in the Background tab, set Wallpaper to None, and in the Appearance tab, select a single background color.
  • Place shortcuts on the desktop and keep the Programs group in the Start menu as flat as possible.
  • Enable file sharing on client computers and share drives with easily identifiable names like drivec. Be aware of the security implications involved.
  • Avoid the use of MSDOS or Win16 (16-bit) applications.

Exercise 18.3: Using Terminal Services for Remote Administration

In this exercise you install Windows 2000 Terminal Services in Remote Administration mode, and then connect to the terminal server from a client computer.

Procedure 1: Installing Terminal Services

To install Terminal Services to run in Remote Administration mode, complete the following steps:

  1. Log on to a Windows 2000 server as Administrator.
  2. Click Start and, from the Settings group, select Control Panel.
  3. Double-click Add/Remove Programs.
  4. Click Add/Remove Windows Components to open the Windows Components Wizard.
  5. In the Components list, select the Terminal Services check box, and then click Next to display the Terminal Services Setup page.
  6. Make sure that Remote Administration Mode is selected and click Next.

    The Configuring Components page appears as Windows 2000 configures and installs components. After a few minutes, the Completing The Windows Components Wizard page appears.

  7. Click Finish. The Add/Remove Programs Control Panel appears.
  8. Click Close and then close Control Panel. A System Setting Change message box appears, informing you that you must restart the computer before the settings will take effect.
  9. Click Yes to restart the computer. After the server restarts, do not log on. You will log on from another computer using Terminal Services remote administration.

Procedure 2: Logging On to a Terminal Server

To log on to another computer running Windows 2000 and connect to the terminal server in Remote Administration mode using the Terminal Services client, complete the following steps:

  1. On another computer running Windows 2000 on the same network as your terminal server, log on to the local machine as Administrator.
  2. Click Start and then select Run to open the Run dialog box.
  3. In the Open text box, type \\servername\c$\Winnt\System32\clients\ tsclient\net\win32 (where servername is the name of your terminal server) and then click OK. An Explorer window appears containing the files in the folder you specified.
  4. Double-click the Conman icon to display the Client Connection Manager.
  5. Click the New Connection button in the toolbar to display the Client Connection Manager Wizard.
  6. Click Next to bypass the Welcome To The Client Connection Manager Wizard page and proceed to the Create A Connection page.
  7. In the Connection Name text box, type Terminal Server Remote Administration.
  8. In the Server Name or IP Address text box, type the name or IP address of your terminal server and click Next to display the Automatic Logon page.
  9. Select the Logon Automatically With This Information check box.
  10. In the User Name text box, type Administrator.
  11. In the Password text box, type the password for the Administrator account on your terminal server.
  12. In the Domain text box, type the name of your domain and click Next to proceed to the Screen Options page.
  13. Select a resolution that the monitor on your client computer can support. If you do not know what resolution it supports, select 640 x 480.
  14. Click Next to display the Connection Properties page.
  15. Select the Enable Data Compression and Cache Bitmaps check boxes and click Next to display the Starting A Program page.
  16. Click Next to display the Icon And Program Group page.
  17. Click Next to display the Completing The Client Connection Manager Wizard page.
  18. Click Finish. The Client Connection Manager appears with the new connection you created.
  19. Double-click the Terminal Server Remote Administration icon. A Connecting box appears. Then, a Terminal Services Client window opens.
  20. In the Log On To Windows dialog box, type the password for the Administrator account on the terminal server and click OK. You are now able to remotely administer your terminal server from your client computer. Notice that on the terminal server's monitor, the computer is not logged on but you are logged on to the terminal server from your client server.
  21. Close the Terminal Services Client window on the client computer. A Disconnect Windows Session message box appears, stating that you are about to disconnect from the terminal server but that you can return to this session later and continue to run the programs started in this session.
  22. Click OK.
  23. Close the Client Connection Manager.

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next chapter. If you have difficulty answering the questions, you can review the material in this lesson before proceeding. For the answers to these questions, see the Appendix.

  1. Which type of license server supports workgroups and Windows NT 4 domains?
  2. How does Terminal Services simplify client administration?
  3. What happens to a Terminal Services installation running in Remote Administration mode when you fail to activate a licensing server in 90 days?

Lesson Summary

  • Terminal Services running on a Windows 2000 server enables all client application execution, data processing, and data storage to occur on the server.
  • Terminal Services clients run a terminal emulation program that transmits keystrokes and mouse movements to a terminal server and receives display information in return.
  • With Terminal Services, you can administer a server from a remote location on the network.
  • Terminal Services clients require an access license, which is maintained separately from Windows 2000 client access licenses by a Terminal Services Licensing server.
  • When running in Application Server mode, you must activate Terminal Services within 90 days of installing it, or it will cease to function.


Disaster Recovery and Prevention

About This Chapter

In this chapter, you examine the process of backing up your network drives and particularly your Active Directory database, to protect them from data loss due to drive failures, computer theft, or natural disaster.

Before You Begin

This chapter has no prerequisites.


Lesson 1: Backing Up Your Network

It might not happen today or tomorrow, but someday you will lose a hard drive containing essential network data. The drive might be stolen along with the computer, destroyed in a fire or other catastrophe, or simply fail. Whatever happens, the data is gone and it's up to you, as the network administrator, to get it back. When this occurs, you will thank yourself for the effort you took to set up a network backup strategy. If you don't have a backup strategy in place, it might be the day you start working on your resume.

After this lesson, you will be able to

  • Describe the various types of hardware used to perform backups
  • Understand the capabilities of software backup products
  • Distinguish among full, incremental, and differential backups

Estimated lesson time: 45 minutes

Backups are simply copies of your data that you make on a regular basis, so that if a storage device fails or sustains damage and the data stored there is lost, you can restore it in a timely manner. A backup is the ultimate fault-tolerance measure. Even if you have other storage technologies in place that provide fault tolerance, such as mirrored disks or a redundant array of independent disks (RAID), you still need a backup solution. Networks both complicate and simplify the process of making regular backups. The process is more complicated because data stored on multiple devices must be protected, and it is simpler because you can use the network to access those devices. A network backup strategy specifies what data you back up, how often you back it up, and what medium you use to store the backups. The decisions you make regarding the backup hardware, software, and administrative policies you will use depend on how much data you have to back up, how much time you have to back it up, and how much protection you want to provide.

Backup Hardware

You can perform backups using any type of storage device. One objective in developing an effective backup strategy, however, is to automate as much of the process as possible. Although you can back up a gigabyte of data onto 1.44-MB floppy disks, you probably don't want to be the person sitting around feeding 695 disks into a floppy drive to do so. Therefore, you should select a device that is capable of storing all of your data without frequent media changes. The ideal situation is one in which an entire backup job fits on a single tape cartridge or storage unit for another medium. This enables you to schedule backup jobs to run unattended. This doesn't mean, however, that you have to purchase a drive that can hold all of the data stored on all of your network's computers. You can be selective about which data you want to back up, so it's important to determine just how much of your data needs protecting, and how often, before you decide on the capacity of your backup device.

Another important criterion to use when selecting a backup device is the speed at which the drive writes data to the medium. Backup drives are available in many different speeds, and, not surprisingly, the faster ones are generally more expensive. It is typical for backup jobs to run during periods when the network is not otherwise in use. This ensures that all of the data on the network is available for backup. The amount of time that you have to perform your backups is sometimes called the backup window. The backup device that you choose should depend in part on the amount of data you have to protect and the amount of time that you have to back it up. If, for example, you have 10 GB of data to back up and your company closes down from 5:00 P.M. until 9:00 A.M. the next morning, you have a 16-hour backup window-plenty of time to copy your data using a medium-speed backup device. However, if your company operates three shifts and only leaves you one hour, from 7:00 A.M. to 8:00 A.M., to back up 100 GB of data, you will have to use a much faster device, or in this case, several devices.

Cost is always a factor in selecting a hardware product. You can purchase a low-end backup drive for $100 to $200, which is suitable for backing up a home computer where speed isn't a major factor. However, when you move up to the drives with the speed and capacity suitable for network backups, the prices increase dramatically. High-end backup drives can command prices that run into five figures.

When you evaluate backup devices, you must be aware of the product's extended costs as well. Backup devices nearly always use a removable medium, such as a tape or disk cartridge. This enables you to store copies of your data offsite, such as in a bank's safe deposit vault. If the building where your network is located is destroyed by a fire or other disaster, you still have your data, which you can use to restart operations elsewhere. Therefore, in addition to purchasing the drive, you must purchase storage media as well. Some products might seem at first to be economical because the drive is inexpensive, but in the long run they might not be, because the media are so expensive.

One of the most common methods of evaluating various backup devices is to determine the cost per megabyte of the storage it provides. Divide the price of the medium by the number of megabytes it can store, and use this figure to compare the relative cost of various devices. Of course, in some cases you might need to sacrifice economy for speed or capacity.

Magnetic Tape Drives

The most common hardware device used to back up data is a magnetic tape drive, like the one shown in Figure 19.1. Unlike hard disk, floppy disk, and CD-ROM drives, tape drives are not random access devices, meaning that you can't simply move the drive heads to a particular file on a backup tape without spooling through all of the files before it. As with other types of tape drives, such as audio and video, the drive unwinds the tape from a spool and pulls it across the heads until it reaches the point in the tape where the data you want is located. As a result, you can't mount a tape drive in a computer's file system, assign it a drive letter, and copy files to it, as you can with a hard disk drive. A special software program is required to address the drive and send the data you select to it for storage. This also means that tape drives are useless for anything other than backups, whereas other media, such as writable CD-ROMs, can be used for other things.

Figure 19.1 An external magnetic tape drive

Magnetic tape drives are well suited for backups; they're fast, they can hold a lot of data, they can archive that data indefinitely, and their media cost per megabyte is low, often less than one-half cent per megabyte. There are many different types of magnetic tape drives that differ greatly in speed, capacity, and price. At the low end are quarter-inch cartridge (QIC) drives, which can cost as little as $200. A single QIC tape cartridge can hold anywhere from 150 MB to 20 GB. At the high end are digital linear tape (DLT) and linear tape-open (LTO) drives, which can cost many thousands of dollars and store as much as 100 GB on a single tape. The most common magnetic tape technologies used for backups are listed in Table 19.1.

Table 19.1 Magnetic Tape Technologies

Type | Tape Width | Cartridge Size | Capacity (Uncompressed) | Speed
QIC | .25 inch | 4 inches (data cartridge); 3.25 0.6 inches (minicartridge) | Up to 20 GB | 2 to 120 MB/min
Digital audio tape (DAT) | 4 mm | 2.875 2.0625 0.375 inches | Up to 20 GB | 3 to 144 MB/min
8 mm | 8 mm | 3.7 0.59 inches | Up to 60 GB | Up to 180 MB/min
DLT | .50 inch | 4.16 1 inches | Up to 40 GB | Up to 360 MB/min
LTO, Ultrium-media | .50 inch | 4.0 0.87 inches | Up to 100 GB | Up to 1920 MB/min
The capacities of magnetic tape drives are generally specified using two figures, such as 40 GB to 80 GB. These numbers refer to the capacity of a tape without compression and with compression. Most tape drives have hardware-based data compression capabilities built into them, but the additional capacity that you achieve when using compression is based on the type of data you are storing. The capacity figures assume an average compression ratio of 2:1. Some types of files, such as image files using uncompressed .bmp or .tif formats, can compress at much higher ratios, as high as 8:1. Files that are already compressed, such as .gif or .jpg image files or .zip archives, cannot be compressed further and are stored at a 1:1 compression ratio.

Autochangers

In some cases, even the highest capacity drive isn't sufficient to back up a large network with constantly changing data. To create an automated backup solution with a greater capacity than that provided by a single drive, you can purchase a device called an autochanger. An autochanger, shown in Figure 19.2, is a unit that contains one or more drives (usually tape drives, but optical disk and CD-ROM autochangers are also available), a media array, and a robotic mechanism that swaps the media in and out of the drives. Sometimes these devices are called jukeboxes or tape libraries. When a backup job fills one tape (or other storage medium), the mechanism extracts it from the drive and inserts another, after which the job continues. The autochanger also retains a memory of which tapes are available, commonly called an index, and can automatically load the appropriate tape to perform a restore job.

Figure 19.2 A tape autochanger

Some autochangers are small devices with a single drive and an array that holds four or five tapes, whereas others are enormous devices with as many as four drives and an array of 100 tapes or more. If you purchase a large enough autochanger, you can create a long-term backup strategy that enables backups to run completely unattended for weeks at a time. However, before you solidify your plans to get a refrigerator-sized autochanger and never load a tape into a drive by hand again, be aware that the cost of these devices can be astonishingly high, reaching as much as six figures in some cases.

Backup Software

Apart from the hardware, the other primary component in a network backup solution is the software that you use to perform the backups. Storage devices designed for use as backup solutions are not treated like the other storage subsystems in a computer; a specialized software product is required to package the data that you want to back up and send it to the drive. Depending on the operating system you're using, you might already have a backup program that you can use with your drive, but in many cases an operating system's own backup program provides only basic functionality and lacks features that can be especially useful in a network environment.

The primary functions of a good backup software product are examined in the following sections.

Target Selection and Filtering

The most basic function of a backup software program is to let you select what you want to back up, which is sometimes called the target. A good backup program enables you to do this in many ways. You can select entire computers to back up, specific drives on those computers, specific folders on the drives, or specific files in specific folders. Most backup programs provide a tree display that you can use to select the targets for a backup job. Figure 19.3 shows the interface that the Microsoft Windows 2000 Backup program uses to select backup targets.

Figure 19.3 The Backup dialog box in the Windows 2000 Backup program

In most cases, it isn't necessary to back up all of the data on a computer's drives. If a hard drive is completely erased or destroyed, you are likely to have to reinstall the operating system before you can restore files from a backup tape, so it might not be worthwhile to back up all of the operating system files each time you run a backup job. The same is true for applications. You can reinstall an application from the original distribution media, so you might want to back up only your data files and configuration settings for that application. In addition, most operating systems today create temporary files as they run, which you do not need to back up. Windows, for example, creates a temporary file for memory paging that can be hundreds or thousands of megabytes in size. Because this file is re-created each time you start the computer, you can save space on your backup tapes by omitting files like this from your backup jobs. Judicious selection of backup targets can mean the difference between fitting an entire backup job onto one tape or staying late after work to insert a second tape into the drive.

Individually selecting the files, directories, and drives that you want to back up can be quite tedious, though, so many backup programs provide other ways to specify targets. One common method is to use filters that enable the software to evaluate each file and directory on a drive and decide whether to back it up. A good backup program provides a variety of filters that enable you to select targets based on file and directory names, extensions, sizes, dates, and attributes. For example, you can configure the software to back up a computer running Windows 2000 and use filters to exclude Pagefile.sys, which is the memory paging file; the \Temporary Internet Files directories, which contain Microsoft Internet Explorer's browser cache; and all files with a .tmp extension, which are temporary files created by various applications. None of these files are necessary when restoring the system from a backup tape, so it's worthless to save them and they can add up to a significant amount of tape storage space.

You can also use filters to limit your backups to only files that have changed recently, using either date or attribute filters. The most common type of filter used by backup programs is the one for the archive attribute, which enables the software to back up only the files that have changed since the last backup. This filter is the basis for incremental and differential backups.

Incremental and Differential Backups

The most basic type of backup job is a full backup, which copies the entire contents of a computer's drives either to tape or to another medium. You can perform a full backup every day, if you want to, or each time that you back up that particular computer. However, this practice can be wasteful, both in terms of time and tape. When you perform a full backup daily, the majority of the files you are writing to the tape are exactly the same as they were yesterday. The program files that make up the operating system and your applications do not change. The only files that change on a regular basis are your data files and perhaps the files that store configuration data, along with special resources like the Windows Registry and directory service databases.

To save tape and shorten the backup time, many network administrators perform full backups only once a week, or even less frequently. In between the full backups, they perform special types of filtered jobs that back up only the files that have recently been modified. These types of jobs are called incremental backups and differential backups.

An incremental backup is a job that backs up only the files changed since the last backup job of any kind. A differential backup is a job that backs up only the files that have changed since the last full backup. The backup software filters the files for these jobs using a special file attribute called the archive bit, which every file on the computer possesses. File attributes are 1-bit flags, stored with each file on a drive, that perform various functions. For example, the read-only bit, when activated, prevents any application from modifying that particular file, and the hidden bit prevents most applications from displaying that file in a directory listing. The archive bit for a file is activated by any application that modifies that file. When the backup program scans the target drive during an incremental or differential job, it selects for backup only the files with active archive bits.

During a full backup, the software backs up the entire contents of a computer's drives, and also resets (that is, removes) the archive bit on all of the files. Immediately after the job is completed, you have a complete copy of the drives on tape, and none of the files on the target drive has an active archive bit. As work on the computer proceeds after the backup job is completed, applications and operating system processes modify various files on the computer, and when they do, they activate the archive bits for those files. The next day, you can run an incremental or differential backup job, which is also configured to back up the entire computer, except that it filters out all files that do not have an active archive bit. This means that all of the program files that make up the operating system and the applications are skipped, along with all data files that have not changed. Compared to a full backup, an incremental or differential backup job is usually much smaller, so it takes less time and less tape.

The difference between an incremental and a differential job lies in the behavior of the backup software when it either resets or does not reset the archive bits of the files it copies to tape. Incremental jobs reset the archive bits, and differential jobs don't. This means that when you run an incremental job, you're only backing up the files that have changed since the last backup, whether it was a full backup or an incremental backup. This uses the least amount of tape, but it also lengthens the restore process. If you should have to restore an entire computer, you must first perform a restore from the last full backup tape, and you must then restore each of the incremental jobs performed since the last full backup. For example, suppose that you run a full backup job on a particular computer every Monday evening and incremental jobs every evening from Tuesday through Friday. If the computer's hard drive fails on a Friday morning, you must restore the previous Monday's full backup, and you must then restore the incremental jobs from Tuesday, Wednesday, and Thursday, in that order. The order of the restore jobs is essential if you want the computer to have the latest version of every file.

Differential jobs do not reset the archive bit on the files they back up. This means that every differential job backs up all of the files that have changed since the last full backup. If you perform a full backup on Monday evening, Tuesday evening's differential job will back up all files changed on Tuesday, Wednesday evening's differential job will back up all files changed on Tuesday and Wednesday, and Thursday evening's differential backup will back up all files changed on Tuesday, Wednesday, and Thursday. Differential backups use more tape, because some of the same files are backed up each day, but differential backups also simplify the restore process. To completely restore the computer that failed on a Friday morning, you only have to restore Monday's full backup tape and the most recent differential backup, which was performed Thursday evening. Because the Thursday tape includes all of the files modified on Tuesday, Wednesday, and Thursday, no other tapes are needed. The archive bits for these changed files are not reset until the next full backup job is performed.

Running incremental or differential jobs is often what makes it possible to automate your backup regimen without spending too much on hardware. If your full backup job totals 50 GB, for example, you might be able to purchase a 20-GB drive. You'll have to manually insert two additional tapes during your full backup jobs once a week, but you should be able to run incremental or differential jobs the rest of the week using only one tape, which means that the jobs can run unattended.

Drive Manipulation

When you have selected what you want to back up, the next step is to specify where to send the selected data. The backup software typically enables you to select a backup device (if you have more than one) and prepare to run the job by configuring the drive and the storage medium. For backup to a tape drive, this part of the process can include any of the following tasks:

  • Formatting a tape
  • Supplying a name for the tape you're creating
  • Specifying whether you want to add the backed up files to the tape or overwrite the tape
  • Turning on the drive's compression feature

Scheduling

All backup products enable you to create a backup job and execute it immediately, but the key to automating a backup routine is being able to schedule jobs to execute unattended. This way, you can configure your backup jobs to run when the office is closed and the network is idle, so that all resources are available for the backup and user productivity is not compromised by the sudden surge of network traffic caused by the backup process. Not all of the backup programs supplied with operating systems or designed for stand-alone computers support scheduling, but all network backup software products do.

Backup programs use various methods to automatically execute backup jobs. The Windows 2000 Backup program uses the operating system's Task Scheduler application. Other programs supply their own program or service that runs continuously and triggers the jobs at the appropriate times. Some of the higher end network backup products can use a directory service, such as Microsoft's Active Directory service or Novell Directory Services (NDS). These programs modify the directory schema (the code that specifies the types of objects that can exist in the directory) to create an object representing a queue of jobs waiting to be executed.

No matter which mechanism the backup software uses to launch jobs, the process of scheduling them is usually the same. You specify whether you want to execute the job once or repeatedly at a specified time each day, week, or month, using an interface like that shown in Figure 19.4. The idea of the scheduling feature is for the network administrator to create a logical sequence of backup jobs that execute by themselves at regular intervals. After this is done, the only thing that remains to be done is changing the tape in the drive each day. If you have an autochanger, you can even eliminate this part of the job and create a backup job sequence that runs for weeks or months without any attention at all.

Figure 19.4 The Windows 2000 Backup program's Schedule Job dialog box

Logging and Cataloging

When a backup job runs, the software accesses the specified targets and feeds the data to the backup drive in the appropriate manner. Because of the nature of the media typically used for backups, it is important for the data to arrive at the storage device in a consistent manner and at the proper rate of speed. The software, therefore, must be designed to address specific drives in the manner appropriate for that device.

As the software feeds the data to the drive, it also keeps track of the software's activities. Most backup software products can maintain a log of the backup process as it occurs. You can often specify a level of detail for the log, such as whether it should contain a complete list of every file backed up or just record the major events that occur during the job. Periodically checking the logs is an essential part of administering a network backup program. The logs tell you when selected files are skipped for any reason; for example, if the files are locked open by an application or if the computers on which they are stored are turned off. The logs also let you know when errors occur on either the backup drive or one of the computers involved in the backup process. Some software products can generate alerts when errors occur, notifying you by sending a status message to a network management console, by sending you an e-mail message, or by other methods.

It is also important to keep an eye on the size of your log files, particularly when you configure them to maintain a high level of detail. These files can grow huge very quickly, and can consume all of the available disk space on the drive on which they are stored.

In addition to logging their activities, backup software programs also catalog the files they back up, facilitating the process of restoring files later. The catalog is essentially a list of every file that the software has backed up during each job. To restore files from the backup medium, you browse through the catalog and select the files, directories, or drives that you want to restore. Different backup software products store the catalog in different ways. The Windows 2000 Backup program, for example, stores the catalog for each tape on the tape itself. The problem with this method is that you have to insert a tape into the drive to read the catalog and browse the files on that tape.

More elaborate network backup software programs take a different approach by maintaining a database of the catalogs for all of your backup tapes on the computer where the backup device is installed. This database enables you to browse through the catalogs for all of your tapes and select any version of any file or directory for restoration. In some cases, you can view the contents of the database in several different ways, such as by the computer, drive, and directory where the files were originally located, by the backup job, or by the tape or other media name. After you make your selection, the program specifies which tape contains the file or directory; simply insert it into the drive, and the job proceeds.

The database feature can use a lot of the computer's disk space and processor cycles, but it greatly enhances the usability of the software, particularly in a network environment.

Backup software products that rely on a database typically store a copy of the database on your tapes as well as on the computer's hard drive. This is done so that if the computer you use to run the backups should suffer a drive failure, you can restore the database later.

Media Rotation

Some network administrators use new tapes for every backup job and store them all permanently, but this can become extremely expensive. It's more common for administrators to reuse backup tapes. To do this properly, however, you must have a carefully wrought media rotation scheme, so that you don't inadvertently reuse a tape you'll need later. You can always create such a scheme yourself, but some backup software products do it for you. One of the most common media rotation schemes is called Grandfather-Father-Son, which refers to backup jobs that run monthly, weekly, and daily. You have one set of tapes for your daily jobs, which you reuse every week; a set of weekly tapes, which you reuse every month; and a set of monthly tapes, which you reuse each year. Other schemes vary in complexity and utility, depending on the software product.

When the software program implements the rotation scheme, it provides a basic schedule for the jobs (which you can modify to have the jobs execute at specific times of the day), tells you what name to write on each tape as you use it, and once you begin to reuse tapes, tells you which tape to put in the drive for each job. The end result is that you maintain a perpetual record of your data while using the minimum number of tapes without fear of overwriting a tape you need.

Restoring

Restoring data from your backups is, of course, the sole reason for making them in the first place. The ease with which you can locate the files you need to restore is an important feature of any backup software product. It is absolutely essential that you perform periodic test restores from your backup tapes or other media to ensure that you can get back any data that is lost. Even if all your jobs complete successfully and your log files show that all of your data has been backed up, there is no more reliable test of a backup system than an actual restore. There are plenty of horror stories of network administrators who dutifully perform their backups every day for a year, only to find out when disaster strikes that all their carefully labeled tapes are blank due to a malfunctioning drive.

Although making regular backups is usually thought of as protection against a disaster that causes you to lose an entire hard drive, the majority of the restore jobs you will perform in a network environment are of one or a few files that a user has inadvertently deleted. As mentioned earlier, the program's cataloging capability is a critical part of the restoration process. If a user needs to have one particular file restored and you have to insert tape after tape into the drive to locate it, everyone's time is wasted. A backup program with a database that lets you search for that particular file makes your job much easier and enables you to restore any file in minutes.

Restore jobs are similar to backup jobs, in that you typically select the files or directories that you want to restore, using an interface like that shown in Figure 19.5. You then specify whether you want to restore the files to the locations they originally came from or to another location. If you restore them to a different location, you can usually configure the software to place all of the restored files into one directory or re-create the directory structure from which the files were backed up.

Figure 19.5 The Windows 2000 Backup program's Restore dialog box

Disaster Recovery

One of the problems with the typical backup software product is that, like any application, it requires an operating system to run. What happens if the drive in the computer hosting the backup drive should fail? You may have a complete back-up of the computer, but to restore it, you first have to reinstall the entire operating system and the backup software product, which can be a time-consuming task. To address this problem, many backup software products provide a disaster recovery feature that enables you to create a boot disk that loads just enough of the operating system and the backup application to perform a restore. A restore from a full backup will then provide all of the software needed to restart the computer in the normal manner.

Network Backup Functions

It is particularly important that you choose a backup software product that is designed for network use. The primary difference between network backup software and an application designed for stand-alone systems is that the former can back up other computers on the network. This means you can purchase one backup drive and use it to protect your entire network. Many stand-alone backup products can access drives on networked computers that you have mapped to a drive letter, but a fully functional network backup product can also back up important operating system features on other computers, such as the Windows Registry and directory service databases. This type of remote backup may require you to install a software component on the target computer, as well as on the computer where the backup drive is located.

In many cases, network backup products also have optional add-on components that enable you to perform specialized backup tasks, such as backing up live databases or computers running other operating systems. These can be a critical part of your network backup solution. If, for example, you have database or e-mail servers that run around the clock, you might not be able to fully back them up using a standard software product because the database files are locked open. As a result, your backup job protects the program files for the database engine (the part that's easily replaceable) but leaves your actual data unprotected. To back up a database of this type, you either have to close it by shutting it down or use a specialized piece of software that creates temporary database files (called delta files) that the server can use while the database itself is closed for the duration of the backup process.

Exercise 19.1: Incremental and Differential Backups

  1. If you back up your network by performing a full backup every Wednesday at 6:00 P.M. and differential backups in the evening on the other six days of the week, how many jobs would be needed to completely restore a computer with a hard drive that failed on a Tuesday at noon?
  2. If you back up your network by performing a full backup every Wednesday at 6:00 P.M., how many jobs would be needed if you performed incremental backups in the evening of the other six days of the week?
  3. For a complete restore of a computer that failed at noon on Tuesday, how many jobs would be needed if you performed full backups at 6:00 A.M. every Wednesday and Saturday and incremental backups at 6:00 A.M. every other day?
Answers

Lesson Review

The following questions will help you determine whether you have learned enough to move on to the next lesson. If you have difficulty answering the questions, you can review the material in this lesson before preceeding. For the answers to these questions, see the Appendix.

  1. Which of the following types of backup jobs does not reset the archive bits of the files it backs up?
    1. Full
    2. Incremental
    3. Differential
    4. Supplemental
  2. Which of the following is the criterion most commonly used to filter files for backup jobs?
    1. File name
    2. File extension
    3. File attributes
    4. File size
  3. How does an autochanger increase the overall storage capacity of a backup solution?
  4. What are the three elements in the Grandfather-Father-Son media rotation system?
    1. Hard disk drives, CD-ROM drives, and magnetic tape drives
    2. Incremental, differential, and full backup jobs
    3. Monthly, weekly, and daily backup jobs
    4. QIC, DAT, and DLT tape drives
  5. Network backup devices most commonly use which drive interface?
    1. IDE
    2. SCSI
    3. USB
    4. Parallel port

Lesson Summary

  • Magnetic tape is the most popular storage medium for backups because it is fast, inexpensive, and holds a lot of data.
  • Tape drives are available in a variety of speeds and capacities to suit the needs of different installations.
  • Backup software enables you to select the data you want to back up and sends it to the tape drive or other device you use for your backups.
  • Daily backup jobs can be full backups, which copy all of the data on a computer, or incremental or differential backups, which only copy the data that has recently changed.
  • A good backup software program enables you to schedule jobs to execute at any time, and it maintains both a tape version and a hard disk version of a catalog of all of the files that have been backed up.
  • Network backup software enables you to back up data from computers anywhere on the network, and might also provide optional features such as live database backups.


Lesson 2: Backing Up and Restoring Active Directory

This lesson guides you through the steps required to back up Active Directory data using the Windows 2000 Backup program. When you create a backup, you need to perform several preliminary tasks, and then use the Backup Wizard to create the job and schedule it to run at a specified time.

After this lesson, you will be able to

  • Back up Active Directory at a local computer
  • Schedule a backup of Active Directory
  • Explain the difference between nonauthoritative and authoritative restore
  • Restore Active Directory

Estimated lesson time: 45 minutes

Performing Preliminary Tasks

An important part of backing up Active Directory is performing the preliminary tasks. One task that you must do is ensure that the files that you want to back up are closed. If users are working on the network, you should send them a notification, warning them to close their files before you begin backing up data. Windows Backup does not back up files that are locked by applications. You can use e-mail or the Send Console Message dialog box (available in the Computer Management and the Services consoles and the Shared Folders snap-in) to send administrative messages to users.

If you use a removable media device, make sure that the following conditions are met:

  • The backup device is properly installed on the computer running Windows Backup.
  • The media device is listed on the Windows 2000 Hardware Compatibility List (HCL).
  • The media is loaded in the media device. For example, if you are using a tape drive, ensure that a tape is loaded in the tape drive.

Using the Backup Wizard

After you have completed the preliminary tasks, you can perform the Active Directory backup using the Backup Wizard.

To start the Backup Wizard, use the following procedure:

  1. Log on to your domain as Administrator.
  2. Click Start and from the System Tools program group, select Backup.
  3. In the Welcome To The Windows 2000 Backup And Recovery Tools page, select Backup Wizard.
  4. Click Next to begin using the Backup Wizard. Proceed through the What To Back Up, Where To Store The Backup, and Advanced Backup Settings pages as needed.
  5. In the Completing The Backup Wizard page, click Finish.

The details involved in configuring a backup job are examined in the following sections.

What to Back Up

The first phase of using the Backup Wizard to back up Active Directory is to specify that you want to back up only System State data (see Figure 19.6).

Figure 19.6 Backup Wizard What To Back Up page

For Microsoft Windows 2000 Server operating systems, the System State data comprises the registry, the COM+ Class Registration database, system boot files, and the Certificate Services database (if the server is a certificate server). If the server is a domain controller, Active Directory and the SYSVOL directory are also contained in the System State data. When you choose to back up System State data, all of the System State data that is relevant to your computer is backed up; you cannot choose to back up individual components of the System State data. This is due to dependencies among the System State components. You can only back up the System State data on a local computer. You cannot back up the System State data on a remote computer using Windows 2000 Backup (although there are other backup software products that can do this).

Where to Store the Backup

After you indicate that you want to back up the System State data, you must provide information about the backup medium (see Figure 19.7), as follows:

  • Backup Media Type. The target medium to use, such as tape or file. A file can be located on any disk-based medium, including a hard disk, a shared network folder, or a removable disk. Other media are listed only if you have an appropriate drive installed on the computer.
  • Backup Media Or File Name. The location where Windows Backup will store the data. For a tape, enter the tape name. For a file, enter the path for the backup file.

    Figure 19.7 Backup Wizard Where To Store The Backup page

After you provide the media information, the Backup Wizard displays the wizard settings and provides the opportunity to do either of the following:

  • Start the backup. If you click Finish, the Backup Wizard displays status information about the backup job in the Backup Progress dialog box during the backup process.
  • Specify advanced backup options. If you click Advanced, the Backup Wizard enables you to select the advanced backup settings.

Specifying Advanced Backup Settings

When you specify advanced backup settings, you are changing the default backup settings for the current backup job only. The advanced settings are listed in Table 19.2.

Table 19.2 Advanced Backup Settings

Advanced Settings Page | Advanced Option | Description
Type Of Backup | Select The Type Of Backup Operation To Perform | This option enables you to choose the backup type that is used for this backup job. Select one of the following types: Normal, Copy, Incremental, Differential, or Daily.
 | Backup Migrated Remote Storage Data | This option backs up data that Hierarchical Storage Manager (HSM) has moved to remote storage.
How To Backup | Verify Data After Backup | This option confirms that files are correctly backed up. Windows Backup compares the backup data and the source data to verify that they are the same. Microsoft recommends that you enable this option.
 | Use Hardware Compression, If Available | This option enables hardware compression for tape devices that support it. If your tape device does not support hardware compression, this check box is unavailable.
Media Options | If The Archive Media Already Contains Backups | This option specifies whether to add to or replace the existing backup on the backup medium. Choose Append This Backup To Media to store multiple backup jobs on a tape or other medium. Choose Replace The Data On The Media With This Backup if you do not need to save previous backup jobs and you only want to save the most recent backup data.
 | Allow Only The Owner And The Administrator Access To The Backup Data And To Any Backups Appended To This Media | This option enables you to restrict who can gain access to the completed backup file or tape. This option is only available if you choose to replace an existing backup on a backup medium, rather than adding to the backup medium. If you back up the registry or Active Directory, select this option to prevent others from getting copies of the backup data.
Backup Label | Backup Label | This option enables you to specify a name and description for the backup job. The name and description appear in the backup log. The default set is Set Created Date At Time. You can change the name and description to a more intuitive name (for example, Active Directory backup 09-12-02).
 | Media Label | This option enables you to specify the name of the back-up medium (for example, the tape name). The default name is Media Created Date At Time. The first time that you back up to a new medium or overwrite an existing backup job, you can specify the medium name, such as Active Directory.
When To Back Up | When To Back Up | This option enables you to specify Now or Later. If you choose Later, you specify the job name and the start date. You can also set the schedule.
 | Job Name | This option enables you to specify the backup job name.
 | Start Date | This option enables you to set the backup start date.
 | Set Schedule | This option enables you to set the backup schedule.

Depending on whether you chose to back up now or later, the Backup Wizard provides you with the opportunity to do either of the following:

  • If you chose to finish the backup process, the Backup Wizard displays the Completing The Backup Wizard settings and then presents the option to finish and immediately start the backup. During the backup, the wizard displays status information about the backup job.
  • If you chose to back up later, additional dialog boxes appear, enabling you to schedule the backup process to occur later, as described in the next section.

Scheduling Active Directory Backup Jobs

Scheduling an Active Directory backup job means that you can have an unattended backup job occur when users are not at work and files are closed. You can also schedule Active Directory backup jobs to occur at regular intervals. To enable this, Windows 2000 integrates Windows Backup with the Task Scheduler service.

To schedule a backup, use the following procedure:

  1. Click Later on the When To Back Up page of the Backup Wizard.

    The Task Scheduler service presents the Set Account Information dialog box, prompting you for your password. The user account must have the appropriate user rights and permissions to perform backup jobs.

    If the Task Scheduler service is not running or not set to start automatically, Windows 2000 displays a dialog box prompting you to start the service. Click OK, and the Set Account Information dialog box appears.
  2. Enter your password in the Password text box and Confirm Password text box, then click OK.

    The When To Back Up page appears. You must provide a name for the backup job, and by default, the wizard displays the present date and time for the start date.

  3. Type an appropriate name in the Job Name text box.
  4. Click Set Schedule to set a different start date and time. This selection causes Task Scheduler to display the Schedule Job dialog box.

    In the Schedule Job dialog box, you can set the date, time, and number of occurrences for the backup job to repeat, such as every Friday at 10:00 PM. You can also display all of the scheduled tasks for the computer by selecting the Show Multiple Schedules check box. This helps to prevent you from scheduling multiple tasks on the same computer at the same time.

    By clicking Advanced, you can also schedule how long the backup can last and for how many days, weeks, months, or years you want this schedule to continue. After you schedule the backup job and complete the Backup Wizard, Windows Backup places the backup job on the calendar in the Schedule Jobs tab in Windows Backup. The backup job automatically starts at the time that you specified.

Preparing to Restore Active Directory

Like the backup process, when you choose to restore Active Directory, you can only restore all of the System State data that was backed up, including the registry, the COM+ Class Registration database, system boot files, the SYSVOL directory, the Active Directory, and the Certificate Services database (if the server is a certificate server). You cannot choose to restore individual components (for example, only the Active Directory).

If you are restoring the System State data to a domain controller, you must choose whether you want to perform a nonauthoritative restore or an authoritative restore. The default method of restoring the System State data to a domain controller is nonauthoritative.

Nonauthoritative Restore

In Nonauthoritative mode, any component of the System State that is replicated with another domain controller, such as the Active Directory database, is brought up to date by replication after you restore the data. For example, if the last backup was performed a week ago, and the System State is restored nonauthoritatively, any changes made subsequent to the backup operation are replicated from the other domain controllers. The Active Directory replication system updates the restored data with newer data from your other servers.

Authoritative Restore

If you do not want to replicate the changes that have been made subsequent to the last backup operation, you must perform an authoritative restore. For example, you must perform an authoritative restore if you inadvertently delete users, groups, or organizational units (OUs) from Active Directory and you want to restore the system so that these objects are recovered and replicated.

To authoritatively restore Active Directory data, you must run the Ntdsutil.exe utility after you have performed a nonauthoritative restore of the System State data but before you restart the server. The Ntdsutil.exe utility enables you to mark objects as authoritative. This changes the update sequence number of an object so it is higher than any other update sequence number in the Active Directory replication system, ensuring that any replicated or distributed data that you have restored is properly replicated throughout your organization. The Ntdsutil.exe utility can be found in the \%systemroot%\system32 directory; accompanying documentation is accessible in the Windows 2000 Help files (available from the Start menu).

For example, suppose you back up the system on Monday, and then create a new user called Mark Lee on Tuesday, which replicates to other domain controllers in the domain, but on Wednesday, another user, Amy Anderson, is accidentally deleted. To authoritatively restore Amy Anderson without reentering information, you can nonauthoritatively restore the domain controller with the backup created on Monday. Then, using Ntdsutil.exe, you can mark Amy Anderson as authoritative. The result is that Amy Anderson is restored without any effect on Mark Lee.

Performing a Nonauthoritative Restore

To restore the System State data on a domain controller, you must first start your computer in a special safe mode called Directory Services Restore Mode. This enables you to restore the SYSVOL directory and the Active Directory database. You can only restore System State data on a local computer. You cannot restore the System State data on a remote computer.

If you restore the System State data and you do not designate an alternate location for the restored data, Backup erases the System State data that is currently on your computer and replaces it with the System State data you are restoring. Also, if you restore the System State data to an alternate location, only the registry files, SYSVOL directory files, and system boot files are restored to the alternate location. The Active Directory database, Certificate Services database, and COM+ Class Registration database are not restored if you designate an alternate location.

Using the Restore Wizard

To nonauthoritatively restore Active Directory, use the following procedure:

  1. Restart the computer.
  2. Press F8 during the startup phase in which you normally select the operating system.
  3. From the Windows 2000 Advanced Options menu, select Directory Services Restore Mode and press Enter. This ensures that the domain controller is offline and is not connected to the network.
  4. At the Please Select The Operating System To Start prompt, select Microsoft Windows 2000 Server and press Enter.
  5. Log on as Administrator.
    When you restart the computer in Directory Services Restore Mode, you must log on as an Administrator by using a valid Security Accounts Manager (SAM) account name and password, not the Active Directory Administrator's name and password, because Active Directory is offline and account verification cannot occur. Rather, the SAM accounts database is used to control access to Active Directory while it is offline. You specified this password when you set up Active Directory.
  6. Click OK in the Desktop message box that warns you that Windows is running in Safe Mode.
  7. Click Start and, from the System Tools program group, select Backup.
  8. In the Welcome To The Windows 2000 Backup And Recovery Tools page, select Restore Wizard.
  9. Click Next to begin using the Restore Wizard.
  10. In the Restore Wizard's What To Restore page (see Figure 19.8), expand the media type that contains the data that you want to restore or click Import File. This can be either tape or file media.

    Figure 19.8 Restore Wizard What To Restore page
  11. Expand the appropriate media set until the data that you want to restore is visible. You can restore a backup set or specific files and folders.
  12. Select the data you want to restore, then click Next.
  13. Do one of the following:
    • Click Finish to start the restore process. The Restore Wizard requests verification for the source of the restore media and then performs the restore. During the restore, the Restore Wizard displays status information about the restore.
    • Click Advanced to specify advanced restore options.

Specifying Advanced Restore Settings

The Advanced settings in the Restore Wizard vary, depending on the type of backup media from which you are restoring. Table 19.3 describes these options.

Table 19.3 Advanced Restore Options

Advanced Settings Page Option Description

Where To Restore

Restore Files To

Specifies the target location for the data that you are restoring. The choices in the list are as follows:

  • Original Location. Replaces corrupted or lost data.
  • Alternate Location. Restores an earlier version of a file to a folder you designate.
  • Single Folder. Consolidates the files from a tree structure into a single folder. For example, use this option if you want copies of specific files but do not want to restore the hierarchical structure of the files. If you select either an alternate location or a single folder, you must also provide the path.

How To Restore

When Restoring Files That Already Exist

Specifies whether or not to overwrite existing files. The choices are as follows:

  • Do Not Replace The File On My Disk. Prevents accidental overwriting of existing data. This is the default.
  • Replace The File On Disk Only If It Is Older Than The Backup Copy. Verifies that the most recent copy exists on the computer.
  • Always Replace The File On Disk. Windows Backup does not provide a confirmation message if it encounters a duplicate filename during the restore operation.

Advanced Restore Options

Select The Special Restore Options You Want To Use

Specifies whether or not to restore security or special system files. The choices are as follows:

  • Restore Security. Applies the original permissions to files that you are restoring to a Windows NTFS volume. Security settings include access permissions, audit entries, and ownership. This option is only available if you have backed up data from an NTFS volume and are restoring to an NTFS volume.
  • Restore Removable Storage Database. Restores the configuration database for removable storage management (RSM) devices and the media pool settings. The database is located in systemroot\ System32\Ntmsdata.
  • Restore Junction Points, Not The Folders And File Data They Reference. Restores junction points on your hard disk as well as the data that the junction points refer to. If you have any mounted drives and you want to restore the data that the mounted drives point to, you should select this check box. If you do not select this check box, the junction point is restored but the data your junction point refers to might not be accessible.

After you have finished the Restore Wizard, Windows Backup prompts you to verify your selection of the source media to use to restore data. After the verification, Windows Backup starts the restore process. After the restore process begins, Windows Backup displays status information about the job.

Performing an Authoritative Restore

An authoritative restore occurs after a nonauthoritative restore and uses Ntdsutil.exe to designate the entire directory, a subtree, or individual objects to be recognized as authoritative with respect to replica domain controllers in the forest.

To authoritatively restore Active Directory, use the following procedure:

  1. Perform a nonauthoritative restore as described previously.
  2. Restart the computer.
  3. Press F8 during the startup phase in which you normally select the operating system.
  4. From the Windows 2000 Advanced Startup Options menu, select Directory Services Restore Mode and press Enter. This ensures that the domain controller is offline and is not connected to the network.
  5. Select Windows 2000 Server.
  6. Log on as Administrator.
    When you restart the computer in Directory Services Restore Mode, you must log on as an Administrator by using a valid SAM account name and password, not the Active Directory administrator's name and password, because Active Directory is offline and account verification cannot occur. Rather, the SAM accounts database is used to control access to Active Directory while it is offline.
  7. In the Desktop message box that warns you that Windows is running in Safe Mode, click OK.
  8. Click Start, point to Programs, point to Accessories, then select Command Prompt.
  9. At the command prompt, type ntdsutil and press Enter.
  10. At the Ntdsutil prompt, type authoritative restore and press Enter.
  11. At the authoritative restore prompt:
    • To authoritatively restore the entire directory, type restore database and press Enter.
    • To authoritatively restore a portion or subtree of the directory, such as an OU, use the OU's distinguished name, type restore subtree <subtree distinguished name> and press Enter.

      For example, to restore the Security1 OU in the Microsoft.com domain, the commands would be:

      ntdsutil
      authoritative restore
      restore subtree OU=Security1,DC=Microsoft,DC=COM
    • To authoritatively restore the entire directory and override the version increase, type restore database verinc <version increase> and press Enter.
    • To authoritatively restore a subtree of the directory and override the version increase, type restore subtree <subtree distinguished name>verinc <version increase> and press Enter.

    The authoritative restore opens Ntds.dit, increases version numbers, counts the records that need updating, verifies the number of records updated, and reports completion. If a version number increase is not specified, one is automatically calculated.

  12. Type quit and press Enter to exit the Ntdsutil.exe utility, then close the command prompt window.
  13. Restart the domain controller in normal mode and connect the restored domain controller to the network.

When the restored domain controller is online and connected to the network, normal replication brings the restored domain controller up to date with any changes from the additional domain controllers that were not overridden by the authoritative restore. Replication also propagates the authoritatively restored objects to other domain controllers in the forest. The deleted objects that were marked as authoritative are replicated from the restored domain controller to the additional domain controllers. Because the objects that are restored have the same object globally unique identifier (GUID) and object security identifier (SID), security remains intact, and object dependencies are maintained.

Additional Tasks for Authoritatively Restoring the Entire Active Directory Database

When you authoritatively restore the entire Active Directory database, you also must perform an additional procedure involving the Sysvol directory. This is necessary to ensure the integrity of the computer's group policy. To ensure the proper elements are authoritatively restored, you must copy the Sysvol directory on the alternate location over the existing one after the Sysvol share is published.

When you authoritatively restore only a portion of the Active Directory database (including policy objects), you also must perform another procedure involving the Sysvol directory. To ensure the proper elements are authoritatively restored, you must also copy only the policy folders (identified by the GUID) corresponding to the restored Policy objects from the alternate location after the Sysvol share is published. Then, copy them over the existing ones.

When authoritatively restoring either the entire Active Directory database or selected objects, it is important that you copy the Sysvol and policy data from the alternate location after the Sysvol share is published. If the computer is in a replicated domain, it may take several minutes before the Sysvol share is published because it needs to synchronize with its replication partners. If all computers in the domain are authoritatively restored and restarted at the same time, then each will be waiting (indefinitely) to synchronize with each other. In this case, restore one of the domain controllers first so that its Sysvol share can be published; then restore the other computers nonauthoritatively.

Lesson Review

The following questions will help you determine whether you have completed the work. If you have difficulty answering the questions, you can review the material in this lesson. For the answers to these questions, see the Appendix.

  1. When backing up Active Directory, what type of data must you specify to be backed up? What is included in this data type?
  2. When you restart the computer in Directory Services Restore Mode, what logon must you use? Why?
  3. How does Windows Backup verify the data written to the backup medium?

Lesson Summary

  • To back up Active Directory you must back up System State data.
  • You can only back up and restore System State data as a whole; you cannot work with individual System State components.
  • When restoring the System State data in Nonauthoritative mode, any component of the System State data that is replicated with another domain controller, such as the Active Directory database, is brought up to date by replication after you restore the data.
  • When restoring the System State data in Authoritative mode, changes that have been made subsequent to the last backup operation are not restored; the deleted objects are recovered and replicated.
  • To perform an authoritative restore, use the Ntdsutil.exe command-line utility.


Questions and Answers

Chapter 1

Lesson 1: Understanding the Windows 2000 Networking Architecture

Lesson Review Questions

  1. Which component enables the Client for Microsoft Networks to use any installed protocol?
    1. NDIS
    2. NetBEUI
    3. TDI
    4. UDP

    c

  2. How do you prevent a network interface adapter from using one of the protocol modules installed on the computer?

    You unbind the protocol by opening the network connection's Properties dialog box and clearing the check box next to the protocol you want to disable.

  3. Which type of component enables an application running on a Windows 2000 computer to open a file on a shared network drive?
    1. A service
    2. A redirector
    3. A boundary layer
    4. An API

    b

  4. Give two reasons why NetBEUI was replaced by TCP/IP as the Windows default networking protocol.

    Because NetBEUI does not support communications with the Internet and because it is not routable.

Lesson 2: Using Microsoft Management Console

Lesson Review Questions

  1. When you use the Administrative Tools program group to open an MMC console provided with Windows 2000 Server, can you add snap-ins to it? Why or why not?

    No, snap-ins cannot be added to preconfigured MMC consoles when you open them from the Administrative Tools program group. These consoles are configured for User Mode operation.

  2. The MMC consoles accessible through the Administrative Tools program group are of which type?
    1. Custom
    2. Extension
    3. Stand-alone
    4. Preconfigured

    d

  3. What can you do to limit the functions provided by a stand-alone snap-in?

    Removing extensions from the stand-alone snap-in deletes the specific features provided by the extension from the console.

Chapter 2

Lesson 1: Installing New Hardware

Lesson Review Questions

  1. What is the name of the software component that enables the operating system to communicate with a hardware device?
    1. An interrupt
    2. A DMA channel
    3. A device driver
    4. A device manager

    c

  2. How does Plug and Play automate the hardware installation process?

    By detecting new hardware in the computer, installing device drivers for it, and configuring both the hardware and the driver to use the same system resources.

  3. Which of the following tasks can the Windows 2000 Add/Remove Hardware Wizard never perform for a hardware device that doesn't support Plug and Play?
    1. Detect a new hardware device
    2. Install device driver software
    3. Modify the system resource configuration for the device driver
    4. Modify the system resource configuration for the hardware device

    d

Lesson 2: Installing Updates

Exercise Questions

Exercise 2.2: Update Deployment Technologies

Match the technology in the numbered list with the correct definition.

  1. Slipstreaming
  2. SMS
  3. Hotfix
  4. Group policies
  5. WINVER.EXE
  1. Schedules an automated service pack installation to occur at a specific time
  2. Determines which service pack has most recently been installed
  3. Installs Windows 2000 and a service pack at the same time
  4. Installs a single software patch
  5. Installs a service pack during the next system startup
  1. c
  2. a
  3. d
  4. e
  5. b

Lesson Review Questions

  1. Which of the following commands do you use to extract the files from a service pack release called W2ksp2.exe?
    1. W2ksp2
    2. W2ksp2 -s
    3. W2ksp2 -x
    4. Update -s

    c

  2. Which of the following service pack installation tools or techniques can you use only on a new Windows 2000 operating system installation?
    1. Active Directory group policy objects
    2. SMS
    3. Windows Update
    4. Slipstreaming

    d

  3. What are two advantages of releasing operating system updates in the form of service packs, instead of individual patch releases?

    The possible advantages are as follows:

    • Service packs ensure that the computer has the most recent version of every file.
    • Service packs simplify the update process by installing multiple patches at one time.
    • Service packs ensure a uniform software environment on the computer, for troubleshooting purposes.

Lesson 3: Managing Client Access Licenses

Lesson Review Questions

  1. Which of the following tasks can you not perform using the Licensing tool in Control Panel? (Choose all that apply.)
    1. Add Per Server licenses to the local server.
    2. Add Per Server licenses to a remote server.
    3. Change the licensing mode for the local server from Per Seat to Per Server.
    4. Change the licensing mode for the local server from Per Server to Per Seat.

    b and c

  2. On a network with 250 users and 12 Windows 2000 servers, each of the servers has a maximum of 30 users connected to it at any given time. Which of the two licensing modes would enable the network to operate with fewer CALs, Per Seat or Per Server?

    Per Seat

  3. What are two advantages of releasing operating system updates in the form of service packs, instead of individual patch releases?

    The possible advantages are as follows:

    • Service packs ensure that the computer has the most recent version of every file.
    • Service packs simplify the update process by installing multiple patches at one time.
    • Service packs ensure a uniform software environment on the computer, for troubleshooting purposes.

Lesson 4: Troubleshooting Boot Problems

Lesson Review Questions

  1. Which of the following advanced boot options is functional only on a Windows 2000 Server domain controller?
    1. Enable Boot Logging
    2. Last Known Good Configuration
    3. Directory Services Restore Mode
    4. Debugging Mode

    c

  2. Which of the following is the primary advantage of having a parallel installation?
    1. You can enable and disable services from the command prompt.
    2. You can access NTFS drives when Windows 2000 fails to boot.
    3. You can bypass the system's video driver.
    4. You can access FAT file system drives.

    b

Chapter 3

Lesson 1: Managing Data Storage

Exercise Questions

Exercise 3.1: Understanding Windows 2000 Storage Terminology

Match the terms in the left column with the statements in the right column.

  1. Extended partition
  2. Logical drive
  3. Primary partition
  4. System partition
  5. Unallocated space
  1. Can be made active
  2. Contains the operating system files
  3. The unpartitioned part of a disk
  4. Only one permitted per basic disk
  5. Part of an extended partition
  1. d
  2. e
  3. a
  4. b
  5. c

Lesson Review Questions

  1. Which of the following steps is not required when installing a new basic disk in a Windows 2000 computer?
    1. Specify a storage type (basic or dynamic).
    2. Create a partition.
    3. Create logical drives.
    4. Format the volumes.

    a

  2. What is the maximum number of primary partitions permitted on a basic disk?
    1. None
    2. One
    3. Three
    4. Four

    d

  3. Why doesn't Windows 2000 format all of its drives using the NTFS file system?

    Because only Windows 2000 and Windows NT support NTFS, making it impossible to create a dual-boot environment with another operating system, such as Windows 98.

Lesson 2: Creating Dynamic Disks

Exercise Questions

Exercise 3.2: Creating and Mounting a Volume

  5. Click Next to bypass the Welcome page and proceed to the Select Volume Type page.

    Notice that Simple Volume is the only available option. Why is this?

    The only option available is Simple Volume because only one drive is available. Spanned and striped volumes both require at least two drives.

  16. Click Properties to display the Mounted Vol Properties dialog box.

    How much free space is available on the volume?

    Mounted Vol Free Space indicator reflects the amount of free space on the simple partition you just created, not on the disk where you mounted the volume.

Lesson Review Questions

  1. Why does a striped volume provide better performance than a spanned volume?

    A striped volume provides better performance because it writes small amounts of data to each disk in succession, as opposed to a spanned volume, which fills up one entire disk before proceeding to the next one.

  2. Which of the following conditions is not required to extend a spanned volume?
    1. The volume to be extended must not be the boot volume.
    2. The volume to be extended must use the NTFS file system.
    3. The volume to be extended must be located on a disk with unallocated space.
    4. The volume to be extended must not be the system volume.

    c

  3. How does mounting a simple volume as a folder on another volume affect the capacity of the disk containing the folder?

    Mounting a volume as a folder does not affect the volume of the disk where the folder is located in any way. The disk space used to create the new volume remains separate from that of the disk hosting it.

Lesson 3: Implementing Storage Quotas

Exercise Questions

Exercise 3.3: Configuring Quota Management Settings

  3. Select Enable Quota Management.

    What is the default disk space limit for new users?

    1 KB

  7. Click Apply.

    What happens?

    Windows 2000 displays the Disk Quota message box, warning you that the volume must be rescanned to update disk usage statistics if you enable quotas.

Lesson Review Questions

  1. Which file systems must a Windows 2000 drive use to enable disk quota management?
    1. FAT or FAT32
    2. NTFS only
    3. NTFS or FAT32
    4. FAT32 only

    b

  2. When quota management is enabled, how does Windows 2000 track disk space usage?
    1. Per user
    2. Per volume
    3. Per user and per volume
    4. Per user, per volume, and per file system

    c

  3. How do Windows 2000 quotas compensate for data stored compressed volumes?

    They do not. Windows 2000 quotas ignore compression and charge users for every uncompressed byte they store, regardless of how much disk space the data actually occupies.

Lesson 4: Managing Compression and Encryption

Lesson Review Questions

  1. Which of the following actions can't you perform on a file encrypted with EFS? (Choose all that apply.)
    1. Compress it
    2. Transmit it over the network
    3. Open it with a non-Microsoft application
    4. Copy it to a FAT volume

    a and b

  2. What happens when you move a compressed NTFS file to an uncompressed folder on another NTFS volume?

    The file remains compressed, despite being stored on an uncompressed volume.

  3. EFS can encrypt files in which of the following states?
    1. Uncompressed files stored on NTFS volumes
    2. Uncompressed files stored on FAT volumes
    3. Compressed files stored on NTFS volumes
    4. Compressed files stored on FAT volumes

    a

Chapter 4

Lesson 1: Understanding NTFS Permissions

Exercise Questions

Exercise 4.1: Planning NTFS Permissions

In this exercise, you plan how to assign NTFS permissions to folders and files on a computer running Microsoft Windows 2000 Server. Review the following security requirements and record the changes that you should make to the NTFS folder and file permissions to meet those criteria:

  • Administrators require the Full Control permission for all folders and files.
  • All users run programs in the \WordProc folder, but they should not be able to modify the files in the \WordProc folder.
  • Only members of the Accounting, Managers, and Executives groups should be able to read documents in the \Spreadsh and \Database application folders by running the associated applications, but they should not be able to modify the files in those folders.
  • All users should be able to read and create files in the \Public folder.
  • All users should be prevented from modifying files in the \Public\Library folder.
  • Only user mlee should be able to modify and delete files in the \Public\Manuals folder.

Use Table 4.3 to plan and record your permission assignments.

Table 4.3 Permissions Planning Table for Exercise 4.1

Path | User Account or Group | NTFS Permissions | Block Inheritance (Yes/No)
\Apps | Administrators | Full Control | No
\Apps\WordProc | Users | Read & Execute | No
\Apps\Spreadsh | Accounting Managers Executives | Read & Execute Read & Execute Read & Execute | No
\Apps\Database | Accounting Managers Executives | Read & Execute Read & Execute Read & Execute | No
\Public | Administrators Creator Owner Users | Full Control Full Control Write | No
\Public\Library | Administrators Users | Full Control Read & Execute | Yes
\Public\Manuals | Administrators Users mlee | Full Control Read & Execute Full Control | Yes

Lesson Review Questions

  1. If a user has Write permission for a folder and is also a member of a group with Read permission for the folder, what are the user's effective permissions for the folder?

    The user has both Read permission and Write permission for the folder because NTFS permissions are cumulative.

  2. If you assign the Modify permission to a user account for a folder and the Read permission for a file and then copy the file to that folder, which permission does the user have for the file?

    The user can modify the file because the file inherits the Modify permission from the folder.

  3. If a user has both the Read and Write permissions to a folder and is denied the Write permission to one of the files in that folder, what are the user's effective permissions for that one file?

    The user can read the file but not write to it, because deny entries always take precedence over allow entries.

Lesson 2: Assigning NTFS Permissions

Exercise Questions

Exercise 4.2: Assigning NTFS Permissions for the \Data Folder

Procedure 1: Removing Permissions from the Everyone Group

  5. Click the Security tab to display the permissions for the \Data folder. Notice that the Allow check boxes are shaded, indicating that the permissions are inherited and cannot be modified. What are the existing folder permissions?

    The Everyone group has Full Control.

  6. In the Name list, select the Everyone group, and then click Remove. What do you see?

    Windows 2000 displays a message box, indicating that the folder is inheriting the permissions for the Everyone group from its parent folder. To change permissions for the Everyone group, you must first block inheritance.

  9. Click Remove. What are the existing folder permissions?

    There are now no permissions assigned for the Data folder.

Procedure 2: Assigning Permissions to the Users Group for the Data Folder

  4. Click OK to return to the Data Properties dialog box. What are the existing allowed folder permissions?

    The Domain Users group has the following permissions: Read & Execute, List Folder Contents, and Read. Windows 2000 assigns these default permissions when you add a user account or group to the list of permissions.

Procedure 3: Assigning Permissions to the CREATOR OWNER Group for the \Data Folder

  4. Click OK to return to the Data Properties dialog box. What are the existing allowed folder permissions?

    Notice the Domain Users group has the following permissions: Read & Execute, List Folder Contents, Read, and Write. The CREATOR OWNER group has no permissions.

  6. Click Apply to save your changes. What do you see?

    For the CREATOR OWNER group, none of the Allow check boxes is selected for any permissions. A note appears next to Advanced stating Additional Permissions Are Present But Not Viewable Here. Press Advanced To See Them.

  8. Click the Permissions tab if necessary, and in the Permission Entries list, choose Creator Owner. What permissions are assigned to the Creator Owner group and where do these permissions apply? Why?

    The CREATOR OWNER group has Full Control permission. However, this permission applies only to subfolders and files. Permissions that are assigned to the CREATOR OWNER group are not applied to the folder but only to new files and folders that are created within the folder. The user who creates the new file or folder receives the permissions that are assigned to CREATOR OWNER for the parent folder and must belong to other groups that are capable of writing to the new files and folders.

Procedure 4: Testing the \Data Folder Permissions You Assigned

  3. In the \Data folder, create a new text file. Were you successful? Why or why not?

    You can perform this task because the user account you used to log on to the network is a member of the Domain Users group, which is assigned the Write permission for the \Data folder.

  4. Attempt to open, modify, and delete the file that you just created, and then record those tasks that you are able to complete.

    You can perform these tasks because CREATOR OWNER has been assigned the NTFS Full Control permission for the \Data folder.

Exercise 4.3: Assigning NTFS Permissions

Procedure 2: Testing NTFS Permissions

  3. Attempt to create a new file in the \Reports folder. Were you successful? Why or why not?

    No, because only the user rcarey, the Managers group, and the Administrators group have permissions to create and modify files in the \Reports folder.

  5. Attempt to create a new file in the \Sales folder. Were you successful? Why or why not?

    No, because only the Sales group has the permissions needed to create and modify files in the \Sales folder.

  9. Attempt to create a new file in the \Reports folder. Were you successful? Why or why not?

    Yes, because rcarey has the Modify permission for the \Reports folder.

  11. Attempt to create a new file in the \Sales folder. Were you successful? Why or why not?

    Yes, because rcarey is a member of the Sales group, which has the Modify permission for the \Sales folder.

  15. Attempt to create a file in the \Sales folder. Were you successful? Why or why not?

    Yes, because the Domain Admins group has the Full Control permission for the folder.

Lesson Review Questions

  1. What is the difference between the CREATOR OWNER group and a normal group?

    The permissions assigned to the CREATOR OWNER group apply only to the files and subfolders in the folder to which the permissions are assigned, not to the folder itself.

  2. In the Security tab of a Properties dialog box for a folder, what does a shaded check box mean?

    A shaded check box means that the permission was inherited from a parent folder.

  3. List two of the basic guidelines you should use when assigning NTFS permissions.

    Possible Answers:

    • Group files into application, data, and home folders to simplify administration.
    • Grant users only the level of access that they require.
    • Assign group memberships based on the access to resources that users require and then assign the appropriate permissions to the group.
    • Deny permissions only when it is absolutely essential to do so.
    • Parent To Propagate To This Object check box.

Lesson 3: Assigning Special Permissions

Exercise Questions

Exercise 4.4: Taking Ownership of a File

Procedure 1: Assigning the Take Ownership Special Permission

  4. Click the Security tab to display the permissions for the Test.txt file. What are the current allowed permissions for Test.txt?

    The Administrators group has the Full Control permission, and that the Users group has the Read & Execute permission.

  6. Click the Owner tab. Who is the current owner of the Test.txt file?

    The Administrators group is the current owner of the file.

Procedure 2: Taking Ownership of a File

  7. Click the Owner tab. Who is the current owner of Test.txt?

    The current owner of Test.txt is the Administrators group.

Lesson Review Questions

  1. If an employee leaves the company, what must you do to transfer ownership of his or her files and folders to another employee?

    You must be logged on as Administrator to take ownership of the employee's files and folders. Assign the Take Ownership special permission to another employee to allow that employee to take ownership of the folders and files. Notify the employee to whom you assigned Take Ownership to take ownership of the files and folders.

  2. What is the relationship between special permissions and standard permissions?

    Standard permissions are combinations of special permissions that are commonly used together.

  3. Which special permission enables you to browse through folders you do not have permission to access?
    1. List Folders
    2. Traverse Folders
    3. Read Attributes
    4. Read Extended Attributes

    b

Chapter 5

Lesson 1: Creating Drive and Folder Shares

Lesson Review Questions

  1. To share a folder, you must belong to one of which three groups?

    Only members of the Administrators, Server Operators, or Power Users groups can share folders.

  2. How do you share a folder while causing it to remain hidden from users browsing the network?

    To create a hidden share, you append a dollar sign ($) to the end of the share name.

  3. What are the four ways that users can connect to a shared folder?

    Users can use the Map Network Drive Wizard, the Add Network Place Wizard, the Run Command, or My Network Places.

Lesson 2: Using Distributed Files System

Exercise Questions

Exercise 5.1: Using Dfs

Procedure 3: Accessing a Dfs Root

  2. Double-click trey1. Windows Explorer displays a list of all shared folders on your domain controller. Notice that one of the shared folders is Shared Apps, your Dfs root.

    Does Windows 2000 provide an indication that Shared Apps is a Dfs root and not an ordinary shared folder?

    Windows 2000 does not indicate that the share is a Dfs root.

  3. Double-click Shared Apps to view the Dfs links. Windows Explorer displays the Shared Apps On Trey1 window, which shows all the Shared Apps links.

    Does Windows 2000 indicate that the folders inside Shared Apps are Dfs links and not ordinary folders?

    Windows 2000 does not indicate that the folders are Dfs links.

Lesson Review Questions

  1. How does Dfs facilitate network navigation for users?

    A user who navigates a Dfs-managed shared folder does not need to know the name of the server where the folder is actually shared. After connecting to the Dfs root, users can browse for and gain access to all of the resources that are contained within each link, regardless of the location of the server on which the resource is located.

  2. What is the difference between a domain root and a stand-alone root?

    A domain root stores the Dfs topology as part of Active Directory, while a stand-alone root stores the Dfs topology on a single computer.

  3. Which of the following elements are required to use automatic replication of Dfs links?
    1. You must use a domain Dfs root, and the drive where the Dfs root is located must use NTFS.
    2. You can use either type of Dfs root, and all Dfs links must be located on NTFS drives.
    3. You must use a stand-alone root, and the first Dfs link must be located on an NTFS drive.
    4. You must use a domain Dfs root, and all Dfs links must be located on NTFS drives.

    d

Lesson 3: Installing Network Printers

Lesson Review Questions

  1. What is the difference between a print device and a printer?

    A print device is the hardware that creates printable pages or a file on a disk (print to file) that has been processed through a printer. A printer is the software interface to one or more print devices.

  2. Which of the following Windows 2000 printing elements provides information about the number and type of paper trays in a print device?
    1. Printer
    2. Print device
    3. Print server
    4. Printer driver

    d

  3. Which of the following Windows 2000 printing elements usually takes the form of hardware?
    1. Printer
    2. Print device
    3. Print server
    4. Printer driver

    b and c

Lesson 4: Administering Network Printers

Lesson Review Questions

  1. You have configured two Windows 2000 print servers on your network. When a user connects to one from Windows 95, printing is automatic. When the same user connects to the same print server for a different printer, the user is prompted to install a driver. Why is this happening?

    One printer installed on the print server has been configured with additional drivers, specifically the Windows 95 or Windows 98 printer driver. The other printer has not been configured with additional drivers.

  2. In an environment in which many users print to the same print device, how can you help reduce the likelihood of users picking up the wrong documents?

    Create a separator page that identifies and separates printed documents.

  3. Can you redirect a single document?

    No. You can change the configuration of the print server only to send documents to another printer or print device; this change redirects all documents on that printer. The currently spooled or active document cannot be redirected.

Lesson 5: Managing Share Permissions

Exercise Questions

Exercise 5.3: Applied Permissions

  1. User 1 is a member of Group 1, Group 2, and Group 3. Group 1 has Read permission and Group 3 has Full Control permission for Folder A. Group 2 has no permissions for Folder A. What are User 1's effective permissions for Folder A?

    Because User 1 has permissions of all groups, User 1's effective permission for Folder A is Full Control, which also includes all capabilities of the Read permission.

  2. User 1 is also a member of the Sales group, which has Read permission for Folder B. User 1 has been denied the shared folder Full Control permission for Folder B as an individual user. What are User 1's effective permissions for Folder B?

    User 1 has no access to Folder B. Even though User 1 is a member of the Sales group, which has Read permission for Folder B, User 1 has been denied Full Control access to Folder B. Denied permissions override all other permissions.

Exercise 5.4: Managing Shared Folders

  1. In the first example, the \Data folder is shared. The Sales group has the shared folder Read permission for the \Data folder and the NTFS Full Control permission for the \Sales subfolder. What are the Sales group's effective permissions for the \Sales subfolder when Sales group members access the \Sales subfolder by making a connection to the \Data shared folder?

    The Sales group has Read permission for the \Sales subfolder because when shared folder permissions are combined with NTFS permissions, the more restrictive permission applies.

  2. In the second example, the \Users folder contains user home folders. Each user home folder contains data that is accessible only to the user for whom the folder is named. The \Users folder has been shared, and the Users group has the shared folder Full Control permission for the \Users folder. User 1 and User 2 have the NTFS Full Control permission only for their home folder and no NTFS permissions for other folders. These users are all members of the Users group. What permissions does User 1 have when accessing the \User 1 subfolder by making a connection to the \Users shared folder? What are User 1's permissions for the \User 2 subfolder?

    User 1 has the Full Control permission for the \User 1 subfolder because both the shared folder permission and the NTFS permission allow Full Control. User 1 cannot access the \User 2 subfolder because the user has no NTFS permissions to gain access to it.

Lesson Review Questions

  1. When a folder is shared on a FAT volume, what does a user with the shared folder Full Control permission for the folder have access to?

    All folders and files in the shared folder.

  2. What are the shared folder permissions?

    Full Control, Change, and Read.

  3. By default, what are the permissions that are assigned to a shared folder?

    The Everyone group is assigned the Full Control permission.

  4. When a folder is shared on an NTFS volume, what does a user with the shared folder Full Control permission for the folder have access to?

    Only the folder, not necessarily any of the folder's contents. The user also needs NTFS permissions for each file and subfolder in the shared folder to gain access to those files and subfolders.

Chapter 6

Lesson 1: Monitoring Server Performance

Exercise Questions

Exercise 6.1: Monitoring System Performance Parameters

  10. Click Close. What do you see?

    You see two lines in the graph, representing the two counters. To make the counter values easier to read, you might have to click Properties and adjust the Vertical Scale parameters in the Graph tab.

  11. Click View Histogram and then View Report. What do you see when you click these buttons?

    You see the same counter information expressed in different formats, a histogram-style bar graph and a report with numerical indicators.

Lesson Review Questions

  1. Name two methods for opening the Windows 2000 Task Manager.

    Press Ctrl+Alt+Del and click the Task manager button in the Windows Security dialog box or right-click any empty space on the toolbar and select Task manager from the pop-up menu.

  2. Which three logs does Windows 2000 display in Event Viewer by default?

    The system log, the security log, and the application log.

  3. Which of the following tools is capable of displaying the amount of CPU resources that kernel operations consumed?
    1. Event Viewer
    2. System Monitor
    3. Task Manager
    4. Performance Logs and Alerts

    c

Lesson 2: Monitoring Shared Resources

Exercise Questions

Exercise 6.2: Creating a Shared Folder

  3. From the Name list, select another computer running Windows 2000 on your network and click OK. What happens?

    The root icon in the Computer Management console changes to reflect the computer you selected.

Lesson Review Questions

  1. What is the danger inherent in disconnecting a user from a share without prior notification?

    If the user is currently working on a shared file and has not saved changes, those changes will be lost when the connection is severed.

  2. Which of the following tasks cannot be performed by the Shared Folders snap-in?
    1. Send an administrative message to another user on the network.
    2. Share an existing folder on the local computer.
    3. Create a new shared folder on a remote computer.
    4. Share an existing printer on the local computer.

    d

  3. What must you do before modifications that you have made to the NTFS permissions for a shared folder have their full effect?

    Disconnect all users currently connected to the share, forcing them to reconnect using the new permissions.

Lesson 3: Microsoft Windows 2000 Auditing

Lesson Review Questions

  1. Where does Windows 2000 store the information gathered during the auditing process?

    Auditing information is stored in the security log on the computer where the event occurred.

  2. What command-line program do you use to refresh the audit policy on a Windows 2000 computer?

    Secedit.exe

  3. What steps must you follow to enable auditing of specific file objects on domain controllers in a domain where Group Policy is enabled?

    Use Active Directory Users And Computers to open a group policy (typically the Default Domain GPO or the Default Domain controller Policy GPO). Navigate to the Audit Policy node below the Windows Settings - Security Settings - Local Policies node. In the details pane, double-click Audit Object Access and enable success or failure attempts as appropriate. Using Windows Explorer, navigate to the specific file or folder that you need to access. Access the properties of the file or folder object, click the Security tab, then click the Advanced button. From the Access Control Settings dialog box, select View/Edit to modify the audit policy of a selected user or group or add a new user or group to audit. Be cautious about how much file object auditing you configure. This feature can be processor intensive if it is configured improperly.

Chapter 7

Lesson 1: Creating User and Computer Objects

Exercise Questions

Exercise 7.1: Creating Domain User Accounts

  3. Click the Users folder in your domain. Notice that the default user accounts appear in the details pane. Which user accounts does the Active Directory Installation Wizard create by default?

    Administrator, Cert Publishers, DHCP Administrators, DHCP Users, DnsAdmins, DnsUpdateProxy, Domain Admins, Domain Computers, Domain Controllers, Domain Guests, Domain Users, Enterprise Admins, Group Policy CREATOR OWNERs, Guest, IUSR_SERVER1, IWAM_SERVER1, krbtgt, RAS and IAS Servers, SchemaAdmins, and TsInternet User. (Your answers may vary.)

  4. Right-click the Users folder and, from the New menu, choose User. Windows 2000 displays the New Object - User dialog box. Where in the Active Directory will the new user account be created?

    In the Users container in your domain.

  8. In the list to the right of the User Logon Name box, select your domain name. The user logon name, combined with the domain name in the box that appears to the right of the User Logon Name box, is the user's full logon name. This name uniquely identifies the user throughout the directory (for example, jberry@microsoft.com). Windows 2000 completes the User Logon Name (earlier versions of Windows) box for you. When is the earlier versions of Windows logon name used?

    The user's logon name for earlier versions of Windows is used to log on to the Windows 2000 domain from a computer running a previous version of Microsoft Windows.

  11. Select the User Must Change Password At Next Logon check box.

    What are the results of selecting both the User Must Change Password At Next Logon check box and the User Cannot Change Password check box? Explain.

    Windows 2000 displays an Active Directory message box with the following message: You Cannot Check Both User Must Change Password At Next Logon And User Cannot Change Password For The Same User. The next time that the user attempts to log on, the user would be prompted to change his or her password and would not be able to log on until the password has been changed. However, Windows 2000 will not allow the user to change his or her password, so the user would not be able to log on successfully.

    Under what circumstances would you select the Account Is Disabled check box when creating a new user account?

    Some possible answers include: If the account is for a user who has not yet started at the company, or if a user is taking a leave of absence.

Lesson Review Questions

  1. What different capabilities do local user accounts and domain user accounts provide to users?

    A local user account enables the user to log on at and gain access to resources only on the computer where you create the local user account. A domain user account allows a user to log on to the domain from any computer on the network and to gain access to resources anywhere in the domain, provided the user has permission to access these resources.

  2. Which of the following types of Windows 2000 computers does not have local user accounts?
    1. A Windows 2000 Professional workstation
    2. A Windows 2000 Server domain controller
    3. A Windows 2000 Server member server
    4. A Windows 2000 Server stand-alone server

      b

  3. What information is required to create a domain user account?

    A first or last name, logon name, and pre-Windows 2000 logon name.

Lesson 2: Maintaining User Accounts

Exercise Questions

Exercise 7.2: Disabling and Enabling a User Account

Procedure 1: Disabling a User Account

  6. In the details pane of the Active Directory Users and Computers console, right-click the user account that you just disabled to display the shortcut menu. How can you tell that the user account is disabled?

    The Enable Account option appears on the shortcut menu, and a red X appears on the user icon in the details pane.

  8. Attempt to log on using Jo Berry's account, with the logon name jberry and the password gobloots. Were you successful? Why or why not?

    The logon attempt fails because the account is disabled.

Procedure 2: Enabling a User Account

  6. In the details pane of the Active Directory Users and Computers console, right-click the user account that you just enabled to display the shortcut menu. How can you tell that the user account is enabled?

    The Disable Account option appears on the shortcut menu, and the red X is removed from the user icon in the details pane.

  8. Attempt to log on using Jo Berry's account, with the logon name jberry and the password gobloots. Were you successful? Why or why not?

    Yes, because the account is enabled.

Procedure 3: Resetting the Password for a User Account

  9. Attempt to log on using Jo Berry's account, with the logon name jberry and the original password: gobloots. Were you successful? Why or why not?

    No. The logon attempt fails, because the password has been changed.

  10. Log on again using the logon name jberry and the new password: babaloo. Were you successful? Why or why not?

    Not immediately. Because User Must Change Password At Next Logon was selected, the Logon Message appears, stating that the password has expired and must be changed. Then the Change Password dialog box appears where a new password known only to the user must be chosen and confirmed. Only then is jberry allowed to log on.

Lesson Review Questions

  1. Why would you rename a user account and what is the advantage of doing so?

    Rename a user account if you want a new user to have all of the properties of a former user, including permissions, desktop settings, and group membership. The advantage of renaming an account is that you do not have to rebuild all of the properties like you do for a new user account.

  2. How does Active Directory prevent people from learning other users' passwords?

    By enabling even administrators to reset passwords only, not view them.

  3. How can you tell when a user object is disabled?

    The Enable Account command appears on the shortcut menu, and a red X appears on the user icon in the details pane.

Lesson 3: Creating User Profiles

Lesson Review Questions

  1. What is the difference between a local user profile and a roaming user profile?

    A local user profile is stored on the computer to which the user logs on. A roaming user profile is stored on a domain server and is copied to the client computer to which the user logs on.

  2. What do you do to ensure that a user on a client computer running Windows 2000 has a roaming user profile?

    First, create a shared folder on a network server. Second, for each user account, in the Properties dialog box for each user, provide a path to the shared folder on the server. The next time the user logs on, the roaming user profile is created.

  3. How can you ensure that a user has a centrally located home folder?

    First, create and share a parent folder on a server. Second, change the permission for the folder to Full Control for the Users group. Third, provide a path to the shared folder, including the name of the individual user's home folder (\\server_name\shared_folder_name\ user_logon_name).

Chapter 8

Lesson 1: Using Group Objects

Exercise Questions

Exercise 8.1: Planning New Group Accounts

Record your planning strategies in the Group Accounts Planning Worksheet and then answer the questions that follow it. Use these instructions to complete the worksheet:

  1. In the worksheet, provide a name for each group. Record each name in the Group Name column.
  2. Specify type and scope of the group.
  3. List the members of the group.

Group Accounts Planning Worksheet

Group Name | Type and Scope | Members
Testers | Security, global | All product testers
Customer Service Reps | Security, global | All customer service representatives
Maint Workers | Security, global | All maintenance workers
Managers | Security, global | All managers
Sales Reps | Security, global | All sales reps
Network Admin | Security, global | All network administrators
All Employees | Security, global | All employees
Topics Employees | Security, global | Employees interested in manufacturing topics
Customer Database | Security, domain local | Customer service reps, managers, sales reps
Company Policies | Security, domain local | All employees
Microsoft Office | Security, domain local | Testers, customer service reps, managers, sales reps, network administrators
Sales Reports | Security, domain local | Sales reps
E-Mail Announcements | Distribution, domain local | All employees
E-Mail Manufacturing Topics | Distribution, domain local | Topics employees
  1. Does your network require local groups?

    No. The scenario presents no need to create local groups, which you can use only on a single computer.

  2. Does your network require universal groups?

    No. The scenario presents no need to create universal groups. Your domain has no groups that need to have access to resources in multiple domains and also no need to have members from multiple domains.

  3. Sales representatives at the company frequently visit the company headquarters and other divisions. Consequently, you need to give sales representatives with user accounts in other domains the same permissions for resources that sales representatives have in your domain. You also want to make it easy for administrators in other domains to assign permissions to sales representatives in your domain. How can you accomplish this task?

    Create global groups for the sales representatives in all other domains. Add these global groups to the appropriate domain local groups in your domain. Tell administrators in other domains about the global group that represents sales representatives in your domain. Have the administrators add the group containing the sales representatives from your domain to the appropriate domain local groups in their domains.

Lesson Review Questions

  1. Why should you use groups?

    Use groups to simplify administration by granting rights and assigning permissions once to the group rather than multiple times to each individual member.

  2. What is the purpose of adding a group to another group?

    Adding groups to other groups (nesting) creates a consolidated group and can reduce the number of times that you need to assign permissions.

  3. When should you use security groups instead of distribution groups?

    Use security groups to assign permissions. Use distribution groups when the only function of the group is not security-related, such as an e-mail distribution list. You cannot use distribution groups to assign permissions.

  4. What strategy should you apply when you use domain local and global groups?

    Place user accounts into global groups, place global groups into domain local groups, and then assign permissions to the domain local group.

  5. Why shouldn't you use local groups on a computer after it becomes a member of a domain?

    Local groups do not appear in Active Directory service, and you must administer local groups separately for each computer.

Lesson 2: Understanding Default Groups

Lesson Review Questions

Specify the type for each of the following groups: either predefined, built-in, built-in local, or special identity.

  1. Power Users

    Built-in local

  2. Everyone

    Special identity

  3. Domain Admins

    Predefined

  4. Account Operators

    Built-in

  5. Authenticated Users

    Special identity

Lesson 3: Creating Group Objects

Lesson Review Questions

  1. Which of the following group scope modifications are not permitted? (Choose all that apply.)
    1. Global to universal
    2. Domain local to universal
    3. Universal to global
    4. Domain local to local

    c and d

  2. What tool do you use to create local groups on a Windows 2000 computer that is not a domain controller?

    The Local Users and Groups snap-in for MMC.

  3. Which circumstances can prevent you from deleting a group object?

    You cannot delete a group if one of the group's members has the group set as his or her primary group.

Lesson 4: Managing Administrative Access

Lesson Review Questions

  1. Why shouldn't the everyday user accounts of network administrators have administrative access to the network?

    Everyday user activities such as accessing the Web present a potential danger from viruses, Trojans, and other types of damaging code. A computer with administrative access can provide this type of code with the ability to damage systems that would normally be protected by a standard user account.

  2. Describe the function of the RunAs service.

    RunAs enables users to run programs with credentials other than the ones they used to log on to the network. The new credentials are applied only to that program. This prevents an administrator from having to either repeatedly log on and off of the network with different credentials or use an administrative account for all access to the network.

  3. What are two reasons why the Run As program might fail to launch the program you specify?

    The RunAs service might not be running, or the credentials used to connect to the network share on which the specified program is located might be different from the credentials used to start the program.

Chapter 9

Lesson 1: Understanding Group Policies

Lesson Review Questions

  1. What is a GPO?

    A GPO is a group policy object. Group policy configuration settings are contained within a GPO. Each computer running Windows 2000 has one local GPO and might in addition be subject to any number of nonlocal (Active Directory-based) GPOs.

    One local GPO is stored on each computer whether the computer is part of an Active Directory environment or a networked environment. Local GPO settings can be overridden by nonlocal GPOs.

    Nonlocal GPOs are linked to Active Directory objects (sites, domains, or OUs) and can be applied to either users or computers. To use nonlocal GPOs, you must have a Windows 2000 domain controller installed. Following the properties of Active Directory service, nonlocal GPOs are applied hierarchically from the least restrictive group (site) to the most restrictive group (OU) and are cumulative.

  2. What are the two types of group policy settings and how are they used?

    The two types of group policy settings are computer configuration settings and user configuration settings. Computer configuration settings are used to set group policies applied to computers, regardless of who logs on to them. Computer configuration settings are applied when the operating system initializes. User configuration settings are used to set group policies applied to users, regardless of which computer the user logs on to. User configuration settings are applied when users log on to the computer.

  3. In what order is group policy implemented through the Active Directory structure?

    Group policy is implemented in the following order: site, domain, and then OU.

  4. What is the difference between Block Policy Inheritance and No Override?

    Block Policy Inheritance is applied directly to the site, domain, or OU. It is not applied to GPOs, nor is it applied to GPO links. Thus, Block Policy Inheritance deflects all group policy settings that reach the site, domain, or OU from above (by way of linkage to parents in the Active Directory hierarchy), no matter which GPOs those settings originate from. GPO links set to No Override are always applied and cannot be blocked using the Block Policy Inheritance setting.

    Any GPO linked to a site, domain, or OU (not the local GPO) can be set to No Override with respect to that site, domain, or OU, so that none of its policy settings can be overwritten. When more than one GPO has been set to No Override, the one highest in the Active Directory hierarchy (or higher in the hierarchy specified by the administrator at each fixed level in Active Directory) takes precedence. No Override is applied to the GPO link.

Lesson 2: Implementing Group Policies

Exercise Questions

Exercise 9.1: Implementing a Group Policy

Procedure 3: Delegating Administrative Control of a GPO

  3. Click the Security tab.

    Which security groups already have administrative control of the DispatchPolicy GPO?

    Domain Admins, Enterprise Admins, and SYSTEM.

Procedure 4: Specifying Group Policy Settings

  3. In the console tree, click Start Menu & Task Bar. What appears in the details pane?

    The policies available for the Start Menu & Task Bar category appear in the details pane.

  5. Select Enabled and then click OK. How can you tell at a glance that this setting is enabled?

    The setting is listed as enabled in the details pane.

Procedure 9: Testing a GPO

  5. Press Ctrl+Alt+Del. The Windows Security dialog box appears. Are you able to lock the workstation? Why?

    No, the Lock Computer option is not available. Scott Fallon is unable to lock the workstation because the DispatchPolicy GPO is linked to the Security OU.

  6. Click Cancel and then click Start. Does the Search command appear on the Start menu?

    No, because the Remove Search Menu From Start Menu policy has been enabled for the Dispatch OU.

    Does the Run command appear on the Start menu?

    No, because the Remove Search Menu From Start Menu policy has been enabled for the Dispatch OU.

  12. Press Ctrl+Alt+Del. Are you able to lock the workstation? Why?

    Yes, the Lock Computer option is available. Scott Fallon is able to lock the computer because the Sales group has been filtered from the DispatchPolicy GPO scope.

Lesson Review Questions

  1. What are the tasks for implementing group policy?

    The tasks for implementing group policy are creating a GPO, creating a snap-in for the GPO, delegating administrative control of the GPO, specifying group policy settings for the GPO, disabling unused group policy settings, indicating any GPO processing exceptions, filtering the scope of the GPO, and linking the GPO to a site, domain, or OU.

  2. How do you prevent an Active Directory object from inheriting group policy settings from its parent container?

    By clicking the Block Policy Inheritance check box on the Group Policy tab of the object's Properties dialog box.

  3. How do you filter the scope of a GPO?

    You filter the scope of a GPO by modifying the permissions applied to Active Directory groups. A group that is denied the Read permission to a GPO does not receive the policy settings it contains.

Lesson 3: Using Security Policies

Exercise Questions

Exercise 9.2: Understanding Security Policies

Match the policies in the left column with the descriptions in the right column.

Policy Description
  1. Account Lockout Threshold
  2. Restricted Groups
  3. Audit Account Logon Events
  4. Deny Logon Locally
  5. Enforce User Logon Restrictions
  1. Removes group privileges of unauthorized users
  2. Grants a user right
  3. A Kerberos policy
  4. Prevents brute force intrusions
  5. Adds entries to the security log
  1. d
  2. a
  3. e
  4. b
  5. c

Lesson Review Questions

  1. How are user rights different from permissions?

    User rights apply to user accounts and permissions are attached to objects.

  2. Which of the following security areas in a GPO contains policies that enable a Windows 2000 computer to transmit an application file in encrypted form?
    1. Kerberos Policies
    2. IP Security Policies On Active Directory
    3. System Services
    4. Account Policies

    b

  3. Which of the following policies prevents administrators from having to manually unlock user accounts after repeated failed logon attempts?
    1. Account Lockout Threshold
    2. Reset Account Lockout Counter After
    3. Enforce Password History
    4. Account Lockout Duration

    d

Lesson 4: Troubleshooting Group Policy Problems

Lesson Review Questions

  1. What are three reasons why the users or computers in a site, domain, or OU to which a GPO is linked might not be receiving the policies in the GPO?

    Possible Answers:

    • The policy is being blocked.
    • A policy set at a higher level of Active Directory service has been set to No Override.
    • The No Override option is taking precedence over the Block Policy Inheritance option.
    • The users or computers are members of a security group for which the Apply Group Policy permission is set to Deny.
    • The users or computers are not members of a security group for which the Apply Group Policy permission is set to Allow.
    • The users or computers are not a member of a security group for which the Read permission is set to Allow.
  2. Why is it possible for some members of a security group to receive group policies from a GPO, whereas other members with the same permissions cannot?

    To receive group policies from a GPO, a user object must be part of a site, domain, or OU to which the GPO has been linked. A membership in a security group that is in a GPO-linked site, domain, or OU does not pass the policies on to members in other sites, domains, or OUs.

  3. What does a Failed To Open The Group Policy Object message indicate?

    This message indicates that the client computer is not properly accessing the DNS service, either because of a problem with the DNS server itself or with the DNS client configuration of the computer.

Chapter 10

Lesson 1: Publishing Resources in Active Directory Service

Exercise Questions

Exercise 10.1: Publishing a Shared Folder

Procedure 1: Sharing a Folder

  5. Click OK to create the share. Why must you share the folder if you are going to publish it in Active Directory service?

    You must share the folder because the act of publishing it in Active Directory service does not in itself create a share. Active Directory service provides a link only to an already existing shared folder. All of the permissions assigned to the share and to the folder itself still apply.

    Which permissions are assigned to the newly created share by default? How can you tell?

    By default, Windows 2000 grants the Everyone group Full Control permission over the newly created shares. You can determine this by clicking Permissions in the Sharing tab in the Properties dialog box of the share.

Procedure 2: Publishing the Shared Folder

  5. Click OK. What happens?

    A new shared folder object called Sales Documents appears in the Users container.

Procedure 3: Accessing the Published Share

  4. In the Find drop-down list, select Shared Folders. What happens?

    When you select Shared Folders in the Find drop-down list, the title of the dialog box changes to Find Shared Folders and a Shared Folders tab appears in the dialog box.

  5. In the Named text box, type Sales and click Find Now. What happens?

    The dialog box shows one item as having been found and displays the Sales Documents shared folder object you just created in the results list in the dialog box. Notice that, despite not having typed the entire name of the shared folder object, the desired results appear.

  6. Delete the entry you typed in the Named text box and in the Keywords box, type inventory. Then click Find Now. What happens? Why?

    The dialog box shows zero items found and a No Items Match The Current Search message. The search failure occurs because the keyword you specified for the shared folder object is inventories, not inventory.

  7. Replace the previous entry you typed in the Keywords box with invent, and click Find Now. What happens?

    Typing the correct beginning of a valid keyword results in a successful search, so the Sales Documents shared folder object is displayed in the results list. When searching for a shared folder object (or any Active Directory object), use only the letters you are sure of as the search string.

  8. In the Find Shared Folders dialog box, double-click the Sales Documents shared folder object. What happens?

    When you double-click a shared folder object, either in a Find dialog box or by browsing the Windows Explorer Directory node, you display a Windows Explorer view of the files and folders contained in the share, through which you can open or manipulate the files in the usual manner.

Lesson Review Questions

  1. What is the purpose of publishing a shared folder in Active Directory service?

    Publishing a shared folder (or any resource) in Active Directory service makes it easier for users to locate the resources they need. By assigning keywords to a shared folder object, users can search the entire directory for the share, based on any of these keywords, rather than by browsing through many different servers looking for a particular share. Active Directory service also enables you to place the shared folder objects in the same container as the users who need them, no matter where the actual folders are located on the network.

  2. Which of the following search strings successfully locates a shared folder object called Marketing Images? (Choose all that apply.)
    1. Market
    2. Marketing
    3. Images
    4. Market Images

    a and b

  3. When is it necessary to create a printer object in Active Directory service?

    You must create a printer object only when you want to publish a printer connected to a pre-Windows 2000 computer because Windows 2000 automatically creates Active Directory objects for the printers you install on computers running Windows 2000.

Lesson 2: Redirecting Folders Using Group Policies

Lesson Review Questions

  1. Which folders can be redirected?

    \Application Data, \Desktop, \My Documents, \My Pictures, and \Start Menu.

  2. What is the default behavior of the \My Pictures folder when you redirect the \My Documents folder?

    By default, the \My Pictures folder is redirected along with \My Documents, of which it remains a subfolder. You can modify this behavior, however, to redirect \My Pictures separately from \My Documents.

  3. What are two benefits of redirecting users' personal folders to network shares?

    Possible Answers:

    • Users' documents are available to them from any computer.
    • When used with roaming user profiles, redirecting the \My Documents folder eliminates the need to copy the contents of the folder to each workstation during logon.
    • Storing personal folders on network drives simplifies the process of backing them up.
    • Network administrators can set disk quotas on the network drives where the redirected folders are located to monitor the amount of disk space each user is occupying.

Lesson 3: Deploying Applications Using Group Policies

Exercise Questions

Exercise 10.2: Deploying a Service Pack with Group Policies

Procedure 1: Creating the Software Distribution Point

  7. Click Permissions to open the Permissions dialog box. What are the default permissions for the share?

    By default, the Everyone group has the Full Control permission.

  8. Remove the Full Control and Change permissions from the Everyone group by clearing the corresponding Allow check boxes and clicking OK. What is the purpose of doing this?

    Assigning the Everyone group only the Read permission prevents users from inadvertently modifying or deleting any of the service pack files.

Procedure 2: Creating the Software Package

  8. In the Deploy Software dialog box, select Assigned. Why is the Published option unavailable?

    The Published option is unavailable because you can publish software only to users, not computers.

  11. Click the Deployment tab. What are the default settings on this tab, and what do they mean?

    The Uninstall This Application When It Falls Out Of The Scope Of Management check box is not selected because you want the service pack installation to be permanent. Basic is selected, which causes Windows 2000 to suppress the messages and screens generated by the service pack installation program.

  12. Click the Security tab. Which permissions are granted to the network users?

    The Authenticated Users group is granted the Read permission, which is all that is needed to process the service pack and perform the software installation.

Procedure 3: Testing the Group Policy

  1. Restart a workstation in the domain for which you created the new software package. What do you see during the boot process?

    During the startup sequence, before the Windows 2000 logon screen appears, you see a message stating that the system is Installing Managed Software Windows 2000 Service Pack. After the installation completes, the computer restarts again in the normal manner.

  3. Right-click the My Computer object on the desktop to display the System Properties dialog box. What does the system information in the General tab say?

    The System Properties dialog box should verify that the service pack you deployed has been installed on the computer.

Lesson Review Questions

  1. What is the difference between assigning software and publishing software?

    You assign a software application when you want everyone to have the application on his or her computer. An application can be assigned to both computers and users. You publish a software application when you want the application to be available to people managed by the GPO, should they want the application. With published applications, each person is responsible for deciding whether to install the published application. An application can only be published to users.

  2. When you create an assigned application package in the Computer Configuration node of a GPO, which of the following methods can users employ to install the application?
    1. Use the Add/Remove Programs tool in Control Panel.
    2. Double-click a file with an extension associated with the application.
    3. Log on to the domain.
    4. Restart the computer.

    d

  3. What is the effect of selecting Maximum in the Deployment tab of the Properties dialog box for an application package?

    The Maximum option causes Windows 2000 to display on the client computer all of the messages and screens generated by the installation procedure.

Chapter 11

Lesson 1: Creating Sites and Subnets

Exercise Questions

Exercise 11.1: Linking Sites

Procedure 1: Renaming a Site

  2. Click the Sites folder. Which objects appear in the details pane?

    The Sites folder contains Default-First-Site-Name (the default site created by the Active Directory Installation Wizard), the Inter-Site Transports folder, and the Subnets folder.

Procedure 4: Creating a Site Link Object

  1. Open the Inter-Site Transports folder and click the IP folder. Which object appears in the details pane?

    The IP folder contains DEFAULTIPSITELINK, the default site link created by the Active Directory Installation Wizard.

Lesson Review Questions

  1. Which tasks must you complete to configure a site?

    Create a site, associate a subnet with the site, and connect the site to the other sites on the network using site links.

  2. Which two site configuration objects does the Active Directory Installation Wizard create automatically?

    The Active Directory Installation Wizard automatically creates an object named Default-First-Site-Name in the Sites container and an object named DEFAULTIPSITELINK in the IP container.

  3. Which replication protocol uses RPCs for replication over site links (intersite) and within a site (intrasite)?

    The IP replication protocol.

Lesson 2: Configuring Intersite Replication

Exercise Questions

Exercise 11.2: Configuring Intersite Replication

Procedure 1: Configuring a Site Link Object

  2. Expand the Inter-Site Transports folder and the IP folder, right-click the Redmond To Chicago site link and, from the pop-up menu, choose Properties to display the Redmond To Chicago Properties dialog box. What are the current values for the Cost and Replicate Every properties?

    The default values for a site link object are a cost of 100 and a replicate every value of 180 minutes.

  6. Make the connection available at all times except Monday through Friday from 8:00 A.M. to 9:00 A.M. and from 4:00 P.M. to 5:00 P.M. How many changes are required to do this?

    Two changes are required. Select the 8 AM to 9 AM box in the Monday row and drag down vertically to the Friday row. Then click Replication Not Available. Perform the same task for the 4 PM to 5 PM hour.

Lesson Review Questions

  1. Which three tasks must you complete to configure intersite replication?

    Create site links, configure site link attributes (such as site link cost, replication frequency, and replication availability), and create site link bridges.

  2. What is the difference between replication frequency and replication availability?

    Replication frequency is the duration between replications on a site link. Replication availability is when a site link is available to replicate directory information.

  3. What is the function of a bridgehead server?

    A bridgehead server provides some ranking or criteria for choosing which domain controller should be preferred as the recipient for intersite replication. The bridgehead server then distributes the directory information through intrasite replication.

Lesson 3: Troubleshooting Active Directory Replication

Lesson Review Questions

  1. What happens when you create a new site on an Active Directory network but neglect to connect it to the existing sites with site link objects?
    1. Active Directory service automatically creates the site links.
    2. Replication between the sites cannot occur.
    3. Active Directory service creates a site link bridge object.
    4. Active Directory replication is slowed down considerably.

    b

  2. What are two possible causes for a slowdown in replication traffic?

    Some of the possible causes are incorrectly configured site link costs, insufficient network bandwidth, and insufficient replication frequency or availability.

  3. Which type of Active Directory object do you use to check the replication topology?
    1. A server
    2. A site
    3. A site link
    4. A site link bridge

    a

Chapter 12

Lesson 1: Managing Object and Container Permissions

Exercise Questions

Exercise 12.1: Controlling Access to Active Directory Objects

Procedure 2: Viewing the Default Active Directory Permissions for an OU

  5. In the following table, list the groups that have permissions for the Security1 OU.
    User Account or Group Assigned Permissions

    Account Operators

    Advanced permissions

    Administrators

    Inherits the Read, Write, and Create All Child Objects permissions and also has advanced permissions

    Authenticated Users

    Read

    Domain Admins

    Full Control

    Enterprise Admins

    Inherits Full Control

    Pre-Windows 2000

    Advanced permissionsCompatible Access

    Print Operators

    Advanced permissions

    SYSTEM

    Full Control

    How can you tell if any of the default permissions are inherited from the domain, which is the parent object?

    You can tell that the permissions assigned to Administrators are inherited from the parent object because the check boxes showing the permissions are shaded.

Procedure 3: Viewing Special Permissions for an OU

  2. To view the special permissions for Account Operators, in the Permission Entries box, select each entry for Account Operators, and then click View/Edit to display the Permission Entry For Security1 dialog box.

    What object permissions are assigned to Account Operators? What can Account Operators do in this OU? (Hint: Check each of the permission entries for the Account Operators group in the Access Control Settings For Security1 dialog box.)

    The permissions that are assigned to Account Operators are Create User Objects, Delete User Objects, Create Group Objects, Delete Group Objects, Create Computer Objects, and Delete Computer Objects. Account operators can only create and delete user accounts, groups, and computers.

    Do any objects within this OU inherit the permissions assigned to the Account Operators group? Why or why not?

    No. Objects within this OU do not inherit these permissions. In the Access Control Settings For Security1 dialog box, the Apply To column in the Permission Entries list shows that permissions granted to Account Operators are applied to This Object Only.

Procedure 4: Viewing the Default Active Directory Permissions for a User Object

  4. In the following table, list the groups that have standard permissions for the jbarnhill user account. If the dialog box indicates that special permissions are present for a group, do not list them.
    Group Assigned Permissions

    Account Operators

    Full Control

    Administrators

    Inherits all permissions, except the Full Control and Delete All Child Objects permissions, and also has advanced permissions

    Authenticated Users

    Read permission for General, Personal, Public, and Web Information

    Cert Publishers

    Advanced

    Domain Admins

    Full Control

    Enterprise Admins

    Inherits Full Control

    Everyone

    Change Password

    Pre-Windows 2000 Compatible Access

    Inherits Read, Read Phone and Mail Options, Read General Information, Read Group Membership, Read Personal, Public, Remote Access, Logon, Web Information, and Read Account Restrictions

    RAS and IAS Servers

    Read permission for Group Membership, Remote Access Information, Account Restrictions, and Logon Information

    SELF

    Read, Change Password, Receive As, Send As; Read permission for Phone and Mail Options, General Information, Group Membership, Personal Information, Public Information, Remote Access Information, Account Restrictions, Logon Information, and Web Information; Write permission for Phone and Mail Options, Personal Information, and Web Information

    SYSTEM

    Full Control

    Are the standard permissions for a user object the same as those for an OU object? Why or why not?

    No. Standard permissions for each type of object are different because different object types are used for different tasks, and therefore the security needs for each object type differ.

    Are any of the standard permissions inherited from Security1, the parent object? How can you tell?

    Only the standard permissions that are assigned to Administrators and Enterprise Admins are inherited from the parent object. The check boxes for inherited permissions are shaded.

    What do the permissions of the Account Operators group allow its members to do with the user object?

    Account Operators have Full Control permission. A member of this group can make any changes to a user object, including deleting it.

Lesson Review Questions

  1. Describe the relationship between standard permissions and special permissions.

    Standard permissions are preconfigured combinations of special permissions, representing the access control settings most commonly assigned by administrators.

  2. How do you prevent an Active Directory object from inheriting permissions from its parent object?

    You can prevent permission inheritance for an object in the Security tab of the object's Properties dialog box by clearing the Allow Inheritable Permissions From Parent To Propagate To This Object check box.

  3. What does it mean when the Allow and Deny check boxes in the Security tab of an object's Permissions dialog box are shaded?

    Shaded check boxes indicate that the object's permissions have been inherited from a parent.

Lesson 2: Locating and Moving Active Directory Objects

Lesson Review Questions

  1. How does the Global Catalog help users locate Active Directory objects?

    The Global Catalog contains a partial replica of the entire directory, so it stores information about every object in a domain tree or forest. Because the Global Catalog contains information about every object, a user can find information regardless of which domain in the tree or forest contains the data. Active Directory service automatically generates the contents of the Global Catalog from the domains that make up the directory.

  2. What happens to the permissions of an object when you move it from one OU to another OU?

    Permissions assigned directly to the object remain the same. The object also inherits permissions from the new OU. Any permissions previously inherited from the old OU no longer affect the object.

  3. What program do you use to move a user object to a different domain?
    1. Active Directory Users and Computers
    2. Active Directory Sites and Services
    3. MOVETREE.EXE
    4. NETDOM.EXE

    c

Lesson 3: Delegating Control

Exercise Questions

Exercise 12.2: Delegating Administrative Control in Active Directory Service

Procedure 1: Testing Current Permissions

  3. In the console tree, expand your domain and then click Security1. What user objects are visible in the Security1 OU?

    The Security1 OU contains the jbarnhill and eboyle user objects you created in Exercise 12.1.

    Which permissions allow you to see these objects?

    The eboyle user account automatically belongs to the Authenticated Users built-in group, which has Read permission for the OU.

    For the user account with the logon name jbarnhill, change the logon hours. Were you successful? Why or why not?

    No. The eboyle user account does not have Write permission for the jbarnhill user object.

    For the eboyle user account, under which you are currently logged on, change the logon hours. Were you successful? Why or why not?

    No. The eboyle user account does not have Write permission for the eboyle user object.

Procedure 3: Testing Delegated Permissions

  4. Attempt to change the logon hours for the user accounts in the Security1 OU. Were you successful? Why or why not?

    Yes. The eboyle user account has been assigned Full Control permission for all user objects in the OU. This includes the permission to change the logon hours.

  5. Attempt to change the logon hours for a user account in the Users container. Were you successful? Why or why not?

    No. The eboyle user account has not been assigned any permissions for the Users container.

Lesson Review Questions

  1. The Delegation of Control Wizard allows you to set administrative control at what level?

    At the OU or container level.

  2. Why is it preferable to delegate control over an OU or container rather than over individual user and group objects?

    Because tracking permissions at the higher levels of the Active Directory tree is easier than tracking permissions on objects or object attributes.

  3. Why would a network's Active Directory administrator want to grant other users control over OUs or containers?

    Administrators delegate Active Directory maintenance tasks because on a large network, the number of objects to manage can be large, and it is more efficient to make managers and supervisors directly responsible for creating and maintaining the objects that are their responsibility.

Lesson 4: Troubleshooting Active Directory Service

Lesson Review Questions

  1. Which of the following problems could prevent client computers that do not have Active Directory client software installed from logging on?
    1. Failure of the computer holding the primary domain controller emulator role
    2. Failure of the computer holding the schema master role
    3. Failure of the computer functioning as the infrastructure master
    4. Failure of the trust relationship between the domains on the network

    a

  2. List two reasons why you might not be able to create new objects in Active Directory service.

    The computer functioning as the relative ID master has failed, or a network connectivity problem is preventing communication with the relative ID master.

  3. What is the function of a trust relationship?

    Trust relationships enable computers to access resources in other domains.

Chapter 13

Lesson 1: TCP/IP Overview

Lesson Review Questions

  1. What is the purpose of a subnet mask?

    To mask a portion of the IP address so IP can distinguish the network identifier from the host identifier.

  2. What is the difference between static routing and dynamic routing?

    When an internetwork uses static routing, administrators must manually create and maintain the routing tables on all of the network's routers. On an internetwork that uses dynamic routing, specialized routing protocols enable routers to automatically share and update the information in their routing tables.

  3. What is the primary protocol operating at the Internet layer?
    1. TCP
    2. ICMP
    3. ARP
    4. IP

    d

Lesson 2: Configuring TCP/IP Clients

Exercise Questions

Exercise 13.1: Installing and Configuring TCP/IP

Procedure 2: Configuring TCP/IP to Use a Static IP Address

  11. Press Spacebar as needed to scroll through the configuration information and locate the local area connection information. Record the current TCP/IP configuration settings for your local area connection in Table 13.5.

    How do the results compare with the information you recorded in Table 13.4?

    The values for the IP Address, Subnet Mask, and Default Gateway fields in the Local Area Connection section should be changed to those in Table 13.3.

  12. To verify that the IP address is working and configured for your adapter, type ping 127.0.0.1 and then press Enter. What happens?

    Four Reply from 127.0.0.l messages should appear.

  13. If you have a computer that you can use to test connectivity, type ping ip_address (where ip_address is the IP address of the computer you are using to test connectivity), and then press Enter. (If you don't have a computer to test connectivity, skip this step.) What happens?

    Four Reply from ip_address messages should appear.

Procedure 3: Configuring TCP/IP to Automatically Obtain an IP Address

  4. Select Obtain An IP Address Automatically. What happens?

    When you select the option, the values in the IP Address, Subnet Mask, and Default Gateway text boxes are removed, and the boxes shaded.

  11. Pressing Spacebar as necessary, record the current TCP/IP configuration settings for your local area connection in Table 13.6.

    How do the results in the table compare with the previous settings you recorded in Table 13.5?

    The settings should be changed to those provided by the DHCP server. The actual settings can vary depending on the DHCP server configuration.

  12. To test that TCP/IP is working and bound to your adapter, type ping 127.0.0.1, and then press Enter. What happens?

    The internal loopback test displays four replies if TCP/IP is bound to the adapter.

Procedure 4: Obtaining an IP Address Using Automatic Private IP Addressing

  2. At the command prompt, type ipconfig /renew and then press Enter. Wait while Windows 2000 locates the DHCP server on the network. What message appears, and what does it indicate?

    The message is DHCP Server Unreachable. It means that your computer was not assigned an address from a DHCP server because there wasn't one available.

  4. Pressing Spacebar as necessary, view the current TCP/IP settings for your local area connection. Is this the same IP address assigned to your computer in Procedure 3? Why or why not?

    No, the IP address is not the same as the one assigned in Procedure 3. In this procedure, the Automatic Private IP Addressing feature of Windows 2000 assigned the IP address because a DHCP server was not available. In Procedure 3, the DHCP server assigned the IP address.

Lesson Review Questions

  1. Which of the following is a valid reason for assigning more than one IP address to a single network interface adapter?
    1. To balance the network traffic load between the addresses
    2. To support multiple subnets on one network
    3. To provide fault tolerance
    4. To support both TCP and UDP traffic

    b

  2. How many default gateway addresses does a computer need to function on a LAN?
    1. 0
    2. 1
    3. 2
    4. 3

    a

  3. Your computer running Windows 2000 Client for Microsoft Networks was configured manually for TCP/IP. You can connect to any host on your own subnet, but you cannot connect to or even ping any host on a remote subnet. What is the likely cause of the problem and how would you fix it?

    The default gateway might be missing or incorrect. Other possibilities are that the default gateway is offline or that the subnet mask is incorrect.

Lesson 3: Using TCP/IP Utilities

Exercise Questions

Exercise 13.2: TCP/IP Utilities

Match the utilities in the left column with their functions in the right column.

  1. Ipconfig.exe
  2. Tracert.exe
  3. Ping
  4. Arp.exe
  5. Netstat
  6. Winipcfg.exe
  7. Nbtstat.exe
  1. Displays TCP/IP configuration on a Windows 98 system
  2. Creates cache entries containing IP and hardware addresses
  3. Displays NetBIOS connection information
  4. Tests communications between two computers
  5. Releases and renews IP address assignments on Windows 2000
  6. Displays network traffic statistics
  7. Lists the routers forwarding packets to a particular destination
  1. e
  2. g
  3. d
  4. b
  5. f
  6. a
  7. c

Lesson Review Questions

  1. Which TCP/IP utility should you use to most easily identify which router on your internetwork is malfunctioning?
    1. Ipconfig
    2. Ping
    3. Traceroute
    4. Netstat

    c

  2. Which of the following protocols does the Ping program never use to carry its messages?
    1. Ethernet
    2. ICMP
    3. IP
    4. UDP

    d

  3. Which of the following commands displays the routing table on the local computer?
    1. Arp -r
    2. Netstat -r
    3. Nbtstat -r
    4. Telnet -r

    b

  4. Which command would you use to purge the local computer's NetBIOS name cache?
    1. Nbtstat -p
    2. Nbtstat -P
    3. Nbtstat -r
    4. Nbtstat -R

    d

Chapter 14

Lesson 1: Understanding DHCP

Exercise Questions

Exercise 14.1: DHCP Message Types

  1. Place the following DHCP message types in the order in which a successful IP address assignment procedure uses them.
    1. DHCPACK
    2. DHCPOFFER
    3. DHCPREQUEST
    4. DHCPDISCOVER

    d, b, c, a

  2. Place the following DHCP message types in the proper order for an unsuccessful attempt to renew an IP address lease.
    1. DHCPDISCOVER
    2. DHCPREQUEST (broadcast)
    3. DHCPREQUEST (unicast)
    4. DHCPNAK

    c, b, d, a

Lesson Review Questions

  1. What happens to a DHCP client when its attempts to renew its IP address lease fail and the lease expires?

    TCP/IP communication stops and the computer begins the process of negotiating a new lease.

  2. Which of the following message types is not used during the DHCP lease assignment process?
    1. DHCPDISCOVER
    2. DHCPRELEASE
    3. DHCPOFFER
    4. DHCPREQUEST

    b

  3. What is the name of the time during the lease renewal process when a DHCP client begins broadcasting DHCPREQUEST messages?
    1. Lease identification cookie
    2. Rebinding time value (T1)
    3. Renewal time value (T2)
    4. Init value

    b

Lesson 2: Configuring a DHCP Server

Exercise Questions

Exercise 14.2: Configuring a DHCP Server

Procedure 1: Preparing a DHCP Server for Operation

  5. Type 192.168.5.10 in the Start IP Address text box and 192.168.5.90 in the End IP Address text box. What class are these IP addresses?

    They are Class C addresses.

  6. Change the value in the Length box to 24 and click Next. What does this Length value signify? What happens to the Subnet Mask value?

    The Length value specifies the number of IP address bits dedicated to the network identifier. When you change the Length value to 24, the Subnet Mask value changes to 255.255.255.0.

  7. Type 192.168.5.50 in the Start IP Address text box and 192.168.5.60 in the End IP Address text box. Click Add. What happens?

    The 192.168.5.50 To 192.168.5.60 entry appears in the Excluded Address Range list.

Lesson Review Questions

  1. What tool do you use to manage DHCP servers in Windows 2000?

    The primary tool that you use to manage DHCP servers is the DHCP console, which is a Microsoft Management Console (MMC) snap-in that is added to the Administrative Tools program group when you install the DHCP service.

  2. Which of the following DHCP message types is used for communication between DHCP servers?
    1. DHCPDISCOVER
    2. DHCPINFORM
    3. DHCPRELEASE
    4. DHCPACK

    b

  3. How does Microsoft DHCP Server enable you to select any group of addresses for a scope, despite the fact that you can only specify one range of IP addresses per subnet?

    By making it possible to exclude ranges of addresses from the scope.

Lesson 3: Troubleshooting DHCP

Lesson Review Questions

  1. How can you force a DHCP server to assign new IP addresses with a different network identifier to all of the clients on the network?

    You do this by creating a new scope with a range of new addresses and then modifying the IP address of the server itself to one that uses the same network identifier as the new scope.

  2. What type of messages, broadcast or unicast, do Microsoft DHCP servers use to send DHCPOFFER messages in response to DHCPDISCOVER messages, by default?

    Microsoft DHCP servers use broadcast messages, unless you modify the default behavior.

  3. What is the most common symptom of DHCP-related problems?

    The failure of clients to obtain IP addresses and other TCP/IP configuration parameters from DHCP servers.

Chapter 15

Lesson 1: Understanding Windows Name Resolution

Exercise Questions

Exercise 15.1: NetBIOS Name Resolution Concepts

Match the terms in the left column with the appropriate descriptions in the right column.

  1. M node
  2. NetBIOS name cache
  3. Broadcast name resolution
  4. H node
  5. LMHOSTS
  1. Default name resolution mechanism for Windows computers not configured to use WINS
  2. Uses broadcast name resolution, with WINS as a fallback
  3. Fallback name resolution mechanism for a modified B node computer
  4. First name resolution mechanism used by all Windows computers
  5. Uses WINS name resolution, with broadcasts as a fallback
  1. b
  2. d
  3. a
  4. e
  5. c

Lesson Review Questions

  1. Which of the following name resolution mechanisms can only resolve the names of computers on the local network?
    1. LMHOSTS
    2. Broadcast name resolution
    3. WINS
    4. NetBIOS name cache

    b

  2. Which of the following is the fastest NetBIOS name resolution mechanism?
    1. LMHOSTS
    2. Broadcast name resolution
    3. WINS
    4. NetBIOS name cache

    d

  3. Which of the following node types can use an LMHOSTS file for NetBIOS name resolution?
    1. H node
    2. B node
    3. Modified B node
    4. M node

    c

Lesson 2: Using WINS

Exercise Questions

Exercise 15.2: Installing and Configuring WINS

Procedure 2: Configuring DHCP to Support WINS

  4. In the Server Name text box, type the name of your WINS server, and then click Resolve. What happens?

    The IP address assigned to the WINS server appears in the IP Address text box.

  7. In the Byte text box, type 8 so that the text box entry reads 0x8. 0x8 sets the node type to H node. What does this mean?

    The node type specifies what NetBIOS name resolution mechanisms the client computer should use. An H node Windows client uses WINS to resolve NetBIOS names by default, and switches to broadcast name resolution if the WINS server fails or is unavailable.

  8. Click OK. What happens?

    The two server options appear in the details pane.

Procedure 3: Testing WINS Settings (Optional)

  2. Type ipconfig /release, and then press Enter. What happens?

    A message appears stating that the IP address has been successfully released for the adapter Local Area Connection.

  3. Type ipconfig /renew, and then press Enter.

    What happens?

    The computer displays the IP configuration as it renews its lease with the DHCP server.

Lesson Review Questions

  1. List two reasons why WINS is an improvement over the broadcast name resolution method.

    WINS is an improvement because it uses unicasts instead of broadcasts, and because it can service clients anywhere on an internetwork, not just on the local network.

  2. What is the name of the property that determines when a WINS client should renew its name registration?

    The Time to Live (TTL) value.

  3. When does a WINS name release occur?

    When a WINS client shuts down.

Chapter 16

Lesson 1: Understanding DNS

Lesson Review Questions

  1. What is the function of a forward lookup query? A reverse lookup query?

    A forward lookup query resolves a name to an IP address. A reverse lookup query resolves an IP address to a name.

  2. What is the portion of the DNS namespace that is stored in a DNS name server?
    1. A host
    2. A domain
    3. A zone
    4. A root name

    c

  3. In which of the following domains would you find IP-address-to-name mapping information about a computer with the name www.wingtipshoes.com and the IP address 192.168.54.128?
    1. in-addr.arpa.192.168.54.128
    2. 128.54.168.192.arpa.in-addr
    3. 192.168.54.128.in-addr.arpa
    4. 128.54.168.192.in-addr.arpa

    d

Lesson 2: Creating Zones

Exercise Questions

Exercise 16.1: Configuring Zones

Procedure 2: Creating a Reverse Lookup Zone

  5. Ensure that Network ID is selected, and type the network identifier for your network's IP addresses in the Network ID text box. For example, if the IP address of your server is 192.168.18.43, with a subnet mask of 255.255.255.0, type 192.168.18 in the Network ID text box. What happens when you enter the network identifier?

    In the Reverse Lookup Zone Name box, the in-addr.arpa name is appended to the Network ID value, with the bytes reversed. For example, the network identifier 192.168.18 appears as 18.168.192.in-addr.arpa.

  7. Ensure that Create A New File With This File Name is selected. What value appears in the box provided?

    The name that appears in the box by default is the Reverse Lookup Zone Name value from the previous page, with a .dns extension. In the previous example, the filename is 18.168.192.in-addr.arpa.dns.

Lesson Review Questions

  1. What are the advantages of using the Active Directory-integrated zone type?

    Multiple-master updates and enhanced security are based on the capabilities of Active Directory service. Zones are replicated and synchronized to new domain controllers automatically whenever a new zone is added to an Active Directory domain. By integrating storage of your DNS namespace in Active Directory service, you simplify the planning and administration for both DNS and Active Directory service. Directory replication is faster and more efficient than standard DNS replication.

  2. What must be done when you delegate zones within a namespace?

    When you delegate zones within a namespace, you must also create SOA resource records to point to the authoritative DNS server for the new zone. This is necessary both to transfer authority and to provide correct referral to other DNS servers and clients of the new servers being made authoritative for the new zone.

  3. How does DDNS improve the efficiency of Microsoft DNS Server?

    DDNS enables computers to automatically update their resource records in the DNS database. Before DDNS, administrators had to make all DNS additions and modifications manually. DDNS enables Microsoft DNS Server to support computers with IP addresses that change due to DHCP address assignments.

Lesson 3: Managing Resource Records

Exercise Questions

Exercise 16.2: Adding Resource Records

Procedure 1: Creating a Host Record

  4. Right-click the zone you created in Exercise 16.1, Procedure 1 and, from the pop-up menu, choose New Host. What happens?

    The New Host dialog box appears.

Procedure 2: Viewing Resource Records

  2. Click the icon for the forward lookup zone in which you created the Host (A) resource records. What do you see in the zone?

    The zone contains the SOA and NS resource records that the server creates automatically, plus the server1 and server2 host records you created manually.

  3. Click the icon for the reverse lookup zone corresponding to the forward lookup zone you created. What do you see and why?

    The reverse lookup zone contains a PTR record named with the IP address of the server2 resource record. This record is the result of selecting the Create Associated Pointer (PTR) Record check box when you created the server2 record.

Lesson Review Questions

  1. What type of resource record do you create to represent a domain controller on a Windows 2000 network?

    A Service (SRV) record.

  2. Which two types of resource records can contain the same IP address and host name?
    1. SOA and A
    2. PTR and A
    3. A and CNAME
    4. PTR and CNAME

    b

  3. Which resource records are created automatically by the DNS console when you create a forward lookup zone?

    An SOA record and an NS record.

Lesson 4: Troubleshooting DNS

Lesson Review Questions

  1. What is the difference between a simple query and a recursive query?

    A simple query is one that can be satisfied by the server to which it is sent, whereas a recursive query requires the server to forward the request to other DNS servers.

  2. Give three reasons why a zone transfer might fail to occur.

    Network connectivity problems, one of the servers or zones is shut down or paused, the SOA serial numbers are the same on both DNS servers, the zone database contains nonstandard or unsupported data, or the servers are running incompatible DNS server implementations.

  3. What is the first thing to check if DDNS updates fail to occur?

    The first thing you should check is whether both of the DNS implementations involved support the dynamic update protocol.

Chapter 17

Lesson 1: Creating Web Sites and FTP Sites

Exercise Questions

Exercise 17.1: Creating a Private Web Site

Procedure 2: Creating a New Web Site

  3. Type Secret Site in the Description text box and click Next to display the IP Address And Port Settings page. What is the default TCP port value for the site? Why must it be changed?

    The default port value is 80, which is the well-known port for HTTP. This value must be changed because the default Web site on the IIS server also uses port 80, and because you are not using a different IP address or host header, there is no other means of distinguishing this new site from the default site.

Procedure 3: Accessing Your Web Sites

  2. Type the URL http://127.0.0.1 in the Address box and click Go. What do you see? What does this indicate?

    You see a Web page containing the message: Welcome To The Public Web Site. This indicates that you have successfully accessed the default Web site.

  3. Type the URL http://127.0.0.1:82 in the Address box and click Go. What do you see? Why?

    You see an error message denying you access to the page because, even though you have successfully accessed the new Web site you created, the Default Document setting for the site does not match the name of the home page file you created and directory browsing is turned off by default.

  10. Return to Internet Explorer and click the Refresh button. What happens now? Why?

    You now see a Web page containing the message Welcome To The Secret Web Site because the site is now configured to use the Index.html file in the home directory as its default document.

Lesson Review Questions

  1. List the three methods for distinguishing among multiple Web sites on a single server.

    You can distinguish among multiple Web sites on the same server by assigning them different IP addresses, different port numbers, or different host headers. Each of these methods requires a different modification from the client to access each site.

  2. What happens when IIS fails to find a file with the designated default document name in a Web site's home directory?

    The server delivers error messages to clients requesting access to the site, unless directory browsing is enabled, in which case the server transmits a list of the files and folders in the home directory.

  3. Which of the following does not appear in the console tree of the Internet Information Services snap-in on a default IIS installation?
    1. Default FTP Site
    2. Default Web Site
    3. Administration Web Site
    4. Default SMTP Virtual Server

    a

Lesson 2: Creating Virtual Directories

Exercise Questions

Procedure 1: Creating a Virtual Directory Using the IIS Snap-In

  6. In the Directory text box, type the path to the \Home directory you created in Exercise 17.1, and click Next. What are the default permissions for the virtual directory?

    The default permissions are Read and Run Scripts (such as ASP).

Procedure 3: Accessing Shared Directories

  2. In the Address text box, type http://127.0.0.1/SecretSiteHome and click Go. What do you see? Why?

    You see a directory listing of the \Home directory, containing the Index.html file you created, because the default Web site is not configured to use Index.html as its default document. However, unlike in Exercise 17.1, you now see a directory listing because you enabled the Browse permission for the virtual directory.

  3. In the Address text box, type http://127.0.0.1:82/ASPsamples/ColorPicker.asp and click Go. What do you see? Why?

    You see an error message preventing you from viewing the file because ColorPicker.asp is an ASP script and Execute access to script files is currently forbidden.

  9. Switch back to Internet Explorer and click the Refresh button. What do you see now? Why?

    You now see the Color Choices for ASP Code Viewer page because you now have the permission needed to access ASP scripts in the virtual directory.

Lesson Review Questions

  1. Compare a virtual directory to a Dfs root.

    A virtual directory is a term used to describe Web server directories that appear to be located below a Web server's home directory, but could be located in any location accessible to the Web server. IIS uses an alias to describe the virtual directory so that Web browser users are unaware of the virtual directory's physical location or path.

    A distributed file system (Dfs) root is also a symbolic share that provides centralized access to shares located throughout the network. The user is unaware of the physical location of the shares but is able to reach them by starting from the Dfs root. The Dfs root is similar to an IIS home directory and the shares below the Dfs root are similar to virtual directories in IIS.

  2. How do virtual directories add security to a Web site?

    Virtual directories add security by keeping the physical location of a folder hidden from the clients. Because the virtual directory appears as an alias in a Web browser, its actual location on the network is hidden.

  3. What is the purpose of redirecting a client request for a URL to another URL?

    If you move files around on a complex Web site, it can be difficult to ensure that all of the links to the moved files are updated. A redirected URL can prevent clients from receiving errors due to broken links.

Lesson 3: Managing Site Security

Exercise Questions

Exercise 17.3: Accessing the Administration Web Site

Procedure 1: Configuring the Administration Web Site with the Internet Information Services Snap-In

  5. With the Web Site tab active, record the TCP Port value appearing in the TCP Port text box. What does the value of this field signify?

    The TCP Port text box contains a random number between 2000 and 9999 selected by IIS during installation. The fact that this site does not use the well-known HTTP port 80 means that the URLs that users employ to access this site must contain the correct port number.

  11. In the Administration Web Site Properties dialog box, in the IP Address And Domain Name Restrictions box, click Edit to display the IP Address And Domain Name Restrictions dialog box. What are the current settings in this dialog box, and what do they signify?

    The Denied Access option is selected and only the local loopback address, 127.0.0.1, is granted access to this area. This means that only a user working at the server console can access the administration Web site.

Procedure 2: Configuring SSL Access to the Administration Web Site

  8. Select Send The Request Immediately To An Online Certification Authority and then click Next to display the Name And Security Settings page. What is the name assigned to the certificate by default?

    The default name given to the certificate is the same as that of the site: Administration Web Site.

Procedure 3: Testing Access to the Secured Administration Web Site

  6. Select the Save This Password In Your Password List check box and then click OK. The Internet Services Manager (HTML) interface appears. How can you tell that the connection is secured?

    There is a lock icon in the bottom right corner of the status bar.

Lesson Review Questions

  1. Which of the following types of authentication require users to have Windows 2000 user accounts? (Choose all that apply.)
    1. Anonymous authentication
    2. Basic authentication
    3. Digest authentication
    4. Integrated Windows authentication

    c and d

  2. How does using a different port number for a site make it more secure?

    Most Web users are unaware of the existence of port numbers, because Web browsers automatically use the default port number (80) with every Web URL. The need to specify the correct port number in the URL when a Web site uses a port other than 80 makes it difficult, although not impossible, for an unauthorized user to access the site.

  3. List the default security mechanisms used by the IIS administration Web site.

    The administration Web site uses a randomly chosen port number, IP address restrictions permit only users working on the server itself to access the site, and integrated Windows authentication is used.

Lesson 4: Troubleshooting IIS

Lesson Review Questions

  1. List two instances in which clients must supply port numbers in their URLs.

    When the Web site is configured to use a port other than 80, or when the site requires an SSL connection.

  2. Name the two rights that the anonymous authentication account must possess for logons to occur.

    The account used for anonymous authentication must have the Log On Locally right and the Network Logon right.

  3. What permissions are required for a client to access a Web site with a default document that takes the form of an ASP script?

    The Read permission and either the Scripts Only or the Scripts and Executables permission.

Chapter 18

Lesson 1: Using Remote Access

Exercise Questions

Exercise 18.1: Configuring RAS Connections

Procedure 2: Configuring a Dial-in Client and Accessing the RRAS Server (Optional)

  4. Click Start and, from the Settings group, select Network and Dial-Up Connections to display the Network And Dial-Up Connections window. Why does the Local Area Connection icon contain a red "X?"

    A red "X" appears in the icon because you disconnected the computer's network cable.

  13. In the User Name text box, type shooper and click Dial. What happens? Why?

    The Error Connecting To Dial-in Connection message box appears, stating that this user account does not have permission to dial in. This is because the Stephanie Hooper user account was assigned the Deny Access permission.

  14. In the User Name text box, type mlee and then click Dial. What happens? Why?

    The Connecting Dial-in Connection message box appears and the connection is verified, authenticated, and registered. The Connection Complete message box then appears. The Mark Lee account successfully connected to the RAS server because his user account was configured with the Allow Access permission.

  19. In the User Name text box, type jkelly and then click Dial. What happens? Why?

    The Error Connecting To Dial-in Connection message box appears, stating that this user account does not have permission to dial in. This is because the John Kelly user account was assigned the Control Access Through Remote Access Policy setting, and the remote access policy is not configured to grant him access.

  24. On your dial-in client computer, in the User Name text box, click Dial to attempt another logon as jkelly. What happens? Why?

    The Connecting Dial-in Connection message box appears and the connection is verified, authenticated, and registered because the default remote access policy now grants access to all user accounts that have the Control Access Through Remote Access Policy option selected.

Lesson Review Questions

  1. How does the RAS callback feature provide additional security?

    By configuring the RAS server to always call back to a specific number, you can prevent users from connecting to the server using other numbers.

  2. What are the four authentication protocols supported by Windows 2000 RAS?

    Extensible Authentication Protocol (EAP), Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) version 1 and version 2, Challenge Handshake Authentication Protocol (CHAP), and Shiva Password Authentication Protocol (SPAP).

  3. Which of the following is the primary protocol that Windows 2000 RAS uses for its WAN connections?
    1. SLIP
    2. PPP
    3. Asynchronous NetBEUI
    4. VPN

    b

Lesson 2: Using Virtual Private Networks

Exercise Questions

Exercise 18.2: Creating a VPN Connection

Procedure 3: Establishing a VPN Connection

  3. Type shooper in the User Name text box and click Connect. What happens? Why?

    An Error Connecting To VPN Connection message box appears, stating that the account does not have permission to dial in. This is because the Stephanie Hooper account, as configured in Exercise 18.1, has the Deny Access option selected in the Dial-In tab of the user object's Properties dialog box.

  6. Type mlee in the User Name text box and click Connect. What happens? Why?

    A Connection Complete message box appears, indicating that the client has successfully connected to the VPN server. This is because the Mark Lee user object has the Allow Access option selected in the Dial-In tab of the user object's Properties dialog box.

  8. Expand the Remote Access Clients node in the console tree. What do you see?

    You see an entry in the details pane for the mlee user object, which is currently connected to the server using a tunneled VPN connection.

Lesson Review Questions

  1. How is the Deny Access remote access permission (in mixed mode or native mode) similar in function to the native-mode domain default remote access policy?

    The Deny Access remote access permission does not allow a user with this setting to use remote access to connect to the server. The native-mode domain remote access policy is Allow Access If Dial-In Permission Is Enabled. The default policy's properties, however, are Deny Remote Access Permission At All Times.

  2. List the four tunneling protocols that VPNs can use.

    The four tunneling protocols are PPTP, L2TP, IPSec, and IP-IP.

  3. How does virtual private networking reduce the cost of supporting remote access clients?

    VPNs reduce remote access networking costs by eliminating the need for remote users at distant locations to dial long distance directly into an RAS server. By connecting to the Internet using local ISPs, both the client and the server minimize telephone charges.

Lesson 3: Using NAT and ICS

Lesson Review Questions

  1. Why is a translated network more secure than a routed network?

    On a routed network, the client computers use registered IP addresses and are directly connected to the Internet. This enables the client to access Internet services and it enables Internet users to access the clients. On a translated network, the client computers use unregistered IP addresses, which makes them invisible to Internet users and protects them from intrusion.

  2. What are the components of NAT?

    The translation component is the router on which NAT is enabled. The addressing component provides IP address configuration information to the other computers on the home network. The name resolution component becomes the DNS server for the other computers on the home network. When the NAT computer receives name resolution requests, it forwards them to the Internet-based DNS server for which it is configured and returns the responses to the home network computer.

  3. If a small business is using the 10.0.0.0 private network for its intranet and has been granted the public IP address of 198.200.200.1 by its ISP, to what public IP address does NAT map all private IP addresses being used on network 10.0.0.0?

    The NAT maps (using static or dynamic mappings) all private IP addresses being used on network 10.0.0.0 to the public IP address of 198.200.200.1.

Lesson 4: Using Terminal Services

Lesson Review Questions

  1. Which type of license server supports workgroups and Windows NT 4 domains?

    A domain license server.

  2. How does Terminal Services simplify client administration?

    Terminal Services simplifies client administration by making it possible to install, maintain, and upgrade applications for all clients at a single location.

  3. What happens to a Terminal Services installation running in Remote Administration mode when you fail to activate a licensing server in 90 days?

    Nothing, because a remote administration terminal server does not require licensing.

Chapter 19

Lesson 1: Backing Up Your Network

Exercise Questions

Exercise 19.1: Incremental and Differential Backups

  1. If you back up your network by performing a full backup every Wednesday at 6:00 P.M. and differential backups in the evening on the other six days of the week, how many jobs would be needed to completely restore a computer with a hard drive that failed on a Tuesday at noon?

    Two

  2. If you back up your network by performing a full backup every Wednesday at 6:00 P.M., how many jobs would be needed if you performed incremental backups in the evening of the other six days of the week?

    Six

  3. For a complete restore of a computer that failed at noon on Tuesday, how many jobs would be needed if you performed full backups at 6:00 A.M. every Wednesday and Saturday and incremental backups at 6:00 A.M. every other day?

    Four

Lesson Review Questions

  1. Which of the following types of backup jobs does not reset the archive bits of the files it backs up?
    1. Full
    2. Incremental
    3. Differential
    4. Supplemental

    c

  2. Which of the following is the criterion most commonly used to filter files for backup jobs?
    1. File name
    2. File extension
    3. File attributes
    4. File size

    c

  3. How does an autochanger increase the overall storage capacity of a backup solution?

    It increases capacity by automatically inserting and removing media from a drive.

  4. What are the three elements in the Grandfather-Father-Son media rotation system?
    1. Hard disk drives, CD-ROM drives, and magnetic tape drives
    2. Incremental, differential, and full backup jobs
    3. Monthly, weekly, and daily backup jobs
    4. QIC, DAT, and DLT tape drives

    c

  5. Network backup devices most commonly use which drive interface?
    1. IDE
    2. SCSI
    3. USB
    4. Parallel port

    b

Lesson 2: Backing Up and Restoring Active Directory

Lesson Review Questions

  1. When backing up Active Directory, what type of data must you specify to be backed up? What is included in this data type?

    You must indicate that you need to back up System State data. For Windows 2000 Server operating systems, the System State data comprises the Windows Registry, COM+ Class Registration database, system boot files, and the Certificate Services database (if the server is a certificate server). If the server is a domain controller, Active Directory and the SYSVOL directory are also contained in the System State data.

  2. When you restart the computer in Directory Services Restore Mode, what logon must you use? Why?

    When you restart the computer in Directory Services Restore Mode, you must log on as an Administrator by using a valid Security Accounts Manager (SAM) account name and password, not the Active Directory administrator's name and password, because Active Directory is offline, and account verification cannot occur. Rather, the SAM accounts database is used to control access to Active Directory while it is offline. You specified this password when you set up Active Directory.

  3. How does Windows Backup verify the data written to the backup medium?

    By performing a bit-by-bit comparison of the backup medium with the original source data.


Glossary

A

access control list (ACL)

The mechanism for limiting access to certain items of information or certain controls based on users' identity and their membership in various predefined groups. Access control is typically used by system administrators to control user access to network resources such as servers, directories, and files and is typically implemented by granting permissions to users and groups for access to specific objects.

access permissions

Features that control access to sharing in Microsoft Windows 2000 Server. Permissions can be set for the following access levels: No Access-Prevents access to the shared directory, its subdirectories, and its files; Read-Allows viewing of file and subdirectory names, changing to a shared directory's subdirectory, viewing data in files, and running applications; Change-Allows viewing of file and subdirectory names, changing to a shared directory's sub- directories, viewing data in files and running application files, adding files and subdirectories to a shared directory, changing data in files, and deleting subdirectories and files; Full Control-Includes the same permissions as Change, plus changing permissions and taking ownership of the NTFS files and directories only.

account

See user account.

account lockout

A Windows 2000 security feature that temporarily disables a user account if a number of failed logon attempts occur within a specified amount of time, based on security policy lockout settings.

account policy

Controls how passwords must be used by all user accounts in a domain or in an individual computer.

ACL

See access control list (ACL).

Active Directory service

The enterprise directory service included with the Windows 2000 Server, Advanced Server, and Datacenter Server operating systems. Active Directory is a hierarchical directory service that consists of objects that represent users, computers, groups, and other network resources. The objects are arranged in a tree display that consists of hierarchical layers ranging upward from organizational units, to domains, to trees, and to forests. Objects contain attributes that contain information about the resource the object represents. When users log on to the network, their user names and passwords are authenticated against the Active Directory database by a computer that has been designated as a domain controller. This one single logon can grant the users access to resources anywhere on the network. See also directory service.

Active Directory Domains and Trusts console

An administrative tool that enables you to manage trust relationships between domains. These domains can be Microsoft Windows 2000 domains in the same forest, Windows 2000 domains in different forests, pre-Windows 2000 domains, and even Kerberos v5 realms.

Active Directory schema

A description of the object classes and attributes stored in Active Directory service. For each object class, the schema defines the attributes an object class must have, the additional attributes it might have, and the object class that can be its parent. The Active Directory schema can be updated dynamically by creating or modifying the schema objects stored in Active Directory. Like every object in Active Directory, schema objects have an access control list, so only authorized users may alter the schema.

Active Directory Service Interfaces (ADSI)

A directory service model and a set of COM interfaces. ADSI enables Microsoft Windows 95, Windows 98, Windows NT, and Windows 2000 applications to access several network directory services, including Active Directory service.

Active Directory Sites and Services console

An administrative tool that contains information about the physical structure of your network. Active Directory uses this information to determine how to replicate directory information and handle service requests.

Active Directory Users and Computers console

An administrative tool designed to perform day-to-day Active Directory administration tasks. These tasks include creating, deleting, modifying, moving, and setting permissions on objects stored in the directory. These objects include organizational units, users, contacts, groups, computers, printers, and shared file objects.

Address Resolution Protocol (ARP)

A Transmission Control Protocol/Internet Protocol (TCP/IP) protocol used to resolve the IP addresses of computers on a LAN into the hardware (or MAC) addresses needed to transmit data-link layer frames to them. Before transmitting an IP datagram, TCP/IP clients broadcast an ARP request message containing the IP address of the destination computer to the local network. The computer using that IP address must then respond with an ARP reply message containing its hardware address. With the information in the reply message, the computer can encapsulate the IP datagram in the appropriate data-link layer frame and transmit it to the destination system.

administrator

A person responsible for setting up and managing domain controllers or local computers and their user and group accounts, assigning passwords and permissions, and helping users with networking issues.

ADSI

See Active Directory Service Interfaces (ADSI).

agent

A program that performs a background task for a user and reports to the user when the task is done or when some expected event has taken place.

API

See application programming interface (API).

AppleTalk

A proprietary suite of networking protocols developed by Apple for use by its Macintosh computers. AppleTalk includes AppleShare, a file and printer-sharing solution that enables a Macintosh computer to function as a network server. AppleTalk is rarely used today, as Macintosh computers now communicate using the industry standard TCP/IP protocols.

application

A complete, self-contained set of computer instructions that you use to perform a specific task, such as word processing, accounting, or data management. An application is also called a program.

application assignment

A process that uses Software Installation (an extension of group policy) to assign programs to groups of users. The programs appear to be installed and available on the users' desktops when they log on. You assign programs to a particular group policy object (GPO), which in turn is associated with a selected directory object (site, domain, or organizational unit). When you assign programs, they are advertised to every user managed by the GPO. Advertising the program installs only enough information about the program to make program shortcuts appear on the Start menu and the necessary file associations appear in the registry. When users managed by the GPO log on to a computer running Microsoft Windows 2000, the program appears on their Start menu. When users select the program from the Start menu for the first time, the program is installed. You can also install advertised programs by clicking a document managed by the program (either by file extension or by COM-based activation).

application layer

The top layer of the Open Systems Interconnection (OSI) reference model, which provides the entrance point used by applications to access the networking protocol stack. Some of the protocols operating at the application layer include the Hypertext Transfer Protocol (HTTP), the Simple Mail Transfer Protocol (SMTP), the Dynamic Host Configuration Protocol (DHCP), the File Transfer Protocol (FTP), and the Simple Network Management Protocol (SNMP).

application programming interface (API)

A set of routines that a program uses to request and carry out lower level services performed by another component, such as the computer's operating system or a service running on a network computer. These maintenance chores are performed by the computer's operating system, and an API provides the program with a means of communicating with the system, telling it which system-level task to perform and when.

archive bit

A one-bit flag included with all file systems that backup software programs use to determine whether or not a file has been modified. When a file is backed up, the backup software program typically resets (or strips away) its archive bit. The next time the file is modified, the archive bit is activated. The backup software can then run a job that backs up only the files with active archive bits, which reduces the time and media needed to perform the backup.

ARP

See Address Resolution Protocol (ARP).

Arp.exe

A command-line utility provided by the Microsoft TCP/IP client included with the Windows operating systems, which enables you to display and manipulate the information stored in the cache created by the Address Resolution Protocol (ARP). By preloading the ARP cache, you can save time and network traffic by eliminating the ARP transaction that the TCP/IP client uses to resolve the IP address of each system it transmits to into a hardware address. See also Address Resolution Protocol (ARP).

Asynchronous Transfer Mode (ATM)

A network communications technology based on 53-byte cells, designed to carry voice, data, and video traffic over LANs and WANs at speeds ranging from 25.6 Mbps to 2.46 Gbps.

attenuation

The weakening or degrading (distorting) of a transmitted signal as it travels farther from its point of origin. Attenuation is usually measured in decibels. Attenuation of a signal transmitted over a long cable is corrected by a repeater, which amplifies an incoming signal before sending it farther along the cable.

ATM

See Asynchronous Transfer Mode (ATM).

attribute

Information that indicates whether a file is read-only, hidden, ready for archiving (backing up), compressed, or encrypted, and whether the file contents should be indexed for fast file searching. Also a unit of information that makes up an object in a directory service.

auditing

A process that tracks network activities by user accounts and a routine element of network security. Auditing can produce records of users who have accessed-or attempted to access- specific resources; help administrators identify unauthorized activity; and track activities such as logon attempts, connection and disconnection from designated resources, changes made to files and directories, server events and modifications, password changes, and logon parameter changes.

audit policy

A policy that determines the security events to be reported to the network administrator.

authentication

The process by which the system validates the user's logon information. A user's name and password are compared against an authorized list. If the system detects a match, access is granted to the extent specified in the permissions list for that user. When a user logs on to an account on a computer running Microsoft Windows 2000 Professional, the authentication is performed by the workstation. When a user logs on to an account on a Windows 2000 Server domain, a domain controller performs the authentication.

authoritative restore

A type of restore operation on a Microsoft Windows 2000 domain controller in which the objects in the restored directory are treated as authoritative, replacing (through replication) all existing copies of those objects. Authoritative restore is applicable only to replicated system state data such as Active Directory data and File Replication service data. You must use the Ntdsutil.exe utility to perform an authoritative restore.

authoritative server

A Domain Name System (DNS) server that has been designated as the definitive source of information about the computers in a particular domain. When resolving a computer's DNS name into its IP address, DNS servers consult the authoritative server for the domain in which that computer is located. Whatever information the authoritative server provides about that domain is understood by all DNS ser-vers to be correct. See also Domain Name System (DNS).

authorization

A process that verifies that the user has the correct rights or permissions to access a resource in a domain.

author mode

A console mode that enables full access to all Microsoft Management Console (MMC) functionality, including adding or removing snap-ins, creating new windows, viewing all portions of the console tree, and saving consoles.

automatic allocation

An operational mode of Dynamic Host Configuration Protocol (DHCP) servers in which the server permanently assigns an IP address and other TCP/IP configuration settings to a client from a pool of addresses. Compare with dynamic allocation, which assigns addresses in the same way, but reclaims them when a lease of a given duration expires, and manual allocation, which permanently assigns specific addresses to clients. See also Dynamic Host Configuration Protocol (DHCP).

autochanger

A hardware device consisting of one or more backup drives, a media array, and a robotic mechanism that inserts media into and removes it from the drives. Used to perform automated backups of large amounts of data.

B

bandwidth

In communications, the difference between the highest and lowest frequencies in a given range. For example, a telephone accommodates a bandwidth of 3000 Hz, or the difference between the lowest (300 Hz) and highest (3300 Hz) frequencies it can carry. In computer networks, greater bandwidth indicates faster or greater data-transfer capability.

bind

To associate two pieces of information with one another.

binding

A process that establishes the communication channel between a protocol driver and a network interface card (NIC) driver.

bit

Either 1 or 0 in the binary number system. In processing and storage, a bit is the smallest unit of information handled by a computer. It is represented physically by an element such as a single pulse sent through a circuit or small spot on a magnetic disk capable of storing either a 1 or 0. Eight bits make a byte.

boot

The process of starting or resetting a computer. When first turned on (cold boot) or reset (warm boot), the computer executes the software that loads and starts the computer's operating system, preparing it for use.

boot files

The system files needed to start an operating system, such as Microsoft Windows 2000. For Intel-based computers, this includes Ntldr and Ntdetect.com. For Compaq Alpha-based systems, this is Osloader.exe.

BOOTP

See Bootstrap Protocol (BOOTP).

boot partition

The partition that contains the Microsoft Windows 2000 operating system and its support files. The boot partition can be, but does not have to be, the same as the system partition.

boot-sector virus

A type of virus that resides in the first sector of a floppy disk or hard drive. When the computer is booted, the virus executes. In this common method of transmitting viruses from one floppy disk to another, the virus replicates itself onto the new drive each time a new disk is inserted and accessed.

Bootstrap Protocol (BOOTP)

A server application that can supply client computers with IP addresses, other TCP/IP configuration parameters, and executable boot files. As the progenitor to the Dynamic Host Configuration Protocol (DHCP), BOOTP provides the same basic functions, except that it does not allocate IP addresses from a pool and reclaim them after a specified length of time. Administrators must supply the IP address and other settings for each computer to be configured by the BOOTP server. See also Dynamic Host Configuration Protocol (DHCP), Reverse Address Resolution Protocol (RARP).

bottleneck

A device or program that significantly degrades network performance. Poor network performance results when a device uses noticeably more CPU time than it should, consumes too much of a resource, or lacks the capacity to handle the load. Potential bottlenecks can be found in the CPU, memory, NIC, and other components.

bridgehead server

The contact point for exchange of directory information between sites. You can specify a preferred bridgehead server if you have a computer with appropriate bandwidth to transmit and receive information. If there is typically a high level of directory information exchange, a computer with more bandwidth can ensure that these exchanges are handled promptly.

broadcast

A message transmitted to all of the other computers on the local network. Data-link layer protocols have special addresses designated as broadcast addresses, which means that every computer that receives the message will read it into memory and process it. LANs use broadcasts for a variety of tasks, such as to discover information about other computers on the network.

built-in groups

The default groups provided with Microsoft Windows 2000 Professional and Windows 2000 Server. Built-in groups have been granted useful collections of rights and built-in abilities. In most cases, built-in groups provide all the capabilities needed by a particular user.

built-in user account

Used to perform administrative tasks or to access network resources.

byte

A unit of information consisting of 8 bits. In computer processing or storage, a byte is equivalent to a single character, such as a letter, numeral, or punctuation mark. Because a byte represents only a small amount of information, amounts of computer memory are usually given in kilobytes (1024 bytes or 2 raised to the 10th power), megabytes (1,048,576 bytes or 2 raised to the 20th power), gigabytes (1024 megabytes), terabytes (1024 gigabytes), petabytes (1024 terabytes), or exabytes (1024 petabytes).

C

CA (certificate authority)

See certificate authority (CA).

cache

For DNS and Windows Internet Naming Service (WINS), a local information store of resource records for recently resolved names of remote hosts. Typically, the cache is built dynamically as the computer queries and resolves names. It also helps optimize the time required to resolve queried names.

certificate

A collection of data used for authentication and secure exchange of information on nonsecured networks, such as the Internet. A certificate securely binds a public key to the entity that holds the corresponding private key. Certificates are digitally signed by the issuing certificate authority (CA) and can be managed for a user, computer, or service. The most widely accepted format for certificates is defined by the ITU-T X.509 international standards.

certificate authority (CA)

An entity responsible for establishing the authenticity of public keys belonging to users or other CAs. Activities of a CA can include binding public keys to distinguished names through signed certificates, managing certificate serial numbers, and revoking certificates.

certificate services

Software services that provide authentication support, including secure e-mail, Web-based authentication, and smart card authentication. These services contrast with Internet Authentication Services (IAS), which provide authentication for dial-in users.

channel service unit/data service unit (CSU/DSU)

A hardware device that terminates the end of a leased line connection and provides testing and diagnostic capabilities. See also leased line.

child domain

For DNS, domains located in the namespace tree directly beneath another domain name (the parent domain). For example, example.microsoft.com would be a child domain of the parent domain microsoft.com. A child domain is also called a subdomain.

child object

An object that resides in another object. For example, a file is a child object that resides in a folder, which is the parent object.

client

A program designed to communicate with a server program on another computer, usually to request and receive information. The client provides the interface with which the user can view and manipulate the server data. A client can be a module in an operating system, such as the Client for Microsoft Networks in Windows, which enables the user to access resources on the network's other computers, or a separate application, such as a Web browser or e-mail reader.

client/server networking

A computing model in which data processing tasks are distributed between clients, which request, display, and manipulate information, and servers, which supply and store information. By making each individual client responsible for displaying and manipulating its own data, the server is relieved of a large part of the processing burden. The alternative is a mainframe or minicomputer system in which one computer performs all of the processing for all of the users, who work with terminals that do not have processors (dumb terminals).

collision

In local area networking, a condition in which two computers transmit data at precisely the same time, and their signals both occupy the same cable, causing data loss. On some types of networks, such as Ethernet, collisions are a normal occurrence, whereas on Token Ring networks, they are an indication of a serious problem. Also called a signal quality error (SQE).

command

A word or phrase, usually found on a menu, that you click to carry out an action. You click a command on a menu or type a command at the command prompt. You can also type a command in the Run dialog box, which you open in the Start menu by clicking Run.

command prompt window

A window displayed on the desktop used to interface with the operating system's command line.

computer account

An account that is created by a domain administrator and uniquely identifies the computer on the domain. The Microsoft Windows 2000 computer account matches the name of the computer joining the domain.

connectionless

A type of protocol that transmits messages to a destination without first establishing a connection with the destination system. Connectionless protocols have very little overhead, and are used primarily for transactions that consist of a single request and reply. IP and the User Datagram Protocol (UDP) are both connectionless protocols.

connection-oriented

A type of protocol that transmits a series of messages to a destination to establish a connection before sending any application data. Establishing the connection ensures that the destination system is active and ready to receive data. Connection-oriented protocols are typically used to send large amounts of data, such as entire files, which must be split into multiple packets and which are useless unless every packet arrives at the destination without error. The Transmission Control Protocol (TCP) is a connection-oriented protocol.

console

Collections of administrative tools.

console mode

Determines the Microsoft Management Console (MMC) functionality for the person who is using a saved MMC. The two available console modes are Author mode and User mode.

console tree

The left pane in a Microsoft Management Console (MMC) that displays the items contained in the console. By default it is the left pane of a console window, but it can be hidden. The items in the console tree and their hierarchical organization determine the capabilities of a console.

container object

An object that can logically contain other objects. For example, a folder is a container object.

copy backup

Copies all selected files, but does not mark each file as having been backed up. Copying is useful if you want to back up files between normal and incremental backups, because copying will not invalidate these other backup operations.

counter log

Collects performance counter data in a comma-separated or tab-separated format for easy import to spreadsheet programs. You can view logged counter data using System Monitor or by exporting the data to spreadsheet programs or databases for analysis and report generation.

counters

The individual system attributes or processes monitored by the Performance console in Windows 2000 and the Performance Monitor application in Windows NT.

cyclical redundancy check

An error detection mechanism in which a computer performs a calculation on a data sample with a specific algorithm, and then transmits the data and the results of the calculation to another computer. The receiving computer then performs the same calculation and compares its results to those supplied by the sender. If the results match, the data has been transmitted successfully. If the results do not match, the data has been damaged in transit.

D

DACL

See discretionary access control list (DACL).

daily backup

Copies all selected files that have been modified the day that the daily backup is performed.

data encapsulation

The process by which information generated by an application is packaged for transmission over a network by successive protocols operating at the various layers of the Open Systems Interconnection (OSI) reference model. A protocol packages the data it receives from the layer above by adding a header (and sometimes a footer) containing protocol-specific information used to ensure that the data arrives at its destination intact.

datagram

The unit of data used by IP and other network layer protocols. Network layer protocols accept data from transport layer protocols and package it into datagrams by adding their own protocol headers. The protocol then passes the datagrams down to a data-link layer protocol for further packaging before they are transmitted over the network.

data-link layer

The second layer from the bottom of the Open Systems Interconnection (OSI) reference model. Protocols operating at the data-link layer are responsible for packaging network layer data, addressing it to its next destination, and transmitting it over the network. Some of the LAN protocols operating at the data-link layer are Ethernet, Token Ring, and the Fiber Distributed Data Interface (FDDI). WAN protocols operating at the data-link layer include the Point-to-Point Protocol (PPP) and the Serial Line Internet Protocol (SLIP).

DDNS

See Dynamic DNS (DDNS).

default gateway

The router on the local network used by a TCP/IP client computer to transmit messages to computers on other networks. To communicate with other networks, TCP/IP computers consult their routing tables for the address of the destination network. If they locate the address, they send their packets to the router specified in the table entry, which relays them to the desired network. If no specific entry for the network exists, the computer sends the packets to the router specified in the default gateway entry, which the user (or a DHCP server) supplies as one of the basic configuration parameters of the TCP/IP client.

default groups

Groups that have a predetermined set of user rights or group membership. Microsoft Windows 2000 has four categories of default groups: predefined, built-in, built-in local, and special identity.

default user profile

The profile that serves as a basis for all new user profiles. Every user profile begins as a copy of the default user profile, which is stored on each computer running Microsoft Windows 2000 Professional or Windows 2000 Server.

delegation

The ability to assign responsibility for management and administration of a portion of the namespace to another user, group, or organization.

Destination Address

A 48-bit field in data-link layer protocol headers that contains a hexadecimal sequence used to identify the network interface to which a frame will be transmitted.

Destination IP Address

A 32-bit field in the Internet Protocol (IP) header that contains a value used to identify the network interface to which a packet will be transmitted.

details pane

The pane in the Microsoft Management Console (MMC) that displays the details for the selected item in the console tree. The details can be a list of items or they can be administrative properties, services, and events that are acted on by a console or snap-in.

device driver

A program that enables a specific device, such as a modem, network card, or printer, to communicate with an operating system, such as Microsoft Windows 2000. For example, without serial port drivers, network connections cannot use a modem to connect to a network. Although a device might be installed on your system, Windows 2000 cannot use the device until you have installed and configured the appropriate driver. If a device is listed in the Hardware Compatibility List (HCL), a driver is usually included with Windows 2000. Device drivers load automatically (for all enabled devices) when a computer is started, and thereafter run invisibly.

Dfs

See distributed file system (Dfs).

Dfs link

A link from a Dfs root to one or more shared files, another Dfs root, or a domain-based volume.

Dfs replication

The process of copying data from a data store or file system to multiple computers to synchronize the data. Active Directory service provides multiple-master replication of the directory between domain controllers within a given domain. The replicas of the directory on each domain controller are writeable. This allows updates to be applied to any replica of a given domain. The replication service automatically copies the changes from a given replica to all other replicas.

Dfs root

A container for files and Dfs links.

DHCP

See Dynamic Host Configuration Protocol (DHCP).

DHCP client

Any network-enabled device that supports the ability to communicate with a DHCP server for the purpose of obtaining dynamic leased IP configuration and related optional parameters information.

DHCP scope

A range of IP addresses that are available to be leased or assigned to DHCP clients by the DHCP service.

DHCP server

In Microsoft Windows 2000 Server, a computer running the Microsoft DHCP service that offers dynamic configuration of IP addresses and related information to DHCP-enabled clients.

dial-up connection

The connection to your network if you are using a device that uses the telephone network. This includes modems with standard phone lines and ISDN cards with high-speed ISDN lines. If you are a typical user, you may have one or two dial-up connections, perhaps to the Internet and to your corporate network. In a more complex server situation, multiple network modem connections might be used to implement advanced routing.

differential backup

A type of backup job that employs a filter that causes it to back up only the files that have changed since the last full backup job. The filter evaluates the state of each file's archive bit, which a full backup job clears. Creating or modifying a file sets its archive bit, and the differential job backs up only the files that have their archive bit set. The differential job does not modify the state of the bits, so the next differential job also backs up all of the files that have changed since the last full backup. Differential jobs use more tape or other media than incremental jobs, because they repeatedly back up the same files, but they are easier to restore in the event of a disaster. You only have to restore the last full backup and the most recent differential backup to completely restore a drive. Compare with incremental backup.

digital signature

A means for originators of a message, file, or other digitally encoded information to bind their identity to the information. The process of signing information entails transforming the information, as well as some secret information held by the sender, into a tag called a signature.

Digital Subscriber Line (DSL)

A type of point-to-point, digital WAN connection that uses standard telephone lines to provide high-speed communications. DSL is available in many different forms, including Asymmetrical Digital Subscriber Line (ADSL) and High-bit-rate Digital Subscriber Line (HDSL). The various DSL technologies differ greatly in their speeds and in the maximum possible distance between the installation site and the telephone company's nearest central office. DSL connections are used for many applications, ranging from LAN and Private Branch Exchange (PBX) interconnections to consumer Internet access.

directory

An information source (for example, a telephone directory) that contains information about people, computer files, or other objects. In a file system, a directory stores information about files. In a distributed computing environment (such as a Microsoft Windows 2000 domain), the directory stores information about objects such as printers, fax servers, applications, databases, and other users.

directory database

The physical storage for each replica of Active Directory service. The directory database is also called the data store.

directory service

A database containing information about network entities and resources, used as a guide to the network and an authentication resource by multiple users. Early network operating systems included basic flat file directory services, such as Windows NT domains and the Novell NetWare bindery. Today's directory services, such as Microsoft's Active Directory service, tend to be hierarchical and designed to support large enterprise networks. See also Active Directory service.

directory services restore mode

A special safe mode that allows you to restore the system state data on a domain controller. When your computer is started in this mode you can restore the SYSVOL directory and Active Directory service database. You can only restore system state data on a local computer; you cannot restore the system state data on a remote computer.

discretionary access control list (DACL)

A list that represents part of an object's security descriptor that allows or denies permissions to specific users and groups.

distinguished name (DN)

A name that uniquely identifies an object by using the relative distinguished name for the object, plus the names of container objects and domains that contain the object. The distinguished name identifies the object as well as its location in a tree. Every object in Active Directory service has a distinguished name. A typical distinguished name might be: CN=MyName,CN=Users,DC=Microsoft,DC=Com. This identifies the MyName user object in the microsoft.com domain.

distributed file system (Dfs)

A service used to build a logical structure of file shares from separate computers and presented to users and administrators in a single directory tree.

distribution group

A group that is used solely for e-mail distribution and is not security-enabled. Distribution groups cannot be listed in discretionary access control lists (DACLs) used to define permissions on resources and objects. Distribution groups can be used only with e-mail applications (such as Microsoft Exchange) to send e-mail to collections of users. If you do not need a group for security purposes, create a distribution group instead of a security group.

DN

See distinguished name (DN).

DNS

See Domain Name System (DNS).

DNS name server

In the DNS client/server model, the server containing information about a portion of the DNS database that makes computer names available to client resolvers querying for name resolution across the Internet.

domain

In Microsoft Windows 2000 and Active Directory service, a collection of computers defined by the administrator of a Windows 2000 Server network that share a common directory database. A domain has a unique name and provides access to the centralized user accounts and group accounts maintained by the domain administrator. Each domain has its own security policies and security relationships with other domains and represents a single security boundary of a Windows 2000 computer network. An Active Directory forest is made up of one or more domains, each of which can span more than one physical location. For Domain Name System (DNS), a domain is any tree or subtree within the DNS namespace. Although the names for DNS domains often correspond to Active Directory domains, DNS domains should not be confused with Windows 2000 and Active Directory networking domains.

domain controller

A computer running Windows 2000 or Windows NT that has been designated for storing and processing directory service information. Windows NT domains and the Windows 2000 Active Directory service store their directory service databases on domain controllers, which also authenticate users accessing network resources.

domain local group

A security or distribution group that can contain universal groups, global groups, and accounts from any domain in the domain tree or forest. A domain local group can also contain other domain local groups from its own domain. Rights and permissions can be assigned only at the domain containing the group.

domain model

A grouping of one or more domains with administration and communication links between them that is arranged for the purpose of user and resource management.

domain name

In Microsoft Windows 2000 and Active Directory service, the name given by an administrator to a collection of networked computers that share a common directory. For Domain Name System (DNS), domain names are specific node names in the DNS namespace tree. DNS domain names use singular node names, joined together by periods (.) that indicate each node level in the namespace.

domain namespace

The database structure used by the Domain Name System (DNS).

Domain Name System (DNS)

A distributed, hierarchical namespace designed to provide TCP/IP networks (such as the Internet) with friendly names for computers and users. Although TCP/IP computers use IP addresses to identify each other, people work better with names. DNS provides a naming system for network resources and a service for resolving those names into IP addresses. TCP/IP computers frequently access DNS servers to send them the names of the computers they want to access. The DNS server communicates with other DNS servers on the network to determine the IP address associated with the requested name and then sends it back to the client computer, which initiates communications with the destination system using its IP address.

domain user account

Enables a user to log on to the domain to gain access to network resources.

drive spanning

A process by which a computer creates a single logical storage unit called a volume by combining the disk space of two or more drives. The volume appears to users as a single logical entity, but data is actually being stored on multiple drives. The primary drawback of this arrangement is that if one of the drives should fail, the entire volume is lost.

driver

Also called a device driver, a software component that enables an application or operating system to utilize a particular hardware device.

duplexing

A data availability technique that involves storing identical copies of data on two different drives connected to different host adapters. The drives appear as a single volume to users, and all files written to the volume are copied to both drives automatically. If one of the drives or adapters should fail, the other continues to make the data available until the failed component is repaired or replaced. Compare with mirroring.

dynamic allocation

An operational mode of Dynamic Host Configuration Protocol (DHCP) servers in which the server assigns an IP address and other TCP/IP configuration settings to a client from a pool of addresses, and then reclaims them when a lease of a given duration expires. This enables you to move computers to different subnets without having to manually release the previously allocated IP addresses from the other subnets. Compare with automatic allocation, manual allocation. See also Dynamic Host Configuration Protocol (DHCP).

Dynamic DNS (DDNS)

Enables clients with dynamically assigned addresses to register directly with a server running the DNS service and update the DNS table dynamically. DDNS eliminates the need for other Internet naming services, such as Windows Internet Naming Service (WINS), in a homogeneous environment.

Dynamic Host Configuration Protocol (DHCP)

A service that automatically configures the TCP/IP client computers on a network by assigning them unique IP addresses and other configuration parameters. DHCP servers can assign IP addresses to clients from a pool and reclaim them when a lease of a set duration expires. Virtually all operating systems include a DHCP client, and most of the major server operating systems, such as Windows 2000 Server, Windows NT Server, Novell NetWare, and many forms of UNIX, include DHCP server software. DHCP is a cross-platform service that can support various operating systems with a single server. See also automatic allocation, dynamic allocation, manual allocation.

dynamic routing

A system in which routers automatically build their own routing tables using specialized protocols to communicate with other nearby routers. By sharing information in this way, a router builds up a composite picture of the internetwork on which it resides, enabling it to route traffic more efficiently. The two basic types of routing protocols are distance vector routing protocols, like the Routing Information Protocol (RIP), and link state routing protocols, like the Open Shortest Path First (OSPF) protocol.

dynamic volume

A logical volume that is created using the Windows 2000 Disk Management tool. Dynamic volumes include simple, spanned, striped, mirrored, and RAID-5. You must create dynamic volumes on dynamic disks.

E

e-mail

A service that transmits messages in electronic form to specific users on a network.

encryption

The process of making information indecipherable to protect it from unauthorized viewing or use, especially during transmission or when the data is stored on a transportable magnetic medium. A key is required to decode the information.

Ethernet

Common term used to describe IEEE 802.3, a data-link layer LAN protocol developed in the 1970s, which is now the most popular protocol of its kind in the world. Ethernet runs at 10 Mbps, is based on the Carrier Sense Multiple Access with Collision Detection (CSMA/CD) Media Access Control (MAC) mechanism, and supports a variety of physical layer options, including coaxial, unshielded twisted pair (UTP), and fiber optic cables. More recent revisions of the protocol support speeds of 100 Mbps (Fast Ethernet) and 1000 Mbps (Gigabit Ethernet).

event

Any significant occurrence in the system or in an application that requires users to be notified or an entry to be added to a log.

Event Log service

A service that records events in the system, security, and application logs. The Event Log service is located in Event Viewer.

event logging

The Microsoft Windows 2000 process of recording an audit entry in the audit trail whenever certain events occur, such as services starting and stopping or users logging on and off and accessing resources. You can use Event Viewer to review AppleTalk network integration (formerly Services for Macintosh) events as well as Windows 2000 events.

Event Viewer

Maintains logs about application, security, and system events on your computer.

Everyone group

In Microsoft Windows 2000, includes all local and remote users who have connected to the computer, including those who connect as guests. You cannot control who becomes a member of the Everyone group; however, you can assign permissions and rights.

expand

To show hidden directory levels in the directory tree.

extension snap-ins

Usually referred to simply as extensions. They are MMC snap-ins that provide additional administrative functionality to another snap-in.

F

Fast Ethernet

Updated version of the Ethernet LAN protocol that increases transmission speed from 10 to 100 Mbps, preserving nearly all of Ethernet's defining elements, such as its frame format, its physical layer options, and the Carrier Sense Multiple Access with Collision Detection (CSMA/CD) Media Access Control (MAC) mechanism. Defined in a new document published in 1995 called IEEE 802.3u, Fast Ethernet supports three primary physical layer options: 100Base-TX for Category 5 UTP cable, 100Base-T4 for Category 3 UTP cable, and 100Base-FX for multimode fiber optic cable.

fault tolerance

The ability of a computer or operating system to ensure data integrity when hardware failures occur.

file

A collection of information that has been given a name and is stored on a disk. This information can be a document or a program.

file allocation table (FAT)

File system originally used by the DOS operating system, which is based on a table that specifies which disk clusters contain the files stored on a disk. The Windows 95, Windows 98, Windows Me, Windows NT, and Windows 2000 operating systems currently support the 16-bit version of the FAT file system. Windows 95 OSR2, Windows 98, Windows Me, and Windows 2000 also support FAT32, a newer version that uses 32-bit FAT entries, enabling the file system to support much larger disk drives. The FAT file system is sufficient for a standard workstation, but lacks the security capabilities required by server drives. For this reason, the Microsoft operating systems designed for heavier network use, Windows 2000 and Windows NT, also include the NTFS file system, which has greater security capabilities.

File Replication Service (FRS)

Provides multiple-master file replication for designated directory trees between designated Windows 2000 servers. The designated directory trees must be on disk partitions formatted with the version of NTFS used with Windows 2000. FRS is used by the Microsoft distributed file system (Dfs) to automatically synchronize content between assigned replicas, and by Active Directory services to automatically synchronize content of the system volume information across domain controllers.

file sharing

The ability of a computer running Microsoft Windows 2000 to share parts (or all) of its local file system(s) with remote computers.

file system

In an operating system, the overall structure in which files are named, stored, and organized. NTFS, FAT, and FAT32 are types of file systems.

File Transfer Protocol (FTP)

An application layer TCP/IP protocol designed to perform file transfers and basic file management tasks on remote computers. FTP is a mainstay of Internet communications. FTP client support is integrated into most Web browsers and FTP server support is integrated into many Web server products. FTP is also an important UNIX tool; all UNIX systems support both FTP client and server functions. FTP is unique among TCP/IP protocols in that it uses two simultaneous TCP connections. One, a control connection, remains open during the entire life of the session between the FTP client and the FTP server. When the client initiates a file transfer, a second connection is opened between the two computers to carry the transferred data. This connection closes at the conclusion of the data transfer.

firewall

A hardware or software product designed to isolate part of an internetwork to protect it against intrusion by outside processes. Typically used to protect a private network from intrusion from the Internet, firewalls use a number of techniques to provide this protection, while still allowing certain types of traffic through. Some of these techniques include packet filtering and network address translation (NAT). Once intended only for large network installations, there are now smaller firewall products designed to protect small networks and individual computers from Internet intruders.

flow control

A function of certain data transfer protocols that enables a system receiving data to transmit signals to the sender instructing it to slow down or speed up its transmissions. This prevents the receiving system from overflowing its buffers and being forced to discard incoming data. For example, TCP implements its flow control mechanism by using a Window field to specify the number of bytes that it is capable of receiving from the sender.

folder

A grouping of files or other folders, graphically represented by a folder icon, in both Microsoft Windows 2000 and Macintosh environments. A folder is analogous to a PC's file system directory, and many folders are, in fact, directories.

folder redirection

An extension within group policy that enables you to redirect the following Windows 2000 special folders to network locations: Application Data, Desktop, My Documents, My Pictures, and Start Menu.

forest

A collection of one or more Microsoft Windows 2000 domains that share a common schema, configuration, and global catalog, and are linked with two-way transitive trusts.

forward lookup

In Domain Name System (DNS), a query process in which the friendly DNS domain name of a host computer is searched to find its IP address.

FQDN

See fully qualified domain name (FQDN).

frame

Unit of data constructed, transmitted, and received by data-link layer protocols such as Ethernet and Token Ring. Data-link layer protocols create frames by packaging the data they receive from network layer protocols inside a header and footer. Frames can be different sizes, depending on the protocol used to create them.

frame relay

A WAN technology in which two systems are each connected to a frame relay network called a cloud, and a virtual circuit is established between them through the cloud. The advantages of frame relay over a leased line are that the amount of bandwidth provided by the connection is flexible and it is possible for one site to be connected to numerous other sites using multiple virtual circuits. See also leased line.

FTP

See File Transfer Protocol (FTP).

full zone transfer (AXFR)

The standard query type supported by all Domain Name System (DNS) servers to update and synchronize zone data when the zone has been changed. When a DNS query is made using AXFR as the specified query type, the entire zone is transferred as the response.

fully qualified domain name (FQDN)

A Domain Name System (DNS) domain name that has been stated unambiguously to indicate with absolute certainty its location in the domain namespace tree. FQDNs differ from relative names in that they are typically stated with a trailing period (.), for example, host.example.microsoft.com., to qualify their position to the root of the namespace.

G

gateway

On a TCP/IP network, the term gateway is often used synonymously with the term router, referring to a network layer device that connects two networks and relays traffic between them as needed, such as the default gateway specified in a TCP/IP client configuration. However, the term gateway is also used to refer to an application layer device that relays data between two different services, such as an e-mail gateway that enables two separate e-mail services to communicate with each other.

GB

Gigabyte, equal to 1000 megabytes or 1,000,000 kilobytes or 1,000,000,000 bytes.

Gbps

Gigabits per second, a unit of measurement typically used to measure network transmission speed.

GBps

Gigabytes per second, a unit of measurement typically used to measure the speed of data storage devices.

global catalog

A domain controller that contains a partial replica of every domain in Active Directory service. A global catalog holds a replica of every object in Active Directory, but with a limited number of attributes for each. The global catalog stores those attributes most frequently used in search operations (such as a user's first and last name) and those attributes required to locate a full replica of the object. The Active Directory replication system builds the global catalog automatically. The attributes replicated into the global catalog include a base set defined by Microsoft. Administrators can specify additional properties to meet the needs of their installation.

global catalog server

A Microsoft Windows 2000 domain controller that holds a copy of the global catalog for the forest.

global group

For Microsoft Windows 2000 Server, a group that can be granted rights and permissions and can become a member of local groups in its own domain, the member servers and workstations thereof, and trusting domains. However, a global group can contain user accounts only from its own domain. Global groups provide a way to create sets of users from inside the domain, available for use both in and out of the domain. Global groups cannot be created or maintained on computers running Windows 2000 Professional. However, for Windows 2000 Professional computers that participate in a domain, domain global groups can be granted rights and permissions at those workstations and can become members of local groups at those workstations.

globally unique identifier (GUID)

A 128-bit number that is guaranteed to be unique. GUIDs are assigned to objects when the objects are created. The GUID never changes, even if you move or rename the object. Applications can store the GUID of an object and use the GUID to retrieve that object regardless of its current distinguished name.

GPO

See group policy object (GPO).

grandfather-father-son

A media rotation scheme used by many backup software programs in which grandfather refers to monthly backup jobs, father to weekly jobs, and son to daily jobs.

group

A collection of users, computers, contacts, and other groups. Groups can be used as security or e-mail distribution collections. Distribution groups are used only for e-mail. Security groups are used to grant access to resources.

group account

A collection of user accounts. By making a user account a member of a group, you give the related user all the rights and permissions granted to the group.

group memberships

The groups to which a user account belongs. Permissions and rights granted to a group are also provided to its members. In most cases, the actions a user can perform in Microsoft Windows 2000 are determined by the group memberships of the account with which the user is logged on to the network.

group policy

The Microsoft Windows 2000 Microsoft Management Console (MMC) snap-in used to specify the behavior of users' desktops. A group policy object (GPO), which an administrator creates using the Group Policy snap-in, is the mechanism for configuring desktop settings.

group policy object (GPO)

A collection of group policy settings. GPOs are essentially the documents created by the Group Policy snap-in. GPOs are stored at the domain level and they affect users and computers contained in sites, domains, and organizational units. In addition, each Microsoft Windows 2000 computer has exactly one group of settings stored locally, called the local GPO.

group scopes

Enable you to use groups in different ways to assign permissions. The scope of a group determines where in the network you are able to use the group to assign permissions to the group. The three group scopes are global, domain local, and universal.

guest account

A built-in account used to log on to a computer running Microsoft Windows 2000 when a user does not have an account on the computer or domain or in any of the domains trusted by the computer's domain.

GUID

See globally unique identifier (GUID).

H

hierarchical namespace

A system of object identifiers, such as the Domain Name System (DNS) namespace or the Active Directory namespace, that is structured in nested layers and provides rules that allow the namespace to be partitioned.

histogram

A chart consisting of horizontal or vertical bars, the widths or heights of which represent the values of certain data.

home folder

Specified in the Active Directory Users and Computers console or Local Users and Groups console, the home folder is a directory that is accessible to the user and can contain files and programs for that user. A home folder can be assigned to an individual user or can be shared by many users. Some programs use the home folder as the default folder for the Open and Save As dialog boxes. Other programs use the My Documents folder.

hop

A unit of measurement used to quantify the length of a route between two computers on an internetwork, as indicated by the number of routers that packets must pass through to reach the destination end system. For example, if packets must be forwarded by four routers in the course of their journey from end system to end system, the destination is said to be four hops away from the source. Distance vector routing protocols like the Routing Information Protocol (RIP) use the number of hops as a means to compare the relative efficiency of routes.

host name

The name of a device on a TCP/IP network. For a device on a Microsoft Windows 2000 or Windows NT network, this can be the same as the computer name, but it might not be. The host name must be in the HOSTS file, or it must be known by a Domain Name System (DNS) server, for that host to be found by another computer attempting to communicate with it.

HOSTS

An ASCII text file used by TCP/IP computers to resolve host names into IP addresses. The HOSTS file is a simple list of the host names used by TCP/IP computers and their equivalent IP addresses. When a user or an application refers to a computer using a host name, the TCP/IP client looks it up in the HOSTS file to determine its IP address. The HOSTS file was the original name resolution method for what later became the Internet, until the number of computers on the network grew too large to manage using this technique. Eventually, the Domain Name System (DNS) was created to perform the same function in a more efficient and manageable way. TCP/IP computers still have the ability to use a HOSTS file for name resolution, but because the names and addresses of each computer must be added manually, this method is rarely used today.

HTML

See Hypertext Markup Language (HTML).

HTTP

See Hypertext Transfer Protocol (HTTP).

Hypertext Markup Language (HTML)

A language developed for writing pages for the World Wide Web. HTML enables text documents to include codes that define fonts, layout, embedded graphics, and hypertext links. Hypertext provides a method for presenting text, images, sound, and videos that are linked together in a nonsequential web of associations.

Hypertext Transfer Protocol (HTTP)

Application layer protocol that is the basis for World Wide Web communications. Web browsers generate HTTP GET request messages containing URLs and transmit them to Web servers, which reply with one or more HTTP Response messages containing the requested files. HTTP traffic is encapsulated using the Transmission Control Protocol (TCP) at the transport layer and the Internet Protocol (IP) at the network layer. Each HTTP transaction requires a separate TCP connection.

I

IANA

See Internet Assigned Numbers Authority (IANA).

ICMP

See Internet Control Message Protocol (ICMP).

IETF

See Internet Engineering Task Force (IETF).

IIS

See Internet Information Services (IIS).

in-addr.arpa domain

A special top-level Domain Name System (DNS) domain reserved for reverse mapping of IP addresses to DNS host names.

incremental backup

A type of backup job that employs a filter that causes it to back up only the files that have changed since the last backup job. The filter evaluates the state of each file's archive bit, which a full backup job or an incremental backup job clears. Creating or modifying a file sets its archive bit, and the incremental job backs up only the files with an archive bit that is set. It then resets the archive bits (unlike a differential job, which does not reset the bits). Incremental jobs use the least amount of tape or other medium, but are more difficult to restore in the event of a disaster. You must restore the last full backup job and all of the incremental jobs performed since that last full backup, in the correct chronological order, to fully restore a drive. Compare with differential backup.

incremental zone transfer (IXFR)

An alternate query type that can be used by some Domain Name System (DNS) servers to update and synchronize zone data when a zone is changed. When IXFR is supported between DNS servers, servers can keep track of and transfer only those incremental resource record changes between each version of the zone.

Integrated Services Digital Network (ISDN)

A worldwide digital communication network that evolved from existing telephone services. The goal of ISDN was to replace current telephone lines, which require digital-to-analog conversions, with completely digital switching and transmission facilities capable of carrying data ranging from voice to computer transmissions, music, and video. ISDN is built on two main types of communications channels: B channels, which carry voice, data, or images at a rate of 64 Kbps, and a D channel, which carries control information, signaling, and link-management data at 16 or 64 Kbps. Standard ISDN Basic Rate Interface (BRI) desktop service is called 2B+D. Computers and other devices connect to ISDN lines through simple, standardized interfaces.

interactive logon

A network logon from a computer keyboard, when the user types information in the Log On To Windows dialog box displayed by the computer's operating system.

International Organization for Standardization (ISO)

An organization, founded in 1946, that consists of standards bodies from more than 75 countries, such as the American National Standards Institute (ANSI) from the United States. The ISO is responsible for the publication of many computer-related standards, the most well-known of which is "The Basic Reference Model for Open Systems Interconnection," commonly known as the OSI reference model. (ISO is not an acronym; it is a name derived from the Greek word isos, meaning equal.)

internet

See internetwork.

Internet

A packet-switching internetwork that consists of thousands of individual networks and millions of computers located around the world. The Internet is not owned or administered by any central managing body; all administration chores are distributed among users all over the network.

Internet Assigned Numbers Authority (IANA)

The organization responsible for the assignment of unique parameter values for the TCP/IP protocols, including IP address assignments for networks and protocol number assignments. The Assigned Numbers Requests for Comments (RFC) document (currently RFC 1700) lists all of the protocol number assignments and many other unique parameters regulated by the IANA.

Internet Control Message Protocol (ICMP)

A network layer TCP/IP protocol that carries administrative messages, particularly error messages and informational queries. ICMP error messages are primarily generated by intermediate systems that, because the packets they route travel no higher than the network layer, have no other means of signaling errors to the end system that transmitted the packet. Typical ICMP error messages inform the sender that the network or host to which a packet is addressed could not be found, or that the Time to Live value for a packet has expired. ICMP query messages request information (or simply a response) from other computers, and are the basis for TCP/IP utilities like Ping, which is used to test the ability of one computer on a network to communicate with another.

Internet Engineering Task Force (IETF)

A large, open community of network designers, operators, vendors, and researchers concerned with the evolution of Internet architecture and the smooth operation of the Internet. Technical work is performed by working groups organized by topic areas (such as routing, transport, and security) and through mailing lists. Internet standards are developed in IETF Requests for Comments (RFCs), which are a series of documents that discuss many aspects of computing and computer communication, focusing on networking protocols, programs, and concepts.

Internet Information Services (IIS)

Software services that support Web site creation, configuration, and management, along with other Internet functions. Microsoft Internet Information Services also includes support for Network News Transfer Protocol (NNTP), File Transfer Protocol (FTP), and Simple Mail Transfer Protocol (SMTP).

Internet Protocol (IP)

The primary network layer protocol in the Transmission Control Protocol/Internet Protocol (TCP/IP) suite. IP is the protocol that is ultimately responsible for end-to-end communications on a TCP/IP internetwork. It includes functions such as addressing, routing, and fragmentation. IP packages data that it receives from transport layer protocols into data units called datagrams by applying a header containing the information needed to transmit the data to its destination. The IP addressing system uses 32-bit addresses to uniquely identify the computers on a network, and specifies the address of the destination system as part of the IP header. IP is also responsible for routing packets to their destinations on other networks by forwarding them to other routers on the network. When a datagram is too large to be transmitted over a particular network, IP breaks it into fragments and transmits each in a separate packet.

Internet service provider (ISP)

A type of company whose business is supplying consumers or businesses with Internet access. At the consumer level, an ISP provides users with dial-up access to the ISP's networks, which are connected to the Internet, as well as other end-user services, such as access to DNS, e-mail, and news servers. At the business level, ISPs provide high-bandwidth Internet connections using leased telephone lines or other technologies. They sometimes also provide other services, such as registered IP addresses, Web site hosting, and DNS domain hosting.

internetwork

A group of interconnected local area networks (LANs) and/or wide area networks (WANs) that are connected so that any computer can transmit data to any other computer. The networks are connected by routers, which are responsible for relaying packets from one network to another. The largest example of an internetwork is the Internet, which is composed of thousands of networks located around the world. Private internetworks consist of a smaller number of LANs, often at various locations and connected by WAN links.

Internetwork Packet Exchange (IPX)

A network layer protocol used by Novell NetWare networks. IPX performs many of the same functions as the Internet Protocol (IP), but instead of being a self-contained addressing system like IP, IPX is designed for use on LANs only and uses a network identifier assigned by the network administrator plus the network interface adapter's hardware address to identify the individual computers on the network. Unlike IP, IPX is not based on an open standard. Novell owns all rights to the protocols of the IPX protocol suite, although Microsoft has developed its own IPX-compatible protocol for inclusion in the Windows operating systems.

interoperability

The ability of components in one system to work with components in other systems.

intersite replication

Replication traffic that occurs between sites.

intrasite replication

Replication traffic that occurs within a site.

intranet

A TCP/IP network owned by a private organization that provides services such as Web sites only to that organization's users.

IP

See Internet Protocol (IP).

IP address

A 32-bit number assigned to TCP/IP client computers and other network equipment that uniquely identifies that device on the network. IP uses IP addresses to transmit packets to their destinations. Expressed as four 8-bit decimal values separated by periods (for example, 192.168.71.19), the IP address consists of a network identifier (which specifies the network that the device is located on) and a host identifier (which identifies the particular device on that network). The sizes of the network and host identifiers can vary depending on the address class. For a computer to be accessible from the Internet, it must have an IP address containing a network identifier registered with the Internet Assigned Numbers Authority (IANA).

Ipconfig.exe

A Windows 2000 and Windows NT command-line utility used to view the TCP/IP configuration parameters for a particular computer. A graphical version of the tool, called Winipcfg.exe, is included with Windows 95, Windows 98, and Windows Me. Ipconfig.exe is most useful on computers with TCP/IP clients configured automatically by a Dynamic Host Configuration Protocol (DHCP) server, because it is the easiest way to view the assigned settings for the client system. You can also use Ipconfig.exe to release and renew DHCP-assigned TCP/IP configuration parameters.

IP replication

Uses remote procedure calls (RPCs) for replication over site links (intersite) and within a site (intrasite). By default, intersite IP replication does adhere to replication schedules, although you may configure Active Directory service to ignore schedules.

IPSec

See IP Security protocol (IPSec).

IP Security protocol (IPSec)

A set of TCP/IP protocols designed to provide encrypted end-to-end network layer communications. For computers to communicate using IPSec, they must share a public key.

IPX

See Internetwork Packet Exchange (IPX).

ISDN

See Integrated Services Digital Network (ISDN).

ISO

See International Organization for Standardization (ISO).

ISP

See Internet service provider (ISP).

IXFR

See incremental zone transfer (IXFR).

K

Kbps

Kilobits per second, a unit of measurement typically used to measure network transmission speed.

Kerberos

An authentication protocol that uses public key technology to provide users with secured access to network resources.

kernel mode

Provides direct access to memory and executes in an isolated memory area. Kernel mode consists of four components: Microsoft Windows 2000 Executive, Device Drivers, the Microkernel, and the Hardware Abstraction Layer (HAL).

L

L2TP

See Layer 2 Tunneling Protocol (L2TP).

LAN

See local area network (LAN).

Layer 2 Tunneling Protocol (L2TP)

An industry-standard Internet tunneling protocol. Unlike Point-to-Point Tunneling Protocol (PPTP), L2TP does not require Internet Protocol (IP) connectivity between the client workstation and the server. L2TP requires only that the tunnel medium provide packet-oriented point-to-point connectivity. The protocol can be used over media such as Asynchronous Transfer Mode (ATM), frame relay, and X.25. L2TP provides the same functionality as PPTP. Based on Layer 2 Forwarding (L2F) and PPTP specifications, L2TP allows clients to set up tunnels across intervening networks.

LDAP

See Lightweight Directory Access Protocol (LDAP).

leased line

A permanent telephone connection between two points that provides a predetermined amount of bandwidth at all times. See also T-1.

Lightweight Directory Access Protocol (LDAP)

The primary access protocol for Active Directory service. LDAP version 3 is defined by a set of Proposed Standard documents in Internet Engineering Task Force (IETF) RFC 2251.

LMHOSTS

An ASCII text file used by Windows TCP/IP computers to resolve NetBIOS names into IP addresses. Like the HOSTS file used to resolve host names into IP addresses, an LMHOSTS file is a list of the NetBIOS names assigned to computers on the network and their corresponding IP addresses. LMHOSTS files can also contain special entries used to preload the computer's NetBIOS name cache or to identify the domain controllers on the network. Windows systems can use individual LMHOSTS files for NetBIOS name resolution, but they more commonly use either network broadcast transmissions or the Windows Internet Naming Service (WINS).

load balancing

A technique used to scale the performance of a server-based program (such as a Web server) by distributing its client requests across multiple servers within the cluster. Each host can specify the load percentage that it will handle, or the load can be equally distributed across all the hosts. If a host fails, the load is dynamically redistributed among the remaining hosts.

local area network (LAN)

A collection of computers that are connected to each other using a shared medium. The computers communicate with each other using a common set of protocols. Compare with metropolitan area network (MAN), wide area network (WAN).

local computer

A computer that you can access directly without using a communications line or a communications device, such as a network card or a modem.

local group

For computers running Microsoft Windows 2000 Professional and member servers, a group that can be granted permissions and rights from its own computer and (if the computer participates in a domain) user accounts and global groups both from its own domain and from trusted domains.

local group policy object

A group policy object (GPO) stored on each computer whether or not the computer is part of an Active Directory environment or a networked environment. Local GPO settings can be overridden by nonlocal GPOs and are the least influential if the computer is in an Active Directory environment. In a nonnetworked environment (or in a networked environment lacking a Microsoft Windows 2000 domain controller), the local GPO's settings are more important because they are not overridden by nonlocal GPOs.

local security database

A list of user accounts and resource security information for the computer on which the list resides.

local user account

For Microsoft Windows 2000 Server, a user account provided in a domain for a user whose global account is not in a trusted domain. A local account is not required where trust relationships exist between domains.

local user profile

A user profile that is created automatically on the computer the first time a user logs on to a computer running Microsoft Windows 2000 Professional or Windows 2000 Server.

log file

A file that stores messages generated by an application, service, or operating system. These messages are used to track the operations performed. Log files are usually plain text (ASCII) files and often have a .log extension. In Backup, a file that contains a record of the date the tapes were created and the names of files and directories successfully backed up and restored. The Performance Logs and Alerts service also creates log files.

log off

To stop using the network and remove your user name from active use until you log on again.

log on

To provide a user name and password that identifies you to the network.

logon rights

User rights that are assigned to a user and specify the ways in which a user can log on to a system. An example of a logon right is the right to log on to a system remotely.

logon workstations

In Microsoft Windows 2000 Server, the computers from which a user is allowed to log on.

M

MAC

See Media Access Control (MAC).

macro virus

A file-infector virus named because it is written as a macro for a specific application. Macro viruses are difficult to detect and are becoming more common, often infecting widely used applications, such as word-processing programs. When an infected file is opened, the virus attaches itself to the application, then infects any files accessed by that application.

MAN

See metropolitan area network (MAN).

mandatory user profile

A user profile that is not updated when the user logs off. It is downloaded to the user's desktop each time the user logs on and is created by an administrator and assigned to one or more users to create consistent or job- specific user profiles. Only members of the Administrators group can change profiles.

manual allocation

An operational mode of Dynamic Host Configuration Protocol (DHCP) servers in which the server assigns clients P addresses and other TCP/IP configuration settings specified by the server administrator for each computer. The IP addresses are not assigned randomly from a pool, as in the automatic and dynamic allocation modes. The end result is no different than configuring the TCP/IP clients manually, but using the manual allocation mode of a DHCP server prevents the administrator from having to travel to the client computer and prevents other computers on the network from being assigned duplicate addresses. Manual allocation is typically used for clients that must have a specific IP address, such as a Web server that must be accessible from the Internet using a DNS name. See also Dynamic Host Configuration Protocol (DHCP).

master server

An authoritative Domain Name System (DNS) server for a zone. Master servers can vary and will be one of two types (either primary or secondary masters), depending on how the server obtains its zone data.

maximum transfer unit (MTU)

The largest physical packet size that a system can transmit over a particular network. As packets are routed through an internetwork, they might have to pass through individual networks with different MTUs. When a packet exceeds the MTU for a particular network, the network layer protocol (IP, in most cases) divides the packet into fragments smaller than the MTU for the outgoing network. The protocol then repackages each fragment into a separate packet and transmits them. If necessary, fragments can be split into still smaller fragments by other routers along the way to the destination. Packets remain fragmented for the rest of their journey, and are not reassembled until they reach the end system that is their ultimate destination.

MB

Megabyte, equal to 1000 kilobytes or 1,000,000 bytes.

Mbps

Megabits per second, a unit of measurement typically used to measure network transmission speed.

MBps

Megabytes per second, a unit of measurement typically used to measure the speed of data storage devices.

media

In networking, a term used to describe the data-carrying hardware mechanisms that computers and other network devices use to send information to each other. In computers, a term used to describe a means of storing data in a permanent fashion, such as a hard or floppy disk.

Media Access Control (MAC)

A method by which computers determine when they can transmit data over a shared network medium. When multiple computers are connected to a single network segment, two computers transmitting data at the same time cause a collision, which destroys the data. The MAC mechanism implemented in the data-link layer protocol prevents these collisions from occurring or permits them to occur in a controlled manner. The MAC mechanism is the defining characteristic of a data-link layer LAN protocol. The two most common MAC mechanisms in use today are Carrier Sense Multiple Access with Collision Detection (CSMA/CD), which is used by Ethernet networks, and token passing, which is used by Token Ring and Fiber Distributed Data Interface (FDDI) networks, among others.

member server

A computer that runs Microsoft Windows 2000 Server but is not a domain controller of a Windows 2000 domain. Member ser-vers participate in a domain, but do not store a copy of the directory database. For a member server, permissions can be set on resources that allow users to connect to the server and use its resources. Resource permissions can be granted for domain global groups and users as well as for local groups and users.

metadata

Information about the properties of data, such as the type of data in a column (numeric, text, and so on) or the length of a column. Information about the structure of data. Information that specifies the design of objects such as cubes or dimensions.

metric

A field in a TCP/IP computer's routing table that contains a value rating the relative efficiency of a particular route. When routing packets, a router scans its routing table for the desired destination, and if there are two possible routes to that destination listed in the table, the router chooses the one with the lowest metric value. Depending on how the routing information is inserted into the table, the metric can represent the number of hops needed to reach the destination network, or it can contain a value that reflects the actual time needed to reach the destination.

metropolitan area network (MAN)

A data network that services an area larger than a local area network (LAN) and smaller than a wide area network (WAN). Most MANs today service communities, towns, or cities and are operated by cable television companies using fiber optic cable.

Microsoft Management Console (MMC)

A framework for hosting administrative tools, called consoles. A console can contain tools, folders or other containers, World Wide Web pages, and other administrative items. These items are displayed in the left pane of the console, called a console tree. A console has one or more windows that can provide views of the console tree. The main MMC window provides commands and tools for authoring consoles. The authoring features of MMC and the console tree itself may be hidden when a console is in User mode.

mirroring

A data availability technique that involves storing identical copies of data on two different drives connected to a single host adapter. The drives appear as a single volume to users, and all files written to the volume are automatically copied to both drives. Should one of the drives fail, the other continues to make the data available until the failed drive is repaired or replaced. Compare with duplexing.

mixed mode

The default domain mode setting on Microsoft Windows 2000 domain controllers. Mixed mode allows Windows NT backup domain controllers in a domain. Mixed mode does not support the universal and nested group enhancements of Windows 2000. The domain mode setting can be changed to Windows 2000 native mode when all Windows NT domain controllers are removed from a domain. Compare with native mode.

MMC

See Microsoft Management Console (MMC).

modem

Short for modulator/demodulator, a hardware device that converts the digital signals generated by computers into analog signals suitable for transmission over a telephone line, and back again. A dial-up connection between two computers requires a modem at each end, both of which support the same communication protocols. Modems take the form of internal devices that plug into one of a computer's expansion slots, or external devices that connect to one of the computer's serial ports. The term modem is also used incorrectly, in many cases, to describe any device that provides a connection to a wide area communications service, such as a cable television or DSL connection. These devices are not actually modems, because the service is digital, and no analog-to-digital conversion takes place.

modifications

.mst files that enable you to customize Windows Installer packages (which have the .msi extension). Modifications are also called transforms. The Microsoft Windows Installer package format provides for customization by enabling you to "transform" the original package using authoring and repackaging tools. Some applications also provide wizards or templates that permit a user to create modifications.

MTU

See maximum transfer unit (MTU).

multiple-master replication

A technique usually associated with a directory service, in which identical copies of a database are maintained on various computers scattered throughout a network. In multiple-master replication, users can make changes to any copy of the database, and the changes to that copy are replicated to all of the other copies. This is a complex technique, because it is possible for different users to make changes to the same record on different masters. The system must therefore have a mechanism for reconciling data conflicts in the various masters, such as using time stamps or version numbers to assign priorities to data modifications. Microsoft's Active Directory service uses multiple-master replication. Compare with single-master replication.

N

name resolution

The process of converting a computer or other device's name into an address. Computers communicate using numeric addresses, but humans work better with names. To be able to send data to a particular destination identified by name in the user interface, the computer must first resolve that name into an address. On TCP/IP networks, for example, Domain Name System (DNS) names and NetBIOS names must be resolved into IP addresses. There are several name resolution methods that computers can use, depending on the type of name and type of address involved, including table lookups using text files such as HOSTS and LMHOSTS; independent processes, such as broadcast message generation; and network services, such as DNS and the Windows Internet Naming Service (WINS).

Name Server (NS) resource record

A resource record used in a zone to designate the Domain Name System (DNS) domain names for authoritative DNS servers for the zone.

namespace

A set of unique, alphabetical identifiers for resources or items used in a shared computing environment. For Microsoft Management Console (MMC), the namespace is represented by the console tree, which displays all of the snap-ins and resources that are accessible to a console. For the Domain Name System (DNS), the namespace is the vertical or hierarchical structure of the domain name tree.

NAT

See network address translation (NAT).

native mode

The condition in which all domain controllers in the domain have been upgraded to Microsoft Windows 2000 and an administrator has enabled native mode operation (through the Active Directory Domains and Trusts console).

Nbtstat.exe

A Windows command-line utility that displays information about the NetBIOS over TCP/IP connections that the system uses when communicating with other Windows computers on a TCP/IP network.

NDIS

See Network Device Interface Specification (NDIS).

NetBEUI

See NetBIOS Extended User Interface (NetBEUI).

NetBIOS (network basic input/output system)

An application programming interface (API) that can be used by application programs on a LAN consisting of IBM-compatible microcomputers running MS-DOS, OS/2, or some version of UNIX. Primarily of interest to programmers, NetBIOS provides application programs with a namespace and a uniform set of commands for requesting the lower level network services required to conduct sessions between nodes on a network and transmit information between them.

NetBIOS Extended User Interface (NetBEUI)

Transport protocol sometimes used by the Windows operating systems for local area networking. NetBEUI was the default protocol in the first version of Windows NT and in Windows for Workgroups; it has since been replaced by TCP/IP as the default Windows protocol. NetBEUI is a simplified networking protocol that requires no configuration and is self-adjusting. However, the protocol is suitable only for small networks because it is not routable. NetBEUI identifies computers by the NetBIOS names (or computer names) assigned during the Windows installation. Because NetBIOS uses no network identifier, there is no way for the protocol to route traffic to systems on another network.

netstat

A command-line utility supplied with UNIX and Windows operating systems that displays information about a TCP/IP computer's current network connections and the traffic generated by the various TCP/IP protocols.

network address translation (NAT)

A firewall technique that enables TCP/IP client computers using unregistered IP addresses to access the Internet. Client computers send their Internet service requests to a NAT-equipped router, which substitutes its own registered IP address for the client's unregistered address, and forwards the request on to the specified server. The server sends its reply to the NAT router, which then relays it back to the original client. This renders the unregistered clients invisible to the Internet, preventing direct access to them. See also firewall.

network analyzers

Network troubleshooting tools, sometimes called protocol analyzers. They perform real-time network traffic analysis and capture packets for decoding and analysis. They can also generate statistics based on the network traffic to help create a picture of the network's cabling, software, file server, clients, and NICs.

network attached storage (NAS)

A network data storage technology that uses a dedicated hardware device with a drive array and an embedded operating system.

network basic input/output system

See NetBIOS (network basic input/output system).

Network Device Interface Specification (NDIS)

A standard that defines an interface for communication between the Media Access Control (MAC) sublayer and protocol drivers. NDIS allows for a flexible environment of data exchange. It defines the software interface, called the NDIS interface, which is used by protocol drivers to communicate with the network interface card. The advantage of NDIS is that it offers protocol multiplexing so that computers can use multiple protocol stacks at the same time.

Network File System (NFS)

A standardized file sharing application used primarily by UNIX and Linux operating systems that enables one computer to mount the drives of another computer on the network into its own file system. File sharing interoperability with UNIX and Linux computers is frequently implemented in the form of an NFS product for another operating system, such as Microsoft Services for UNIX.

network interface adapter

A hardware device that provides a computer with access to a LAN. Network interface adapters can be integrated into a computer's motherboard or take the form of an expansion card, in which case they are called network interface cards (NICs). The adapter, along with its driver, implements the data-link layer protocol on the computer. The adapter has one or more connectors for network cables, or some other interface to the network medium. The network interface adapter and its driver are responsible for functions such as the encapsulation of network layer protocol data into data-link layer protocol frames, the encoding and decoding of data into the signals used by the network medium, and the implementation of the protocol's Media Access Control (MAC) mechanism.

network layer

The third layer from the bottom of the Open Systems Interconnection (OSI) reference model. Protocols operating at the network layer are responsible for packaging transport layer data into datagrams, addressing them to its final destination, routing them across the internetwork, and fragmenting the datagrams as needed. The Internet Protocol (IP) is the most common protocol operating at the network layer, although Novell NetWare networks use a proprietary network layer protocol called Internetwork Packet Exchange (IPX).

NIC

See network interface adapter.

node

Any uniquely addressable device on a network, such as a computer, router, or printer.

nonauthoritative restore

A restore of a backup copy of a Microsoft Windows 2000 domain controller in which the objects in the restored directory are not treated as authoritative. The restored objects are updated with changes held in other replicas of the restored domain.

nonlocal group policy object

A group policy object (GPO) linked to Active Directory objects (sites, domains, or organizational units) that can be applied to either users or computers. To use nonlocal GPOs, you must have a Microsoft Windows 2000 domain controller installed. Following the properties of Active Directory service, nonlocal GPOs are applied hierarchically from the least restrictive group (site) to the most restrictive group (organizational unit) and are cumulative.

normal backup

Copies all selected files and marks each as having been backed up. Normal backups give you the ability to restore files quickly because files on the last tape are the most current.

notify list

A list maintained by the primary master for a zone of other Domain Name System (DNS) servers that should be notified when zone changes occur. The notify list is made up of IP addresses for DNS servers configured as secondary masters for the zone. When the listed servers are notified of a change to the zone, they initiate a zone transfer with another DNS server and update the zone.

NSLOOKUP

A command-line utility that enables you to generate Domain Name System (DNS) queries for testing and troubleshooting your DNS installation.

NTFS

One of the file systems included with the Windows 2000 and Windows NT operating systems. Compared to the file allocation table (FAT) file system also supported by Windows, NTFS supports larger volumes, includes transaction logs to aid in recovery from disk failures, and enables network administrators to control access to specific directories and files. The main drawback to NTFS is that the drives are not accessible by any operating systems other than Windows 2000 and Windows NT. If you start the computer with an MS-DOS disk, for example, the NTFS drives are invisible.

O

object

An entity such as a file, folder, shared folder, printer, or Active Directory object described by a distinct, named set of attributes. For example, the attributes of a file object include its name, location, and size; the attributes of an Active Directory user object might include the user's first name, last name, and e-mail address.

object class

A logical grouping of objects.

Open Shortest Path First (OSPF)

A dynamic routing protocol that exchanges information with other routers on the network to update the system's routing table with current information about the configuration of the internetwork. OSPF is a link state protocol that evaluates routes based on their actual performance, rather than using a less accurate measurement like the number of hops needed to reach a particular destination. Compare with Routing Information Protocol (RIP), in particular.

Open Systems Interconnection (OSI) reference model

A theoretical model defined in documents published by the International Organization for Standardization (ISO) and the Telecommunication Standards Section of the International Telecommunications Union (ITU-T) used for reference and teaching purposes that divides the computer networking functions into seven layers: application, presentation, session, transport, network, data-link, and physical (from top to bottom). However, the layers do not correspond exactly to any of the currently used networking protocol stacks.

operating system

The primary program running on a computer, which processes input and output, runs other programs, and provides access to the computer's hardware.

organizational unit (OU)

An Active Directory container object used within domains. OUs are logical containers into which you can place users, groups, computers, and other OUs. It can contain objects only from its parent domain. An OU is the smallest scope to which you can apply a group policy or delegate authority.

OSI

See Open Systems Interconnection (OSI) reference model.

OU

See organizational unit (OU).

owner

In Microsoft Windows 2000, the person who controls how permissions are set on objects and grants permissions to others.

P

packet

The largest unit of data that can be transmitted over a data network at any one time. Messages generated by applications are split into pieces and packaged into individual packets for transmission over the network. Each packet is transmitted separately and can take a different route to the destination. When all of the packets arrive at the destination, the receiving computer reassembles them into the original message. This is the basic functionality of a packet-switching network.

packet filtering

A firewall technique in which a router is configured to prevent certain packets from entering a network. Packet filters can be created based on hardware addresses, IP addresses, port numbers, or other criteria. For example, you can configure a router to allow only certain computers to access the network from the Internet, or allow your network users access to Internet e-mail, but deny them access to Internet Web servers. Although typically used to prevent intrusion into a private network from the Internet, packet filtering can also be used to limit access to one of the LANs on a private internetwork.

packet switching

A type of network communications in which messages are broken up into discrete units and transmitted to the destination. These units (called packets) can take different routes to the destination and might arrive there in a different order than that in which they were sent, but the receiving system is capable of reassembling them in the proper order. Packet switching is what makes it possible for the computers on a LAN to share a single network medium. If the computers transmitted entire messages at once, they could monopolize the network for long periods of time, preventing other computers from transmitting.

page-description language (PDL)

A language that communicates to a printer how printed output should appear. The printer uses the PDL to construct text and graphics to create the page image. PDLs are like blueprints in that they set parameters and features such as type sizes and fonts, but leave the drawing to the printer.

parent domain

For Domain Name System (DNS), a domain that is located in the namespace tree directly above other derivative domain names (child domains). For example, microsoft.com would be the parent domain of example.microsoft.com, a child domain.

parent object

The object in which another object resides. A parent object implies relation. For example, a folder is a parent object in which a file, or child object, resides. An object can be both a parent and a child object. For example, a subfolder that contains files is both the child of the parent folder and the parent folder of the files.

partition

A portion of a physical disk that functions as though it were a physically separate disk. Multiple partitions can be created only on basic disks.

password

A security measure used to restrict logon names to user accounts and access to computer systems and resources. A password is a unique string of characters that must be provided before a logon name or an access is authorized. For Microsoft Windows 2000, a password for a user account can be up to 14 characters and is case-sensitive.

path

A sequence of directory (or folder) names that specifies the location of a directory, file, or folder within the directory tree. Each directory name and filename within the path (except for the first) must be preceded by a backslash (\).

PC Card

A peripheral device standard designed for laptops and other portable computers, which enables manufacturers to create network interface cards, modems, and other devices packaged in a form approximately the size of a credit card.

PDL

See page-description language (PDL).

PDU

See protocol data unit (PDU).

per seat licensing

A licensing mode that requires a separate client access license for each client computer that accesses Microsoft Windows 2000 Server, regardless of whether all the clients access the server at the same time.

per server licensing

A licensing mode that requires a separate client access license for each concurrent connection to the server, regardless of whether there are other client computers on the network that do not happen to connect concurrently.

performance alert

A Windows 2000 feature that detects when a predefined counter value rises above or falls below the configured threshold, and notifies a user by means of the Messenger service.

performance counter

In System Monitor, a data item associated with a performance object. For each counter selected, System Monitor presents a value corresponding to a particular aspect of the performance defined for the performance object.

Performance Logs and Alerts

A tool that provides you with the ability to create counter logs, trace logs, and system alerts automatically from local or remote computers.

performance monitor

A tool for monitoring network performance that can display statistics, such as the number of packets sent and received, server-processor utilization, and the amount of data going into and out of the server.

performance object

In System Monitor, a logical collection of counters that is associated with a resource or service that can be monitored.

performance object instance

In System Monitor, a term used to distinguish between multiple performance objects of the same type on a computer.

peripheral

A term used for devices such as disk drives, printers, modems, mouse devices, and joysticks that are connected to a computer and controlled by its microprocessor.

permission

A rule associated with an object to regulate which users can access the object and in what manner.

permissions inheritance

A mechanism that enables a given access control entry (ACE) to be copied from the container where it was applied to all children of the container. Inheritance can be combined with delegation to grant administrative rights to a whole subtree of the directory in a single update operation.

physical layer

The bottom layer of the Open Systems Interconnection (OSI) reference model, which defines the nature of the network medium itself, how it should be installed, and what types of signals it should carry. In the case of local area networking, the physical layer is closely related to the data-link layer immediately above it because the data-link layer protocol includes the physical layer specifications.

Ping

A TCP/IP command-line utility used to test whether a computer can communicate with another computer on the network. Ping generates Internet Control Message Protocol (ICMP) Echo Request messages and transmits them to the computer specified on the command line. The target computer, on receiving the messages, transmits them back to the sender as ICMP Echo Replies. The system running Ping then displays the elapsed times between the transmission of the requests and the receipt of the replies. Virtually every TCP/IP client implementation includes a version of Ping.

PKI

See public key infrastructure (PKI).

plain old telephone service (POTS)

Common phrase referring to the public switched telephone network (PSTN), the standard copper-cable telephone network used for analog voice communications around the world.

Plug and Play

A set of specifications developed by Intel that enables a computer to automatically detect and configure a device and install the appropriate device drivers.

pointer

The arrow-shaped cursor on the screen that follows the movement of a mouse (or other pointing device) and indicates which area of the screen will be affected when you press the mouse button. The pointer changes shape during certain tasks.

pointer (PTR) resource record

A resource record used in a reverse lookup zone created within the in-addr.arpa domain to designate a reverse mapping of a host IP address to a host DNS domain name.

Point-to-Point Protocol (PPP)

A data-link layer TCP/IP protocol used for WAN connections, especially dial-up connections to the Internet and other service providers. Unlike its progenitor, the Serial Line Internet Protocol (SLIP), PPP includes support for multiple network layer protocols, link quality monitoring protocols, and authentication protocols. PPP is used for connec- tions between two computers only, and therefore does not need many of the features found in LAN protocols, such as address fields for each packet and a Media Access Control (MAC) mechanism.

Point-to-Point Tunneling Protocol (PPTP)

A data-link layer protocol used to provide secured communications for virtual private network (VPN) connections. VPNs are private network connections that use the Internet as a network medium. To secure the data as it is transmitted across the Internet, the computers use a process called tunneling, in which the entire data-link layer frame generated by an application process is encapsulated within an IP datagram. This arrangement violates the rules of the Open Systems Interconnection (OSI) reference model, but it enables the entire PPP frame generated by the user application to be encrypted inside an IP datagram.

policy

The mechanism by which desktop settings are configured automatically, as defined by the administrator. Depending on context, this can refer to Microsoft Windows 2000 group policy, Windows NT 4 system policy, or a specific setting in a group policy object (GPO).

polymorphic virus

A variant of a file-infector virus that is named for the fact that it changes its appearance each time it is replicated. This makes it difficult to detect, because no two versions of the virus are exactly the same.

port

A code number identifying a process running on a TCP/IP computer. Transport layer protocols, such as the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP), specify the port number of the source and destination application processes in the header of each message they create. The combination of an IP address and a port number (which is called a socket) identifies a specific application on a specific computer on a specific network. Port numbers lower than 1024 are called well-known port numbers, which are assigned by the Internet Assigned Numbers Authority (IANA) to common applications. The TCP port number 80, for example, is the well-known port number for HTTP (Web) servers. Port numbers 1024 and above are ephemeral port numbers, which are selected at random by clients for each transaction they initiate with a server. Alternatively, a port is a hardware connector in a computer or other network device that is used to attach cables that run to other devices.

POTS

See plain old telephone service (POTS).

PPP

See Point-to-Point Protocol (PPP).

PPTP

See Point-to-Point Tunneling Protocol (PPTP).

presentation layer

The second layer from the top of the Open Systems Interconnection (OSI) reference model, which is responsible for translating the syntaxes used by different types of computers on a network. A computer translates the data generated by its applications from its own abstract syntax to a common transport syntax suitable for transmission over the network. When the data arrives at its destination, the presentation layer on the receiving system translates the transfer syntax into the computer's own native abstract syntax.

primary master

An authoritative Domain Name System (DNS) server for a zone that can be used as a point of update for the zone. Only primary masters have the ability to be updated directly to process zone updates, which include adding, removing, or modifying resource records that are stored as zone data. Primary masters are also used as the first sources for replicating the zone to other DNS servers.

primary zone database file

The master zone database file. Changes to a zone, such as adding domains or hosts, are performed on the server that contains the primary zone database file.

print queue

A buffer in which a print job is held until the printer is ready to print it.

private key

The secret half of a cryptographic key pair that is used with a public key algorithm. Private keys are typically used to decrypt a symmetric session key, digitally sign data, or decrypt data that has been encrypted with the corresponding public key.

program

A complete, self-contained set of computer instructions that you use to perform a specific task, such as word processing, accounting, or data management. A program is also called an application.

protocol

A documented format for the transmission of data between two networked devices. A protocol is essentially a "language" that a computer uses to communicate, and the other computer to which it is connected must use the same language for communication to take place. In most cases, network communication protocols are defined by open standards created by bipartisan committees. However, there are still a few proprietary protocols in use. Computers use many different protocols to communicate, which has given rise to the Open Systems Interconnection (OSI) reference model, which defines the layers at which different protocols operate.

protocol analyzers

See network analyzers.

protocol data unit (PDU)

A generic term for the data constructions created by the protocols operating at the various layers of the Open Systems Interconnection (OSI) reference model. For example, the PDUs created by data-link layer protocols are called frames, and network layer PDUs are called datagrams.

protocol stack

The multilayered arrangement of communications protocols that provides a data path ranging from the user application to the network medium. Although based on the Open Systems Interconnection (OSI) reference model, not every layer in the model is represented by a separate protocol. On a computer connected to a LAN, for example, the protocol stack generally consists of protocols at the application, transport, network, and data-link layers, the latter of which includes a physical layer specification.

PSTN

See public switched telephone network (PSTN).

public key

The nonsecret half of a cryptographic key pair that is used with a public key algorithm. Public keys are typically used when encrypting a session key, verifying a digital signature, or encrypting data that can be decrypted with the corresponding private key.

public key cryptography

A method of cryptography in which two different keys are used: a public key for encrypting data and a private key for decrypting data.

public key infrastructure (PKI)

The term generally used to describe the laws, policies, standards, and software that regulate or manipulate certificates and public and private keys. In practice, it is a system of digital certificates, certification authorities, and other registration authorities that verify and authenticate the validity of each party involved in an electronic transaction. Standards for PKI are still evolving, even though they are being widely implemented as a necessary element of electronic commerce.

public switched telephone network (PSTN)

The standard copper-cable telephone network used for analog voice communications around the world. Also known as plain old telephone service (POTS).

publish

To make data available for replication.

Q

query

A specific request for data retrieval, modification, or deletion.

R

RADIUS (Remote Authentication Dial-In User Service)

See Remote Authentication Dial-In User Service (RADIUS).

RAID

See redundant array of independent disks (RAID).

RARP

See Reverse Address Resolution Protocol (RARP).

RAS

See Remote Access Server (RAS).

RDN

See relative distinguished name (RDN).

redirector

A network client component that determines whether a resource requested by an application is located on the network or on the local system and sends the request either to the local input/output system or to the networking protocol stack. A computer can have multiple redirectors to support different networks, such as a Windows network and a Novell NetWare network.

redundant array of independent disks (RAID)

A standardized collection of fault-tolerant disk storage technologies, incorporating techniques such as disk striping and disk mirroring. The various RAID levels offer different combinations of performance, reliability, and cost. Formerly known as redundant array of inexpensive disks (RAID).

redundant array of inexpensive disks (RAID)

See redundant array of independent disks (RAID).

refresh

To update displayed information with current data.

refresh interval

A period of time used by secondary masters of a zone to determine how often to check if their zone data needs to be refreshed. When the refresh interval expires, the secondary master checks with its source for the zone to see if its zone data is still current or if it needs to be updated using a zone transfer. This interval is set in the SOA (start-of-authority) resource record for each zone.

relative distinguished name (RDN)

The part of an object's distinguished name that is an attribute of the object itself. For most objects this is the Common Name attribute. For security principals, the default common name is the security principal name, also referred to as the SAM account name. For the distinguished name CN=MyName, CN=Users,DC=Microsoft,DC=Com the relative distinguished name of the MyName user object is CN=MyName. The relative distinguished name of the parent object is CN=Users.

relative name

The partial Domain Name System (DNS) domain name configured in individual resource records to locate and qualify the record within a zone. The relative name is joined to the front of the parent domain (domain of origin) for each resource record to form a fully qualified domain name (FQDN) within the zone.

remote access

Part of the integrated Windows 2000 Routing and Remote Access service that provides remote networking for telecommuters, mobile workers, and system administrators who monitor and manage servers at multiple branch offices. Users with a computer running Microsoft Windows 2000 and Network and Dial-Up Connections can dial in to remotely access their networks for services such as file and printer sharing, electronic mail, scheduling, and SQL database access.

Remote Access Server (RAS)

Any Microsoft Windows 2000-based computer configured to accept remote access connections.

remote administration

The management of one computer by an administrator working at another computer connected to the first computer across a network.

Remote Authentication Dial-In User Service (RADIUS)

A security authentication protocol based on clients and servers and widely used by Internet service providers (ISPs) on non-Microsoft remote servers. RADIUS is the most popular means of authenticating and authorizing dial-up and tunneled network users today.

remote computer

A computer that you can access only by using a communications line or a communications device, such as a network card or a modem.

remote user

A user who dials in to the server over modems and telephone lines from a remote location.

replication

The process of copying data from a data store or file system to multiple computers to synchronize the data. Active Directory provides multiple-master replication of the directory between domain controllers within a given domain. The replicas of the directory on each domain controller are writeable, enabling administrators to apply updates to any replica of a given domain. The replication service automatically copies the changes from a given replica to all other replicas.

replication policy

Rules that define how and when replication is performed.

replication topology

A description of the physical connections between replicas and sites. In contrast, Dfs topologies describe the logical connections.

Request for Comments (RFC)

The official documents of the Internet Engineering Task Force (IETF) that specify the details for protocols included in the Transmission Control Protocol/Internet Protocol (TCP/IP) family.

reservation

A specific IP address within a scope permanently reserved for leased use to a specific Dynamic Host Configuration Protocol (DHCP) client. Client reservations are made in the DHCP database using the DHCP console and based on a unique client device identifier for each reserved entry.

resolver

Another name for the Domain Name System (DNS) client found on every TCP/IP computer. Whenever the computer attempts to access a TCP/IP system using a DNS name, the resolver generates a DNS Request message and sends it to the DNS server specified in the computer's TCP/IP client configuration. The DNS server then takes the necessary steps to resolve the requested name into an IP address and returns the address to the resolver in the client computer. The resolver can then furnish the IP address to the TCP/IP client, which uses it to transmit a message to the desired destination. See also Domain Name System (DNS).

resource

Any part of a computer system or a network, such as a disk drive, printer, or memory, that can be allotted to a program or a process while it is running or shared over a local area network.

resource record

The unit in which a Domain Name System (DNS) server stores information about the computers in a domain. The information stored in a resource record depends on the type of record it is, but typically a resource record includes the host name of a computer and its equivalent IP address. In most cases, administrators must manually create the resource records on a DNS server, but recent additions to the DNS standards define a method for dynamically updating the information in resource records as needed. This capability is central to the DNS functionality required by Active Directory service. See also Domain Name System (DNS).

Reverse Address Resolution Protocol (RARP)

Progenitor of the Bootstrap Protocol (BOOTP) and the Dynamic Host Configuration Protocol (DHCP), an alternative mode of the Address Resolution Protocol (ARP) that enables a computer to retrieve an IP address from an RARP server by broadcasting its hardware address. Designed for use on diskless workstations, RARP is limited in that it can receive only an IP address from the server, and not other TCP/IP configuration parameters, and also in that an administrator must manually configure the RARP server with a specific IP address for every RARP client.

reverse lookup

In Domain Name System (DNS), a query process by which the IP address of a host computer is searched to find its friendly DNS domain name.

reverse name resolution

The process of resolving an IP address into a Domain Name System (DNS) name, which is the opposite of the normal name-to-address resolution performed by DNS servers. Reverse DNS name resolution is accomplished using an extension to the DNS namespace consisting of a domain called in-addr.arpa, which contains four levels of subdomains named using the numbers 0 through 255. These subdomains contain resource records called pointers; each pointer contains an IP address and its equivalent DNS name. A DNS server looks up an IP address by locating the domain name equivalent to the address. For example, the IP address 192.168.1.15 becomes the domain name 15.1.168.192.in-addr-arpa.

RFC

See Request for Comments (RFC).

rights

Authorization with which a user is entitled to perform certain actions on a computer network. Rights apply to the system as a whole, whereas permissions apply to specific objects. For example, a user might have the right to back up an entire computer system, including the files that the user does not have permission to access. See also access permissions.

roaming user profile

A server-based user profile that is downloaded to the local computer when a user logs on, and is updated both locally and on the server when the user logs off. A roaming user profile is available from the server when logging on to any computer running Microsoft Windows 2000 Professional or Windows 2000 Server. When logging on, the user can use the local user profile if it is more current than the copy on the server.

root domain

The domain at the top of the hierarchy, represented as a period (.). The Internet root domain is managed by several organizations, including Network Solutions, Inc.

root name server

One of a handful of servers that represent the top of the Domain Name System (DNS) namespace by supplying other DNS ser-vers with the IP addresses of the authoritative servers for all of the top-level domains in the DNS. When resolving a DNS name into an IP address, a DNS server that is unable to resolve the name itself sends a DNS Request to one of the root name servers identified in the server's configuration. The root name server reads the top-level domain (that is, the last word, such as com in www.microsoft.com) from the requested name and supplies the requesting server with the IP address for that top-level domain. The requesting server then transmits the same request to the top-level domain server that the root name server supplied. The root name servers are also the authoritative servers for some of the top-level domains, so they can eliminate a step from the process and supply the address of the second-level domain's authoritative server. See also authoritative server, Domain Name System (DNS).

router

A network layer hardware or software device that connects two networks together and relays traffic between them as needed. Using a table containing information about the other routers on the network, a router examines the destination address of each packet it receives, selects the most efficient route to that destination, and forwards the packet to the router or computer that is the next step in its path. Routers can connect two LANs together or provide access to remote resources by connecting a LAN to a distant network using a WAN link. One of the most common scenarios involves using routers to connect a LAN to the network of an Internet service provider (ISP), thus providing Internet access to all of the LAN's users.

Routing Information Protocol (RIP)

A dynamic routing protocol that enables routers to receive information about the other routers on the network, which enables them to keep their routing tables updated with the latest information. RIP works by generating broadcast messages at frequent intervals, containing the contents of the router's routing table. Other routers use this information to update their own tables, thus spreading the routing information all over the network. Routers also take the absence of RIP messages from a particular router to be a sign that it is not functioning and they then remove that router from their tables after a given interval. RIP is frequently criticized for the large amount of broadcast traffic that it generates on the network, and for the limitations of its distance vector routing method, which evaluates routes based solely on the number of hops between the source and the destination. See also dynamic routing.

routing table

A list maintained in every TCP/IP computer of network destinations and the routers and interfaces that the computer should use to transmit to them. In a computer that is not a router, the routing table contains only a few entries, the most frequently used of which is the default gateway entry. On a router, the routing table can contain a great many entries that are either manually added by a network administrator or automatically created by a dynamic routing protocol. When there is more than one routing table entry for a specific destination, the computer selects the best route based on a metric, which is a rating of the route's relative efficiency.

Run As program

Enables you to run administrative tools with either local or domain administrator rights and permissions while logged on as a normal user.

S

safe mode

A method of starting Microsoft Windows 2000 using basic files and drivers only, without networking. Safe mode is available by pressing F8 during system startup. This enables you to start your computer when a problem prevents it from starting normally.

SAM

See Security Accounts Manager (SAM).

schema

The structure of a database system. In a hierarchical directory service, such as Microsoft's Active Directory service or NetWare's Novell Directory Services, the schema contains object classes, which specify what objects can be created in the directory, the relationships between the object classes in the directory tree, and the attributes that make up each object class. Third-party applications can expand the schema for these directory services, enabling the creation of new object classes or the addition of new attributes to existing object classes. In Active Directory, it is also possible to modify the schema manually using the Active Directory Schema console.

scope

The pool of IP addresses on a given subnet that a Dynamic Host Configuration Protocol (DHCP) server is configured to assign to clients when using the automatic or dynamic allocation method. See also automatic allocation, dynamic allocation, Dynamic Host Configuration Protocol (DHCP).

secondary master

An authoritative Domain Name System (DNS) server for a zone that is used as a source for replication of the zone to other servers. Secondary masters update their zone data only by transferring zone data from other DNS servers. They do not have the ability to perform zone updates.

second-level domains

Domain names that are rooted hierarchically at the second tier of the domain namespace directly beneath the top- level domain names such as .com and .org. When Domain Name System (DNS) is used on the Internet, second-level domains are names such as microsoft.com that are registered and delegated to individual organizations and businesses according to their top-level classification. The organization then assumes further responsibility for parenting management and growth of its name into additional subdomains.

Secure Sockets Layer (SSL)

A security protocol that provides authentication and encryption services to Web client/server transactions. See also Hypertext Transfer Protocol (HTTP).

Security Accounts Manager (SAM)

A Microsoft Windows 2000 service used during the logon process. SAM maintains user account information, including groups to which a user belongs.

security group

Used to assign permissions to access resources. Programs that are designed to search Active Directory service can also use security groups for non-security-related purposes, such as retrieving user information for use in a Web application. A security group also has all the capabilities of a distribution group. Microsoft Windows 2000 uses only security groups.

security ID

See security identifier (SID).

security identifier (SID)

A unique number that identifies user, group, and computer accounts. Every account on your network is issued a unique SID when the account is first created. Internal processes in Microsoft Windows 2000 refer to an account's SID rather than the account's user or group name. If you create an account, delete it, and then create an account with the same user name, the new account will not have the rights or permissions previously granted to the old account because the accounts have different SIDs.

security log

An event log containing information about security events that are specified in the audit policy.

security template

A physical representation of a security configuration; a single file where a group of security settings is stored. Locating all security settings in one place eases security administration. Each template is saved as a text-based .inf file. This allows you to copy, paste, import, or export some or all of the template attributes.

Serial Line Internet Protocol (SLIP)

A data-link layer TCP/IP protocol used for WAN connections, especially dial-up connections to the Internet and other service providers. Because it is used for connections between two computers only, SLIP does not need many of the features found in LAN protocols, such as address fields for each packet and a Media Access Control (MAC) mechanism. SLIP is the simplest of protocols, consisting only of a single End Delimiter byte that is transmitted after each IP datagram. Unlike its successor, the Point-to-Point Protocol (PPP), SLIP has no inherent security capabilities or any other additional services. For this reason, it is rarely used today.

server

In general, a computer that provides shared resources to network users.

server message block (SMB)

A protocol developed by Microsoft, Intel, and IBM that defines a series of commands used to pass information between network computers. The redirector packages SMB requests into a network control block (NCB) structure that can be sent over the network to a remote device. The network provider listens for SMB messages destined for it and removes the data portion of the SMB request so that it can be processed by a local device.

service

Windows term for a computer program or process that runs continuously in the background and performs tasks at predetermined intervals or in response to specific events. Called a daemon by UNIX operating systems, services typically perform server tasks, such as sharing files and printers, handling e-mail, and transmitting Web files.

service pack (SP)

A software update package provided by Microsoft for one of its products. A service pack contains a collection of fixes and enhancements packaged into a single self-installing archive file.

service (SRV) resource record

A resource record used in a zone to register and locate well-known Transmission Control Protocol/Internet Protocol (TCP/IP) services. The SRV resource record is specified in RFC 2052 and is used in Microsoft Windows 2000 and later versions to locate domain controllers for Active Directory service.

session layer

The third layer from the top of the Open Systems Interconnection (OSI) reference model. There are no specific session layer protocols, but there are 22 services that the session layer performs that are incorporated into various application layer protocols. The most important of these functions are dialog control and dialog separation. Dialog control provides two modes for communicating systems-two-way alternate (TWA) mode or two-way simultaneous (TWS) mode-and dialog separation controls the process of inserting checkpoints in the data stream to synchronize functions on the two computers.

share

To make resources, such as folders and printers, available to other users on the network.

shared folder

A folder on a computer that has been made available to other users on the network.

shared folder permissions

Permissions that restrict a shared resource's availability over the network to specific users.

shared resource

Any device, data, or program that is used by more than one other device or program. For Microsoft Windows 2000, shared resources refer to any resource that is made available to network users, such as folders, files, and printers. A shared resource can also refer to a resource on a server that is available to network users.

shortcut

A link to any item accessible on your computer or on a network, such as a program, file, folder, disk drive, Web page, printer, or another computer. You can put shortcuts in various places, such as on the desktop, on the Start menu, or in specific folders.

SID

See security identifier (SID).

Simple Mail Transfer Protocol (SMTP)

An application layer TCP/IP protocol used to carry e-mail messages between servers and from clients to servers. To retrieve e-mail from mail servers, clients typically use the Post Office Protocol (POP3) or the Internet Mail Access Protocol (IMAP).

Simple Network Management Protocol (SNMP)

An application layer TCP/IP protocol and query language used to transmit information about the status of network components to a central network management console. Components embedded into network hardware and software products called SNMP agents are responsible for collecting data about the activities of the products they service, storing the data in a management information base (MIB), and transmitting that data to the console at regular intervals using SNMP messages.

single-master replication

A technique usually associated with a directory service in which identical copies of a database are maintained on various computers scattered throughout a network. In single-master replication, users can make changes on only one copy of the database (the master), and the master replicates those changes to all of the other copies. This is a relatively simple technique compared to multiple-master replication because data only travels in one direction. However, the system is limited in that users might have to connect to a master located at another site to make changes to the database.

site

One or more well-connected (highly reliable and fast) Transmission Control Protocol/Internet Protocol (TCP/IP) subnets. A site allows administrators to configure Active Directory access and replication topology quickly and easily to take advantage of the physical network. When users log on, Active Directory clients locate Active Directory servers in the same site as the user.

site link

A link between two sites that enables replication to occur. Each site link contains the schedule that determines when replication can occur between the sites that it connects.

site link bridge

The linking of more than two sites for replication, using the same transport. When site links are bridged, they are transitive- that is, all site links for a specific transport implicitly belong to a single site link bridge for that transport. A site link bridge is the equivalent of a disjoint network; all site links within the bridge can route transitively, but they do not route outside of the bridge.

SLIP

See Serial Line Internet Protocol (SLIP).

smart card

A credit-card-sized device used to securely store public and private keys, passwords, and other types of personal information. To use a smart card, you need a smart card reader attached to the computer and a personal identification number (PIN) for the smart card. In Microsoft Windows 2000, smart cards can be used to enable certificate-based authentication and single sign-on to the enterprise.

SMB

See server message block (SMB).

SMTP

See Simple Mail Transfer Protocol (SMTP).

snap-in

A type of tool you can add to a Microsoft Management Console (MMC) console. A stand-alone snap-in can be added to a console by itself; an extension snap-in can only be added to extend the function of another snap-in.

SNMP

See Simple Network Management Protocol (SNMP).

SNMP agent

A software component integrated into a network hardware or software product, which is designed to gather ongoing status information about the product, store it in a management information base (MIB), and transmit it to a central network management console at regular intervals, using SNMP messages.

socket

On a TCP/IP network, the combination of an IP address and a port number, which together identify a specific application process running on a specific computer. The Uniform Resource Locators (URLs) used in Internet client applications express a socket as the IP address followed by the port number, separated by a colon, as in 192.168.1.17:80.

software distribution point

In Software Installation, a network location from which users are able to get the software that they need.

Software Installation

An extension snap-in used by the Group Policy snap-in that is the admini-strator's primary tool for managing software within an organization. Software Installation works in conjunction with group policies and Active Directory service, establishing a group-policy-based software management system that enables you to centrally manage the initial deployment of software, mandatory and nonmandatory upgrades, patches, quick fixes, and the removal of software.

Source IP Address

A 32-bit field in the Internet Protocol (IP) header that contains a value used to identify the particular network interface from which a packet originated.

SP

See service pack (SP).

special permissions

On NTFS volumes, a custom set of permissions. You can customize permissions on files and directories by selecting the individual components of the standard sets of permissions.

stand-alone server

A computer that runs Microsoft Windows 2000 Server but does not participate in a domain. A stand-alone server has only its own database of users, and it processes logon requests by itself. It does not share account information with any other computer and cannot provide access to domain accounts.

start-of-authority (SOA) resource record

A record that indicates the starting point or original point of authority for information stored in a zone. The SOA resource record is the first resource record created when adding a new zone. It also contains several parameters used by other computers that use Domain Name System (DNS) to determine how long they will use information for the zone and how often updates are required.

static routing

A method for the creation of a TCP/IP router's routing table, in which the table entries are manually created by a network administrator. Compare with dynamic routing, in which routing table entries are automatically created by specialized routing protocols that exchange information with the other routers on the network.

stripe set

A form of fault tolerance that combines multiple areas of unformatted free space into one large logical drive, distributing data storage across all drives simultaneously. In Windows 2000, a stripe set requires at least two physical drives and can use up to 32 physical drives. Stripe sets can combine areas on different types of drives, such as Small Computer System Interface (SCSI) and Integrated Device Electronics (IDE) drives.

striping

A data availability technique in which data is written to clusters on multiple drives in an alternating pattern (that is, one cluster is written to one drive, then the next cluster to a different drive, and so on). The drives appear as a single volume to users, but because the computer is reading data from two or more physical drives, it is possible for the heads in one drive to be moving to the next cluster while the heads in the other drive are actually reading a cluster. This speeds up the disk read process because one of the drives is always reading data; if only a single drive were used, it would have to stop reading after every cluster so the heads could move to their next location. The drawback of the striping method is that the failure of one drive causes the loss of the entire volume.

subdirectory

A directory within a directory. Also called a folder within a folder.

subdomain

A Domain Name System (DNS) domain located directly beneath another domain name (the parent domain) in the namespace tree. For example, example.microsoft.com would be a subdomain of the microsoft.com domain. A subdomain is also called a child domain.

subnet

A group of computers on a TCP/IP network that share a common network identifier. In some cases, a TCP/IP network is divided into multiple subnets by modifying the subnet mask and designating some of the host identifier bits as subnet identifier bits. This enables the administrator to divide the network address of a particular class into multiple subnets, each of which contains a group of the hosts supported by the class.

subnet mask

A TCP/IP configuration parameter that specifies which bits of the IP address identify the host and which bits identify the network on which the host resides. When the subnet mask is viewed in binary form, the bits with a value of 1 are the network identifier and the bits with a value of 0 are the host identifier.

subtree

Any node within a tree, along with any selection of connected descendant nodes. In the registry structure, subtrees are the primary node and they contain keys, subkeys, and value entries.

support tools

Additional tools intended for use by Microsoft support personnel and experienced users to assist in diagnosing and resolving computer problems. The Windows 2000 Support Tools are included on the Windows 2000 CD-ROM in the \Support\Tools folder.

synchronous

A form of communication that relies on a timing scheme coordinated between two devices to separate groups of bits and transmit them in blocks called frames. Special characters are used to begin the synchronization and check its accuracy periodically. Because the bits are sent and received in a timed, controlled (synchronized) fashion, start and stop bits are not required. Transmission stops at the end of one transmission and starts again with a new one. It is a start/stop approach, and more efficient than asynchronous transmission. If an error occurs, the synchronous error detection and correction scheme implements a retransmission. However, because more sophisticated technology and equipment is required to transmit synchronously, it is more expensive than asynchronous transmission.

syntax

The order in which you must type a command and the elements that follow the command.

system files

Files used by Microsoft Windows to load, configure, and run the operating system. Generally, system files must never be deleted or moved.

System Monitor

A tool that enables you to collect and view extensive data about the usage of hardware resources and the activity of system services on computers you administer.

system partition

The partition that contains the hardware-specific files needed to load Microsoft Windows 2000. The system partition can be, but does not have to be, the same as the boot partition.

systemroot

The path and folder name where the Microsoft Windows 2000 system files are located. Typically, this is C:\Winnt, although you can designate a different drive or folder when you install Windows 2000. You can use the value %systemroot% to replace the actual location of the folder that contains the Windows 2000 system files. To identify your systemroot folder, click Start, select Run, and then type %systemroot%.

system volume

The volume that contains the hardware-specific files needed to load Microsoft Windows 2000. The system volume can be, but does not have to be, the same volume as the boot volume.

SYSVOL

A shared directory that stores the server copy of the domain's public files, which are replicated among all domain controllers in the domain.

T

T-1

A dedicated telephone connection, also called a leased line, running at 1.544 Mbps. A T-1 line consists of 24 64-Kbps channels that can be used separately, in combinations, or as a single data pipe. Large companies use T-1 lines for both voice and data traffic; smaller companies can lease part of a T-1, which is called fractional T-1 service. Although it uses the telephone network, a T-1 used for data networking does not use a dial-up connection; it is permanently connected to a specific location. See also leased line.

Task Manager

A Microsoft Windows 2000 utility that provides information about programs and processes running on the computer. Using Task Manager, you can end or run programs, end processes, and display a dynamic overview of your computer's performance.

TCP

See Transmission Control Protocol (TCP).

TCP/IP

See Transmission Control Protocol/Internet Protocol (TCP/IP).

Telecommunications Network Protocol (Telnet)

An application layer TCP/IP client/server protocol used to remotely control a computer at another location. A mainstay of UNIX networking, Telnet is a remote control application. When you access another computer and run a program, it is the processor in the remote computer that executes that program. All versions of Windows include a Telnet client. Windows 2000 also includes a Telnet server, that allows the user to execute command line applications.

Terminal Services

Software services that enable client applications to be run on a server so that client computers can function as terminals rather than independent systems. The server provides a multisession environment and runs the Microsoft Windows-based programs being used on the clients.

text file

A file containing text characters (letters, numbers, and symbols) but no formatting information, such as a plain ASCII file that most computers can read.

Time-to-Live (TTL)

A timer value included in packets sent over TCP/IP-based networks that tells the recipients how long to hold or use the packet or any of its included data before expiring and discarding the packet or data. For Domain Name System (DNS), TTL values are used in resource records within a zone to determine how long requesting clients should cache and use this information when it appears in a query response answered by a DNS server for the zone.

Token Ring

A data-link layer protocol originally developed by IBM, used on LANs with a ring topology. Running at 4 Mbps or 16 Mbps, Token Ring networks use the token passing Media Access Control (MAC) mechanism. Although they use a logical ring topology, Token Ring networks are physically cabled like a star, using a hub called a multistation access unit (MAU) that transmits incoming packets out through each successive port in turn. Early Token Ring networks used a shielded twisted pair (STP) cable known as IBM Type 1, but today, most Token Ring networks use unshielded twisted pair (UTP) cable.

top-level domain

Domain names that are rooted hierarchically at the first tier of the domain namespace directly beneath the root (.) of the Domain Name System (DNS) namespace. On the Internet, top-level domain names such as .com and .org are used to classify and assign second-level domain names (such as microsoft.com) to individual organizations and businesses according to their organizational purpose.

topology

The method used to install network cabling and connect the network computers to the cable, which is determined by the data-link layer protocol and cable type you choose. The three basic network topologies are the bus, in which one computer is connected to the next in daisy-chain fashion; the star, in which all of the computers are connected to a central hub; and the ring, in which the computers are logically connected to each other with the ends joined together.

trace log

A type of log generated when the user selects a trace data provider using the Performance console. Trace logs differ from counter logs in that they measure data continuously rather than taking periodic samples.

Traceroute

A TCP/IP command-line utility that displays the path that packets are taking to a specific destination. Traceroute uses Internet Control Message Protocol (ICMP) Echo Request and Echo Reply messages with varying Time to Live (TTL) values in the IP header. This causes packets to time out at each successive router on the way to the destination, and the error messages generated by the time-outs enable the Traceroute program to display a list of the routers forming the path to the destination.

Transmission Control Protocol (TCP)

A TCP/IP transport layer protocol used to transmit large amounts of data generated by applications, such as entire files. TCP is a connection-oriented protocol that provides guaranteed delivery service, packet acknowledgment, flow control, and error detection. The two computers involved in the TCP transaction must exchange a specific series of messages called a three-way handshake to establish a connection before any application is transmitted. The receiving computer also transmits periodic acknowledgment messages to verify the receipt of the data packets, and the two computers also perform a connection termination procedure after the data is transmitted. These additional messages, plus the large 20-byte TCP header in every packet, greatly increase the protocol's control overhead.

Transmission Control Protocol/Internet Protocol (TCP/IP)

A set of networking protocols used on the Internet that provides communications across interconnected networks made up of computers with diverse hardware architectures and various operating systems. TCP/IP includes standards for how computers communicate and conventions for connecting networks and routing traffic.

transport driver interface (TDI)

An interface that works between the file system driver and the transport protocols, enabling any protocol written to TDI to communicate with the file system drivers.

transport layer

The middle (fourth) layer of the Open Systems Interconnection (OSI) reference model, which contains protocols providing services that are complementary to the network layer protocol. A protocol suite typically has both connection-oriented and connectionless protocols at the transport layer, providing different types of service to suit the needs of different applications. In the TCP/IP suite, the transport layer protocols are the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP).

tree

A set of Microsoft Windows 2000 domains connected together by a two-way transitive trust, sharing a common schema, configuration, and global catalog. The domains must form a contiguous hierarchical namespace such that if microsoft.com is the root of the tree, example.microsoft.com is a child of microsoft.com, another.example.microsoft.com is a child of example.microsoft.com, and so on.

Trivial File Transfer Protocol (TFTP)

A connec-tionless, application layer TCP/IP protocol that transmits data files in User Datagram Protocol (UDP) packets with no authentication and no interactive interface.

Trojan horse

A program that masquerades as another common program in an attempt to receive information. An example of a Trojan horse is a program that behaves like a system logon to retrieve user names and password information that the writers of the Trojan horse can later use to break into the system.

trust relationship

A link between domains that enables pass-through authentication, in which a user has only one user account in one domain, yet can access the entire network. User accounts and global groups defined in a trusted domain can be given rights and resource permissions in a trusting domain even though those accounts do not exist in the trusting domain's database. A trusting domain honors the logon authentication of a trusted domain.

TTL

See Time-to-Live (TTL).

tunnel

A logical connection over which data is encapsulated. Typically, both encapsulation and encryption are performed and the tunnel is a private, secure link between a remote user or host and a private network.

tunneling

A technique for transmitting data over a network by encapsulating it within another protocol. The Point-to-Point Tunneling Protocol (PPTP) also uses tunneling to carry PPP frames inside IP datagrams.

U

UDP

See User Datagram Protocol (UDP).

UNC

See Universal Naming Convention (UNC) name.

unicast

A network transmission addressed to a single computer only. Compare with broadcast.

Uniform Resource Locator (URL)

Provides the hypertext links between documents on the World Wide Web (WWW). Every resource on the Internet has its own location identifier, or URL, that specifies the server to access as well as the access method and the location. URLs can use various protocols including FTP and HTTP.

universal group

A security or distribution group that can be used anywhere in the domain tree or forest. A universal group can have members from any Microsoft Windows 2000 domain in the domain tree or forest. It can also include other universal groups, global groups, and accounts from any domain in the domain tree or forest. Rights and permissions must be assigned on a per domain basis, but can be assigned at any domain in the domain tree or forest. Universal groups can be members of domain local groups and other universal groups but cannot be members of global groups. Universal groups appear in the global catalog and should contain primarily global groups.

Universal Naming Convention (UNC) name

The full Microsoft Windows 2000 name of a resource on a network. It conforms to the \\servername\ sharename syntax, where servername is the name of the server and sharename is the name of the shared resource. UNC names of directories or files can also include the directory path under the share name, with the following syntax: \\servername\sharename\directory\filename.

unqualified name

An incomplete Domain Name System (DNS) name that identifies only the host, and not the domain in which the host resides. Some TCP/IP clients can handle unqualified names by automatically adding to them the name of the domain in which the computer is located or by adding user-specified domain names.

UPN

See user principal name (UPN).

URL

See Uniform Resource Locator (URL).

Usenet

An Internet bulletin board system consisting of tens of thousands of conferences, called newsgroups, covering a wide range of technical, recreational, and informational topics. Users access Usenet conferences by using newsreader software to connect to a news server, access to which is usually provided by Internet service providers (ISPs).

user account

A record that consists of all the information that defines a user to Microsoft Windows 2000. This includes the user name and password required for the user to log on, the groups in which the user account has membership, and the rights and permissions the user has for using the computer and network and accessing their resources. For Windows 2000 Professional and member servers, user accounts are managed with the Local Users and Groups console. For Windows 2000 Server domain controllers, user accounts are managed with the Active Directory Users and Computers console.

User Datagram Protocol (UDP)

A connectionless TCP/IP transport layer protocol used for short transactions, usually consisting of a single request and reply. UDP keeps overhead low by supplying almost none of the services provided by its connection-oriented transport layer counterpart, the Transmission Control Protocol (TCP), such as packet acknowledgment and flow control. UDP does offer an error detection service, however. Because it is connectionless, UDP generates no additional handshake messages, and its header is only 8 bytes long.

user mode

A console mode that does not enable full access to all Microsoft Management Console (MMC) functionality. There are three types of user modes that allow different levels of access and functionality: Full Access; Limited Access, Multiple Windows; and Limited Access, Single Window.

user name

A unique name identifying a user account to Microsoft Windows 2000. An account's user name must be unique among the other group names and user names within its own domain or workgroup.

user principal name (UPN)

This consists of a user account name (sometimes referred to as the user logon name) and a domain name identifying the domain in which the user account is located. This is the standard usage for logging on to a Microsoft Windows 2000 domain. The format is user@domain.com (as for an e-mail address).

user profile

A profile that defines the Microsoft Windows 2000 environment that is loaded by the system when a user logs on. It includes all the user-specific settings of a user's Windows 2000 environment, such as program items, screen colors, network connections, printer connections, mouse settings, and window size and position.

user rights

Tasks a user is permitted to perform on a computer system or domain, such as backing up files and folders, adding or deleting users in a workstation or domain, and shutting down a computer system. Rights can be granted to groups or to user accounts, but are best reserved for use by groups. User rights are set in group policy.

user rights policy

Security settings that manage the assignment of rights to groups and user accounts.

V

virtual private network (VPN)

A technique for connecting to a network at a remote location using the Internet as a network medium. A user can dial into a local Internet service provider (ISP) and connect through the Internet to a private network at a distant location, using a protocol such as the Point-to-Point Tunneling Protocol (PPTP) to secure the private traffic.

virus

Computer programming, or code, that hides in computer programs or on the boot sector of storage devices such as hard disk drives and floppy disk drives. The primary purpose of a virus is to reproduce itself as often as possible; a secondary purpose is to disrupt the operation of the computer or the program.

volume

A portion of a physical disk that functions as though it were a physically separate disk. In My Computer and Microsoft Windows Explorer, volumes appear as local disks such as C or D.

volume set

A partition consisting of disk space on one or more physical disks that was created with Microsoft Windows NT 4 or earlier versions. You can delete volume sets only with Windows 2000. To create new volumes that span multiple disks with Windows 2000, use spanned volumes on dynamic disks.

VPN

See virtual private network (VPN).

W

WAN

See wide area network (WAN).

Web server

A computer containing Web site content that is maintained by a system administrator or Internet service provider (ISP) and that responds to requests from users' Web browsers.

well-known port

TCP/IP port numbers that have been permanently assigned to specific applications and services by the Internet Assigned Numbers Authority (IANA). Well-known ports make it possible for client programs to access services without having to specify a port number. For example, when you type a Uniform Resource Locator (URL) into a Web browser, the port number 80 is assumed because this is the port associated with Web servers.

wide area network (WAN)

A network that spans a large geographical area using long-distance point-to-point connections, rather than shared network media as with a local area network (LAN). WANs can use a variety of communication technologies for their connections, such as leased telephone lines, dial-up telephone lines, and Integrated Services Digital Network (ISDN) or Digital Subscriber Line (DSL) connections. The Internet is the ultimate example of a WAN. Compare with local area network (LAN).

Windows 2000 Executive

This component performs most of the input/output (I/O) and object management, including security. It does not perform screen and keyboard I/O; the Microsoft Win32 subsystem performs these functions. The Windows 2000 Executive contains the Windows 2000 kernel mode components.

Windows 2000 Professional

A high-performance, secure network client computer and corporate desktop operating system that includes the best features of Microsoft Windows 98, significantly extending the manageability, reliability, security, and performance of Windows NT Workstation 4. Windows 2000 Professional can be used alone as a desktop operating system, networked in a peer-to-peer workgroup environment, or used as a workstation in a Windows 2000 Server domain environment.

Windows 2000 Server

A file, print, and applications server, as well as a Web server platform that contains all of the features of Microsoft Windows 2000 Professional plus many new server-specific functions. This product is ideal for small- to medium-sized enterprise application deployments, Web servers, workgroups, and branch offices.

Windows Installer

Installs software packaged in Microsoft Windows Installer files.

Windows Internet Naming Service (WINS)

A service supplied with the Windows 2000 and Windows NT operating systems that registers the NetBIOS names and IP addresses of the computers on a local area network (LAN) and resolves NetBIOS names into IP addresses for its clients as needed. WINS is the most efficient name resolution method for NetBIOS-based networks because it uses only unicast transmissions. Other methods rely on the repeated transmission of broadcast messages, which can generate large amounts of network traffic.

Winipcfg.exe

A graphical utility included with Windows 95, Windows 98, and Windows Me that you can use to view the TCP/IP configuration parameters for a particular computer. A command-line version of the tool-called Ipconfig.exe-is included with Windows 2000 and Windows NT. Winipcfg.exe is most useful on computers with TCP/IP clients configured automatically by a Dynamic Host Configuration Protocol (DHCP) server because it is the easiest way to view the assigned settings for the client system. You can also use Winipcfg.exe to release and renew DHCP-assigned TCP/IP configuration parameters.

WINS

See Windows Internet Naming Service (WINS).

workgroup

A simple grouping of computers, intended only to help users find such things as printers and shared folders within that group. Workgroups in Windows 2000 do not offer the centralized user accounts and authentication offered by domains.

workstation

Any networked computer accessing server resources.

Z

zone

In a Domain Name System (DNS) database, a zone is a subtree of the DNS database that is administered as a single separate entity, a DNS server. This administrative unit can consist of a single domain or a domain with subdomains. A DNS zone administrator sets up one or more name servers for the zone.

zone database file

The file where name-to- IP-address mappings for a zone are stored.

zone transfer

The process by which Domain Name System (DNS) servers interact to maintain and synchronize authoritative name data. When a DNS server is configured as a secondary master for a zone, it periodically queries another DNS server configured as its source for the zone. If the version of the zone kept by the source is different, the secondary master server pulls zone data from its source DNS server to synchronize zone data.


About This Electronic Book

Every effort has been made to ensure that the text of this eBook matches the text of the paper version as closely as possible. For usability reasons, formatting changes may have been made to the eBook version.

Tell Us What You Think

We need to hear from you regarding your experience with our eBooks. Tell us what you like, don't like; which features you use, and which features you would like to see in future versions of our eBooks. Send your comments to epublish@microsoft.com. Please note that technical support is not offered through this alias.


Create a List of Favorite Topics

  1. Locate the topic you want to make a favorite topic.
  2. Click the Favorites tab, and then click Add.

To return to a favorite topic, click the Favorites tab, select the topic, and then click Display.

If you want to rename a topic, select the topic, and then type a new name in the Current topic box.

To remove a favorite topic, select the topic and then click Remove.


External Links

This eBook may contain links to Web sites. All hyperlinks within the text were valid at the time this eBook was published. Due to the nature of the World Wide Web, we cannot guarantee that all links to Web sites are still valid after the release date of the eBook.


Enlarge Graphics

Many of the graphics shown in this book are quite large. To improve the readability of the electronic version, reduced versions of these graphics are shown in the text. To see a full-size version, click on the reduced graphic.


Use Accessibility Shortcut Keys

The following keyboard shortcuts can be used for navigation.

For more information about accessibility features and services, visit the Microsoft Accessibility Web site.

For the Library:

To | Press
Close the eBook. | ALT+F4
Switch between the eBook and other open windows. | ALT+TAB
Print a topic. | Right-click in the Topic pane.
Move back to the previous topic. | ALT+LEFT ARROW
Move forward to the next topic (provided you have viewed it just previously). | ALT+RIGHT ARROW
Refresh the topic that appears in the Topic pane (this is useful if you have linked to a Web page). | F5
Switch between the Navigation pane and the Topic pane. | F6
Scroll through a topic. | UP ARROW and DOWN ARROW, or PAGE UP and PAGE DOWN
Scroll through all the links in a topic or through all the options on a Navigation pane tab. | TAB

For the Contents tab:

To | Press
Open and close a book or folder. | PLUS SIGN and MINUS SIGN, or LEFT ARROW and RIGHT ARROW
Select a topic. | DOWN ARROW and UP ARROW
Display the selected topic. | ENTER

For the Search tab:

To | Press
Display the Search tab. | ALT+S
Type a keyword to search for. | ALT+W, and then type the word
Start a search. | ALT+L
Select a topic in the results list. | ALT+T, and then UP ARROW and DOWN ARROW
Display the selected topic. | ALT+D
Search for a keyword in the result list of a prior search. | ALT+U
Search for words similar to the keyword. For example, to find words like "running" and "runs" for the keyword "run." | ALT+M
Search only through topic titles. | ALT+R

For the Favorites tab:

To | Press
Display the Favorites tab. | ALT+I
Add the currently displayed topic to the Favorites list. | ALT+A
Select a topic in the Favorites list. | ALT+P, and then UP ARROW and DOWN ARROW
Display the selected topic. | ALT+D
Remove the selected topic from the list. | ALT+R

There are also shortcut menu commands that can be accessed through the keyboard.

Shortcut keys also work in secondary and pop-up windows.

Every time you use a shortcut key in the Navigation pane, you lose focus in the Topic pane. To return to the Topic pane, press F6.

The Match similar words check box, on the Search tab, will be selected if you used it for your last search.


Use the Shortcut Menu Commands

There are several commands on the shortcut menu that you can use to display and customize information.

Command | Description
Right-click in the table of contents, and then click Open All. | Opens all books or folders in the table of contents. This command works only if the Contents tab is displayed.
Right-click in the table of contents, and then click Close All. | Closes all books or folders. This command works only if the Contents tab is displayed.
Right-click, and then click Print. | Prints the topic.
These commands can be accessed through the keyboard. You can click SHIFT+F10 to display the shortcut menu, and then click the appropriate shortcut keys. Or, you can enable Mousekeys. Use a Mousekey combination to display the shortcut menu, and then click the appropriate shortcut keys.


To Turn On MouseKeys

  1. Open the Accessibility Properties dialog box by clicking Start, pointing to Settings, clicking Control Panel, and then double-clicking Accessibility Options.
  2. Click the Mouse tab.
  3. Select the Use MouseKeys check box.


Customize the Help Viewer

There are a few ways to easily change the size and position of the eBook and the panes in the eBook:

  • To resize the Navigation or Topic pane, point to the divider between the two panes. When the pointer changes to a double-headed arrow, drag the divider right or left.
  • To proportionately shrink or enlarge the entire eBook, point to any corner of the eBook. When the pointer changes to a double-headed arrow, drag the corner.
  • To change the height or width of the eBook, point to the top, bottom, left, or right edge of the eBook. When the pointer changes to a double-headed arrow, drag the edge.
  • To reposition the eBook on your screen, click the title bar and drag the eBook to a new position.
When the eBook is opened again, it will appear with the last size and position settings you specified.


Print the Current Topic

Right-click a topic, and then click Print.

If you print from the Contents tab (by right-clicking an entry, and then clicking Print) you will see options to print only the current topic, or the current topic and all subtopics.


Full-Text Search

The Search tab allows you to search through every word in the Library to find a match. For example, if you do a full-text search on the word "database," every topic that contains the word "database" will be listed.

The Search tab in this Library also contains advanced full-text search functionality that allows you to search using boolean, wildcard, and nested expressions.


Use Full-Text Search

  1. Click the Search tab, and then type the word or phrase you want to find.
  2. Click List Topics, select the topic you want, and then click Display.


Advanced Full-Text Search

Advanced full-text search allows you to search using boolean, wildcard, and nested expressions. You can also limit the search to previous results, match similar words, or search topic titles only.


Search for Information

A basic search consists of the word or phrase you want to find. You can use wildcard expressions, nested expressions, boolean operators, similar word matches, a previous results list, or topic titles to further define your search.

The basic rules for formulating queries are as follows:

  • Searches are not case-sensitive, so you can type your search in uppercase or lowercase characters.
  • You may search for any combination of letters (a-z) and numbers (0-9).
  • Punctuation marks such as the period, colon, semicolon, comma, and hyphen are ignored during a search.
  • Group the elements of your search using double quotes or parentheses to set apart each element. You cannot search for quotation marks.
If you are searching for a file name with an extension, you should group the entire string in double quotes, ("filename.ext"). Otherwise, the period will break the file name into two separate terms. The default operation between terms is AND, so you will create the logical equivalent to "filename AND ext."


Find Information with Advanced Full-Text Search

  1. Click the Search tab, and then type the word or phrase you want to find.
  2. Click [image] to add boolean operators to your search.
  3. Click List Topics, select the topic you want, and then click Display.
  4. To sort the topic list, click the Title, Location, or Rank column heading.

You can precisely define a search by using wildcard expressions, nested expressions, and boolean operators.

You can request similar word matches, search only the topic titles, or search the results of a previous search.


Search for Words or Phrases

You can search for words or phrases and use wildcard expressions. Wildcard expressions allow you to search for one or more characters using a question mark or asterisk. The table below describes the results of these different kinds of searches.

Search for Example Results

A single word

select

Topics that contain the word "select." (You will also find its grammatical variations, such as "selector" and "selection.")

A phrase

"new operator"

or

new operator

Topics that contain the literal phrase "new operator" and all its grammatical variations.

Without the quotation marks, the query is equivalent to specifying "new AND operator," which will find topics containing both of the individual words, instead of the phrase.

Wildcard expressions

esc*

or

80?86

Topics that contain the terms "ESC," "escape," "escalation," and so on. The asterisk cannot be the only character in the term.

Topics that contain the terms "80186," "80286," "80386," and so on. The question mark cannot be the only character in the term.

Select the Match similar words check box to include minor grammatical variations for the phrase you search.


Define Search Terms

The AND, OR, NOT, and NEAR operators enable you to precisely define your search by creating a relationship between search terms. The following table shows how you can use each of these operators. If no operator is specified, AND is used. For example, the query "spacing border printing" is equivalent to "spacing AND border AND printing."

Search for | Example | Results
Both terms in the same topic. | dib AND palette | Topics containing both the words "dib" and "palette."
Either term in a topic. | raster OR vector | Topics containing either the word "raster" or the word "vector" or both.
The first term without the second term. | ole NOT dde | Topics containing the word "OLE," but not the word "DDE."
Both terms in the same topic, close together. | user NEAR kernel | Topics containing the word "user" within eight words of the word "kernel."
The |, &, and ! characters don't work as boolean operators (you must use OR, AND, and NOT).


Use Nested Expressions

Nested expressions allow you to create complex searches for information. For example, "control AND ((active OR dde) NEAR window)" finds topics containing the word "control" along with the words "active" and "window" close together, or containing "control" along with the words "dde" and "window" close together.

The basic rules for searching help topics using nested expressions are as follows:

  • You can use parentheses to nest expressions within a query. The expressions in parentheses are evaluated before the rest of the query.
  • If a query does not contain a nested expression, it is evaluated from left to right. For example: "Control NOT active OR dde" finds topics containing the word "control" without the word "active," or topics containing the word "dde." On the other hand, "control NOT (active OR dde)" finds topics containing the word "control" without either of the words "active" or "dde."
  • You cannot nest expressions more than five levels deep.


Search for Words in the Titles of Topic Files

  1. Click the Search tab, type the word or phrase you want to find, and then select the Search titles only check box.
  2. Click List Topics, select the topic you want, and then click Display.
If you use this option, all topic files will be searched, including any that are not listed in the table of contents.


Find Words Similar to Your Search Term

This feature enables you to include minor grammatical variations for the phrase you search. For example, a search on the word "add" will find "add," "adds," and "added."

  1. Click the Search tab, type the word or phrase you want to find, and then select the Match similar words check box.
  2. Click List Topics, select the topic you want, and then click Display.
This feature only locates variations of the word with common suffixes. For example, a search on the word "add" will find "added," but it will not find "additive."


Search Previous Results

This feature enables you to narrow a search that results in too many topics found. You can search through your results list from previous search by using this option.

  1. On the Search tab, select the Search previous results check box.
  2. Click List Topics, select the topic you want, and then click Display.
The Search tab will open with this check box selected if you previously used this feature.


About Microsoft Press

Microsoft Press is a division of Microsoft Corporation and the leading source of comprehensive self-paced learning, training, evaluation, and support resources to help everyone from developers to IT professionals to end users get the most from Microsoft® technology. Choose from more than 250 current titles in print, multimedia, and network-ready formats-learning solutions made by Microsoft, with the most timely and accurate information available. For more information, visit http://mspress.microsoft.com/.