Microsoft Distributed File System (DFS) continue...

Creating a DFS Root

Creating a DFS tree is not a complicated task when using a graphical interface such as the one provided by the MMC and by the wizards that walk you through setting up your file system. To create a new DFS root, use the following steps:

1. Click Start, Programs (All Programs for Windows Server 2003), Administrative Tools, Distributed File System.
2. When the management console appears, select New Root from the Action menu. A wizard pops up. Click Next.
3. You can select to create a file system that makes use of the Active Directory for storing the DFS configuration information. You can also select to not use the Active Directory. For the purposes of this example, I've chosen to not use the Active Directory. After making the selection, click Next.
4. The next dialog box prompts you to enter the name of the server that will host the distributed file system. The default is usually the server on which you are running the wizard. Use the default or enter another server. Click Next to continue.
5. The wizard next prompts you to enter the name of the new root DFS file system. Note that what you enter here shows up in the field Share to Be Used at the bottom of the dialog box. You can use the name of an existing share in the Root Name field, or create the share to be used after you complete this wizard.

6. If you entered a share that does not yet exist, you can now choose the folder to share by entering it in the field or by using the Browse button.

7. Finally, the wizard displays a summary of the information you have entered. Click the Finish button to complete the process of creating the new DFS root.

Adding Links to the DFS Root

After you've created the initial root for your file system, you can add one or more links. Links, as yo will recall, are actual directories (or folders, depending on which terminology you prefer) that will be accessible from your DFS root.

DFS is a domain-wide file system. You can easily browse a file share located on another server in the domain. Thus, you can hide the physical location of files from users. Instead of having to remember servers and share names, the user only has to remember the share name. Because the share name is domain-wide, you can't use the same share name on one server that you do on another. Users can then simply connect to the share \ \domainname\share. They don't need to know the server names on which the actual folders in this share are located.

You can use the Action menu to add or delete a DFS root. You can also use the Action menu to manage links and replication.

DFS does not add any additional security features to the file system. Instead, the usual rights and permissions that are already in place on the server are used when evaluating a client's access to a file or directory in the DFS tree.

One major difference between NFS and DFS is that DFS is built using SMB messaging techniques for the most part and is not compatible with all NFS servers. If you have a mixed-environment network in which most of your data files are offered via NFS on Unix servers, it would be more economical to acquire PC-based NFS client software than it would be to replace all your existing servers with NT DFS servers.

Windows 2000 User Groups continue…

Built-In Groups

There are several kinds of built-in groups, depending on where you look in the directory structure. The domain local scope built-in groups can include the following:

• Account Operators—Users placed into this group can perform account management duties, such as creating new users.

• Administrators—This is the most powerful group. Members of this group can do just about anything they want in the domain, including taking ownership of files and creating user accounts.

• Backup Operators—Members of this group get the access rights needed to perform backups on computers in the domain.

• Guests—A guest group, which can be used to grant very limited access to users from other domains.

• Incoming Forest Trust Builders—Users in this group can create incoming trust relationships from other forests. Keep in mind that trust relations in the Active Directory are transitive but must be established manually between Active Directory trees in the forest.

• Network Configuration Operators—This group allows users to manage some aspects of network configuration.

• Performance Log Users—Members of this group can schedule logging of performance monitors on this computer, from a remote computer.

• Performance Monitor Users—This user group can monitor performance on this computer from a remote computer.

• Pre-Windows 2000 Compatible Access—This group is meant for pre-Windows 2000 users to enable them to have read access for users and groups in the domain stored in the Active Directory.

• Print Operators—Youguessed it: Members of this group can control printers and print jobs.

• Remote Desktop Users—Users in this group can log in to this computer from a remote computer.

• Replicator—Used by services responsible for replication.

• Server Operators—Members of this group can perform tasks on specific servers.

• Users—A built-in group for ordinary users in the domain, which can run applications, but not make systemwide configuration changes.

In addition to these built-in groups, you can click on the Users folder and see a list of predefined groups, which also can be used to organize users. These are global scope groups, so you can use them to organize users and computers, and then place them in domain scope groups in the current domain or in other domains. If none of the following group names fits your needs, you can create your own groups, which we'll look at next.

The Predefined groups found in the Users folder are listed here:

• Cert Publishers—Users can publish certificates to the Active Directory.
• DHCP Administrator—Members can administer the DHCP service.
• DHCP Users—Members of this group have view-only access to the DHCP service.
• DnsAdmins—The DNS Administrators group who can manage the DNS service.
• DnsUpdateProxy—This group allows members to update the Domain Name System (DNS) service for other clients, such as a DHCP server.
• Domain Admins—Users who administer the domain.
• Domain Computers—All workstations and servers joined to the domain.
• Domain Controllers—Every domain controller in this domain is a member of this group.
• Domain Guests—Members are guests in the domain, with limited access.
• Domain Users—All members of the domain.
• Enterprise Admins—Members can administer the entire enterprise.
• Group Policy Creator Owners—These users can modify the group policy for a domain.
• HelpServicesGroup—Users that provide help via the Help and Support Center.
• IIS_WPG—Members who manage the Internet Information Server.
• PasswordPropDeny—Members of this group should not have their password synchronized.
• RAS and LAS Servers—Servers that are members of this group can access the remote access properties of users.
• Schema Admins—Administrators of the Active Directory schema.
• Terminal Server Computers—Computers that can communicate with the Terminal Services License server.
• WINS Users—Members of this group have view-only access to the WINS server.

In general, the groups you'll use most in the list will probably be the Domain Computers and Domain Users groups. By default, when you create a user account, the new account is placed automatically into the Domain Users group. Likewise, when you add a computer to the domain, the computer is automatically placed into the Domain Computers group. Looking at the domain from an overall picture, you can use these two groups when you want to make changes that apply to all users or all computers in a domain. The Domain Admins group can be used to give selected individuals administrator-level rights in a domain. It is always a good idea to not use the actual built-in Administrator account for a domain. Instead, create individual accounts for each user, and then place the user into one or more groups that give him the access he needs. If you need to grant a user administrator-level rights, just place him into the Domain Admins groups.

The other groups will depend on the services you have installed. Some may not appear if you have not installed that service (such as DHCP).

A few notes about these predefined groups in the Users folder:

The Domain Users group is a member of the domain's Users group (the one located in the Builtin folder).

The Domain Admins group is automatically a member of the Administrator's group in the Builtin folder.

The Domain Guests group is automatically placed into the Guests group in the Builtin folder.

Sun Network Information System

NIS is used on Unix networks to keep important system files, such as the password file, synchronized among a group of servers. Remember that on Unix systems, each server has a password file, a user group file, and other important files that are managed locally on each server by default. This is similar to using a Windows computer in a standalone manner where each Windows computer has its own user account database.

NIS uses a database of maps that contain entries for the files the system administrator chooses to keep synchronized. For redundancy purposes, a master NIS server can be used along with slave NIS servers that receive updates from the master server.

SFU version 3.5 contains a component that can be used to allow a Windows Server domain controller to operate as a NIS server. The Windows server can operate as either a master or slave NIS server. However, if it is to operate as a slave server, the master NIS server on the network must also be a Windows server. This is due to the way NIS is implemented in Windows Server: The information that Unix NIS servers store in a map database is stored in the Active Directory. The Active Directory schema is extended to include a class for each NIS map. Then objects are created based on this class for each map entry.

NIS uses its own protocol to send updates from a master NIS server to slave servers. The Active Directory, on the other hand, has its own method for replication information to other Active Directory replicas. The two methods are not compatible. That's the reason why a Windows domain controller cannot be made a slave NIS server to a Unix master NIS server. However, Microsoft does provide support for the NIS protocol so that Unix systems can become slaves to a Windows 2000 master NIS server! So, if you decide to integrate NIS into the Windows 2000 portion of your network, you'll have to make a Windows domain controller the master NIS server.

The advantages of using NIS should be obvious. On Unix networks, NIS relieves the administrator of having to manually coordinate important system files on multiple servers. By incorporating the SFU NIS server into the network on a Windows domain controller, you can use the tools designed around the Active Directory to manage not only your Windows users but also users on your Unix systems.

Another advantage to using a Windows-based NIS server is that the Active Directory is a hierarchical database, whereas the NIS database format is a flat namespace. You can place NIS maps into any container in the Active Directory, such as an organizational unit (OU). You can probably figure out from this that you can support multiple NIS domains in the same Active Directory database.

Modeling the Directory Structure After Your Business Organization

The main points to consider when grouping users and resources are how you want to administer them and what this will do to affect the network traffic associated with logon authentication and directory information replication.

Do you want to create a network that allows centralized or decentralized control? In Windows NT, domains were used to enable you to group users and resources into convenient, manageable units that share a common security policy. With the X.500 naming hierarchy adopted by the Active Directory, you might find that you now can get by with fewer domains, while using other methods, such as organizational units, to make administration more flexible.

Having a single domain and using OUs to divide users and resources for administrative control purposes is a good idea if the network is connected by high-speed links. If your network is widely dispersed over a large geographical distance (or via slow links), you should take into consideration the replication traffic that will occur when changes are made to the database if a single domain is used. If frequent changes to the database occur, you might want to consider using separate domains for users and resources in different locations so that only the domain tree metadata becomes the object of replication.

For example, suppose that a manufacturer has just decided to upgrade all its business sites to Windows 2000 and use the Active Directory to manage resources. The sales office is located in New York and two manufacturing sites are located in Dallas. The user base at the Dallas site has a much higher turnover rate than that of the New York site. Because users at each site mainly access only resources local to their site, it makes sense to use two domains, one for each geographical site. Using two domains also keeps replication traffic between the sites to a minimum because the frequent changeover of users at the Dallas site does not need to be replicated to the New York site.

Later, the company decides to open another manufacturing plant in San Antonio. A high-speed leased line is installed between the Dallas and San Antonio sites because the plants will be sharing a lot of information between them. The Dallas domain is expanded to include the San Antonio users. However, a separate OU is used for each of these sites so that users can be dealt with easily by the local managers for each site. Because both of these OUs reside in the same domain, controlling user access to domain resources is a simple task no matter where the user is located.

Domains Are Partitions of the Active Directory

A domain in the Active Directory is basically a partition of the entire domain tree namespace. The namespace consists of all domains in the domain tree of which the domain is a member. In the Active Directory, each domain controller in the domain holds a complete replica of that domain's partition of the directory database. Each domain is responsible for holding directory information about users, resources, and other objects defined in the domain. The global catalog enables users in other domains in the domain tree the ability to quickly locate resources that are entered in other partitions, or domains, of the tree.

Note

You aren't stuck with your initial decision when you set up a domain tree or forest. The Active Directory uses a unique number, the globally unique identifier (GUID), to identify each domain in the network. Because this identifier is used throughout the network to uniquely identify the domain, the directory enables you to add, delete, and change domain names easily

as your organization or network changes. Because each domain can be easily identified by its GUID, you can make changes to the shape of the domain tree or forest by moving domains around and reattaching them at different points to match your current needs. In the Windows 2003 Active Directory, you can use drag-and-drop utilities to rearrange domains in a tree.

Another important characteristic of a domain is the domain security policy. You define certain characteristics of the security policy, such as the password history and account lockout values, on a domain-by-domain basis. However, you cannot assign different account policies, such as lockout values, on an OU basis.

Organizational Units Allow for Delegation of Control

Organizational units are container objects in the Active Directory. A container object is an object that can hold other objects in the directory. An OU can hold other organizational units and container objects, as well as leaf objects in the directory. Leaf objects are the endpoints in the tree structure of the directory and hold information about such things as users, printers, applications, and other resources.

Tip

In the Active Directory, you can use the OU to subdivide portions of the directory. By doing so, you can reduce the number of domains that you need. You can delegate authority to manage OUs to only those administrators who need such access. Thus, OUs can be used not only to partially replace domains, but also can be a very useful method for controlling rights and access for day-to-day management chores.

In Windows NT, you use a domain to group users and resources so that they can be managed as a unit. Within a domain, you can grant certain users the rights to perform system management andadministrative tasks, such as creating user accounts or adding computers to the domain. However, this administrative control is domainwide. For example, if you grant a user account the right to modify user accounts, that user can modify any user account in the domain.OUs enable you to further subdivide a domain and grant those same user rights based on the OU instead of the entire domain. This finer granularity of control can make it possible for you to get by with fewer domains in situations in which you want to use a large number of user groupings for administrative control purposes. Instead of creating a domain for each of the accounting, human resources and manufacturing departments, you can create one domain and assign administrative privileges by OUs created within the domain to allow each department to control its own users and resources.