Lesson 1: Introduction to Active Directory Directory Services

Before you implement Active Directory directory services, it is important to understand the overall purpose of a directory service and the role that Active Directory directory services play in a Windows 2000 network. In addition, you should know about the key features of Active Directory directory services, which have been designed to provide flexibility and ease of administration.

Active Directory directory services provide a set of directory services that are included in Windows 2000 Server. A directory service is a network service that identifies all resources on a network and makes them accessible to users and applications.

Active Directory directory services includes the directory, which stores information about network resources, as well as all the services that make the information available and useful. The resources stored in the directory, such as user data, printers, servers, databases, groups, computers, and security policies, are known as objects.

Active Directory directory services organize resources hierarchically in domains. A domain is a logical grouping of servers and other network resources under a single domain name. The domain is the basic unit of replication and security in a Windows 2000-based network. Each domain includes one or more domain controllers. A domain controller is a computer running Windows 2000 Server that stores a complete replica of the domain directory.

To simplify administration, all domain controllers in the domain are peers. You can make changes to any domain controllers, and the updates are replicated to all other domain controllers in the domain. Active Directory directory services further simplify administration by providing a single point of administration for all objects on the network. Since Active Directory directory services provide a single point of logon for all network resources, an administrator can log on to one computer and administer objects on any computer in the network.

In Active Directory directory services, the directory stores information by organizing the directory into sections that permit storage for a very large number of objects. As a result, the directory can expand as an organization grows, allowing you to scale from a small installation with a few hundred objects to a very large installation with millions of objects.

Active Directory directory services, like all directory services, are primarily a namespace. A namespace is any bounded area in which a name can be resolved. Name resolution is the process of translating a name into some object or information that the name represents.

Active Directory directory services integrate the Internet concept of a namespace with Windows 2000 directory services. This allows you to unify and manage the multiple namespaces that now exist in the heterogeneous software and hardware environments of corporate networks. Active Directory directory services use Domain Name System (DNS) for its name system and can exchange information with any application or directory that uses Lightweight Directory Access Protocol (LDAP) or Hypertext Transfer Protocol (HTTP).

The Active Directory namespace is based on the DNS naming scheme, which allows for interoperability with Internet technologies. Following DNS standards, the domain name of a child domain is the relative name of that child domain appended with the name of the parent domain. The name of the child object in an object hierarchy always contains the name of the parent domain.

Because Active Directory directory services use DNS as its domain naming and location service, Windows 2000 domain names are also DNS names. Windows 2000 Server uses Dynamic DNS (DDNS), which enables clients with dynamically assigned addresses to register directly with a server running the DNS Service and update the DNS table dynamically. DDNS eliminates the need for other Internet naming services, such as Windows Internet Name Service (WINS), in a homogeneous environment.

Active Directory directory services further embrace Internet standards by directly supporting LDAP and HTTP. LDAP is an Internet standard for accessing directory services, which was developed as a simpler alternative to the Directory Access Protocol (DAP). For more information about LDAP, use your Web browser to search on the Internet for "RFC 1777" and retrieve the text of this Request for Comment. Active Directory directory services support both LDAP version 2 and version 3. HTTP is the standard protocol for displaying pages on the World Wide Web. You can display every object in Active Directory directory services as an HTML page in a Web browser. Thus, users receive the benefit of the familiar Web-browsing model when querying and viewing objects in Active Directory directory services.

Active Directory directory services support several common name formats. Consequently, users and applications can access Active Directory directory services by using the format with which they are most familiar. Table 4.1 describes some standard name formats supported by Active Directory directory services.

Table 4.1 Standard Name Formats Supported by Active Directory Directory Services

Format	Description
RFC 822	RFC 822 names are in the form somename@somedomain and are familiar to most users as Internet e-mail addresses.
HTTP URL	HTTP Uniform Resource Locators (URLs) are familiar to users with Web browsers and take the form http://somedomain/path-to-page.
UNC	Active Directory directory services supports the Universal Naming Convention (UNC) used in Windows 2000 Server-based networks to refer to shared volumes, printers, and files. An example is \\myco.com\xl\budget.xls.
LDAP URL	An LDAP URL specifies the server on which the Active Directory directory services reside and the attributed name of the object. Active Directory directory services support a draft to RFC 1779 and use the attributes in the following example: LDAP://someserver.myco.com/CN=jimsmith,OU=sys, OU=product,OU=division,DC=devel CN represents CommonName OU represents OrganizationalUnitName DC represents DomainComponentName

The three server editions of Windows 2000 provide directory services based on Active Directory technology. Active Directory directory services provide a set of directory services that are included in Windows 2000 Server. A directory service is a network service that identifies all resources on a network and makes them accessible to users and applications. Active Directory directory services include the directory, which stores information about network resources, such as user data, printers, servers, databases, groups, computers, and security policies. The directory can scale from a small installation with a few hundred objects to a very large installation with millions of objects.

Active Directory directory services use DNS as the domain naming and location service. Therefore, Windows 2000 domain names are also DNS names. Windows 2000 Server uses Dynamic DNS (DDNS), so clients with dynamically assigned addresses can register directly with a server running the DNS Service and update the DNS table dynamically. Finally, in a homogeneous environment DDNS eliminates the need for other Internet naming services, such as WINS.