1.1 Introduction

Windows 2000 is a complete redesign of the operating system that aims to meet the requirements of enterprise deployments. Active Directory (AD), a scalable and robust directory service (DS) for Windows 2000 servers, is deeply embedded in the operating system. Many other components of Windows 2000 depend on data held in the directory. These facts mean that careful thought must be given to the deployment of the AD before any implementation of Windows 2000 can begin.

Essentially, a DS is a way to look up and retrieve information from any-where within a distributed environment. A DS provides storage for data, a schema for defining what the data are, methods for accessing these data, and the ability to organize these data hierarchically. The AD provides the storage, the access methods, and the security for the OS and applications that use its services. It is extensible and shareable, and it provides the scalability and manageability required by large enterprises.

Many different objects can be stored in the AD:

• All the objects necessary for running a Windows 2000-based infrastructure, such as the following:

  • Users and groups;

  • Security credentials such as certificates;

  • System resources, such as computers (or servers) and resources;

  • Replication components and settings, which are themselves objects in the AD;

  • COM components, which in previous versions of Windows NT Server 4.0 were required to store information about their location in the registry but which are now stored in the AD's Class Store;

  • Rules...