1.1 Introduction

When the Windows NT operating system first shipped in 1993 it was mainly used as a departmental file and print server. Corporations still relied on OpenVMS, UNIX, and other operating systems to run their business applications.

The evolution of back office applications and, more specifically, Microsoft Exchange was the major driver that made Microsoft enhance Windows NT to meet the requirements of the enterprise. Over the last few years, the Windows NT operating system has evolved from a small workgroup to a large enterprise server. Some limitations remain in Windows NT that prevent true scalability in terms of user accounts.

The Windows NT 4.0 account database (also known as the Security Account Manager [SAM] database) contains information about users, groups, and computers. The SAM database is limited in size to approximately 60 MB. This is not an architectural limitation but rather a Microsoft recommendation that it is unwise to exceed this size. In some circumstances, large corporate deployments have encountered the limit. For example, the DIGITAL1 account domain in Compaq contains 33,000 user accounts. The limited size of the SAM database impacts on large deployments that must accommodate tens of thousands of accounts. If a single account domain can t host the required number of accounts, the accounts must be divided across multiple domains. Trust relationships must then be created between the different account domains to allow roaming users to benefit from passthrough authentication and access resources in all the domains. Creating trust relationships is not a difficult task,...