Learn Windows XP Professional in 15 Minutes a Week: Windows XP Pro in AD Environments, Part 1
January 14, 2003
Welcome to this week's installment of "Learn Windows XP Professional in 15 Minutes a Week," the 20th in this series. In this article we will take a look at the Active Directory service provided by Windows 2000 server and how it interacts in Windows XP Professional environments.
[NOTES FROM THE FIELD] - I am going to do my best not to repeat too much material from my Windows 2000 Network Environment Overview, Active Directory Logical Architecture, and my Active Directory Domains, Organizational Units and the Global Catalog articles, all of which are part of the "Learn Active Directory Design and Administration in 15 Minutes a Week" series. Inevitably, however, some sections will overlap. (It also wouldn't be the worst thing in the world to take a look at those articles first, and then head back here.)
Active Directory Logical ArchitectureForests
The Windows 2000 Active Directory forest is the collection of one or more Microsoft Windows 2000 domains that share a common schema, configuration, and global catalog. You will find all different types of clients in this setup, everything from Windows 9x systems up to and through Windows XP Professional. You might even find Windows NT 3.51, NT 4 and 2000 member servers in a Windows 2000 forest.
[NOTES FROM THE FIELD] - What you will not find, unless it's been hacked to do so, is a Windows XP Home edition system as a member of a domain. This is not a supported configuration. Windows XP Professional is the only version of Windows XP that allows users to join and be managed by the domain. This is outlined in full detail on the Microsoft Web site in the Windows XP in a Domain Environment article.
The domain namespace of the domain trees in the forest is not always a contiguous namespace. If there is a single tree in the forest, it will have a common domain namespace. Since there can be more than one domain tree in a forest (it is not a requirement, but it is allowed) these different domain trees will have their own individual contiguous namespaces.
All of the domains in a domain tree, and all of the trees in a single forest, have the connectivity benefit of the two-way, transitive trust relationship, which is the default trust relationship between Windows 2000 domains. A two-way, transitive trust, by definition, is the combination of a transitive trust and a two-way trust. This complete trust between all domains in an Active Directory domain hierarchy helps form the forest as a single unit via its common schema, configuration, and global catalog.
The first Windows 2000 domain installed in the forest is considered the forest root domain.
Figure 1: The Windows 2000 Forest
Figure 1 illustrates a single Windows 2000 Forest with two domain trees. Zandri.net and Gunderville.com are both in the same forest, yet each of their domain namespaces have different names.Trees
Domain trees within the Windows 2000 Active Directory forest are a set of Windows 2000 domains connected together via a two-way transitive trust, sharing a common schema, configuration, and global catalog. To be considered a true Windows 2000 domain tree, the domains must form a contiguous hierarchical namespace with one domain being the domain root.
The first Windows 2000 domain installed in a tree is considered the root domain of that tree. It would be considered the forest root domain only if it was also the first domain in the forest.
[NOTES FROM THE FIELD] - In Figure 1, Zandri.net is linked "down" to Gunderville.com. This is usually designed to show that it is the forest root domain. When the domain tree Zandri.net was first installed, it was installed as the root of the Zandri.net tree and the root of the Active Directory forest. When Gunderville.com was first installed it was installed into an existing forest and as the root of its own domain tree.
In the illustration, the Zandri.net tree has two child domains installed in its tree, Northamerica.Zandri.net and Southamerica.Zandri.net. Likewise, Gunderville.com has two child domains installed in its tree, Northamerica.Gunderville.com and Southamerica.Gunderville.com. This shows the contiguous hierarchical namespace within the domain trees.Trust Relationships
All of the domains in a domain tree and all of the trees in a single forest have the connectivity benefits of a two-way, transitive trust relationship, which is the default trust relationship between Windows 2000 domains. By definition, a two-way, transitive trust is the combination of a transitive trust and a two-way trust. This complete trust between all domains in an Active Directory domain hierarchy helps form the forest as a single unit via its common schema, configuration, and global catalog.
Transitive trusts are a relationship that extends from one domain to the next, and the next, and so on. In the above example, Northamerica.Zandri.net indirectly trusts Southamerica.Zandri.net because the trust relationship travels from Northamerica.Zandri.net to Zandri.net to Southamerica.Zandri.net. Because Northamerica.Zandri.net to Zandri.net is a direct trust and Zandri.net to Southamerica.Zandri.net is a direct trust and all trusts in a Windows 2000 Active Directory are transitive by default, Northamerica.Zandri.net indirectly trusts Southamerica.Zandri.net.
This is also the relationship of Northamerica.Zandri.net to Southamerica.Gunderville.com. Since they are all in the same forest and connected by a common schema, configuration, and global catalog (as well as the fact that all Windows 2000 Active Directory are transitive by default), the following is true:
Northamerica.Zandri.net directly trusts Zandri.net and Zandri.net directly trusts Gunderville.com and Gunderville.com directly trusts Southamerica.Gunderville.com. Therefore Northamerica.Zandri.net indirectly trusts Southamerica.Gunderville.com.
A two-way trust can be looked at simply as two one-way trusts between two domains. When Zandri.net trusts Northamerica.Zandri.net, it is a one-way trust. When Northamerica.Zandri.net trusts Zandri.net, it is another one-way trust. The trust is considered two way when each trusts the other in the same reverse manner it is trusted.
This would also be where Zandri.net trusts Gunderville.com and Gunderville.com trusts Zandri.net. Since these two domain trees are in the same forest, they each trust the other and all of their child domains (two way and transitively).
Again, all of the domains in a domain tree and all of the trees in a single forest have the connectivity benefit of the two-way, transitive trust relationships, which are the default trust relationships between Windows 2000 domains.
This is not true of domains and domain trees outside of the forest. (Such trusts are referred to as external trusts.)
For example, if Zandri.net were corroborating a project with 2000trainers.com where users in the 2000trainers.com Windows 2000 domain needed access to resources within the Zandri.net Windows 2000 domain, the domain administrator for Zandri.net would have to manually set up a trust relationship with 2000trainers.com in which Zandri.net trusted 2000trainers.com so that users in 2000trainers.com could gain access to the resources they needed. This would not give users in Zandri.net access to any resources in 2000trainers.com, as the manual setup of a one-way trust does not automatically allow for the "reverse" one-way trust, making 2000trainers.com trust the users of Zandri.net.
Figure 2: One-Way Trust
Such a trust is also in no way transitive. If there was situation where a trust was established from Zandri.net to 2000trainers.com and there was a child domain of 2000trainers.com called Forums.2000trainers.com, users of Forums.2000trainers.com could not gain access to any of the resources in Zandri.net, even though those resources might be included in the common schema, configuration, and global catalog of the 2000trainers.com Active Directory. The trust that exists is between only 2000trainers.com and Zandri.net, and in the example of Figure 2 it has been set so that only users in 2000trainers.com can access resources in the Zandri.net domain. If access to Zandri.net is required by users of the forums.2000trainers.com Windows 2000 domain, then another one-way, external, non-transitive trust would need to be established.
Figure 3: One-Way, External, Non-transitive Trust
External trusts can be created between different Windows 2000 forests or to a Windows NT domain (sometimes called a down-level domain) or a Kerberos version 5 realm.
You can also combine two one-way trusts to create a two-way trust relationship. In this case, 2000trainers.com would trust Zandri.net and Zandri.net would trust 2000trainers.com. However, even these are not transitive, since they are from different Windows 2000 Active Directory forests.[NOTES FROM THE FIELD] - In Figure 3, users of the 2000trainers domain would be able to access resources if they are given permission to in the Zandri.net domain. However, this does not necessarily allow them access to the other domains in the forest, such as Northamerica.Zandri.net, Southamerica.Zandri.net, or any of the Gunderville.com domain tree.
Well, that wraps up this section of "Learn Windows XP Professional in 15 Minutes a Week." I hope you found it informative and will return for the next installment.
If you have any questions, comments or even constructive criticism, please feel free to drop me a note. I want to write solid technical articles that appeal to a large range of readers and skill levels, and I can only be sure of that through your feedback.
Until next time, best of luck in your studies and remember:
Of all the oxymorons there are, found missing and clearly misunderstood are two of my favorites.