ServerWatch Staff

Installing Active Directory One of the major improvements between Windows 2000 and Windows NT 4 is the fact that the decision on whether or not a server becomes a domain controller is made independent of the actual OS installation. As such, turning a member server into a domain controller (or vice-versa) is something that can […]

Object Permissions and ACLs Although the concepts of permissions and ACLs were just discussed, you’ll need to know a little more about them. First of all, every object in Active Directory has an associated ACL. This controls who can do what to an object. By default, the ACL associated with an object is hidden, but […]

Creating and Customizing Administrative Tools As mentioned earlier in the series, it is possible to create custom MMC consoles that restrict the administrative tools that a user has access to. For example, you could create a custom tool that includes access to AD Users and Computers as well as Event Viewer, as shown below: To […]

Active Directory Forests and Trust Relationships   As I outlined in previous articles, all domains within an Active Directory forest are capable of accessing one another due to the nature of the trust relationships that are automatically created. A transitive two-way trust relationship exists between every child domain and its parent domain, and transitive two-way […]

Other types of changes are impractical to perform in multimaster fashion, such as those to the Schema and Configuration Partitions. Since these partitions and other types of changes are too sensitive to be done in a multimaster fashion, specific domain controllers are assigned to handle these operations. Since these specific domain controllers handle these particular […]

Transferring FSMO Domain Controller Roles Once additional domain controllers have been installed in the forest, it is recommended to move some of the load off of the forest root domain controller (the original domain controller installed in the forest and domain which holds all the per-forest and per-domain roles). Operations Masters role transfers take place […]

Viewing FSMO Domain Controller Roles using NTDSUTIL NTDSUTIL is included with Windows 2000 Server, and one of its many uses is that it can be used to view the Flexible Single Master Operation roles on a specified Domain Controller. You can start NTDSUTIL from either the RUN box in the start menu or from the […]

Finding FSMO Domain Controller Roles using ADSI and WSH You can also use Active Directory Services Interface and the Windows Script Host to show you the Flexible Single Master of Operations role owners for a specified domain or domain controller. You need to cut and paste the following code into a text file and then […]

Seizing FSMO Domain Controller Roles After the Operations Masters roles have been spread out and balanced on other Domain Controllers in the forest, it normally is not necessary to change them again unless some environment variable has changed. Operations Masters roles can be seized if the situation calls for it. Role seizure happens when the […]

Note that if your client machines do not meet the specs above, there is still hope. Windows 2000 includes support for a small number of network cards that are not PXE-compliant. This support allows a boot disk to be created that allows the PXE to be emulated. In order to create this disk, the rbfg.exe […]

– Adding exclusions. An exclusion is a group of IP addresses from within the provided range that you wish to not be handed out by the scope. Often these addresses are ones which you have statically assigned to hosts (such as servers) on the given subnet. – Lease duration. Unlike in NT 4 where the […]

WINS Replication You should recall from NT 4 that you could configure WINS servers to replicate information to one another, giving multiple WINS servers a more complete view of the network. This functionality still exists, with the ability to configure replication manually, as well as automatically. The automatic partner configuration can be set on a […]