WINDOWS 1002000 PROFESSIONAL RESOURCE KIT [Electronic resources] نسخه متنی

Centralized Administration

A key advantage of using Windows 2000 Professional with Windows 2000 Server is that Active Directory and change and configuration management features allow you to centrally manage desktop installations and configurations. Table 2.2 summarizes the management features that are available by using Windows 2000 Professional with and without Windows 2000 Server Active Directory.

Table 2.2 Comparison of Management Features for Windows 2000 Professional with and without Windows 2000 Server

Active Directory

The process that makes directory information useful and available to users, software applications, and third-party services in a network environment is called a directory service. Active Directory is a directory service.

NOTE

---

A directory service includes both the directory information and the services that make that information useful.

The main functions of a directory service are the following:

Replicate directory information to make it available to all users in the network and to overcome failures.

Partition directory information into multiple stores to store a large number of objects.

Enforce security policies defined by the administrator.

Active Directory makes centralized administration possible in Windows 2000. Active Directory offers an extensible, scalable directory service with hierarchical views and distributed security. Active Directory stores information such as user names, passwords, and phone numbers in a structured database called a data store which is represented by objects with attributes or properties. For example, a user account is an object in the directory and the user's name, password, and phone number are attributes of that user.

Active Directory gives network administrators and end users access to a directory service that provides the following features:

Flexible Querying Users and administrators can use the global catalog to find any object on the network using any attribute of that object. For example, you can find users by their first name, last name, e-mail address, office location, or other attribute of their user account.

Flexible Administration An access control list (ACL), or permissions, protects access to objects in Active Directory. An ACL determines who can view and use objects, and specifies how objects can be used. You can grant access to an entire object or to each attribute of an object. For example, you can grant all users access to view names and office telephone numbers of all users on the network, but restrict access to any other attributes, such as home telephone numbers and other personal information.

Delegation of Authority Active Directory security supports both inheritance and delegation of authority. Inheritance makes an object's specific permission set available to all of its child objects. Administrators can use delegation of authority to grant specific administrative rights for containers and subtrees to other individuals and groups. By using delegation of authority, instead of granting administrators authority over large parts of the network, you can assign them to precise areas of the network.

Information Replication Within a domain the directory is replicated, or copied, to each server running Active Directory. If the domain contains multiple Active Directory servers (or domain controllers), the directory is replicated to multiple servers. Each domain controller stores and maintains a complete copy of the domain's directory. Replication of this directory provides fault tolerance, load balancing, and more reliable data availability.

Information Partitioning With Active Directory, the directory of each domain stores information about only the objects located in that domain instead of using one massive store. By enabling multiple domains, trees, and forests, Active Directory scales to suit the smallest and largest organizations. Both small and large organizations benefit from smaller domains that are easy to administer, but large companies can easily add to their Active Directory environment by configuring multiple domains.

Directory Extensibility Active Directory has an extensible schema, which means that administrators can add new object types to the directory and new attributes to existing object types. For example, you can add a purchase authority attribute to the user object type, and then store each user's purchase authority limit as part of the user's account.

DNS Integration DNS is a set of protocols and services used throughout the Internet and other Transmission Control Protocol/Internet Protocol (TCP/IP) networks to provide name registration and name-to-address resolution services. This enables identification and connection to computers and users on TCP/IP networks. Active Directory uses DNS as its location mechanism and supports DNS dynamic update protocol.

Interoperation with Other Directories In addition to DNS, Active Directory supports other industry standards, such as Lightweight Directory Access Protocol (LDAP) version 2 and version 3, and Name Service Provider Interface (NSPI). LDAP, the core protocol of Active Directory, is an industry-standard directory service protocol, enabling Active Directory to share information with any other directory service that supports LDAP. Active Directory support for NSPI, which is used by Microsoft® Exchange 4.0 and later clients, provides complete backward compatibility with those products. By supporting these standards, Active Directory can expand its services across multiple namespaces, and process information and resources from the Internet, other operating systems, and other directories.

Full Backward Compatibility Active Directory supports and works with Windows NT 4.0 and earlier. Servers running Windows NT can operate with each other within a domain. Active Directory domain controllers appear to earlier-version clients as Windows NT Server 4.0 domain controllers.

Change and Configuration Management

Change and configuration management reduces the total cost of ownership (TCO) and managing change in network environments. After you install Windows 2000, you can use Group Policy to manage computing environments for groups of users and computers. This significantly reduces the need for administrators to visit desktops for application or operating system installations, updates, or to repair unauthorized or unexpected configuration changes.

Change and configuration management consists of two features, IntelliMirror and RIS. IntelliMirror in turn consists of the User Data Management, Software Installation and Maintenance, and User Settings features. Figure 2.2 shows the benefits and technologies for each of these features.

Figure 2.2 Change and Configuration Management Features

By using the standard change and configuration management features with Windows 2000 Professional and Windows 2000 Server together, you can:

Log on to any computer in the domain and access your personal desktop configuration including data, applications, and preference settings.

Quickly find your data files and access network files even if the network is offline.

Centrally define settings for groups of users and computers and rely on the system to enforce those settings.

Quickly replace a computer and automatically regenerate its settings, data, applications, preferences, and administrative policies.

Centrally install, update, and remove software, eliminating the need for user intervention and onsite support.

Configure a computer running Windows 2000 Server with RIS to allow PXE-enabled client computers to connect and install Windows 2000 Professional.

For more information about using the change and configuration management features from the perspective of a Windows 2000 Professional administrator, see "Introduction to Configuration and Management" in this book. For a thorough description of configuring and using Windows 2000 Server change and configuration management features, see the Distributed Systems Guide.

IntelliMirror

IntelliMirror is a set of Windows 2000 features used for desktop change and configuration management. Taking advantage of different features in both server and client, IntelliMirror enables data, applications, and settings to follow roaming users.

With IntelliMirror management technologies, administrators can have total control over client data, applications, and system settings. This helps reduce the need for technical support, and ensures that users do not inadvertently damage their systems. More importantly, it helps ensure that users always have access to needed data, applications, and settings.

At the core of IntelliMirror are three features:

User Data Management

Software Installation and Maintenance

User Settings Management

You can use these features separately or together. When fully deployed, IntelliMirror uses Active Directory and Group Policy to provide policy-based management of users' desktops. You can centrally defined policy settings based on criteria such as business roles, group memberships, and location.

NOTE

---

Client computers that are running Microsoft® Windows® 95, Microsoft® Windows® 98, and Microsoft® Windows NT® version 4.0 or earlier cannot use IntelliMirror technologies.

User Data Management

User Data Management technologies include Active Directory, Group Policy, Offline Files, and Folder Redirection. These technologies ensure that data is protected, available offline, and available from any computer on the network.

User data can follow the user whether the user is online and connected to the network or the user is offline in a stand-alone state. The user's data follows the user because Windows 2000 can store the data in specified network locations while making the data appear local to the user. You can configure which files and folders are available manually, set them up on a per-user basis, or configure them by using Group Policy settings.

By using the Offline Files feature of User Data Management, you ensure that the items that users create, such as files and documents, are easily accessible and readily available. If users take their work home or on the road, they still have access to their files. The network files that a user works with when online are automatically cached on that user's computer and available when he or she is offline. The master version of the file is stored on a server. When users reconnect to the network, any files that they have worked on are synchronized with the network version. For more information about using Offline Files, see "Managing Files, Folders, and Search Methods" in this book.

By using the Folder Redirection feature, you can redirect specific user data folders, such as My Documents, to a network location using Group Policy settings, and then make this location available to users for offline use. When a user saves a file to My Documents, the file is actually saved on the network location, and the local computer is synchronized with the network copy. This synchronization occurs in the background and is transparent to the user.

Because user files are redirected to a server, you can protect the centrally stored version of the data. If user data is lost on a local computer because a hard disk drive fails, you can restore that data from the network.

Software Installation and Maintenance

Use Software Installation and Maintenance to manage the installation, configuration, repair, upgrade, and removal of software, including applications and service packs.

Software Installation and Maintenance provides software installation and automatic repair of software to groups of users and computers. By using Software Installation and Maintenance, you can define Group Policy settings that specify which applications a user can use, regardless of which computer the user logs on to; you can also set how software files update and synchronize on a per-computer or per-user basis. You can assign software to a user or computer, or you can publish applications to a user.

Assigned Applications Assigned applications appear to be installed on the user's computer; the user sees shortcuts for the applications on the desktop or Start menu. Registry entries are made and shortcuts are placed on the desktop or the Start menu, but the software is not installed until the first time a user selects the software. Use this method to deploy software that is resilient and available regardless of user actions; if the user removes the software, it is installed again the next time the user selects it.

Published Applications Published applications do not appear to be installed on the user's computer; there is no evidence of the application on the desktop. Published applications are installed by using Add/Remove Programs in Control Panel. Use this method for managing software that is not necessary for a user to perform a job.

When you deploy applications by either assigning or publishing them, you can update them from the server. When the user logs on to the client computer, any new applications or updates are installed. For more information about Software Installation and Maintenance features of IntelliMirror, see "Software Installation and Maintenance" in the Distributed Systems Guide.

User Settings Management

User Settings Management is used to configure Group Policy settings that are applied to the operating system, desktop environment, and software for each user. These include language settings, custom dictionaries, accessibility options, desktop configurations, and other user preferences and restrictions.

By using User Settings Management, you can centrally define computing environments for organized groups of users and computers; you can also grant or deny users the ability to further customize their computing environments, such as style and default settings.

For more information about using User Settings Management, see "Introduction to Configuration and Management" in this book.

Group Policy

You can use Group Policy to have any level of control for managing desktops. You can choose to centrally manage a wide variety of settings, to control options such as desktop settings and the applications available to the user, or you can allow an open environment to enable users to modify their own desktops and install any application.

The Microsoft Management Console (MMC) Group Policy snap-in is used configure Group Policy settings. The settings are storedGroup Policy objects, which you associate with specific Active Directory container sites, domains, or organizational units. Group Policy settings can be filtered by using memberships in security groups. Table 2.3 lists the components of Group Policy.

Table 2.3 Group Policy Components

Group Policy and its extensions provide a unified replacement for many of the functions of the System Policy Editor in Windows NT 4.0.

Table 2.4 lists some of the ways in which you can control a user's work environment by enforcing system configuration settings for all computers that are using Group Policy and the equivalent tools used in Windows NT Server 4.0.

Table 2.4 Group Policy Administrative Tools

For more information about Group Policy settings, the order in which Group Policy settings can be processed, and how to filter and block Group Policy inheritance, see "Group Policy" in the Distributed Systems Guide. For more information about using Group Policy on computers running Windows 2000 Professional, see "Introduction to Configuration and Management" in this book.

Support for Roaming and Mobile Users

Using Windows 2000 Professional with Windows 2000 Server allows you to provide an even richer support for roaming and mobile users. Roaming users need to move from computer to computer while keeping a single desktop configuration. Although a roaming user logs on to different computers, they are usually connected to a network through a high-speed or LAN connection.

Mobile users need different desktop configurations as they move from one location to another. For example, a mobile user might require one network configuration that supports high-speed connections at headquarters and another for low-speed or dial-up lines at a branch office.

Using Windows 2000 Professional with Windows 2000 Server allows a roaming or mobile user to use a single profile when logging on to the network, while moving from computer to computer (roaming user) or among different locations (mobile user).

In Windows 2000, user profiles define customized desktop configurations, which include individual display settings, network and printer connections, and other specified settings. There are three types of user profiles—local, roaming, and mandatory.

Local user profiles are available on Windows 2000 Professional, regardless of the network being used. When a user logs on to the network for the first time, a local user profile is created and stored on a local hard disk. Users can modify their own local user profiles. Any changes the user makes to the local user profile are specific to the computer where the changes were made.

Because local profiles are specific to the local computer, they cannot support the needs of roaming and mobile users. With Windows 2000 Server, you can support these users by creating roaming user profiles and mandatory user profiles.

These types of user profiles are created by a server administrator and stored on computers running Windows 2000 Server. Changes made by a user to a roaming profile are updated and kept on the server. Only server administrators can make changes to mandatory user profiles.

Roaming user profiles allow users to wander among computers within a corporate network. With roaming user profiles, a user can log on to any computer that is running Windows 2000 within the user's domain. After logging on, all of the user settings and documents stored on the server in the roaming user profile are copied to the local computer. A user can run applications, modify documents, and work on the computer normally until logging off. When a user logs off, the user profile is copied to a server. When the user logs on to another computer, all of that user's profile information is copied to the second computer. This profile is available every time a user logs on to any computer on the domain.

A mandatory user profile is a special kind of roaming profile that specifies particular settings for an individual or an entire group of users. A mandatory profile is not updated when the user logs off. It is created by a server administrator, assigned to one or more users for job-specific functions, and downloaded to the desktop each time the user logs on.

For more information about how to setup and manage roaming user profiles, see "Introduction to Desktop Management" in the Distributed Systems Guide.