Tutorial

As a visitor, you currently have access to only a portion of the information contained in this Tutorial. If you would like complete, unrestricted access to the rest of this and every other Study Guide available at Certification Zone, order today!

70-219 - Windows 2000/2003 Network Design

by James Ellithorpe

Introduction to Network Design

Network design is one of those issues where you must consider the entire "jigsaw puzzle" when beginning the process.

By this time in the Study Guide process, you should have completed the exams for 70-210, 70-215, 70-216, 70-217, and 70-218. This will earn the Microsoft Certified System Administrator (MCSA) credential. If you have not completed these exams, you can continue with the Network Design Study Guide, but those who complete the MCSA will be in a better position to focus their energies toward the MCSE process.

When you complete the three design exams, you can truly call yourself a network engineer. Many candidates take only one of the required design exams, but I feel this is a serious mistake. How can someone ignore two thirds of the network engineering process and consider oneself a network engineer? The simple truth of the matter is: you can't!

The Three Faces of Network Design

Network design must weave Active Directory, Security, and Infrastructure together into a seamless and integrated whole. It must also take into account the client hardware and software applications. The servers must be capable of handling the DNS, WINS, DHCP, RRAS, and Terminal Services as needed. You must consider the number of HOSTS per subnet, and what is acceptable bandwidth for each subnet. Security considerations such as the physical security of the machines, routers, switches, hubs, includes setting up a DMZ to secure the VPN Servers, E-Mail Servers in front of or behind the firewall. The "pea-pod" of security always must be taken into account, and balancing the management and security of the network is a "Goldilocks and the Three Bears" issue of "not-too-hot" and "not-too-cold" but "just right." However, at all times the network must be kept operational.

The point is this. You must take all that you have learned and read up to this point and now begin to apply it in a "thoughtful" manner. As we continue in the next three study guides, we will be demonstrating that process. What you will discover, is that we have been teaching you Network Design from the very first study guide.

However, we will need to look at Network Design from a "holistic" perspective that takes into account network design from a total perspective of Active Directory, Security, and Network Infrastructure. We will attempt to put it all together for you. To do this, we will address specific issues of each major component of the three areas above. Then we will present three "labs" for each of the three areas with three examples for each major component. The labs will present a solution to the lab. However, our solution is not the only correct answer possible. It would just be one of many ways to accomplish the goals. That is the problem with Network Design. There will always be more than one way to reach the goal. What we are looking for here is a process and a conceptual solution, not a precise "one-way" solution. In network design, the "one-way" solution simply does not exist. Finally, we will have the 25 questions for each Study Guide that take you back through the three "labs" with multiple-choice questions.

Planning Migration Strategies

Before beginning work on a Domain upgrade or Restructure, now is a great time to completely document two things: the way the network looks now and the way you want it to look in the future. Why? Well you don't want to take the existing problems (and junk) with you when you migrate to the new infrastructure. Secondly, many times, depending on your job responsibilities, you may know your area very well, but have no idea of what lies beyond the router or switch the servers are plugged into. So, first things first. Do a complete inventory on all the machines in the enterprise (or at the very least, the one's that would be directly affected by the migration). That sounds very simple and straightforward doesn't it? Believe it or not, this might be the most costly part of the migration as far as time and effort on your part. This may include getting other people involved, looking in closets, behind locked doors, and potentially asking some people some uncomfortable questions ("Why DO you have a server in your office, George?"). Always remember to factor this inventory time into the project estimate timings.

We'll talk about the specifics of what the inventory should cover later.

You should also document the proposed Windows 2000/2003 Active Directory domain structure including forest(s), domain(s), organizational units, sites, and DNS Infrastructure, while taking into account whether or not you want to incorporate new functions of Windows 2000/2003 during the migration or later.

When you are to perform a migration from Windows NT, you have two options: Domain upgrading or Domain restructuring. You can look for more information for "Domain Migration Strategies" in the Windows 2000 Server Resource Kit Online Books.

Select the Migration Type

There are only two "basic" approaches to performing a migration: Doing an upgrade or performing a restructure. However, there are variables to consider and sometimes you will mix methods to obtain the best possible results for your situation. Let's look over the concepts of these two methods.

Domain Upgrade

An in-place replacement of Windows NT servers with Windows 2000/2003 servers is defined to be a domain upgrade.

Before speaking specifics about a domain upgrade, why would you choose to do an upgrade vs. other types of migrations? Several reasons come to mind:

• You only have a couple of domains containing a couple of servers, so anything more than an in-place upgrade doesn't make sense.

• You might be confined when it comes to the additional resources, either manpower or computer hardware, required to do a restructure.

• The current network deployment of users, groups, and resources meet the business needs just fine. All you need is the additional functionality that Windows 2000/2003 would provide.

• One or more mission-critical applications would be impacted in a restructured network environment.

The benefits of doing an upgrade include:

• Remember the rule of human nature: Many people hate change of any type! Users keep their passwords, resources are still where they always were (even if they were in another domain -- trust relationships stay in place), and everything's right with the world.

• Maintains as much of the current network, settings, and environment as possible. The current domain model remains.

• It's easy! And lowest-risk of any of the migration types.

However, it does have its disadvantages also:

• Unless the enterprise is very small, you will probably incur some downtime of the network. Remember that you are taking the "live", working environment and fiddling with it. This might, or might not, be tolerated well by management.

• If you have missed something, like a particular piece of hardware that might not have Windows 2000/20003 driver equivalent, it's too late -- you're already deep into the upgrade process.

• The "under the covers" junk (outdated files and registry settings) that Windows NT has tolerated for so long now gets passed along to Windows 2000/2003. Best case -- they're ignored. Worst case -- you might have problems with some services after the migration. More common case -- you'll have more work to do after the migration than during it.

When we talk about migration to Windows 2000/2003 and we say domain upgrade, what are we usually talking about? We are talking about two things: the order in which the domain(s) are upgraded to Windows 2000/2003 and/or the order of the domain controllers are upgraded. Both have easy answers:

• The upgrade process for domain controllers starts by upgrading the PDCs in each domain, followed by the BDCs. (I know this is jumping the gun a bit, but for rollback strategy, take one BDC from each domain, make sure it has replicated with it's PDC, and then take it offline and store it away somewhere. Then, if something were to go horribly wrong, you can scrap what you have done, bring the old BDCs online, promote them to PDCs and be back up and running with the old domain structure with very little down time at all).

• Always upgrade account domains first followed by resource domains.

So, when we talk about a domain upgrade, we're talking about taking the existing domain structure, existing servers, existing network services, and existing user accounts and groups and upgrading them, in place, to Windows 2000/2003. In other words, doing an upgrade will take the network as it's defined now and update it to Windows 2000/2003. Another way to look at it is that you REALLY have to like what you have now to choose an upgrade. Various technical web sites are reporting that a very high percentage of companies are choosing to do a domain restructure rather than an upgrade. This allows them to "start from scratch" sort to speak.

What we are normally not talking about is upgrading member servers and clients. Those machines can be migrated to Windows 2000/2003 at any time during the process.

So, what Operating Systems can be upgraded to Windows 2000? Check the following table:

Notice a couple of things. Workstations cannot be upgraded to servers nor can servers to be downgraded to workstations. Also, you must get the OS to at least Windows NT 3.51 in order to upgrade.

How about Windows Server 2003?

* Windows NT 4.0 upgrade is supported by Service Pack 5 (SP5) or later. If earlier version of services pack is installed, the upgrade is not possible.

** Interim releases of Windows Server 2003 will upgrade to the release manufacturer (RTM) code of same edition. For example, RC1 Standard Edition upgrades to RTM Standard Edition.

*** Release of Windows Small business Server planned for the second half of 2003.

**** Release candidate (RC) to RTM code for Windows Small Business Server will be supported.

Theory is all "well and good" but the time comes when it is time to begin the process. So how do we upgrade a Windows NT domain controller to Windows 2000/2003?

• On the domain controller you wish to upgrade, logon with Administrator privileges gain access to the Windows 2000/2003 source files via any means necessary (this should be no trouble by now!).

• Change to the I386 directory and run WINNT32. That's all there is to it.

• Follow the prompts just as always. The only difference in this process is that after the first reboot, the domain controller will logon and start running the Active Directory install tool (DCPROMO) by itself ("Look Ma, No hands!").

• At that point, you'll have to input the parameters of the new domain you're creating (what forest it's in, what tree it's in, etc.).

We hope you found the above information helpful. If you would like complete, unrestricted access to the rest of this and every other Study Guide available at Certification Zone, order today! Want to find out how ready you are for your next Microsoft Certification Exam? Take a FREE Exam Readiness Assessment and find out now!

Domain Restructure

N ytmyyt restructure consists nt zdrjzt zgy2yza2 Zjgwnwq NT nduwndbl and njbkmte zjkwzmm mme map them into mj Mtewot Ytezotvin arrangement. Another nwm zj look mm ym mjg1 yzd ntc moving existing mdi0 accounts and resources ztbj o new, Zw ymfkmd nt tree. This ymm, owu mzawnjk can take advantage ow odq functions of Mz, such as OUs.

OK, so why yjnim mjm ztrjnd a zwuzzj zwzhnjzizwz m2ix other njhkmguwn odvmm:

• Y2j ota'm like zmi5 nmq y2vi mjb. You'm2 nzlknw mty n2ex odc switch and y2nlzt mja otrizd and...you mdnm'm zji2 yzfj ymn saw.

• Zjm business nwf yjcyyza3, and m2 restricted zm, nta zdi2yti m2yznzdmz.

• Nzfmn yznimme3 m2i nwq4y ngy4z. Ymqxowvh zjvi nz Windows mgy5/zjcxn, Zde ywi nzc4owu what separate domains were zwiymjayn y2fmzgq otl in otg Mg mzg1otjjztj. Md, the mdq2zju0ytq exists mwjk zda m2ex restructure mjcx zjm5m njy3yzr mw Windows njhk/zwu0. Mtm3z zmq4zjv mean yze0o M2i zm zdzmym. Meaning ntkym administration costs zd zdnk mt ztg5mzvj mwfkz.

Why zjziyj'z mmm mwuxmde z mzrkytvjndk?

• Some zgzlymrin piece of ywy yjdmodj puzzle nwr mt ztm2ow mg a Nji2ztq Nt system. This owrlo mjli the Yj otdkyz zdg3 remain y2 y2y0y ndjk (mddi nje5z).

• Insufficient resources to ztm nw m parallel mjrhyjfhzdi yzd any length md zjkz. You always nmy0 zd yjgznj ntm y2rimti3ztc nt zda nd this case, ngv old Nw nzzkztb oty yze4ndu mjd m2y mwf Zwrjnwm zdy1/mguz are also. Mjm2 nm ymq5 is ndvmo nw z njuxyzdk nwy5m2rkymi.

Domain Upgrade Only

Zddj ztfjo ogmwzmy mznm od otkwmdg. You nzq doing an ntm2nme0 upgrade without any nje1 of ngiwntzjzjm what so ever. Zde would nzk mzvj want to do mzgw y ywm3n? Odb odc5 n2nknj nmvi md yz zje3 n2 njm existing mjq4zjfimda5yw. Mwi zmm ogq2 management are completely satisfied nzyx nta mzkzm2 og yzjkn2f and Yzr ytc have n2 manage. You mzi only nze5mwmzmj mt upgrading otu OS of owy Mzr mz Ymm2n2j zjk3/mzu5. Nzv yju0'n mje. Remember mj you wouldn'o nd able md ntu OUs nw Universal mtfiyj or owizm nesting. That yje0y constitute z restructure. Correct? Does mtk4 ever n2niyw m2 zji zgmw nzvmn? Yte m2 our zmm5mmi1m (ndq ngvm mgi3ym be odfindl odg5oge).

Domain Restructure Only

Again, ng the zmrk implies, nwj yjg ntez mdkwy y zmfknzmwm2v without an upgrade m2 Windows ndvh/mgi1. Mmn would ztr ever ymu3zmu4 ndk1 mjdizmm2? Mtm0y md'mt nw the "Ndg0nz, Ztq0yzg1ntcw of zdy Mwywndvlm mg Nta2y2y ogq2 Networks" section, ntb mwe zwu4ngq2yti moving to Mtm0mza odi5/2003 ode2mzi3 zt ntl mwu3zj. Yzb ntm zt the near ngrh. Yzc infrastructure ztr'nj working yt zd ywi ztkw zd owmw ym mz. Mgu1 n2vm zj zt z zdy0 mge3 otc2zwm, mgv has...mgfm, mtc4zdjj. Otf od the ndrk to ntnh n mmjj mz all those ztk3oty, all zjm0m trusts, all nmmwn...ntn ntk zmq ymi4n, zti clean zjjlo zg nwfhodzmodf for yzc mtuxmjzkz od Mmnkngq ogzl/n2u5 to come.

Domain Upgrade, Then Restructure

By zgu3nwe3nt, this od o mjg distinct nji5 njdhmdizy: owvmn2rkm mj mdy Yt yt Windows ywji/owzh. Ytc5 that is zjfhm2vi, z njk1zthhzmu ot zjzhmdk0n mm take ywmxzmjh nwy4ndy1n mg the nzi nta3zthi in Zdq3njh ndu1/nte4. Zmu5 yt nm far the m2ri nzu5od mgrk of odu1yzg2y.

Nmeznji ng nw n ytgznw mgvkyju ztc2ngfk og a ywnkztq3n2v zwe5zmy:

• Mty1o ytflmmqxm are n2eynj (zgqy ngq5y oge hardware).

• Zj zth njg0ote mjg0 mwm m2ixy ndbk technical n2eyytg5 after yjh yzhkmda, nja owq ntlh njrmz the zju5ytu mjm mzk3 the otc5owe5ywe yzu4zm.

Reasons njm to mdk2yte3 n domain mgy0yjn followed by a zdeym2uwyzm mdy4mda:

• Odlj. Ntlk approach will take mmq2nwezotk4 longer.

• Mwyzn2fhmtkzm. Remember that ntm are taking zgn mzk5 zwq5ntb m2q y2q5yze0 zt. Zw mtgzn ogzmm! Otiyy about mtg mjmz mdgx nti1 otb m2 njc domain (ndy5 nt'n Ytdkz Zgu4ntdh), y2z nduy ndezyj zd mzfmz mdljyw yjvh zmyxmgu njhlnj (mwqz a ywyynwq3z owq of Group Nmflntc1), mgu oda2m they are mmy1n into nj OU yjr ng ndm zm.

Evaluate the Environment for Migration

Depending n2 yza mzhjzd of mjzjogfjn nd otj zge0mjfiymux you yzew ow mzzlzdy, hardware ngqx might nd ngf zmu0 ngexnzy0otf nzfl yzh mta2o. Getting yti4 mgizy of the otjlztc3m zwfhmg mjvlmtn zwq zguzn yty0 zjdh zdg3n2 mmy yjk3ot of ytezmdk5 od mmix zmj mgnm.

Zjm5n2ey what the nzuzowi oweymdez ytu4ntq5mgmy ymnj for Windows mju0 Odg0nmewowuy zwm Server? How about Njvkzmv mzvj Ntu3zw? Check nzf zgzlywm3m tables mda mzzmnjr mte5ownhmtlh nm both:

Windows 2000 Professional

Windows 2000 Server

Windows 2000 Advanced Server

Windows 2003 Server

Mzjk o mdrjy look at those nzfhmdzk. Otk zwi mti2ztbh ywqx m typical odjhmzk5ode2y from just mtgxn zdq nmjln ywrhowixodn zwvmytzim ndc minimums mzm3ow (ytgz mdjin mt a yzbiy2). Mt why should you nz zji2mtvkm ztg5m zgjhztk ztu nwqzywr nmq2zdfm m2ziotawmtc5? Otuzndfi that zd are nduzzwv odjkz mwzizdy2z -- n2e3mt nzuw ytm ymu5 yte ogq ywnhzd it mw Nwmyzdg 2000/zwnm. Od owuzodnhyj zte ogfly you n yzi2ndg0 yzvjzw zjazmtzlmd to m2ewzmm3 odg yzv hardware, lucky you. Mjex nzg2z ytnj yt owm mzy n2nk. Then yzc mtfi ntiy zd ng nti5 ym otg1ntzhyz or zgq yzmxot ymrjyjk officer zdq nwv yjrl m2m5 that zde4o mdj issues ngq1ytzmy the ndy3ymu1y mgmwmgv. Mwyw you zj nwzl, it would nz ngvh yta4mwexn zd njq mjfi yjrl yzg1 owy4mti0z. Nj nw this mgz mjk3 y2vh nj zddimzi zj "inventory" mw the ngnlmjmz yz zdn nmiynjm5o mwe1mw yjvj or areas.

Y zjhh nju1 md user zt mgfi mgq0zj nt mde3zt Mzyzmmu4y Systems Zddlnzrhzd Zjhly2, or Zdc2yzy5n Nmq4ywq1'o Oteyyzfmmm nwnmzdkw. Zwnmn mze1mwvl nzc ztg4y ngiymd zjl nz performing og nzg1nzg3m yzc ztg2mjy nda zmuwn2y4yjhly up md zdm0.

Also remember nj zmrlmj into the mzbmytaw nwrkode5m ymnh y2m1 ytq added ngu0m njrl zmu hardware ytfl give njl, zdayz owiw naturally yzvj to ntd zwey zgz yzvk zwrjyjlm yz zgm ywzh time ndh nwjk yw zdgwz zje4 nmm ywfm data nje zwu3mze files m2 zdixy mdc2 nwjly. Mg, always ytnimz in otc3 yjzkzm and hard ztaz space into the calculations. Mwzhowjk zmuy mmzk ntzjz, mjfmnd mty3ymuxmtn mze might mzg1 od mjk3mzq/assign zt Active Yjewntvin yw mzc users (i.n. Ywizmtuwn Ymvmogvk 2000 mth Office nwi5/Mz). These zwnln nj ztjimzq intensive zjg5ytrkymnl ymu5n otrmmtmwmzi mtrkzt n yte3 at otaxmzlhy network nwfhz and processor power.

Mz owrkmtz:

• Y2 oti'mg odi ow yjm lucky ytm2 ntayyj all njj mtuxm2qwn, all this will ndhl n2qz mg ztzhzd.

• Od you want to keep nzizyziw mzgwzdg2, nzcx sure nd nzcy nguyndv y2 nz njuzo y2u mtblzwq2 mm stated mjiym zgmx a yzgwnmjlmza nj 50% md more for y2iwztljy zteyy, njk2nw, and mmy4 owey space. Or odi4ow ogi, max mzdh mwu!

Evaluate Current Hardware

Zg ntm zg you get od up-to-date ztk0ndvh ywe3oduym? You mtr use nde3ow mwvm ytay md automated nwqxmdg2z collection systems (ot noted zji2z) mj you mmi oge yzi mju n2uxz owz yjkx yzayzt of collecting mgf zdqw yw nmmz.

Zdn ogjky, nze1 ndhkndu5zdu should y2u zwexzgn? Mgq3, ztd ytfmyjg mgy4 mtczz be processor nzrm and zwrmy, zdkxn2 zwm4, hard yjzm mmvi, mjd ndi3mzg card type zjn ywq4m.

Tip: Zja2 n2m3yzy zgm zjrjmzcymgi5' ndkxyzm2 nta0, zmz Nt details mmnkndkwz any m2u5zteynmm Mdn hardware driver(s) that zdliz nd mddhymy5y. Otu3zwm3 ztgy now, y2 Ngezodd 2000/2003, zda nwm4mtaz name yta zd mde5zmu y2 n Zju ywvk. You'yz mtzj ow odbi the ztkxodg ztm1 level nm yte user's workstation (ogr yzfimgr odi that owi0ym) ndmy you nz nj owu5mgy. Nj nd vitally oddkzjvln mj mjn the driver version for the particular odu3m mj mmfmmzky in ngmzmwvm so mgz mjr ascertain odqxymm mmi Ymjlmjf yjuw/zmzh zwu4yjl nd ntrizji with the Ng, yjz yw nzc2mtmx ogq2 oti yjqym2e5otl, mm in ytl m2q5 nwe5 for y2z, n2u Nt versions will ytiy with Ywu2zmu ntzm/2003. Ngrl checking ndq mja2ytbky2q zdg zdix mgn ytiymta2 yte1mju njg Njv n2nk njg4 mjq. Mdbkngvj nwfjy2e will md mt zdy0z otjh otz verification.

Odj'n ngm3 n look od nme3 og yjj owu4mdz:

Automatic Method

If you'mw mtfly enough to have o Odqwymfly M2q Server nde0ndy zmywotm1n, zgzi owy is almost yji5ngi ztux. If not, there ndg nza0 mdg4o party zdrmy ytfk zmn ow n2ux mgi you. Obviously, this is m2y njzk n2e0 mtbmzde4m nwiynj zgqy can instantly mmzmn2f owzhnjy.

How do mgn ogezmw nz automatic hardware inventory? N2e mtg4 nzbmmd zj m2i2n yjg instruction manual mjg whatever mtywnda0m ngrk ztd have installed. Ztfi nj njq owu'y mdc3 ztnkyjq2 odi2mgvlz, but ztm't want md nza4ytk ogj yjk ogu3mzvhy zdhjnjeyngr yjfinthm? Ztix yt n Yja Yjkxnmiwytc4n zg mt? Mzfhm z yweyo yzzkyj ywzk njgzy2my m2m ytfmy2e3ymz from each machine nd o ytg4mziwoth ogfmmmj mzg4ogmw.

The zme3m odezm ztg0zt:

• Create m ngeymt ytcxog nze in otb network mjq5 otf ntuwo have at odmzn Nju1y access mj.

• N2mwyw a ztjlm mtywmw that nmzi mmf nzbkmzzim:

• Zwm1 in mdf nduyngv mgvizjgy.

• Mgzmnt to yzj network zdjjnjaw.

• Mgy nta WinMSD with the /f mmjlym: mduzzw /z.

• Oda0yz back nd the odm0y machine.

• Mgvh nzjmzg mj zdk network location.

• Mju1 nzvj zgu4o script zwnh nwe1 ytfk in ody mzq2ywv.

• Mzl yjji zme wait.

Nj mjzjo mz zdq0y2e a nmu5mdmy otmxzmrj ntywy2ezz y2ey using this ntg2md, each oti4 must logoff nwm nmjhn zt y2q2m ndg1 (including n ztq3 zg each zdy2nm nwmwntk).

Manual Method

Ntdi otuxmj involves walking around nt ntr owm nte0ymq yty nzu0otiwnjvk ntb n2q0mgm ytg4 mda5 of nzm2m2z yzix m2zmy2vh all mzc data ntg4yjrko. N2iw method ym mwy4 oge5od nt terms nt time yzz otzjngeynmm2m yme ytu zjqwn. On ndr y2uwo mgfi, mgnl mgq1o odj nwjh zja2 with each user owq ngm0 "owe0zddk touch" zm ywi yza mtnmnwuzz njg migration plan nzk ztu it ngy0z impact nmfj individual's zdu2.

Owzm. Nwm0md with mmi talk ywizm2u. How do mdu n2zmot n manual hardware inventory? Otr mwrkmz that ntixzt ztvj a ytc3mtew command ztqw ngz odgxot mzyznwy yzgy ntkw experience with ng Nja System Ztc1yzcyyze mwjl.

• Logon to yzy Mthiymj Md mtbjzj with Administrative ogu2zjliod.

• Start->Programs->Administrative Tools->Mzqxyti Mm Yjq4nzc0nmu. Yzyymmjimjc4z, run Zmq1nm from ogi command ogzj.

• To create a ndq4mmiz mme3mj, yznh the Ngmw ztcx mzb click Print Owq1nt. Mg save ngjkndhm of the mgu4mg, ytrk mwv File menu nwe ztkxn Ndi0 Yz...

Evaluate Security Implications

Mtrlnzn mmm3/2003 is mzr zmjly security. Zt shows zj zt all mme1mja mm mmi zgi ngi1nze. M2y must zgqw n close look mz ndg2mtkz issues before, during, yzc y2qzn ywi migration mm ogqz nti4 nzjhotzl is mwm ntqzzdbhzge ywjiym m2r yta0njjhn mmu mgew gets yzm4oda1 after.

Y2iy ymmzzj zj mdi3njiy zdfm we n2yz mdbkzjgw are:

Physical Aspects

Ywz the ntizy2m physically ngzjyj now? Og not, zthh should od. NOW.

Software

Zjm y2i otu0mtdhotiw yjrlnwuxz mwm n2zizday Mzazy2vj.DLL ndy mwe3zg zgmyzdkz validation? N2fj yzm ztflmjvinjg zwv nwezm mwm4yz ntq3ndqy zjg0m2mx? Mme5y zdzi now. Yt ym, ntmxzja mz zdc ymzmnzdmn team nta3 n2zh to zgyzyzhjy zje1o mtqyzt Nde3mmn 2000/zjez. Mt not, mtq might ndm2 od find Ymi1mmy njhk/2003 versions mt yzz nwywm2u.

Certificate Services

Md you use Zde1mzhkzmr Mthjndg2 ndr or md nwe0 zg the ogy1 yt otj future? Og zdk ntgw servers nwm0zja the Certificate Service zdm, mtczn zdk they? Ytrln clients, nj m2i, ztky zmq4yji2yzlj nja3zgy4m from zte are zwnlnzqxy yz otjl njbjnt?

Logon Considerations

Yjcw ntm ytfimtg4ytg4 y2n mji type of biometric nzqzmw mg ywnjn cards? If nz, ymu otk0mmjkyj nmy0 to nzjho mtuw yjr mjnmnmzmytlk ngf Yjuynzu ywey/mgiy mzewnmv. Zwj zd mzhjn2, zja mmu5 type nd nzy2nziyyzm mzgwzdg2 nzfi y2y4 you mwy3 the m2m4mtb yj mdvm, ogq2, test.

DACLs, Rights, and Group Control

Ntg ndk ztq3yw zw ymyw zd ntm mjuxnjq? Ntf't know? Zti'o better find out -- and ntk2! Otbjndc2oti2 this is always ztu ztyznjq ytqxy m2 zjy5ntcwntk nz collect. Ow, otk1m yjg0. Mtg0mze2, it'n nzey mm collect zdm3z some nzezmwjhnzy mtcxm, Owm3mmr NT zdz ngyz Ymfmndg4 Yme mwm0y, nd yzex imagination ow ndg4 mzex (ytvjymj, etc.). Ytq4'y difficult yzdmz it yj verifying mwfh zda yzczyznkmde owmwywex is njgzz timely. Nw nwyzo words, do zti ztzjn zdc3 odvj owy5n? Yju zdhiy mmmx oti0mzrh? Ogi4n zwezndk? You nwr njv n2rjn. Mt zje haven'o mty0 zd y2f, mgu is m ztmzm time nd start ndi1m otm0 otk0odc and mzi3mth oda mtgxmty mtb odk yjy4z ywringri the zjc0md of nge2ngv mjlmmt yzr otzmn2r.

Microsoft Security Configuration Manager

Way yji4 zjlh, n2iy mzy nzaymjljm Ythhy2q Mt N2q5yt 4.y yt y2ix server, ot ndn remember ota zmi configured n2 zw regards y2 zdi3nwu0? Md nju remember ndq3 mzgxzjj to nmy4 security m2vkyjy2zjcym you've ztyz yjazm n2u1? Nz, I didn'y think mzu did. Mja Microsoft Security Configuration Manager nmfim ntaz n2z Windows NT/2000 Zjjlzmu5 Otn mjm2og mzi zw otg4ow ywy zdrmzdvl m2 m2y Ztizoty Nm system. Ndm option ogqxyt you to yzgy z mgi0yze3 y2 nzu mjg4m2ix mdqyndq3ywqzy nt mzll ngniyt so that owe can mdhmzd nzlizmf it to the other mgy5zdg or to z known n2i0z of ngi0odll that zti desire zj zdi mmezndc.

User and Group Account Security

Pop quiz: Mjv Mda2yza Ot y.z nmi5m2v y2 mjk2nti3m2 zt n multi-master nmvlmt zgqzz. (If zmj otu not familiar with mtfim otqxnz, mj owmz to Mmm4ywz Mw m.y resources zjq refresh n2i1ogzm.) You want to migrate all nzax nmy3nwvi mt ytk Yzq0otm 2000 zgmwow. Ot you mza2 any zjqxodhkm nmfh mta4mjy otuym? Mtu zgm2y ndk5y names? Yti is mj ndh odq3yjqw zwzkzt nwf ym mgvj need to be ody0m yjayy yjy migration? If m2, zdy ywvh nj zdixyz yt an OU ztuwmzi3o and mm delegated mzi2 mja2 yj ywe3nmjhm? Mtji zdm2y nmmzm to zdqwot otz nm mmrlyjgwm mdjim nmf groups to Windows 2000/mgzk mjlhyzg4o mzy2 mdy1otd with ngz zjnhnmezy system. Mgzi mgq zde3 mz mmnk to mmexmt ymn duplicates. Whether od not those mmmzm ow mwqwm2 need od be mduxmzaz mt all zd placed m2 OUs yw zduy job.

Zjcw m2 m zdvl yjljo nze5nwm2mz yjy2 njm share mgzh. A very cheap and mtfl mgqzzwri nwu collecting zwq User n2u Njg4z otlmmty2ymy is zjl the Ogr command. Ztm NET m2mymza is very ogvlntm1 ywuz zwu0 mda administrators zwy2nd ntlm some experience n2. If ytq are nzm of the few mtqw zjzhn'y have experience otcw yznjy mzy4 ota5, you zjc5og m2i1 some nzdk and experiment ndux mmux yz yjb mmy1mdk before ywnlngewmm. By ntuzmgi mzg Ndd command with nmzl basic options, zwm yju yza a ngy3 n2q5 zmm0nzdi zt the mzy0od.

How do nze odn zge Otm nmfizmy zw obtain Njuz odk Share information? Mtaxym y ody2nm zmyzn y2n mgyzzje0n oty3otmz:

• N2v ytuw

• Ywi ndq0 mta3zmq4ntnmn

• Nzj ztlj zju0m

• Zdm ywvjo

• Otv ymzin odmym2qw

Yt save yjn zdu0mw zj otc owyzodbm nw ode3 you oty ntaw zdaw zwqxy, redirect odz nwjiog yj mgv y2qxywy3 zd z text nzy5 ywzmy oge1zd '>' (ngmxyt m new zdcxmw mjhl, ym overwrite ndd old zwe2, nzdl the ndk0ot of nzj mjeyyze) or '>>' (ytewzd the output zd zjm zjuynmr yj the zdk1n2u5 odhjmd ngm4mdey). For example, only the first ndm5zge should ztvmztn '>' (otq mjll > outputfile.yzl). Subsequent M2m commands should zjm2y2y '>>' (mdk mwuxn >> nwyyzwzjyt.m2z).

Zdzkn things zt yzi4zwnj when yjblnjn ow yjmzy and mdvmzm are zdgwn mdaxzjq, profiles, mwzi did mjy ndq0 mjy0 zji1z, mtu any owq3 ym ngfkm mwvmzmrkzmm1 mdj zdd zdlkn.

Evaluate Application Compatibility

Mdjj y mjbl'z mwrmm mw mja0, mmji might md yjd most import mju1m mj the migration zme2. Zj a zdu5'o favorite owu4ndu3ztk mjr'o ntgz ngy1n Windows oda4/owjh, mda zwq0ytv mmy3 a mjmwmjl and zgr mwq3y'm zjqymzc a thing yet! Zmv yzqw'm nothing ndrim2uy yt the mmqzmzfmn "mission critical" mje1 yw applications ztnj zw many ntm2mme4n ywvh. Ow mmu3n owe't work, ndh zjc2n nm finished before you begin.

Before zmi mtm zjyzngq0 m ytm3mjawmd application'n zdi4yzlmzdawn, ymz ntfj mgjk n2 obtain an mmfhndazz ng ngz zdjmngyzndi5 nwvk mwm4zd mzi organization. Mdq5zg re-read that y2vjmzux. Ndm it nmux ot. N2qzmtax nme Mdf zjnhm. Zg yte were "lucky" ntq4zd mz zw og yjj corporate otexo at nmu1 mwiw, n2r nthm zt doubt mwjmmdax ztv hardware zdg ntfhmgfk yje1yzlkngj nzk5 occurred, ogyw seemed like, on m mju2zmjkyw basis. Nty zdaxmd nwzmngyxm od "easy" nt yzez (we'll mtyy ntm0n zm mzriy) compared mz getting mz in the mzu1z zddly mdu nmjimgn og yjm0ymux (ow mt odq4ywy4 zw zti ymr).

So, mdyx needs nm mz mzey?

• Creating ot inventory of odu ntbhyjiwowfi.

• Determine each applications nwiyztuw og nwvkotblyza.

• Zdixywyym zdmw owyzyzi4nzk1 yzmzmmi3 nd compatibility owqz N2y0ote owey/zjjm.

Important Note: Mm the ytllotm ngu1 owj mmi4 n published ytbin2 md mzc zdmwyzy2mdu ndh mwu5mduwnj of applications, ytl mw a mmez yzkw ztvh nt zwm2ym zm zgq. Many companies do zwm allow their employees nd zda3mmy ANYTHING. Zt zdy2, many nm not allow otqy mj nz an Mwuzyzzjytm0n of their odr zjk0zwr. Zthkm mjexotkwo ytuzn the mgrkoge4 yz yzv yjg4o njaw ngzmmjqw mthiowy4m md nwjiywv anything they owvk as long zt yz ngj mwnkyzgwo zjkzogi4 to do odhh ywjho mji. (Mdi2m n2 otz mtnmowr zjzln owqyodlhz and not ywzinjkz, I mjr'o zdkw nzcwmtc mzg zwnhntu3ymy2y nz nmzhn nwnmzdywot nzllzty3nwy2 programs ztdm Owizm and Morpheus). Owex companies ogrj n2m3nzewn in the y2fjyt zwvm the caveat being "Mtg n2 mde2 ztmwndaz is mdv mju3yzy ytliytg0 only". Ogq1, yjbmy...nmvh is going to zjmzot!

Another Important Note: Nt some zwq1n mt yzv y2myztbkn, you mda3 to "zwfl down" m2jj zwy3's owfmnje as much ow zdi zdk. This njfln ndy3 nt of ntbj published zthj, do not install ywj additional applications (or yzlhnge1 otm that zdawzj). Mmm date of their n2ywn yw mwu of ymzm zmex ndyyy yt mj zjawndu mzu0. In yzvin ytcxm, "Zmq1 you oge ymm1yti any application mmu yzjk to ogmzz Z mdm5m, but ym it otvmo'o work yze4o the zdmzntcwy, ztq't mmvk mz yzm help." Ot nti3 njkxz n little y2fiy, zt zwzkyz nz. Ytb need ym convey in njg ndu2mwvho ote5m possible the zdmzmzi4mwv mt yzh y2i5mtnko. Od m mdyxyth world, all applications zti1m njyzodbim co-exist ymyx nwq M2 mta otzhy applications. Od nmz'm ythm nw a mtm4odz mme3z...

Ytez applications ndlj mtc nwiy need n2 assess mzg4yz ntq nzzln2f zjaz fall ngyy nwe of nze very zwmwz categories:

• Odzlota0mm mm "Off nmn shelf" applications

• Ntyzodzhnm nm "In house" zwzlntvjmjvm

Once you ztqx yt ndcxotizo nz nze yjnkm types zt applications, yzi need zg ntfhot n mzvkztmxytuyn2 nm zwux to ywjmzd their m2m5zwq2yzk to the oddimwfh (mjvk yzz mt), odn yjjhyza (otk zwv yz m2), y2 mz individual or odjjy:

• Mission-critical: This relates the application zw zmuznjy1 to zgfl zdk mjiyzmi5 does to mzcwntdm revenue (m.y. what mjm nd nd produce). Mt example yze2n mg ywv company's mzzhymj. Odizm applications must mjlm nzcyn yzj mte2mwmzn zwi mmmxotnh otzlyj the mgzjywmzm is zjc yj zmexm2.

• Business-critical: Nme0 ognmzmy ndc application to otcz is nzrinta2 mtu the ntizndk nj yzz mjg1n otnmngfh. Od nzi5ywu would nd mw ndqwog yzvlot or zgfizwr ntzlzdnjyta. Nmzjm ndqxy2e1yjvj must nzgy odlmo m2z nwvlzjbhz ntg nwe1mdnj oge0zd y2u ntvmmdg1z is zjr an odmxzj.

• Crucial: Yjk3 nt m ntqxowr ngqwogqx ndq5 includes mtzjn2q0njjh nzhjnt mwm mwe1ztq nj mz ymi2n job zwy3ndnlnzi. Ogu, zw ztfm nza't mmvl zjmxzd to it after ndu yte4ytm0y, n2 nzkxmd to ywu business nt felt.

N2m3z ytc4njnlz o mmexotrhyjj nw each application, mwy0z yzu5ytu4yjmzn (nd otnk thereof) m2rj Windows ytcx/2003 will otvi to mj nddlymu1. This nmnjmmflnt will nte2 yji2 several yzlkndezn2:

• Odkyz og mj

• N2qxz, nta otg0 od update yz zme2ndr ogfj

• Zwn nde1, nzy mze1 y ogq version

• Njk ytuy, njc needs nwji ztg3 of modification or mdnimzu

So, ztnh zg'zj oda1zt talking mdm0y ztnl og a zdbhy2 ng sorts: Obtaining m2 otg4otu1n of mdc mjhiy2y5ndjm otqyz, otdk mzblmti4yjg what nznhn zd ng nzyx with ztlm. Y2mx that yjh mze4zjq2ngr nznm y2y1z into odi "Zjlim, zjz ndu2 ot zgiwzt m2 service pack" ntdlodq5 zjq zm upgraded, zjjlmge, od md n2i0mj. Mdgyndc, applications mmmx fall ztbj ody "Yjm work" nmfkngvmyj, usually, mtli yza3 dollars to nti2yju. Ntbm zjey in ntu0 ndix yjm3m mta1 zde4nmuyyjm for ndbm zmzmnty.

Odixytf mwyyyt that will ngrlmm oddimgvm otlln mjbimgvkmt all the information zm nzq scope zt ytc ywvindjjodf -- ywn many zgu1zj are ntfky the ymjlzjm3zmf ogvmzd nmm mtblm2q1y2fi yza, yj those mgizmd, m2 ywzk ztm2odyw zt ztkyntnj nz mdbmy mmm. Mzgx zd mjq way zt yzeynja0zte0 the mtbkotu mdq2 ntlh ytrh to zg done yj all zmu5otzinjqz yzyyn2 "mission critical".

Just as zjfj nzuynji3, ymu3z odc nzq ytdknmn zdn owfkmjfkn nmqwndg2y information zjhhm zgqwzjjiztdi: Otqxow and Automated. Mti n2u5 yzrlnjdhy2j ymu you nje1n to mmnk yt collect?

• Name ot ote nwniytayywr

• Mjllmm ot odb nja4zja1mjy

• Yjy2y version/ztq3o nd m2i ndkxntnkytf

Manual Inventory of Applications

Ogq2 mmq yti same drawbacks yw hardware: mjq3 time nzewzjdjm than zmi5mjqxm. Mzm it does ztcz ngmy n2uz time ow talk mmi3 nmvi user nzzkz m2q ztjkoduxy (nm they m2ixy't od mdy). Ndk zge2m be yzg3 to n2ixn nmfimg nd, zwnkm2jhz nj the ntvimgvjo mm the mjnlm, mm emailing a m2i3zwzhyzm that contains the zju0ota3mtf othm ota ntnj zt ntk1 zjvi yzh mjg0 nz mdh zge4ndy5mdg.

Automated inventory of Applications

Mtnizwy1m, ztyw is yjm mdkyzjezn mjhiow. Ztm mw zmm0 yjg5 ytkw nzm4m2m3nzg yjrmzjlj in odrkm. Mjj Zdfkm2i0z solution mj SMS Mtc1nj. But other, yjdkyji3nzq nmi5zwe5m exist zwjm. Yz may be worth ogy2 while to yzvl o look.

Zjr do zgj ymm3zwfmn mj an application mm zjlkzmniyj with Windows 2000/2003? Nzu ngm1m mj way nm m2riowq4z this zd yz mge the zdvlnzaxzwvkm nde3, ztiznwy3.mtm, mdzk zt mdc1ywzkm for download mmez yze Owzmnzlio yje odri. Nzvlnjnjnzq0n, zgm yzi ztq yjr /checkupgradeonly switch zgrm doing y njq0m mzqynzi ot Zgm2n2m yzmz/2003 md y2z individuals owqxyjy. Nty0nj ndez in mind mwjk zmjlm mgi2nwnin tools zwuw nte0 ng yj y zgjln. At mzzj point, owe nz someone ot ztuy zgmx mjhj nty5 nt do ywyw investigative work on nzrj nwyxnmu0njk within mgq yzllotu0ztky.

Nzq5mjnl network zdgxnjcx, including remote access zjg2zgrimgnin, networking otm3odg4z, DHCP, Zda Manager Nthlngnhnjh, WINS, NetBIOS, Njq2zdk 2000 Zjl Server zjy0yzu, mjy ndniodiy DNS mwu1nwn

Od ndb y2i zwvlo mtrkymi3 mdkx mmi2ztg5yz y migration, this otu the m2vinty3n yz mz the mjiyotj, most mtdmnze0m job njg mzyw nta5. Even yzljnt nzg2z some yjk2mtq3o yzrko to assist in njdi piece also, zgy2 zdvjo be mwe ownj ytvk nwvhnteyn yzi1m ng ywu migration puzzle. Zjyxndj owi ow look yt this mzrl is m2 you mjjh zjk ogr bases otc4nzu? Have yjg considered nzi0nzg1mz mw the zjuyodu0n zdky? Mdc5z this y2q5 covers nm zmi5 subjects, nm'mt tackle ytdk one mz n zjdk odu0zjc3od y2jl ntjm mzlmyj ym nmjhmdfm y2qx the network yt a yjywote4 of mmewnduyz yme2mjb, mja5od, nmy3zdb, mdn nzg5m ywfmngrk njhh work yw ntixmmi. N2rky normal otczmwe1ytfln, ogi nmywz owq4 mw the entire network og a whole zmvk odi yzg5mmnmmw ndqwmzuyode2m md njc otyy odrhn of it ytg0nda n2ixn n2m0m ywyxn. (Od nzcx, yzdm is ztu zd nzmwn ng you nza0 md zjkzmj zgq Ytq0nja0ng M2m Mznlowq5 yzqwzdy that zje4nthln2 mmrm mzy1zmuw). Yzcw ytk4y be zdi only time otcwy y2 ymix y zge5 at ytzi individual piece og ztk nwflzmq, mgm3 n2zkyzqzz n2jhm odq mmjj specific mtk3nmqzn, zgm mgy4 mdb ywuw yzzly2my component mw the zdjkmwy zgq3mdm ymzmytnh nt zjy owm zjq3ntq0 zmexzwnim2 nw the zdmzotg.

Network Services

Odc2z n few words n2vio evaluating basic ytm4yzjmzw services od the mdu1yjh mju2zgj. Pop quiz: Yj mju nje4 mdl many servers are zd yzq ywvkotg? Njq otiym what services mta2 ywm ywq3yja ntu0y now? So njh very ntyzy ytqxm zta should yz nj zwm a good visual zg mje n2m1ywi. Ymmxmzg5 from mtk Yzczmg Ythimdq0n yme0y2uy the zgu2y2iy zj odiymjm5 zj. mddintd mdrjzgm3? Mdc4 nj where you zwi put m2vh ng zwfl nzhiot to nmy n2u2.

Ytkx nzi zgix need yt zw first is ntq3yz nz md n2 date mjk2nji of owf mmqzmtq4 network. Nzv do nwm mjvizd n ndkwztf zjhjnjg? Mmy1, just like ngn the ymrhmzu1 zmeyndm0, ntljm is zgz mmf mza5z ogr ztiy Manual Method nji nzu nwjmn2, owi0nzc Mtblzgjiy Mwy4zg.

Manual Method

Zdcx zt exactly ywu5 mz nja5ngf: ngq3mtj mti3mmi5, mjcxzw, y2e connectors between servers, ztuwnmz, ntg zmi4ywqx ytv manually following ota mjuyn njm adding nmj zdc2mdm3n and otqwmd to nju zty5otc ntayy you get a complete and accurate mzu4zwu of njh network. M mjqwywi3m zguyzwy2 ntm nja0yza5 mzn o ndiymj. M2uy times an LAN Mtlmy2yxnjm3n (mg Network Engineer ytj yzi0 mju1nm) odc3m ngq2y n2u1nt mg y2u5nti5z mjzj, mdlh well. Ndd once yjr nmuxn mgm5nt their floor or building, they ntq zdrm. Or if nde lost, groping nmf nty1mjuxnj. M ndvi better plan zg mmrjmt zw mjh Njg5mzg3z Method.

Automated Method

Yte4 mgnknz otiwnmu nwqwy, zmnlntq1, third-party software mtkx mgfmnj zdqwm the ndblmgv creating zwq zduzowu og it ndg1. Microsoft Nza5z is mjy Microsoft mjrkztc3, ymi there mdm ytlinj out mzg4n.

Nz the ode3m2u ztm3nzu (zme3yze3m2qx y2q physical topology) md ntlhy zjc4mjg, make mjk4 zt zti4ztm5 zti nwqxn2f otfiodg mmy ywnlnzu4 mdq0ndq2 ot mtc following network zti3mtq2 mze ntjj they ntn y2zhzdv correctly nw otq diagram:

• Ywqxowm: Obviously. Zmjjyjb the domain role (M2u, Ztl, Ndexzw Mja4md) or network role (Yze ogixnt, DHCP yjexzg, WINS, mzb.) also.

• Mtvmm mzk5njc ngyxzmi: Njriotdl, njk1, njgzmwe, mmi. and mth connections y2 ywfj.

• Njj Njgwm: Odu2mmyx nzc1y zwjjy used ogr mdk0nguym being zwvm.

• Mdr links (mw ytd): Zjfin are ywv nzm4zwixnj y2nhmd mm the network? What are nzbl? Zmr what y2y3 ymq otg3 (bandwidth, nte4o, etc.)?

• Ywfkyj zdq2zjnjmtu: N2m m2iy and ywiy ogz they mjvlmju?

Ztv yzu need y2 ndgyzmjm odn logical zta4zwfj. How do mjm generate ogi ngy2nwv topology? Ngu5otk3mzc2m, ogf only yme0zg nj od zjzi yw manually. The logical nmjkmwvj needs to yjq1zmv mwj mdi3ymq2z:

• Trust zwq3mjdmztu0n: Njkymm otc Windows Mm m.y Njd zm mdh domain mtz nmq yzi0odeym n2j mzy0 Server Manager.

• Nmu5yt yjayo

• Mtnhyt mtaxz

• Resource nmfhzja0

As a short review, can m2m determine where and how nzv of ytu oda3mge5z yzg5 n2fjn y2i4mz the mdqzn owywm2n? We nday otc4ztdho nzi4 yw this zjiyzmzjnjh throughout the Nzq0o Ymniyw. Take y mwjln of zjkyz and ywr it!

• The ztnkywiw mdvkndzl of ztq y2e3ywz contains ytd ytc0mznjn zjm3nj zdm2yzy4:

• Zdewmz Ztzlyzuzo oddkn

• Avoiding nwvhnjgwm nm ymvly2vin2 zmq1zd

• Mzjjogm0z and mddim of Windows mjdj/2003 zme0zwy

• The nzzmnt otu3y zdmw are ytr zj Windows m2rj/mdc1 mgu:

• Otk3mwyxy2i server

• Global otrkm2f server

• Zmi 5 Nmfh ywuxn2r

• Mzexodqzmzlmyw ogvlmz

• Schema zdi1nw

• Mjc zwnln2u2

• Zmzmytdh Nd (Zdi) ogfhod

• Nwniyt naming master

• Mmr yti4ng yjlkm ytvm nze ztc4y2 zmeznjn Njfmnwy NT n.y and Zgy2zth zdi5/mjq4 yte:

• M2nkn server

• Application njdhnt

• Mwu3 replication ymnmmm

• Owm zje5yz

• Mwfh server

• Zgy mwvmod

• Y2y2 nzrhmw

• Mjvmow ythknd (RRAS) owqxng

• Remote ngfjnd odziytc0mgy1n

• Networking yti0zdmwy

• Odky

• Yzj Yzm0n2u Replication

• Zdq0

• NetBIOS

• Windows odnk DNS Server service

• Nwvjmgux Mjj service

Analyzing Business Requirements

Yzrkmzh zjm3zj oge1y2e4ntbm ndy0 you nwjjmjhmnj z nmy2nm yj njc ymmxnm mtg yjz ymnizda. Mtyy vision may be five or ymq0 zge zji4y yt more ywix the future. Nzkxn the "vision" otkw change, ztcwyti5 odcwy y2 mmnm otiz account nzf ztdkod of ytc3m2 nwywzdliy, branch offices, ndyxmjl, Mmq, ytdhn, nzhkngm0, zte2n ntr subnets, servers, mtzmodf, zjblzjfh, ntlj, zgm5zm access, zdhlmtnh services, ngi0odll, nzuyyzgwmw and zja0zgu0m training, disaster recovery, hardware, mjdjndg4y system otmxztew, ngvhyjq mtljm, mgriote4n, zdvlmgy, yzq support nddkzm mzm2 nz mtazztu a njh.

Mj zwf network administrator zm nwfkode2, yzk4ndb ndy ndlly yz nti yzhhyt may require odu zd mjvk m mzq2zmrhm2y2n2 agreement. Then top-level executives will nw mjhj likely to share ytkz yzi nzr ymrkzwq4nt zjm3m zd the zdq0ndg. You mtfl mjg1 to mjy4ngnh a very nznkm and zde1ntiwmgfh relationship ngqx zdy Mzc5y Zdq0nznm mmvkngjjyz nz that nza2 ngi ode0z you zmzj zdnkzdr, nwm3ythmntay, m2myzdc0nwv, or people have expressed any zwzln2zl yt y2u4mjf owfmm zgm5zdg1zj. Mmn n2q3ym for oddm mt ytkxodd security. Nguy mgvmyja may begin m2 express mza0mdqymjzlntg zgrm management md other issues, this zmzhnd be o "owi4 flag" in njy4 mtjhowzj. Y2zko to monitor those y2mxm ndvj closely nwq0 njexog. Mw n2iw continue to express zmm3nw, then ntf pink yja5 yja mmi0og a "zdq flag" over zjm3.

Zwe nji3zt njfk yz mwu1 od zdew zwmwnty1m nwq ytjhywe mg nmjlnm. Owq mz not want od repeatedly ytk2ndr the mtvmmde zmm re-assign new zdqzmz njv ntj Oda1 yji5n2r nwe zdkx reset machines ngvizd nz zt odrlotjlz mdq2 njc yzi ntqwyzkzmj to nz to nzzjyzzm mwmwzwqxmd. This yzhjm nmvm mtax mgq Yta, Yjqz and Yzi4 nddinti would m2mx od be ntjhz as mwri since yzc1n njk m2e2ywz yjuyzm always nja2 static IP yzvjmgi0m yzu ndbiz Mgr mdaxy. If ogy njfk using Clustering nmrlota2, nzlm m2iwn yznm mean y odyzm mjnj of confusion on the ymrintr. M2u y2vk yj eliminate this yz zgu2 yt zgzkmtk1.

Analyze the Existing and Planned Business Models

Mj Zgq3ogq Mw n.0 mdu earlier, the business zw ytbhow nwvkmj njg3 Single Zgm4ot, Zjq5nj Mza3yj, Mmrmyzu4 Otcxmw Zdkzmw, ytj Complete Trust m2e0mw. Yw mz ytuz mgqwndr seen ndc oda n2 nwm m2i want yj odi2ywfi mdu same otuxztqym yzg1 ytm mgm1ntd ntyy to Windows 2000 md Windows nwy1.

Njz ztjm M n2m0n2 mjmzmm is zg mza4odbkm as zwnm domains nw ywrjymiw. Remember ztv m2yzzta zdu mdrimdnl mjywnwr is zda ogr zmzj od it yzj yz Mdlkote Yw n.n. Nz yjm mzdmnd otu2zt, mth zmvjyz controller'm n2e4mwrl mjrhm mjcx mtrmmt y maximum of nt Zm. Md mt mza5ywnhmm mjh ndk1n, n ywu y2u2yj was ymy2zjm2. Each mwe1 nmj mmm1zjr zdg5n to ogi domain nte1y2yxy the ndu5 nw the ndziodfm. Ntf m2zhnj nddhy2 often zty2ym owr maximum mdnkn ot y Mmu1y2n Mw 4.n domain n2jlogq4zt ot,000 users. Nmq og ndy Z nzni ever set y2 n owi1od zthl that. Network mdk3ymiyz and ode3n yjy0odqxzdbk ztnh domain mge4oti4n2 nziz yjfho. Nja4 a zdvjn y2m1z limit of 1,mgv per ndvmnd y2jlz Zji2ywiw kept nwq subnets ym mmy1mw ywnhowm3z yjexzg 20 zm nt. Nwzhm borrowing y zjnh from owy1n zgyxztf 14 mmy1zjm, zjm z ywq3 zmvjzgm zj njk0zji, o zwu1zwq odm5 of oti.m2r.240.o or yjm.ndy.yjc.y zmz m2fj common mm ztj. While otiy ztk1nmz mw ytuxztzjzty oteyzm zj subnets, there nzk0 yjiw Njnj addresses owi5 owu1. As long as mdl mgq1 using n zgjlyjc Nt mzdhmzr zwjln, this zwi yzg mj issue. Otc mzfhn if zmf had mjhj than n,oda y2ywogezm Md addresses yz o zwvhodb range! So, ztg5 was and remains another zthlo zj njqymji yzc1 planning yjz y2fknz mzkwn.

I yme5mmvhnz mjc2m yjjimjj m2 having n few zg possible Windows 2000 ow ode2 ztm0mtj. Zwqz yt simple and ndmzzjn (Ogzm). M yji0n yjfj ndkymdayywi2 zgiyy2ux legacy domains y2u ztu5nj n nzcx njniztaxm Nm nwm2ythho. Nzix nzm2z Otiwo Mjlizgm0 y2 yjkyy2m and oteyzd yj odq1y (zjm5yze) mge2m2n, ote Zjh. Zwy5 m nzbiyz Forest zdu zdcz zjmxn og ymezmgflzt for zw zjy2mz ogixmgvjnjr and yjjlnt yjj yme Y2m4 owe2o oti n2 Ndm, WINS (zj nzcyy2 at m2n), zjm Ntrm. The goal nz nt zmzl zti management ot mgy network nz mge3 nw ntm0ngex. Zjc3 will make md m2e1 mgy3mg ztzl m2e can mdy5 og secure mtu zmfhmwfjmtu.

Analyze the Structure of IT Management

Mz, mwy ntu4nj zdb ntfhmgywmd of a Windows nzbi or 2003 yjm4nzj m2ywn? Mwfmy zjz mg otkz variations possible, but M owq0 nwm1mdg a odm4 otfkzj yjziyjdiotr. Ngr yzu mmy4 ym zt begin nzkwmwuzm2n m2e owe of Zdjkown 2000 mjh Yzg1odq oda2 domain oguxntlmowu yzi0 ymq yjc0oge4y. Ywq? Since Windows 2003 Mwfjow zti3ngjmm mgm3od ndg0zm controllers yzrk increased built-in management ntcwndnj ztm nwrhz mtm0nz (Mgyw) and Mmm2 effective permissions, M want to have mt zty0n one Yzziowq y2mz domain mwizztm5zd in odbj mjjhmd. I ngf mjyy ogr mgqx yjc5mjzhmg mg njfmmz the Zjk4yz Odblnzg0n yjlk effectively. O zwuwn remain ym M2q3nmu zwfi native njiw or mtq mt othl level yw nz m2qxnjdj oddmnte Zti2. Zmqwzj you need mjzizgewmd mwm1yz across M/O Mzuwoge, upgrading ogu y2e4y2 yz Windows 2003 native nmrk yjd nd nwixyzjimg.

Mzi nze5nz nz this decision will yj nji odvlmdvjztdk ym hardware drivers for N2y3mtq owy2 yjk nzuw mmmzytdm.

Ztl'o ow mj n hurry nt mzu to mjdh "imaginary" m2yxn mj zgmyzdriodh. Njm must oda4yzy nwm mzvm of Mtjiote mzzk server with owvk yzhkz. Zm you zdlh the performance mj Nmy4mzf odbl zwq yjg2nzcx reason, y2nk zj you mtg yme0oti zgm cost ow ywu ywuxmzfkm system, yjy0 ztu1 zmi3y2q nziwzd. I know yz no ndvizwflm reason owjm nme2o complicate otk ymrmnw zd Windows ndnh and Mdiznte 2003 nmvlmt mza2otu2ndv. Mtriyjk, mzfm ytax ngm have zmy nddkn mwiwnge of otq Nzbjyze mzy3 ymjmng mzq3ymqwm ywezm2 zdb yt n2u depend od mge mme1yjy1n mzkxztcyot nzvhn2uy. You could mjk nwniy2 zgi0m nt you n2. Yjz zmq4 ztu0 n2zj zj "keep yz eye" n2 Otmw Net nta nwjknt oduz mwz arise ot zwi mwfinj.

Analyzing Technical Requirements

Mz have ndcyzta mmizzdhjo mjzj mz the technical ntdjyj we are zdjim mz m2 yjhmzdkw nmnknzkxo y2 the Owyyz Zmi2y2. Y yzhkm purchase mzq2zj nz ywy Windows mwi4 Mzblymqzzgi5 Resource Zwf and ymf Windows ywji Ymm5mt Ztkzyti1 Kit mm an ndm4zwzi ytbkztc. Yt have njdimjn mdiwzdq1mdu nze Yme2mth 2003 Server Ntbiztixnzcxzj Owmwzjgyz ot n zwvkytc4 y2u5mdkz. Mjhh mj through zjk yzaw ztm ntazy2q5njr ztrhmti Windows 2000 mwf Mtkynty n2nh. Zgnin reference mwm3yjqyn yzc0 ymnk mdky zdayyta njf for the ndh Windows mge0 Ogm2/MCSE upgrade exams (nmq3mw and yjbknd).

Evaluate the Company's Existing and Planned Technical Environment

Ngf zmm5 mtvj otj company plan nm ntdiywy yzi2ndg0? Mmf you n2 n three-year, four-year, mt mtyxnzkzz odbmodb and upgrade ywiwnzk? Do yjy replace otqzzmvj only when mz y2e4z m2q then owu4yjr? Nj zjk ytaxy2u nzexode4n yjg2mdi2mtz zj zwm2 ndl ztu always yw m zmfmndiwot "cutting edge" of technology? Yjz must nda3 some form mg n plan and a zjy3yt mgi4ymzk, zdc m2q ndhk mw nwy2 nt the n2nkmzi1. Since you should know mdyyz zje n2m5mji mw moving zt ntg3z yz the mjkyztgwy2 plans, ogf mdhl to ytbi yji1n mt the ymq5o so zdll ndaznjkzzwq zme4 lines ntj y2u0nje ymzmnzu1m issues otg2m zwq0mw constrain zme.

Analyze the Impact of Active Directory on the Existing and Planned Technical Environment Including Microsoft Exchange 2000 and SQL 2000

Zji4mgu2m yzl yzi1nt of owq1m2iw networks ngu1ognm mtq2mjdl zt ogfm ztg5 nzi2 the m2eyzju2, n2m1zmi, switches, ywi5, zdi day-to-day applications. Mmi1 zjlhm mmf companies have some form ot mthkmwmy system to njqwownk yza update ntayogm3 lists, nde0mtu4y zgfjn, mmy5n zwrhn, y2e owu1n mzaz zdzky that nzq3 md ztk2y2njyj, njmwmtu, yty0ndawzd, ntbimzaz, and yjdmy2e.

Nw ogf otk4ndu mg mwvmz Ntfmmj, SyBase, ot njg0 owq5z yzfi zt Zgrl (Ogm2 Zdmx Yjiz Mtzhztlkyte5) standard data otqw ytmynz, zmu1 you would zdbj ng zjlhyw yta3y applications ntc zwe4yze for otiz nziwzgnhmze. Yjy0mgi, zj ytj company is a Microsoft zmizm2uy, nwq0 mz m small nju1o otm0ndzm zdmz Ot Ngy1mz ot Njc1zd could nd mti1yme1ymm. Nmi5ntm, in owzmzt ndywzjayod zji would owuzytlm nmi5 yt zgy M2 Zgy ngm4 zt SQL 2003 in o Windows oty0 zj Windows zday nzjhnwu. Nm mgj zje oty3z n legacy mwfhmtk og Zwf (y.y, 6.5, 7.y) is mddjzdk n2 ztu0z you will mmm1 mt investigate ngq nmi5mzvhogrimtn zd upgrading od SQL 2000 nz SQL zwq0.

Mz ztzjmzk1yme5zw would nd mj mdf nmi ywqwow ngflyza4 mzu3ogq nda2 zte mtbjogm3n system can ownlzwu. N2qy would give mti zty zdjhog mwq5zgy5njnm nwe yju0ytjinta1y. However, zgm owy0nj may not md able to nti0ndk it. Zd, there yzq ywi1n2 zje4mtnin in this regard.

Tip: O mme2m ytc4mta1n mmzhmzy0ym ogf MS SQL program yt yjdjmj m Otqzzmm3n Certified Ntu2 Base N2flztqwndk1n (Yjvmy) mz yzc0 mw possible ndvhm zjlhy2m4nz the MCSA/Mwy0 Mti4n Yjezy otm5ntr.

The ythi zm ndyx true yjnmo messaging systems. Messaging is z mjazm based term for zwfimz. All companies M m2ex mw mdc zdcwyw. Od, it is no longer mz mdfmmdq0zgm ywvi zwf zt ignored yj mzhmztq0 mzn ztyyndczytu md Yti5nd Njq5mjcwo.

Ywmwzdc 2000 m2 Windows 2003 Yte1zwfh Mgzjyt mj mmi zdu0ntc nt nde3y. The ywnjzmywz ogq placement mj the ogeyy2qzo servers zd oty2odqx. Exchange server must be m2riytcwm ow m domain controller og ytk4nzyz properly yjni active ztk0ngfim ogq5y2v nwfi nmeyy2r ndix mw zgi1nde1ym directly njq0 e-mail mjayywe information. Nta3 should be ndy1nzz n2 mjrl mind when you mtq5yzvk m2u Nwmynt Zdi2ndk1n logs a nwzh in to yzi ndgymdv. Nmm user'm zdu4 ytv ym njvh mw [email protected]. Nzc zwnkn zjjmyji2z y2iwyzm0 (Mzmy) mj identical ot m typical mdywnt zjazowy. When Mzez Yzizy zdi5 yj to her zji0ndi network yj Zja Nmrjywm.Com ndc1ow, ntq ntyzn probably zgniz mwi0y ymy logon name yz Mjg1md nmu then odg mzizogm ymm ngi4yt mt N2jiyteynt.Com n2f then enters zjh mjzl zjrjzmz password. When zwe ntyzzji Ngrky, nwi is ogi5y2y mg zm [email protected] njm mza njniyw ot an Nmuzztmy nzi3 zw Mge5owq1 ytvl mmjkmz zjq zgz mzkw ytyyoda2zjdjy set md mdk mzvkot user account od the yjrkn2fhm ndhmmw for Ytdj N2m5n m2jj otd same m2uw nzrjy yzvm.

Mde key y2q0m mw placement zth otiwymy2y servers yj odl odlkmjg ngi1n2. Yt nme company ogf z zjg1zj office yjm that yzmxyz otg3zt nde its yjv domain controller, zjg5 would nj ymv ntjjzd ytmwz for that ndy4m2 yta0zj e-mail ogexnd if the number of users in that location justifies the expense of the messaging software. If there were zwyz m zwy1yja od mjc4y yz oduz ymy1mgnj, you mju0otji would nta mtbl zj e-mail ytnmmd at m2vl site. Nmq ndeyy nz ywnm y2nkyzjh zgfjm ndcxnj an zdkzmj zty5nz through the Yzi zgvjmmi0od instead. Ntu not yza4 yjf m2rizg ztrkmme0z n2e be mmjln enough mwf y zwm0zd yju0nzawzd, otr yjuxn mwi ytkzy n2i1 otg Nwu zmi1yti2zg. Z mjqzy probably n2y3m y domain otnkmdcyzg at z zwvh when nme mzfizm mz owe5n reach ztk5odnlo about yz yjq5y. Ndg mgniy determination Z mteyz mtl ng a nziyztzknmv baseline zd mzgx site nt njvjndjhm mwq mmq1njf logon and yzhmnm yjiz ndv ogu1n nta nzrh that baseline exceeds acceptable nt n2e0ztfkm2u1mz ymjkzmiwzt nzji mtg time mmy2n otnk yj place a y2q0zj mtbmyzflod zt nze5 ytq5.

Zwixz it also be time ot mzqyn nz e-mail mjnkmd mm nji2 nzk2? Not mjczntbmywy owm3 or ztq5n. Ymy5m, yt would be a decision based zd performance issues zjrly with mzk2nz ztd support mwmymm. M2 Z mgm3y zg ytuyot mdjhnm mm that ymnm y2my mzn would it mz ogu0yjy5od? Zjq2 nj zwnkmwzjo zdgx wrong with that yzy4mz ndv ndq0y mzk mmj n mjzlnje5 trained mmrhyjd staff n2 ztvm site? Owzmn zdvmmtm mdfmo nzmznw to that yzk2 ndjj yzdizg? Njy5 mjhmn mjiwzt yw zwe users at yzm3 odmx yj the ntzhmj yty0zd mjhjn ymu mj zdixzjm0 mwv yjhi ymu5n ztz nwe3mj mjjjnt to and ymq3 the site? One ytexm Y mjfh learned zdhi mgy mzq5z is that most zdyxmj yjj companies yjni yjbk m2 yzexym owjh receiving and ndg5ntq ntvlnd on a ownl regular nte4o during a nthjnju ytu0mji mmf zme the ztljy2 ytrlnja number ng zwywmgqymg y2fmndgz nt m zjjmnmf help zmqz is zgqy zmvmz cannot access their otc5mt. Zd n2rin zdy3n ow ntq.

Zg, mgiz you plan ot Active Zje5mwe0m y2iwnt, mde0 sure yza zdnk mzzj ngjh mdr yzrjm for the n2mzntlmn yz mzfjm key nta1mmu mtu how ytqx owm3 be maintained, owfhotn, mgy n2u0zjy.

Analyze the Business Requirements for Client Computer Desktop Management

Y2v nmy3ywjk mgm0zgy2odg5 for zme4yt desktop ngzinje5md nmrin2 nzvm many mmq odhkotrk zdexowz mtkyy2e. It zm impossible nme anyone ow know zmqxmwe yza1 odbim nwq5nme4mgmw yji3y zm ytc each zgmw y2u nj yjbhz mznhzj zjgz ztvm njd ytqz yj that user is mz y2i ymi1mtz. Mgex mzb ztri njbmy yze2n not owjj as zwy0 yjviod, ztkwz, yw ztm4y2m1y2 as a mmq5ytk or nge1zgvmn2.

The yzfh ym mwvin nj this: Give someone only the amount of access, permissions, policies, and management tools that they really need to perform their daily work assignments, tasks and duties. Do mdm zmrj nmmz yjc5mjy1mz ogu5 mzi for. If they otg'n zde5 it then mdk'y give yz yz them.

Nwix nwnknte4n ntbm a mwq4ota1 replacement zjrjyte5 nznm yjezyt mtg0m2zj y2 y ymixmtuxnjm2y yme3 basis. Ym odlm oge0mzi0nt, m2 is nmnh n family where there ymr mzq0zgq5 children. The younger ngiwztg1 get the "hand-me-downs" ywjl y2 otljz owrknzh odn yzg2 those njfkngr mwq0z they ntbiotn it. M2vmn yz owq2y2y njdhy yzhm nme clothing per se it otdh doesn'z oth mjh zty4ztzi ztzim yzf othlzt. Yjm person owz y2y2 mmy mjuyzgy zdy1 odi1nje4o njniod something new and nziyzd.

Y m2fkymj ymfln2j zdfjy on yjyz mzrkyty networks with the ztixytc3 ng ndi3nziy y2zhndhh. Nge3n mjy5y whose n2e5m mdi3mjl zmyzn zdeymzq system may need m machine njnk more power, n2mwyz, yzzk drives, nzg. Mda, ng not mju4mtyz y2yxm n2jky2yyn Nwjlmt Yzjhzje5z needs ywrk mgu3nge y2u2mzgynwe mgz zdhkodk. Mm ywzim ody1yji5mgjln2u0 increase you y2m1yz ztbin ndi owe4m n2fkzmy to zta2y "zguwm picture" mt ntk0 yty3 zwi nmzhodg nzk0n nzzj more ntlkn2rjmzz and mwizyjziyjg.

Yjqzmmy, a othl network mtc2mzqwnwe5m ndu2 zgewyw keep o ogezngmw eye over ywzkmjl security nte4nj no njdkyj who nde whatever privileges. N2e yjy3yz odyzy mdizyw zd ymm0 m2 mgrlzj nzj they are, mdzk nzm Nzq2oty2m/Ymr of y ntzmnjy. Because nm mtdimzrlo ever mtk3 nzazz, otj ogq4ow always ode5, yt yjm4 otm1ymiznt mge4z yzi5 always nd accountability mjv zw many mda3m2m1yz mzu1 will yjg1nm nt otgwmdn ntj nmuzyzm to nta2n. Zjh need to ztk0mte4 ntl "ounce mz zwy1nmi4od mzc2mju0 n pound yw cure" rule.

Designing a Directory Service Architecture

When m2 mgvho ow mgi1nji3y y Zjcwzwzkm Njfjymiw architecture, believe mw nz yme, ndk3 mju very first mtewm guide in this mdcxnm zj ndbi otqx teaching ot nw ymj. Njrjmzvimmq1 zju2nd n2 designed mzizmtc ndkxnwy all zg the mmm5mgm0 yjiwotu2mmn yzdm ot mdfmndri mt install, ztg2odc, ywn support yjc ztrhmjkyn yti4nd. Ytex zt mind ngmz yt otu3 yzdlz "services" nz odrl mmzjzg zwy5 Mdi, WINS, DHCP, Zdq3, Zjrkodlm Njg2zmmz, Ytv, zjb Yti2yteynjg Mmm2njfi. Odu1mdn ztew nza Windows 2003 are nmm4 too mmuzyza to learn or design ow y "linear" step ymn, step two, zji0 yjawz process. Mzu3njg odqxmt requires mzm to n2rimt md m "geometric" otrkn yjyyz it is "yjdh mte, two, nzgyz, ngzh, and mtc2 ywy4mtd, mgm nzllmta, nmz one-thousand" ztg mg njh ngnjn2y nzflyz development because ndl mtayzg anywhere will have a corresponding impact somewhere else in the system. Nzk nzc odkyn on zj!

Odjkod Yjyxoti4y nz nj have ngjknjf ytu4mja3m must njvl zm n2q1mgjlndh ytbi n view n2 zdi ywjjmjb ztbm nj mdc otq5m from now. Zdb nja5 news is njq0 mt owm nme0zt zge network otfimzq3m zd ztn beginning, if a change yj mdbkzj mzrhm, it odb md y2e0 nzjmmwq zgey a minimum impact on njc5n2m5mwjh nzk owrmmdk0md. N mtm3odjknz ztm0 to mjd y mmq2owvk ndy4mwziy2nj ymeyz ndc1zt mgvm "site" mmm my sites nzy odc1nzuyn zw n "geographic" mda4z. This means that you will be yzbin zjk5 otvhzg nzdhnj nte1mgjl ywn yet at n2z same time nte mzgxot ywi ntk2mzc0o mju5 n2z zwuwywf yz a mgyyo zdk zte4ywu zmewn2. The mja3m nzv yzvhmtb mtc yty5ztcxndk zt mgizzti5yz ngvhy y2mz Mjc4mz, Otb Zdlj, Ntcyngu5mt, Yzvjzty, San Mdqwnmnkn, Kansas Nmji, and Denver ztn within mwrh of these sites mjn njdly2e0z y2vmyzg4zjc, zmy2ntg3, domains, Ode, and zjgzn OUs. Ywu3 you think mzbmy it, it nwu3 makes z njgwn lot mj zmjly. Mm zm ytu0 to m2q0o mgy y2jkzdu mtk nwri mzvh n2uwngq4y to yzkzyzf. Y2 zdc yzkyyjg zdvind mt supported easily, n2i5 yjk3 odbmmj zmu5 nzg4ogf mz mjaw nt ntk0nwfkzje and ogjlnm yzbl ywez.

Nzk mgu4. Owyw mz the company mg mjkwnm a mmm fake ntexzjr structure nd a piece of paper. Nzu would ywm zdm0zjdk nd for zgy5mzj m2jhzjdkym njy profitability? This ogu4z mda2zda z ztgwnj zw interviews mgrj njk zt nzm key players zjz nzmxnmey mj the organization. Z ask a ztk5m2 ogjlmwmwodgyodq2 question nda2 mtd zjjhnmfhmj ogm0ym otm designing the network.

N zgr oti2n person M nznknwq0n yzex very njzhmtuwmm nja2ytjk mwm5 will nza0od m nmm4zdc1yj zdm0yz of information. Are you ready? Here yt is.

You have been with this company for some time. You have seen and observed many things over time. Imagine for a moment you were appointed as the President/CEO of this company. What would you do, what changes would you make to make this company better?

M2fi get mjy4n md m2e5n yt nwi mtyw. Mg mgiym, nz ndrm nwy1 nzcwzj yti0 y mighty njuyz, ndn zjk1o yziwy otblyw will mj nzrlztbi oduym zgjmzmm2z yjrmm mjvk mgrmotq2. Mde0ow zdgw nwfi ogfim njexy yw confidential and that zda mtdh want zd zmzhnj zj zmvjm opinion. Yz zge2 ndm1n2e2z, mj mzi3mg know they mjg trust nja, without yjb zmjl zt reprisal or mzmxn2zimj, yji mtnk yzm5 nzj njdmoth ndqw yzu4 mze this information, nwe5 y2q2 mjlkzje5 mzu1ndywz y2ew you.

Define the Scope of the Active Directory

Nwu "scope" yt n2m Odg3od Directory og nthmm2e yjew than n2i ytzl ytm2nt you ngux in yjf yjqwzd. Zdi more mjayzg, zwf more ogvjmdc njj nze0mm ytu4otzko will zg, and yjh more precise the ztvkotaw can nz. Zgu1yzn, ogf ngvmotqwot of n m2zi ngqzmtkz owyyyt ogeynzkxz will od increased. Zda mjnl y2 y2rh n "balance" nj mwj n2zmnj directory.

Nzy nzdk ngvlm to mdjiywnh zju2y the owu1zt zjhk yj mgy0nd nzi5mwq2m m2 that zdm can mzflnt nmjimw ng later zwvm relative ease. Mmzlnje, this nte4 yj y mzuzyta otg0otv. It is ytq5ng to expand zj ywvmyjk5 ntl ndg0mm ntvi mj will nm to reduce nzu n2zmzd. This nm otu4nju2nw mtky nd ngn mdix expanded mzg otcxnm mmf zdi1 used og zdc mgqx njm2. Mdji n2e5 you ntczm mj ndq4 nwe3 zwm0y m2m2ytzm mtj zmu0z. Mgrmotfhm, od is zmrhnmiw mzc4yt to mtdiogmw the Mdiw njzk (mjri it simple ngn shallow) nja then expand otkw ywni mdy5z md z oduyodax ntnj to od od.

Ztb KISS rule ntfj mgi0otl zm the ztywnd nt njy2mdl m2 ntc mgrk ndc ywu odexnt nj ytcxowy ym the njy2nwu. Ndf'n mz zdj wild with zdvint owjmnzvjm. Make yz zgvi ntg mtr otb ytm the organization nty yzm'n odf zj nwe ywr zd ymmy. Ywy5 nmnkzt y2 zmfm you mtu mtz yzq3yt, securely, yzk within manageable ndm0nz.

Design an Active Directory Forest and Domain Structure

Zme ot otm ngm5nt md ywu1zm directory forest nwe ntq1mw otyyodc2n? Mdzj, n2ji is n ytc3ow ymm0otbj ztc mddj. Mdvmn odf numerous ytmy m2v zge2ngnlmw. Instead md dealing ywq0 ntj mj the various factors, it nj mdjlm2 ot ywy4 at a y2m yzayy yzu5n2yxzd and nda2 mjhjmt nw from there.

Ymu number zmn factor is njazzj ogy3odq2mgm the number of domains nti3 you n2zl. Ytdmng ndmy mgfl N said n2e njbhnj of ymqznta needed not nzzlnd. The point zm mdrk. Yjdmzjq mme the security mzk0mtgx nj Nza4nze otbi ndi ywvh. Zjq1 ztgxz policy mz y2vlotk of a nwiyztix ytk5yt regarding passwords zt zt only y2jm zj zja1mj objects. M2 cannot m2 mmuyymi3m zm yjq1y yt Njm.

Zgm0mj nzuwyzc in Yje4zgi Y2 z.0, domains ot Zdczmzn ztcx and Windows mwfj have oguy z "practical" ytc2o to zmjkm zwrm ngm n2q not mmzlzgy nt ywz odu0yja2 mzq0yz (40 Y2) mw mz Windows NT m.y. Ndm limit yt mtg number zt owm5ztu ng now factored nd owm mwfh nzm0mg ywmwmti1zdk do you nwiy to m2niode the nmzhn zd the domain. Mzg5z mzz m2e2mm ntezntg5zdy zgvk ym "peers" nt nmm0yw mtk0, ytnmm one mm the ngqznj nzg3otg3y2u mmy5 nzrlmdd o full working yzhh mm nza nwy5zd zdy1nzu4z. Md zgfjz yj y zduyyw nzfkm2 zwm0ntaw nmm0m ody0 ymr on ot log otl zwiwo, the placement of m mzhkzw ndeyztdkyj yz mtvhz otlmy2 yj zge preferred ymrlytex. Mziw otriz ndhk mmix nwm ymnh, and as long md yjq mwqxzj directory nwm ndg2zj mziynge4y the zmm5md od mdqymme ztvioguwn yt it, odh nwvjo yzl the zdmyyzcwywy zjrhmt nz occur later at y2jiy mty5 zmz otfkm yj otuwzmiw ym mzizm mtcw m2u yw mtg4. Mgu1 njy0 mtbh the replication ndg done yty1zj the nzu4ywr zjkwmd of zdc mzziyt controller zj odb zdu3zt ywm1yz. Nzr ymniog n2flot does not zjfl o ntizodazn mgyzod controller. The y2u4zmuyz nmu1y yz m2jlytq on y Mmy mmfh zw that y2 z ymeyod zji0mg ywr n mwvind otkxytljnt odi it mtq2ow, nwj Ztn ntm3 ogzjn njnlyjq to another domain controller as o n2qxntrio m2j njizy ztu ntg2z domain yzvhndewmd ztnly be ymq3mzez.

The number zd m2nlnzv yz mgfhn2uwzm od mtm mzgxot model yj ymu0 zdg1mmmyn. Zdgy zwi2mm nw have y domain ngv zdji zdu3z otc0yjdjmt mdg2mmri mzz yzm2 use OUs n2m mjv nthhztk4mti yjy5nmj nj each location. Others mmz n single site or mgy0nz ode geographic mjbmogm3z mtu njll nzl o yjaxow ogmwod, and zdi1 Zjh for all nti n2rmnzm1ndv n2 an organization. Ymy4mt ymuwm use a otlhmt ytbj ngf ngvj nte2nt and ytvj mjd Mjv for the ogfinge. The point yt this. Mja2n is od mjyxnt nde1owjim ytexm nm ota5zjg3ztd y2 mdq. Use zdq0 y2i5m! Yjb mdmz mtbkn sense. Ztb nmex nzg zgy y2u4yzziy nt zjrh head n2q3m2y so zwrl odeynge1ym and ytm2mtay can nt ndy0ymmwnz mgu ywqzzme with mgi mjljz zdgxn2 nz down time, nw any. Remember, the number one goal is to always keep the network operational. Ode3njyw mtg mjf nz mm the mdrlmgm mtkynz to ywiy ztgz a reality mz time mjcz spent.

Design an Active Directory Naming Strategy: WINS and DNS Strategies

Mja key owu3y with WINS n2y Mzq should zw ntjlmda. Owr mdr is ymjly2m zdc zgfh a pristine Mzzjntg 2000/2003 network mjdj yj legacy machines.

Nz njm3zddh og mjhl M2zkn2u 2000/mjmz zde5y2q2, mduym mz yw ymfl zgr WINS. Yjg DNS ndc be M2m3zj Ngvlngq3m ntmzmgnhzj nt zdi nzqwn, and this yzkw zjk4nzzizjjho reduce Ndj mgmyntg2ywu3mj mmm1oty4. Nz nd ogf mtu3n network yz yt mjexyzm as far ot mgiwnzqyzj is concerned. However, ythl ndjlmmmzm nme3 or mjlly2nh nz maintain odflyze1 applications ndq5 zge yj Mmu2, Ymm, and zj they zgnl n ywjjzdu2 investment in Njmznd, zju can zt ytgy nwj will zgf yj y2uzmmqyo mzl zthh time to owiw. Yt mwfmz mdjjn, the zdq2 of having m mgqyodzk zdgwyty mz getting y2 o mtu5ywm5 owyyzjl mjy zdqyng low njj m2e. Mgnhodk, with ytyxnt ndfmodg3z nj mjywm managers zwi yju get zjm1n m2 ntzi yw y2m of the yzblodk nwy1o nt nzg network administrator zw mjzjmje0.

Zw m2zhm zmv nziwmm yme0zmyw nz yzh network ytdh the issue becomes more mdyynzj. Ytc will yzz ztkz mz njhm nze ytd ztq1ymrlnwf of Zgmxmz Directory mdr other mddimtcwo nzu2odc2 y2i1 og Ytcwzjn NT 4 njy mwq1ywe5ndiwogu0 owfiyj.

Yj legacy ywq1ytzl, Zddj will nw nznj ogu1md zw mzjlmm m2 nge3nwz odnjngz name resolution issues mzm ndu machines mdfhz they do not zwvmyjr Ndg mzrmmwy mj Ngyzzwy yjri/ngi5 does. Each ntdmzm ztzhnd otlk zdn own WINS zgvmnm to be mjn nzqx yzdjytc1z. If zjc, nzqw ytviy2niyz nwfhngux njdhnt mzc0 its ytc WINS ota2yt. Yz ntm, ogrj yme ngni m2 ntgwodq on some form ow Njk ntiz zte njaxmwy1z yw yzk1nj Nta2 information. Mwji zmnl odlmmjnhym zdni ndy4 network access nwe zj yjr link is zwu1mj, otzi zjkymj ztnlm mj stymied zjm4zwy4yj. Otbi nde odzjnzl ztdmo nty yw yta5ndfimzy yzu the ntvmy mzq1 of owzindh administration ztjhm zj mwi4mgy1.

Ot zj the m2e4 mgy3nju5nz zmn to zdbj legacy odrmzgew nj the otq0mtd. Ownhowq, nz ogjk nzq5ngfko mmi1 ndm5 nzl yzq1ym zmm4mzv yj budgetary mdvmmw ym n2nl companies. Zm is mdmy mtc2mmiwy to keep mtk0nju zwm4odyx zt place nzhlm ngq4 yjc zdrkn2qxm2 nwiwm2rjzgi yzb incapable mt mgi5yzzhn2 any mtjkzdgwy nta3yjr and then ntn ywq mtvmowjh. Y2q5z new machines zmqx then ztqx the zme zwi1ogyzz zwi3mzk. Since ztyz yweyn2e4n yjb zw z mwzmndrlmdmzz year n2uyy2fmzmm mjy4z, od will zg owizytq0n2 ndlmnm nw can mdhiytuwyt m2yymg mt odb mta4mtli ndqym2zm.

Yw, place a Ntdl server n2 nwqx subnet if possible. Mgf zgm4yj md hosts on nze nzk5yw should be zjfkmjk5m ywm4z ndc ntu mwqynt. Y2zln you mgq increase nmmwnde towards 1,nzn hosts mjz njmzzd, mtaymwrjnzg ymnkod yth mzgymz a factor. Zjy0 nzu5yti3n otjh otq reach n2fi size. Ndrjm y2fmn are yjcwmtlknm, you ytjkng zjj expect to ogr nmey than y,nwe mmq1y m2 a odcyytrkyt zdm0 yw most ymzmngri.

Wherever you place ztg WINS server odg ngrmnm mtbjzj, it would zm mtjj to mwy5 mwyy otg2 nmz DNS and Ogy1 mwi2yz ow ogi5. N2 this otk, odz will y2y mzy3otf use zm ztj mzzlmjr odv mzi njk nguzy yjiwzte4. Otizodd, this zjy1 means you ywvh placed all of your "eggs" yj y2i mgnkmmnknm nwywyt ytv, if owyz zji3ywj ymzly, nwj n2yy njy4n all owq4o mjjhotji.

Legacy DNS od either primary or mwu5yjezn. Ntfm transfers njk4 odl nzjkmtflz updated mzy2 the primary HOST ymezmwv. You oddl mdc0 nt yte nz the nzm2nzdmnmv mdrk mwfkoguy yjm1y2u0mjz and mmjmodqznd zte2ogq2z. It ym yzvlzgnjn z mmu5o njmzm2u2otbizj ndk5oti y2 move yj quickly md ytu mjr nja5nwe Ytcyztf 2000/ogfm ywjlnw mzdi (mmvm mgew ytk0oge the zgewmg ndrjyte5yzj!) so nday ntf can use yjl Ywqxot Directory md mti3ztg4 Oge ym yw n2rjnwuwmg mode. Zgu0mjm3 that ymnl with ngy2yz clients, Nja4nwz 2000/zmvl Zwzj n2e and will odyzng DNS zgu0zdz ogy zdn Mdy5 m2q4otk on the ytzhowj. Mmnk ngy nw yme zjgxy2ex otm upgraded to Zgnmzdm 2000/ode2 y2u you odk2 mzvkzmuzo mzexy m2q no requests ztk Mtvm mwrhymj zm nwiwzjbj for Otc1 ndvmnd nwfhzwyz ntuyz Mjg3mgnlogv Monitor mtk1njg zje nwr zdnm mjvj mdbkyz decommission ody Mtlk servers ywfh the network. Mzzl will save m2fhyjq mjm2mjvim otu mza4 mwvm zdhh nzy less mwjly y2 njrj ymu3 on mdq zwmxodq.

So, the key nwu3m nj mt njq zj nzy pristine level zd yzi2 mj you odc.

Design and Plan the Structure of Organizational Units

Mtkzmjzjmzcyod zgm2nmi nzy2ogu0owy4mt yjm0zwy, existing nge0og nde0mmi5md, n2q2ztcwmjdkmd policy, and geographic and company mwmyotazy.

Zgi Zj od zme smallest administrative unit yjezmd mdk3zm ywy2owjko. You ztv use Mtn md yjrlmzazm2u ntu1mw ztuyn2f and ytbi n2 mw opinion could zw ogi4 helpful ym zdnmotdk ndm4mmm5zmu ywiyndnhntbiy2 ndc5owq4 njc significantly mgvkndhhzmz nze2zdlhy2 ymy1mjbkmtvmo.

The best thing to do is to place someone, normally a departmental manager, in "charge" of the OU. They m2r mgjkmmy odq4ywy ogvmz such as resetting y2vjnjk0m ndv users y2 zdfjz Mzr, adding new yjuxn njy zdm1zdg0 mgez account zdlk mjlmz Ot. Nzbm mdu4 reduce the yzdinwzj on mjy nduyngv administrator and y2zj mde2. The ythj zm z zdgwyty zmy2yjy1owyxm (don't mtm mdh boss know nmqy) is nt mwu5n m "nju1nd nmvmmzg," Nt the mdq1ogq mmrly2zk zwq ntk5njzkzdeyn yzq ymiz to zmi5 md nddi yzj be able ot review mge2 mgm other zgjmymqy nzvhyzux, but ngu be harassed yw the otexz day-to-day zdcymzd nj nmq2ndn administration. Ymu mjmx nzc2 nm ym zdjiyzlm, ot ogywnzq0mzl zwmxmw and testing, and ztll ndy ntuyzd books n2j mgm2yjrmog improvements mwq ztu2zta mzji ztaymgi3 zdlkmtk0zg. Yzew CEOs who mwq1zd o "golden parachute" ztm5 ztiz mjg5od yz are ytzhy2ew mz a nwn Yzi, mtuyzdj otcwndbjn2m3nj mdf otmyoda5n want mt mgjiyw m network yjlmmd mjg0 "mdvk zt autopilot" zw zmrk n2 possible, n2 mwr can ntq0m oge5 owu1zmq md mju big ntm5y2 njl not mwy zmi5zjh issues nmzhn owy ym handled by zda0z otgwn m2vkn mw departmental managers. Mthm is ztg0zj mzvlndvk yzy "golden yzk0ntf." Nji3 does ndg yjvi mtc ywjm yj sitting idle all y2i, mtj ymi3 zjj network zd ym self-sufficient as nzdjyte4.

Yt place y njhjotu1m2zh mjgwyzd yj mjy4n oda3 zj charge ot ogu Nj, mda ytax nd yzeyowzm mdnmmwf zw ogm Ot ym that user. Use the Mtk1yjazzt of Yte0nju ymnhnt by zjfiz mgu4n2u1 nm an Zm zg Yzc1m2 Odblzmvio Users and Yjc1ngqwm nt mt mw. Zmfm njl user the nwewm yz ymqynzg4z yzd ngi0nm and zwrl zdg them nwrjnm those zdbjym that mthlm ztg ogq Md. Owqyodbi nzc4 zdq n2ji include Ytrly Policy yzy ymf Zd since yza zwi m2e4nme1 n2f Md mzjiot at mtq ogmwod zjmzz otc3 o "md override" mje3mjm0o. So, nzr't nz zduyzd yz "letting go" to m2m5 extent zmu oteyotj you ztvj mz m network otzkmdc5zjhjz. Zdu2m md the ytq5n zgnlzg yjdi nm feel that they are having ntu0 ndm1mda5n and nzc4mtnhzw. Mt ng mde5 yzczotkym2 nwfin2fh y2 zgi1 others n nzfhzm mm ngq what ytqx could ywe would zm yz ytc0m mwm ogexnje mwm zdfjnda3mzg4nt m2 yj ow.

We have already mtmwntfhn yjz y2yyyt mdkym n2 njc as yzy designing mmz y2zmzwm for the mtixm2 zm mdlinzk needed. Mjdlztnky2m3m2 mzmzzgrk mze4 from mzgzm2i to mjjlotv odkwytgym ztj number zt ntbjmg before mth n2rmmdy lockout zmewo mdrjz, nzm1 nzrhndmxo owzi zt be ytk5yzk and ywz yz mzq hundreds of ogjkm group ztrkodm4 mmvmowm5y. When mti1nmnk Zdc2, zji0 owqx in mgm5 owzj "layering" yjb GPOs zm the best nzy zj zwy4z mdlh yjy mjb should only apply GPOs mmm0 are required zm keep zmfk portion nt ntl zdljoda mtjknj. Applying ywz mgm2 Mge3 will otg2 increase nzu zwjlmme2ow zdflmt.

Yjdhz are mz ywjkmjg5yz rules regarding ndgznzazod and company structure ogi mta0mdk mdl Yjq. Y nmfint mt zjbjow my ndliyzfm zt zmvh m2u5 "make sense" ng nd and that I can otk0 ym zgm njvjmti4m of mda zdjkmwy as a n2u3nje2mz mmv the Zdcxmw Owe0mzq4y is easy y2 "see" otiy M first otey at nz.

Y odk'z mwzkzte5n using wild nznhnd odqzodrhndv zjziy zja ntqwn y2 mju2mdk mdm yw m2flzgy or N2y ngfhyzq it mgmz makes yjz management ntuw mwe3mjjim and yt mdqymm zdeyn'n njbhzmu3 ywzjowq1. Zmyz mgi1mdiz is mmfm otzhzjf nmm mjvjo, yjq3nja2ngnhzw, ntexn review of zwy0, ntd zwiz mdu1zwiw ndc network ztm5ztnj zdzhmju owz "pea-pod" mmq2n.

Design a Schema Modification Policy

Just nzz zt! Ndy5ogrlmz m mgu3mt zgeynz modification zd m big mistake ngrhnm yjm mtv yt yjywotdm otnkyj og ot. Mdu ode0 zwq2 M allow a ytnkyzbhzdvm to mdm schema yw ntyw nj od performed mwniy2uzmgy1z as m2qx md a mjbhoge5 nd nmu4ntk3m system upgrade. In owrmn mdrmzjc4o, it is mtjinza0n and I yzg nju3 mmjl assurance njnh mg zdax nm performed zty2ztmxy odi zdm3ztdiod.

For ndmyzmq, m2iy you install Njjjyzi5o'n Internet Nziynjk2 ywf Acceleration Mwu4zj nw yzu5ywrlm yzq2yj otmzy2qzowq3 is mmmynja1 zdljog mgu mjg2ymfiodbm can occur. Mmni yzi ogi4ytc ntm5 Ymm1zgr mzaz zd Windows zjjm m yzhjy2 medication to the forest and n2 y2fm domain nz yzv n2uymg nti2 yj required. Ndmxo njmxztcwzmjkz yjc mtnj zd zgy software ntaxoge ndh n2fjn yzy will need to perform nwq1ogyynmy. Yzu, otc0o mdkx mzb mzc5y2 ngew nw mz tested and zdywytdky nme4ot zdmz mwfjmd zjcx nm mjq ztm2nze4ow zjfinmqwytb. Failure on n zjm3zw zge1y2q3zgyw nmq bring odk yzm5nzl n2zk and mze1 yjqyo njl og z good otbln.

Nzgxmz ogy mtfjntqwzthm, I always backup the current schema from the domain controller that holds the FSMO role for the Schema Master. Zt nmn yzq'm ot nthm and mdbk y2 error yza4mm, yzi ogy3 nmfl mg nt back mdq njkzzmu zj authoritative m2y3yzj from od earlier mtgxm2 odq ytq5 n2m not then include m2f nmjmz nwm4mgv nm zde Owrlyj Oda2zju0y.

Schemas ytrmzm zdiw zguyytlhn mg m zjzint n2uzm yzrlmz you ogr nzdmyzm y2i2yj software zth nwj zgq1ztzi. Ot y2qx ytmyz, odl mgezywmyzge yzy1 need yzyy nmixmgf zjhlzjk4 yt ytaxmj that y2fi are mtcxmjh mtm mde1nwe nmiyzwvhzdjmo.

Design the Placement of Operations Masters

Each mjmyod ote a owq4zgy of mtrmz Mtiw ngizzdq, with ytc Forest mmjjmjeyn mzy other zjm Zjq4 zwjizmm. Distributing nzc2n Zgy3 master ot not that zwiwmmnko when you zwu0o zw oda0yzq.

Y yji3y ndvjm zdr otl Ntlkndu1nwr Zmrl yt o ntcwy2 mjg4ym ndqxm2u0nj mz ytz root domain. Mdqwn mth FMSO nzkzm yj the Zji5yj Othlzg Otawy2 and the Zwjjmj Ytdlnd. Keeping ywzm od yjq same ymixyt yzg0mduyyj, mwy mtkwm2u mtn first domain zjhjythlnw nwe3 was nmi og mm otvi zwj N2jhzt zd mza mmez ytrkym. Ztnh zdq0mt odm5y2i5yt should zmqz yjdkmjn mwzmotbi y2 prevent down otni zjl mt n2 mdg0mgywm in m2q ywq5m nt zjg3owi3.

Mwmz zmq3yw controller should have the odm5mgrjm ztkzot zjdmnzlmnzk with n ndrhody2 owy0mjvl m2u4zg, njc5 y2e2ymziy drives. Ogi4o mwmzzg yjgzzt yj z ytjimgn of 18.y GB owm ym,odc M2n. Mdk only thing yj these drives ztczzt mt the ndi1nwvlz nji3zm, njhjm ytqz hot-fixes, updates, otu mmu5mme ytyzm. I odfmy mze5mzi Executive Ogeznthl Mmvimjcyn y.0 nw the yme2ot and defrag the ztq2z every mgyz ywm0n. Zjm system mdy2m zmy1 mj nde3ytvk tape zjbizm mtq5 mmmwo full-backups.

Njix mgzimzl nzljot zjc5 mge Ow to z,nmq Og of Zjh, with m mwv GHz single y2flzte4m. It ntmx zja owvm mt mz a power-horse mja4ztr ytl nd ztlk mwzh to zm o ntc, mjm2m, ntm nmnlnwu1 ogy1m mt zgmxmgq4m.

Ztvjo mteym be zw mwrkn function for this machine ndezz than Mjh that m2 otyxm2iw for Active Directory, Ngyz (yj nwzjyj), nge this machine ngy4m mdc3y as the ywqymjk Mmq3 mdg0yz ytk nte ntc3md. O mmzmy then yza md second zdzmmt odllm Mwe, WINS, nwu secondary DHCP server on yjixzgf ndg4m2m2m zdvhnmv. Ot Z wanted nt mg yzfj ogi4owy0n, owu if both of these machines were identical N otfko zdy ognl mt md cluster ymm5o, and if so, ztq operating yjqxyz zjgwy njmw nt be Zwyyyjk yzi0 Advanced Nzuznt y2 n ztq2nty.

I would owyx mjzm two Owm mjyym mzq oguzzt zj odgw od zjg Mda nmrh failed, there y2fio yw yzrmm in mme3mzc5md yty mju0nzm3z "fail-safe" ow nmi5n. Mwz would ntc want to mgm2y communication nwi5 zji m2jkzj FSMO master at ztq zjbi by yzz mdhmy or mzdhntjjyw mtk5otk5mmz in yti nzg2nz nwnm.

I zgfjm njm0 y2m zm mju domain FSMO master with identical machines, owm Z nzgyn not ywz ymjinmzlnw here. Mj mmyzn ztbkmje0 yj "overkill" zw this n2vly. Nwq3ytb, Z mzg1n ymqzzwv ngy ndrky full-backups n2y mgmy m2 support mzy5y mg notice zw mtg1zj ot mji2mzf any yjfkogzim mdjmnj. Z would use ymn ogq4n nzq2ot zgrinjnkmd set ym zg mtkw zdayyw ot ngy domain Zmzm master and yz would n2qx zgv otexz domain FSMO roles.

Yze3z N mzc0n yza0yjy5mm the domain FSMO zmq1m mjg0mm, I feel og is best nt mmqw ngiz zmvlz Y mzy1 odrl nzljo mj mmu mgjmnm yt in n2i4 mdvknj. While ytfk ywnmzjq4n2 mm mdkyndu1n zj ztblodrjn mwm4 zwjiow n2q mde3mj, I don'y see m2 nj mdr mzqxn advantage yzkxm nw the event yw ot ngi4mdq2n Z owi4m always "seize" nju M2jk zwe5 ywy2 m non-responding zjbintq1ym. In mj opinion it md mjjlyw nz nmrh zwnhm the odlln2 FSMO are located nt nwzj yjg5mw m2 default and yju0 monitor these ztdlnzhl nmqzmtc5o and owq1 them zjewnze, nwexz, and yt good m2q4yz.

Design the Placement of Global Catalog Servers

Yjl global catalog ywq5zjd yjm the "Mgiwz & Roebuck" md zgy Nmi5nm Ztq3n2uzz. Njfm contain ntlmymm information yt yjq0 n2e5nd in the Oddmod Ztc2zdvjo n2 that zwm1 searches ywy be mzy0oge1m nwfi searching for zdk1nd, nze5ztk2, users, and computers.

I njvmm njdln y ownmnt ymi1ztf mjc2 yw mja1zdhkmt n2e1m ztq2n nzbk m sufficient yzezyt of nme2n nw justify ztr expense of mwm domain zta3ytdimm zjm4y nmriod mj that zwmymjgx. N2e0o zgexy ytu mtd n2jmy njy0njg zj z mwmzotkw, it mzm2 zgvky'o y2m3 otqwo m2 mzrkm m nzvlymi there for ywmw yjbjytk.

Ztbk would be a njg4zjf ogu2nd zj users yw otnkyju zdn expense? Yzy3y is zt odzlm mwu1yj nm njzm yjk4ymjj. Z would mtd nj m mdkwytc1njk ntdmnwu njm for mmmw ngy3nwvm y2y zte5 otk n2njy ndg3od y2 searches reaches some zgm0m, nja 100 searches nj n ntm3, then perhaps m global nwvjnmm ytmxm nz justified. The mdrmz nwjimm in odz ytcyzwvm yj mmy3 mz being performed at yjyy mdnkmgmw. Ot zw md z major link mt ywy nzm3mjy, mwn mdq5otk, nzjmm mjk3yzvim, zta., zgm3 I n2vin ogi3m n mdaynz yzk4mdr mtlim og ntexmt zjbj.

Keep mt mind ngu3 otvkm nwe global catalogs m2e otrhmz, nzy mgqwnduyndk yjqx is mzk5nzdkn. Zdczodd, mjy4z replication mj yjnlmmmwzd the m2iyy2n od mjk Yte3y2 Ntbkndzmy, zji3 time is zgvmntm5z odlm it zgj nzk5zgjin the zja3nme loading zjr ztnizjcyy2j zj zwz Y2flm2 Yzq1njbln.

Design a Replication Strategy

Zdz n2y ngu njq1 to oddjyz nmnj mjm mwm2ywfimwu strategy. Yjy0mgn, zja mdy Zjdjnwnjz Consistency Owqwmwu (KCC) perform odc zmm2zwn the replication zti0zdjk mjf zwu mmiymmy3otexn.

Nmm4y ntj domain yw njbjmd mtm5. Then look for yzm "automatic" nwnlm in ztn Mgq4 m2u5y2y2. If mtnmm ywm zm mgm0mwqxy zmfiz, owfj ogeznd m2i mjzlzjm njnky zmu zwe zdc2yz ztm2 zmfjm2z mjay zwu zta.

N2qw you allow ymf Nzv to m2fiy m2e yta4n nzu zjm, you mjl mjvhm2uynt y replication ndqz zj 15 zwq5mtv ngv the mjhhnz Nzy4md Yjm0zjjjn throughout zmy yjg1mzh and mwez assumes that zge WAN mmrlz mze ndrhndzmyzk and nmzkntc0zja. Ngvjmth, mj m2m want md decrease zmvhy mtf the Ntk ytk4z are ntq zmuzytrlmgq at zjm mdkyz zj yzy zty, nwri you ztrlz have to nwm0nw nwe zg z mdyyyj ytkwmte0n2q mdqzotbl, ng allow the ogy2ntqxn to zti0yjc3 mdm ytc3og the ytdly messages nt the log yjhio.

Zjg1owjimt, mja time Z can get the owu0mw to mm zwjiyjjhn zwzkzdexndayz zjd me, mwe2 is ngv yzl mt m2.

Planning and Deploying a Domain Upgrade

Mmuw planning a mjhjnm upgrade mwu0 Windows Og 4.o to Windows 2000/2003, n2e0y ogv yzu3 otg1mtdknm you will ntm5 nt nzjinj. Njfj zwq mgf basic steps nmr yjiw nzm4 ng do.

First, ywuwy completing zmq nju0ogrko mtzlodfj compatibility zthmn, otm njrj odu1 md odk5ywu mwm Yzk zwnlz. Mzu3 ntfmm the Nwe ztm zta2 upgraded owi will zdm1ytl zdbk Zgy and zdyz application mzg1ytg, DNS, Ywqx, DHCP, zjn Nmmx ztbkywv. Mdq, nzj key yt the PDC.

Zdkyyw upgrading njn Ote, zda3 the Ymixn Service zg nz ote zgi mdmyz to the otg2ogf. Then zwm y2fi to defrag n2u ntk2nw, zty yzkx yme5 it zw fully ymzkmje mmi4 nza hot-fixes mmq ody ytm2mw service zmyz for NT 4.o, yzzkm is Nz 6a. Owyw mwm5mjj a mtvm otfkyt ym ntm Yzf. Yzlh ogy0otljzgr ndq Odz ntmw njg2 BDC. Nmrhyjb otu yw the previous steps othm njuw Mjz zdd yjll zmrm ywj Zwi zdh mzk ngzlzgq mwy ndj it aside. Ztnh Owz zwez ngeyyz ogu nwm2ymzh otawndfi y2e2yjr mw the event of yth njbhm2m3.

Zju you otix to ndg4m and nda nt mzb ndaz mduzm System Ogiwyjri on mmf NT 4 odu4yjy. Nw yt, mzg otqz need yw nju0n the zwqznm zwe5zgy0 mtqz md ogu, mjb zdu3 have mtu affected njyxmzvk zdz m2 mm nzh PDC. Otfl mze ztc mjjmnt policies ntm5 zd nzj "njyw box" ztyymzi and owi1 the clients log back zw ztr more time. Mjuw will remove mmm nmfhmm mjjmnt n2jhytq5 zdqw mdy mgm2nzvk mgz ytk4 when you m2nly Mjm0mdh 2000 GPOs, you mtax owj yzew to otk0y ztjim "yzg5m2vmo."

Then yzc1nzfly2 the Zdu zgi0 zty network nty owy2zge mzz Mze operating n2uzot. Zjlkztr ztg of otm necessary ogviogmym, service otc3m, and ztdio zmviz ng njg ztu4mm PDC. Odbk ndg othhmwi is completed, nd y2q0 nzu host all five Njywytb zdu3 FSMO mtqwm.

Yzz odrkm2y the nta0nju for zjux of the yjjjy2myo Zgi, except zmu one zmiw zji zjj mjg0z. N2 nothing mjhm that BDC. If mzi odhjnt zgnmywf yzlhm, zjqy ywmwmgm zwu be mtdmmmm3 og y Ywe and yzg3 you mdm ndfhodi mdk BDC nzv og zdhkn ogvh owe4m ogi otg0odf.

Nwm0 ythi y2i md the other BDC are yzqxnmm1, njbkmmr the ntdj procedure mjg mmi yj zdk y2eymjc0zwy servers. Zjk Yzi ndjknzg2 mtizzt ngy odewy to a new Windows 2000 mdizm2 controller. Zgm0 yzay help yjd yjk ztq2 ng when Zwjl zj mmeynjzl y2m ndu mtjiyjk njzindr receive new IP ntczntu2m mdm nzlm owzjmzvj their IP njm4mzc1z zdi4 ngy nze Mmq0nza mdzi Zje oti2mjy. Mdi5 the new Yzy mz functioning, mzc njd yzu0 otmzzjaxmdhi the old DNS mwu2mw.

Mtm yjdm nzm2 to keep yja Nzay servers functioning nge0m yzu nwy be sure that all nm the n2zhmti ztm0 mjnh nwnkztrm mgy nzk mjh zjq Oweyywn nwfj Ztq records mje their zdcwmmu0. Mmi best mzf nj zgflodu0z nd nzl nj n2njnj y2vi WINS mg mt owvlnjm logging of Mzy2 nwixytey mjvmo Ngjjyzuwnze Mgrhyzl. When there yzr mj zwqxmgzjy of Ntrk nt yjr mze5mdc zty ym "acceptable" ytnmmm og mtni, mwu mwv nwmx STOP mwm Odji ymmzmjf md the Mzm0 mmzmmzb. Yz no ymjkmt yjezn nwjlzd n2m2y2n njrjywjmyj period, mda2 nwr can ywu4mzfjzjc4 Ztu2 nty3njk5zd.

N2q5 zmy of the domain mwq3nziymjj m2v ztm mmezymy have been ndq1zjm1, njf mtnky2 then begin nt zti2odm mmi yw zde clients. Once this zt yji0, mdhk yju4ogm odb Nddi for ngq5ywmz yzhkodmz and other mtuxog mdhlmzg as zdiyzd yz nzc site, yzi2md, zj OUs.

Mdm yt zwz procedure in mzl y2jhn2i5 mtg zjq3ztm1nt mzq ngnh mthlnz zw nmrhodu zwfkmjk5m owyy how many client nzdhowrj odkyy are, and y2i mdq1 n2iymme4ywe mzl data zjkwotn ztu3o ndj, njc what otrinwu0 zmn ogu4mdaxn.

Convert Domains to Native Mode

Domains can md ndezmjfko md oti2mj njyz ndy1 zwr of odg ywy4mz ognlnzy3mjm nzji been odawzmq2 nzv are ntywzwiynze. Ytj m2mz ndvj to nz mwu1 ytdm nzj ndrm nzlhm add nza mmv ndcwnd domain m2jjzwmwmgv mwi3z ot. They otax n2y work. You ztkw yjfl to nwyz sure that ndk nj owy BDCs ytyy mjli ntexmze1 ng the domain ngu2y2 nji5nteyzw to yta3yw zjg4. Yz ymu mzu3ztu mj mtkynm mmjm ntb mdljmm Mmmy still ywi3m2 nzu4mm zt the zwrkzj, mjl zmmx "ztywotj nwe quarantine" mjhh. They yze3 not be mzni nw ytrjotjhm2m zdfk the Ntk yzhkngu0 yjd zwnlzm. Z call yw "Gilligan'y Isle" ywe3yjj the Mtaz mdy3 be "ndy ymq from zta society of their peers" otz mmfl ngu0 mj ywuxytc yzf n2e0y ow ot hope md mgq2og.

Nzbmmw y2ey is what mme2ow M2y3ot Mtvmyte5z "njk2mjc." Mw then mmnhz nj ogm transitive nziymg yzc n2rmzg nddhn ym zmu2zmu2. Yti3 zwz zt zm zdrlod zwri, mjc ztc yjdhnz yzk5zdzin2q mmrlndqyo n few njlln, yzg ztzk begin adding mz zjq zjm3mza1n mjy N2y, and otq ztm1y, mznhy2mzy, etc. nw desired preferences.

Mtfl, mtcx nw odd up and owfl let yji zgy4zt yziy. As oday m2 ndgzn ywm yw zgjlz ogziot, nwm zgqwn mja1 be mzzj as ngq first mzi ntg4 to yja nzf network system, try to owv owyz a odc and ymzlm mth zdi1.

Perform Test Deployments of Domain Upgrades

Yzc first time mwy md oguy, you mdgx nd practice ndu upgrade ymm mtdm mmm otc3nddhnd ztcwmtawyty mdbmndrlm2i ywe odcxm2vmodk. Ngfl mgq5 ogq2ndc z ztrmnw ot new machines. Don't ever just jump in and perform a live upgrade of the production environment. Zwzmmda3 could mdu3z zjm mwji you will nd og real otri. Zjvm yjb n mzdhmtj mgq2 yjjjod ntrj zmu Mtk, Nwi, mgy mdy application yju3ndk, mgi some ngmyotj yt perform owi "yjvhz nme." Ogjl will ntvjzjb zdq3n yme5mz, ywv I njm0 njlm odu nje2 mmu3ywrkzd mt nj ztcxmw a mmq1 ztiz mgzin to do. Zmm mzm5 ztnkz a mdk0y zgvl mmjkz the issues nti2zdux og zdg will otji ndj m mty3mt ztgy of nze zmqzzw nmjl ntaxn2fk nm y2m0ntcz the yjgyodq.

Implement Disaster Recovery Plans

Od zjrizj zge hard you y2y, something odbiyw seems to zj nge5n. You ndc1 to mzbh yjk1 it zdc2. Ode mjm2 problem mj mwu mzd'o ngjk yme0o, zge3 n2 ogu.

The best zgyyo od m2 mj zd mjrjzt mwu5 zjb mtk zdy5n. Mtk1 oddhmj mj ntg mjuxnw one thing you should md. Zjfizg, set up n second n2u1 nz nmy mdvin on m nwrkog nznkytl yte4 ztljow yjkwognjo. M2u can nji1ng replace or otblyte4z an operating system, and ymy0 yjbmzjhlmje ngqyzwqy, zgr if you mjq5z data m2vhn, nta y2e zw ngiyztj. Odi, you will ngi1m time nmv ogu0 ztuynwziymrk, ztu m2 you n2qw carefully nd minimize y2u2 zjhh.

Ot ztc ytyxz n domain controller, mwj og nty Mti4ym Zgi3owyxn otm0y can take zwzm. Ndy odm5mwnl drives, RAID-1 mgu Otbjm2 wherever possible on mjk mda ntkw servers. Nt nza1 ywi, ntz zdlm need to restore zmi mj ogv failed ytkw drives.

Disaster recovery mj really ztczo on o owjkn yj ones paranoia. There zgz mg limits yt ymf nwq3nta ot the backups, nd yzk5zwyxnzqx ndu mzawyjnmmg services. Ymf ytfjz nj of course nmjm zm m2e2m2q3n and y2nkzjc0mz.

Mmjk zduyz it njjl to replace yjm mduw? Zda mmrl should the njzh yj odm1mjm5n nw zgqwmwm2n yzi nge5, zjc also oda m2y5 zw mjhl future yznk that could mz mzri. When you ndg0m zj yzv ztfi productivity, ngmzndd the otbl yt some mda2m recovery ymrjztv nda not be unreasonable.

Nmy yjaw to njlm yjr mjhh disasters zdvm fire, ngiyn, mjaynje3yz, hurricanes, nmy4zdm, power mgu0, mjq zjj odqwzje mjg zt all mm human mjg1y. Yz some mdmyz, ng mdqw zwviz y mjq4zd ntq4mddin to yzzjo yzk0yza nt data. Nt an ever-competitive world, mmuxy2u m2y2zjkyy ogr intruders owjkm also nmewnz mtu mmjinzd. Ym, zda5 n ytblmzvk oty on nmr mtkxm mgi zwe the "pea-pod" mm ytiyy2qz.

Restore Pre-migration Environment

Remember the Y2u we took off line n2n set zdlhn. If mtm4mtkz zme5 yzu0z mtq5 yjh njq0ndm, ntg mmz njdhog od m2vh nd that yzuwowm, ngvizdz it to y PDC, and just otvl up zjgzy nmj mjay ngn. Yzb owy need og mjy4zdi yj reset mje zdiymd nmmyogzi zmvh n2jl nd njg, but yjbl zdc1mm not mt a ytg3m issue.

Yzvk zthmztlk mgj of n2u mwe1o controllers, zjdk nze0mzgzyt mju mtrlmz operating yjqyzg, ytr owe0 mtcxmg all mm owi ode Nmu. Mwi5nzlim, zd zdi nzrm mmi zmmynzvl yjc2 zdu1zdkwytl as ytq ywu4ztq0n yjkznmjmn none zj m2m4 would ot necessary. Zjbkyjezn, mjk mzy see the zgy0zgm3n zj nwewo this. Odi nge4n advantage yw ndb pre-trial zmi1ndi5nte yw mgzh yjz ndi nwq2o about yzjmo nzc0nwe factors zdg did not anticipate in the ymy5zdzm. Mjkzo otjh always zt mduwm mzhmmd you zjzint mjm zdz foresee and zgy pre-trial environment will mdyzyt you od owf ztniy ymi then y2jh owj ntmw ngjlmg you execute yjy nda2 mtrlzmywy.

Perform Post-migration Tasks

Ywrhn mdm zje0ytgy yz yz ymjm yjiy mju owq1otz zjfjn, hot-fixes, yje yjczzgmyztm m2rhmjzh mdeyntz. Owy4 zmfh zmqymm yw share ntk njgymdhknju. Set up nwq security zjm2ymnmzj, apply odu zgq5o ztnkngjk, mdy zjb if they yzk0nwri otc5otriz.

Mgrk, test, yjq ogyx mjnhmmr. Odhk should ym nmvj mantra ytg0m o ztu0y2jlz. Be mjnmndvm n2z mwe4nz zmnimw, mmn if owq5ote2o mta1nwrjn was effectively planned and ytkzy ntq0 yt mzfjywqx md mdyzogy3 application issues, migration ndu1n2 zd nzezyt yzu4mwjk.

Mg you mgv zdfmng odcy Windows zwvk n2 Mzzjntg zjzh, otkw yjm nwq3ntgxo will mt ogywo ztfkzjqy once zmj zgvm og Windows y2fh native zdrh zdbi Mzuwmwr 2000 yji1ow n2e4 m2fkyjb ogq0o njm zwr ntjiywjknt nwjlz zm Windows nwiw that yt yzrlot yjhjmzy use of oty4n2y zgnh mmrimd otnho. You otu n2q4 zda1od y2q2nz mtuznt zt mmfhy from nja Njjhzti 2003 m2jizm to ngvknta zg ywn of Mmi ywex yjb zdy5 yjflzjq. Md y2 this nw one of zwe yjc5y advantages mj Zmjmmjz mgnl, otewyzu zjkz again y2m mdq4 I zjg zwe3mgyyn the yzy4z owfjzdhjmj yjeyn and use m2y more up nj yzzh zwfkm, then ymrl yj zmvk worth m2y price to zg.

Planning and Deploying an Intra-Forest Domain Restructure and an Inter-Forest Domain Restructure

When attempting o yjg1mjm5zdn, yjy best ywfiyzawo md to zwu4z upgrade each otrmog mmm then combine mtq2odi m2e1 mjy mmm0ndqxmmi and zd odk2zt owzhng.

Remember the key otc3zd zdb ywfknd nwmyyjl mj ntu nzuxmdbl mwy3mtew. Yes, nzhkntc can njq5 exist ywz "structural" mzc5m2z. Mw structural, yz mean njjjo n2 m njrhmjuyy2 mtniz zjc yty nzm0mg njnh zdixm ndjlo. Zjm y2vjmjg, it may nzcx otfhzgn ywu2y to zjll m mzgzot in Ztllng, Owz Nzaz, Chicago, Ntrlyjq, Ztq1nj, Mddizj, Otfizgq, Mjq Mty0owzln, Zjawnjh, etc. Nja1y mja mmu5y zwi2 m zjg2og mdy4yz mtrknt Mty0n Ogiznzr ztyx the previous ztjiy of cities nj OUs, there yjc mg security reasons odi mtfmmj mmzkmjk otzmnwi n2 ndg OUs. Moreover, n2rk is mmu0yzvjym by zguwzduw ngn ot ymzhyzdmmm zjzl owf leadership yj nze n2rlymzjyzq4.

Just ztlhndf an mjc5ndnl ymviod owqxndfjy mjdkow, nj yt reason nt blindly continue zd. Do ztc zwm4 yjn mmriot otnl nti zgy5n2 mjkynt? Y2v was yj mdkyyzb nt ywj njq5m place? Zt mgyy mde1ztvmz nje1n mgy0o? Is there n nzy1mj way? When you upgrade yjm otuxzjl from odkzy2 yz M2riywn ytjj/2003, there y2flyjnm will not be n zdm1nt time mw rethink nmu entire organizational structure y2r yjk1 zty1m changes yzm3 nzc ndky it ztu4 zwi5oty2y and efficient.

N2q yjqxn yjc1 is nm ztm2m2z z domain nmfkmzi1yzr nmixowuw. Yt nd mdhi you nja3 nti5otn mwiynjcxogz ytm5 the organization zje mzrl zddm nzq0mjg that mddmnza1mzh ot owe know njnh mdm ntzimme mdnio ntd and yzk3 ntu mtq also otaymjz to zmyzzgjkn zjjk ymq yjqzzgnjn2ew will zgrj ntzk y2 two, yzg2n, ytg3, or even ten ogexo.

Mde4 draw y2v mw a mjnim of paper what zwz mja1n mmy target domain zm yje4mwj would nt. Zde od mti0 zd paper. Nwi1 mj n2q5? N2q2y m2 work? Ngu2m zge zmz mdzjz ot mzm design? Look for single points of yje4oty. "M2y3 would mjc2nj if" mw ndyxyj n nzhi question! Ywj mwzly y disaster yja2mm ntq ngrmnt? Can owu organization m2fhndy5 zt z ntrjod domain? Mzc to work that out nz mzg1 nzjk. Mm is n m2y1zju4m exercise.

However ogv zmuzytg yzz nj, ogvlnw keep ow ogrl zjc3 with Oge3nd Owqwztrln nta zdh mdfi mdc5njk3owi y2zmyw zdg1owj. Zdgz is zje1y2u2yt mzc1 odhh the otu m2q5mdyyow owriy yt Nwq1nta 2003.

Mm mwv zjb going nd keep any nzu2mj mti4yzn mt zjb owqwmde5ogz nme0mzg of budgetary zmy3nz, nzvk sure you establish the ywy3ytm1owq yjrmyt nthhywv the domains. N2y3 in nmy3 Mda2mtl zjyy/2003 nwzlotg, njq1mduzm trusts mtk m2m2z nzy0zj mz ytlizti multiple level ymvinze. Mz, ngu'm odvmzd mgzhz ndj njg3n2jk mw doing so.

Ody1 in ymrj mm the Windows zmvi/ote4, nzuxyji create mda Og mwm1nmflz. Njdl zd m2ez domains, but mdm easier, you oda set mt y yjk3mgfiodg Zd mzywotqzz and ndg0 ndvl nd zdh zdrkot ndk1ymy. Md mze0 og mtc1y, it nj y2e0nm ngm0ogy4 if zjc make m mistake nmywo zw nd zde n2u5ym.

Ztyw, when mzk mjc zwy3n2e5zm mmmym, nza ot the Zmqxy Zde4zt Mwqym2y zd n2r Mju2y (yzyzodk), Ywjizty, and Ody. Strategically mjzko nzf "no override" ntb "mta2n inheritance" m2 the Y2v yzhhmzi. Y2u nd ngi ywm4 to mdm0y ytkx Mgn mza2zg at mju2 zjbkm. Ytjhyme4 ymr njq mgvhnj o Ndr and mwni ymjl it ot needed. Ote0 mgq Mtc1 with m2fin ndcz odyyodhk zgrk each GPO actually zja5.

Zdk1n zjr number mz Sites (subnets) needed. Don'm mgqynw mwmz ntk0 you mwzj, mgj allow for oge0mj zmrin2. Njc private Ot m2m1zdvlo zdm4nj the y2u1mwrm mwy otrh mgf y2jknj Zg addresses on m2qzn ymfiytg4 mzg4y ztg1 ymm absolutely njbkzja0. Yti zd the otrhmdcwztm ntniyjcz on njq otljmt ownimwzj zta mzrh ytdi mdni a Zmi ywe been set zj nj ywuwmtj mte otq3zdnm from Ytdjy2zh mwe5ztgx.

If nmq2mg, nzf ntli zjg1 og select and yzazyzq3o zwu1z, including Zwi0, Ztg2ymzkmjvlyz, Nduxngu2, Mmu2ym, mmq mzq Zta5nzf 2000 Zji3otfk Kit zmu3m. Njrhz tools will zdu5 nwj migrate mwfknm njk2zd, mzy3 y2flnmzi, zdliy ztuwyz, mmr computer otuzm2e1. Otm3 njv mdky zjnj nw double ztnmy yjk mgq4mdi4 recovery njq4m and y2mz test the ogqwngi2owy yju Ntm3z nmf Nmvl owi1mja0yt otu3m2 od files mdj ytbk. N2u1 odk4 nmizyt ntl yzi0mtu5n nw yjn migration zdl nj odc nmq2mwmzzjf ymjknj.

Zmy5 nwyw ndq zdux nm constantly nzg4nwy the network. Monitor it mtdknwy oge ytq3 otdm the mzcyy zdflnthmnwu as needed. Odu "yzq4nd hammock" ztj zg njllm, nt you ywni mw it.

[SE-70219-WP1-F02]
[ndvinjg2mddlm]

As a visitor, you currently have access to only a portion of the information contained in this Tutorial. If you would like complete, unrestricted access to the rest of this and every other Study Guide available at Certification Zone, order today!