Alistair G. Lowe-Norris - Active Directory, Second Edition

"NOS" is the term used to describe anetworked environment in which various types of resources, such asuser, group, and computer accounts, are stored in a centralrepository that is controlled and accessible to end users. Typicallya NOS environment is comprised of one or more servers that provideNOS services, such as authentication and account manipulation, andmultiple end users that access those services.

Microsoft's first integrated NOS environment becameavailable in 1990 with the release of Windows NT 3.0, which combinedmany features of the LAN Manager protocols and OS/2 operating system.The NT NOS slowly evolved over the next eight years until ActiveDirectory was first released in beta in 1997.

Under Windows NT,the"domain" concept was introduced,providing a way to group resources based on administrative andsecurity boundaries. NT domains are flat structures limited to about40,000 objects (users, groups, and computers). For largeorganizations, this limitation imposed superficial boundaries on thedesign of the domain structure. Often, domains were geographicallylimited as well because the replication of data between domaincontrollers (i.e., servers providing the NOS services to end users)performed poorly over high-latency or low-bandwidth links. Anothersignificant problem with the NT NOS was delegation of administration,which typically tended to be an all-or-nothing matter at the domainlevel.

Microsoft was well aware of these limitations and needed torearchitect their NOS model into something that would be much morescalable and flexible. For that reason, they looked to LDAP-baseddirectory services as a possible solution.

In generic terms,adirectory service is a repository of network, application, or NOSinformation that is useful to multiple applications or users. Underthis definition, the Windows NT NOS is a type of directory service.In fact, there are many different types of directories, includingInternet white pages, email systems, and even the Domain Name System(DNS). While each of these systems have characteristics of adirectory service, X.500 and the Lightweight Directory AccessProtocol (LDAP) definethe standards for how a true directory service is implemented andaccessed.

In 1988, the International Telecommunication Union (ITU) andInternational Organization of Standardization (ISO) teamed up todevelop a series of standards around directory services, which hascome to be known as X.500. While X.500 proved to be a good model forstructuring a directory and provided a lot of functionality aroundadvanced operations and security, it was difficult to implementclients to utilize it. One reason is that X.500 is based on the OSI(Open System Interconnection) protocol stack instead of TCP/IP, whichhad become the standard for the Internet. The X.500directory accessprotocol (DAP) was very complex and implemented a lot of featuresmost clients never needed. This prevented large-scale adoption. It isfor this reason that a group headed by the University of Michiganstarted work on a "lightweight"X.500 access protocol that would make X.500 easier to utilize.

The first version of the Lightweight Directory Access Protocol (LDAP)was released in 1993 as RFC 1487, but due to the absence of manyfeatures provided by X.500, it never really took off. Itwasn't until LDAPv2 was released in 1995 as RFC 1777that LDAP started to gain popularity. Prior to LDAPv2, the primaryuse of LDAP was as a gateway between X.500 servers. Simplifiedclients would interface with the LDAP gateway, which would translatethe requests and submit it to the X.500 server. The University ofMichigan team thought that if LDAP could provide most of thefunctionality necessary to most clients, they could remove themiddleman (the gateway) and develop an LDAP-enabled directory server.This directory server could use many of the concepts from X.500,including the data model, but would leave out all the overheardprovided by the numerous features it implemented. Thus the first LDAPdirectory server was released in late 1995 by the University ofMichigan team, and it turned into the basis for many future directoryservers.

In 1997, the last major update to the LDAP specification wasdescribed in RFC 2251. It provided several new features and made LDAProbust enough and extensible enough to be suitable for most vendorsto implement. Since then, companies such as Netscape, Sun, Novell,and Microsoft have developed LDAP-based directory servers. Mostrecently, RFC 3377 was released, which summarizes all of the majorLDAP RFCs.

contains acomparison of features between Windows NT and Active Directory.

First, Windows NT Primary Domain Controllers and Backup DomainControllers have been replaced by Active DirectoryDomain Controllers. It ispossible under Active Directory to promote member servers to DomainControllers (DCs) and demote DCs to ordinary member servers, allwithout needing a reinstallation of the operating system; this is notthe case under Windows NT. If you want to make a member server a DC,you can promote it using the dcpromo.exe wizard.dcpromo asks you a number of questions, such aswhether you are creating the first domain in a domain tree or joiningan existing tree, whether this new tree is part of an existing forestor a new forest to be created, and so on.