FREE Monthly Technology Updates One-year Vendor Product Upgrade Protection Plan FREE Membership to Access.Globalknowledge If it’s a high-risk, high-impact, must-not-fail situation, it’s MISSION CRITICAL! Robin Walshaw, MCSE Technical Editor: D. Lynn White, MCPS, MCSE, MCT, MCP+I ”This book is perfect for administrators who need an advanced Windows 2000 reference. I will turn to it again and again.“ –Eric Livingston, Vice President and Chief Technology Officer AppNet, Inc. 1928994164.qx 11/22/00 11:26 AM Page 1 With over 1,500,000 copies of our MCSE, MCSD, CompTIA, and Cisco study guides in print, we have come to know many of you personally. By listening, we've learned what you like and dislike about typical computer books. The most requested item has been for a web-based service that keeps you current on the topic of the book and related technologies. In response, we have created solutions@syngress.com , a service that includes the following features: ■ A one-year warranty against content obsolescence that occurs as the result of vendor product upgrades. We will provide regular web updates for affected chapters. ■ Monthly mailings that respond to customer FAQs and provide detailed explanations of the most difficult topics, written by content experts exclusively for solutions@syngress.com . ■ Regularly updated links to sites that our editors have determined offer valuable additional information on key topics. ■ Access to “Ask the Author”™ customer query forms that allow readers to post questions to be addressed by our authors and editors. Once you've purchased this book, browse to www.syngress.com/solutions . To register, you will need to have the book handy to verify your purchase. Thank you for giving us the opportunity to serve you. solutions@syngress.com 113_MC2k_FM 8/21/00 3:39 PM Page i 113_MC2k_FM 8/21/00 3:40 PM Page ii MISSION CRITICAL! MISSION CRITICAL! WINDOWS 2000 SERVER ADMINISTRATION 113_MC2k_FM 8/21/00 3:40 PM Page iii Syngress Publishing, Inc., the author(s), and any person or firm involved in the writing, editing, or production (collectively “Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from the Work. There is no guarantee of any kind, expressed or implied, regarding the Work or its contents. The Work is sold AS IS and WITHOUT WARRANTY. You may have other legal rights, which vary from state to state. In no event will Makers be liable to you for damages, including any loss of profits, lost savings, or other inci- dental or consequential damages arising out from the Work or its contents. Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you. You should always use reasonable case, including backup and other appropriate precautions, when working with computers, networks, data, and files. Syngress Media® and Syngress® are registered trademarks of Syngress Media, Inc. “Career Advancement Through Skill Enhancement™,” “Ask the Author™,” “Ask the Author UPDATE™,” and “Mission Critical™” are trademarks of Syngress Publishing, Inc. Brands and product names mentioned in this book are trademarks or service marks of their respective companies. KEY SERIAL NUMBER 001 9TATW2ADSE 002 NF4TRA7TC4 003 CDE3C28FV7 004 DC5C8NVT4N 005 Z745QQE2BR 006 PF62RT652H 007 DTP252ZX44 008 NT3F743RTG 009 6532M977LS 010 SMWR8P554N PUBLISHED BY Syngress Publishing, Inc. 800 Hingham Street Rockland, MA 02370 Mission Critical Windows 2000 Server Administration Copyright © 2000 by Syngress Publishing, Inc. All rights reserved. Printed in the United States of America. Except as permitted under the Copyright Act of 1976, no part of this publication may be reproduced or dis- tributed in any form or by any means, or stored in a database or retrieval system, without the prior written per- mission of the publisher, with the exception that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for publication. Printed in the United States of America 1 2 3 4 5 6 7 8 9 0 ISBN: 1-928994-16-4 Copy edit by: Beth Roberts Proofreading by: Fred Lanigan Technical edit by: D. Lynn White Page Layout and Art by: Reuben Kantor Index by: Robert Saigh and Shannon Tozier Co-Publisher: Richard Kristof Distributed by Publishers Group West 113_MC2k_FM 8/21/00 3:40 PM Page iv v Acknowledgments We would like to acknowledge the following people for their kindness and sup- port in making this book possible. Richard Kristof, Duncan Anderson, Jennifer Gould, Robert Woodruff, Kevin Murray, Dale Leatherwood, Rhonda Harmon, and Robert Sanregret of Global Knowledge, for their generous access to the IT industry’s best courses, instructors and training facilities. Ralph Troupe and the team at Callisma for their invaluable insight into the challenges of designing, deploying and supporting world-class enterprise net- works. Karen Cross, Kim Wylie, Harry Kirchner, John Hays, Bill Richter, Kevin Votel, Brittin Clark, Sarah Schaffer, Ellen Lafferty and Sarah MacLachlan of Publishers Group West for sharing their incredible marketing experience and expertise. Mary Ging, Caroline Hird, and Simon Beale of Harcourt International for making certain that our vision remains worldwide in scope. Annabel Dent, Anneka Baeten, Clare MacKenzie, and Laurie Giles of Harcourt Australia for all their help. David Buckland, Wendi Wong, David Loh, Marie Chieng, Lucy Chong, Leslie Lim, Audrey Gan, and Joseph Chan of Transquest Publishers for the enthu- siasm with which they receive our books. Kwon Sung June at Acorn Publishing for his support. Ethan Atkin at Cranbury International for his help in expanding the Syngress program. Special thanks to the professionals at Osborne with whom we are proud to publish the best-selling Global Knowledge Certification Press series. v 113_MC2k_FM 8/21/00 3:40 PM Page v vi From Global Knowledge At Global Knowledge we strive to support the multiplicity of learning styles required by our students to achieve success as technical professionals. As the world's largest IT training company, Global Knowledge is uniquely positioned to offer these books. The expertise gained each year from pro- viding instructor-led training to hundreds of thousands of students world- wide has been captured in book form to enhance your learning experience. We hope that the quality of these books demonstrates our commitment to your lifelong learning success. Whether you choose to learn through the written word, computer based training, Web delivery, or instructor-led training, Global Knowledge is committed to providing you with the very best in each of these categories. For those of you who know Global Knowledge, or those of you who have just found us for the first time, our goal is to be your lifelong competency partner. Thank your for the opportunity to serve you. We look forward to serving your needs again in the future. Warmest regards, Duncan Anderson President and Chief Executive Officer, Global Knowledge 113_MC2k_FM 8/21/00 3:40 PM Page vi vii About the Author Robin Walshaw (B.Sc Computer Science, MCSE, DPPM) is an independent consultant who delivers strategic Windows 2000 solutions to large corpora- tions around the globe. Born in England, Robin spent the majority of his ear- lier years in Scotland and South Africa. One of the first MCSEs in Africa, he enjoys being at the forefront of new developments in network and operating system architecture. With a flair for developing strategic IT solutions for diverse clients, he has worked in the world of computers in eight countries, and has traveled to over thirty countries in the last ten years. A veteran of numerous global pro- jects, Robin has honed his skills across of a wide variety of platforms and technologies. Though an industrious computer professional by day, by ‘night’ Robin is an experienced mountain guide. Robin is a keen sportsman and has man- aged to balance work with a passion for climbing the world’s highest moun- tains, culminating in an attempt on the North Ridge of Mount Everest. Residing with his wife, Natalie, in London and South Africa, Robin can be contacted via email at rwalshaw@hotmail.com. Displaying Herculean resolve, Natalie simultaneously manages to keep Robin’s feet on the ground and a smile on his face. Some men just have all the luck. 113_MC2k_FM 8/21/00 3:40 PM Page vii viii Contributors Melissa Craft (CCNA, MCSE, Network+, CNE-3, CNE-4, CNE-5, CNE-GW, MCNE, Citrix) is a Director of e-Business Offering Development for MicroAge. MicroAge is a global systems integrator headquartered in Tempe, Arizona. MicroAge provides IT design, project management and support for distributed computing systems. Melissa develops enterprise-wide technology solutions and methodologies for client organizations. These technology solutions touch every part of a system’s lifecycle—from network design, testing and implementation to operational management and strategic planning. Melissa holds a bachelor’s degree from the University of Michigan and is a member of the IEEE, the Society of Women Engineers and American MENSA, Ltd. Melissa currently resides in Phoenix, Arizona with her family, Dan, Justine and Taylor, and her two dogs, Marmaduke and Pooka. Debra Littlejohn Shinder (MCSE, MCP+I, MCT) is an Instructor in the AATP program at Eastfield College, Dallas County Community College District, where she has taught since 1992. She is Webmaster for the cities of Seagoville and Sunnyvale, Texas, as well as the family Web site at www.shinder.net. She and her husband, Dr. Thomas W. Shinder, provide consulting and technical support services to Dallas area organizations. She is also the proud mom of a daughter, Kristen, who is currently serving in the U.S. Navy in Italy, and a son, Kris, who is a high school chess champion. Deb has been a writer for most her life, and has published numerous articles in both technical and non- technical fields. She can be contacted at deb@shinder.net. Thomas W. Shinder, M.D. (MCSE, MCP+I, MCT) is a Technology Trainer and Consultant in the Dallas-Ft. Worth metroplex. Dr. Shinder has consulted with major firms, including Xerox, Lucent Technologies, and FINA Oil, assisting in the development and implementation of IP-based communications strategies. Dr. Shinder attended medical school at the University of Illinois in Chicago, and trained in neurology at the Oregon Health Sciences Center in Portland, Oregon. His fascination with interneuronal communication ultimately melded with his interest in internetworking and led him to focus on systems engi- neering. Tom works passionately with his beloved wife, Deb Shinder, to design elegant and cost-efficient solutions for small- and medium-sized businesses based on Windows NT/2000 platforms. 113_MC2k_FM 8/21/00 3:40 PM Page viii ix Technical Editor D. Lynn White (MCPS, MCSE, MCT, MCP+I) is President of Independent Network Consultants, Inc. Lynn has more than 14 years experience in net- working and programming. She has been a system manager in the mainframe environment as well as a software developer for a process control company. She is a technical author, editor, trainer, and consultant in networking and computer-related technologies. Lynn has been delivering mainframe, Microsoft-official curriculum and other networking coursed in and outside the United States for more than 12 years. 113_MC2k_FM 8/21/00 3:40 PM Page ix [...]... Chapter 1: Introduction to Windows 2000 Server Introduction What’s New in Windows 2000 Server? The Key to Unlocking Your Network: Active Directory Why Should I Use the Active Directory? Change and Configuration Management Group Policies Windows 2000 Security Why the Change? Differences in Windows 2000 Server Security Windows 2000 Network Services Managing and Supporting Windows 2000 Server Integrated Directory... Comprehensive File, Print, and Web Services What’s Not New in Windows 2000 Server? Core Architecture Application Support User Interface Client Support Windows 2000 Challenges Summary FAQs Chapter 2: Active Directory—The Heart of Windows 2000 Server Introduction Mission- Critical Active Directory Concepts Where Active Directory Fits in the Overall Windows 2000 Architecture Active Directory Concepts What’s in... required—an operating system infrastructure like Windows 2000 Server A significant portion of the design objectives for the Windows 2000 development team was to ensure that Windows 2000 Server was the most efficient, scalable, and reliable Microsoft operating system for the enterprise Complex decision-making issues that arose during the design of Windows 2000 Server were handled with ruthless efficiency If... NTFS Permissions Are Applied Access Control Lists Combining NTFS Permissions Permission Inheritance NTFS Folder Permissions NTFS File Permissions Managing NTFS Permissions Special Access Permissions Using Special Access Permissions Changing NTFS Permissions Copying and Moving Files and Folders Copying Files Moving Files Administering Shared Resources Securing Network Resources Shared Folder Permissions... around the core Windows 2000 Server features I have mentioned For those of you looking for particular technical information, or those who need no introduction to Windows 2000 Server, feel free to page through and use this book as a technical reference Hopefully, within no time your copy of Mission- Critical www.syngress.com 113_MC2k_intro 8/21/00 4:13 PM Page xxxv Introduction xxxv Windows 2000 Server will... Directory Group Policy and OUs Delegating Administration Site Topology Summary FAQs Chapter 3: Migrating to Windows 2000 Server Introduction Server Migration Strategies Primary Domain Controllers (PDCs) Changes Required when Upgrading a Domain Controller Backup Domain Controllers (BDCs) Member Servers Promoting Member Servers with DCPROMO Upgrading with the Windows 2000 Setup Wizard Installing Active Directory... 4:13 PM Page xxxiv Introduction Who Should Read This Book? If you work with Windows 2000 Server, or are planning to, then this book will be of use to you It is not meant to be light bedtime reading, but an exploration of the more technical issues of Windows 2000 Server I recommend that you gain some familiarity with Windows 2000 Server concepts before reading this book (though it is not entirely necessary,... no one was physically able to pick up! As a result, certain features of Windows 2000 Server have received greater coverage than others Core Windows 2000 Server features like Active Directory, IntelliMirror, network services, and security rightfully receive the lion’s share of the coverage For relative newcomers to Windows 2000 Server, I recommend that you read the chapters in the order presented in... DNS Updates Changing Zone Types Integration with DHCP Registration of Server in DNS Using the SRV Record Installing DNS Server Service DNS Server Roles and Security Topology Primary DNS Server Secondary DNS Server Caching-Only Servers DNS Forwarders and Slave Servers Security Considerations and DNS Server Location Configuring DNS Server Options 478 478 479 480 480 481 481 482 482 483 484 485 485 485... Data Security Windows 2000 Security Options Common VPN Implementations Remote User Access Over the Internet Connecting Networks Over the Internet Tunneling Protocols and the Basic Tunneling Requirements Windows 2000 Tunneling Protocols Point to Point Tunneling Protocol (PPTP) Layer 2 Tunneling Protocol (L2TP) Using PPTP with Windows 2000 How to Configure a PPTP Device Using L2TP with Windows 2000 How to . PM Page i 113_MC2k_FM 8/21/00 3:40 PM Page ii MISSION CRITICAL! MISSION CRITICAL! WINDOWS 2000 SERVER ADMINISTRATION 113_MC2k_FM 8/21/00 3:40 PM Page. 10 Windows 2000 Security 11 Why the Change? 12 Differences in Windows 2000 Server Security 12 Windows 2000 Network Services 13 Managing and Supporting Windows