<META HTTP-EQUIV="PICS-Label" CONTENT='(PICS-1.1 "http://www.rsac.org/ratingsv01.html" l comment "RSACi North America Server" by "inet@microsoft.com" r (n 0 s 0 v 0 l 0))' />
<TITLE>Active Directory Overview : [Microsoft Windows 2000, Microsoft Windows 2000 Server, Active Directory]</TITLE>
<META NAME="KEYWORDS" CONTENT="Microsoft Windows 2000, Microsoft Windows 2000 Server, Active Directory">
<META NAME="DESCRIPTION" CONTENT="A non-technical overview of Active Directory technology and a look into Microsoft's overall directory services strategy. ">
<TD WIDTH="10"><!--mstheme--><font face="Times New Roman"> <!--mstheme--></font></TD>
<TD WIDTH="10"><!--mstheme--><font face="Times New Roman"><IMG SRC="/windows2000/images/1ptrans.gif" WIDTH="10" HEIGHT="1" /><!--mstheme--></font></TD>
<TD><!--mstheme--><font face="Times New Roman"><IMG SRC="/windows2000/images/1ptrans.gif" WIDTH="10" HEIGHT="1" /><!--mstheme--></font></TD>
<TD WIDTH="100%"><!--mstheme--><font face="Times New Roman"><A CLASS="NavLink" HREF="file:///D:/Documents and Settings/ericbrus/My Documents/My Webs/myweb12/server/features/exploring.asp" target="_top">Technologies in Depth</A><!--mstheme--></font></TD>
<TD WIDTH="15"><!--mstheme--><font face="Times New Roman"> <!--mstheme--></font></TD>
<TD WIDTH="10"><!--mstheme--><font face="Times New Roman"> <!--mstheme--></font></TD>
<TD WIDTH="10"><!--mstheme--><font face="Times New Roman"><IMG SRC="/windows2000/images/1ptrans.gif" WIDTH="10" HEIGHT="1" /><!--mstheme--></font></TD>
<TD><!--mstheme--><font face="Times New Roman"><IMG SRC="/windows2000/images/1ptrans.gif" WIDTH="10" HEIGHT="1" /><!--mstheme--></font></TD>
<TD WIDTH="100%"><!--mstheme--><font face="Times New Roman"><A CLASS="NavLink" HREF="file:///D:/Documents and Settings/ericbrus/My Documents/My Webs/myweb12/server/features/choosing.asp" target="_top">Choosing the Right Server</A><!--mstheme--></font></TD>
<TD WIDTH="15"><!--mstheme--><font face="Times New Roman"> <!--mstheme--></font></TD>
<TD WIDTH="10"><!--mstheme--><font face="Times New Roman"> <!--mstheme--></font></TD>
<TD CLASS="NavItemSelected" COLSPAN="3"><!--mstheme--><font face="Times New Roman"><A CLASS="NavLink" HREF="/windows2000/upgrade/default.asp" TARGET="_top">Upgrading to Windows 2000</A><!--mstheme--></font></TD>
<TD WIDTH="15"><!--mstheme--><font face="Times New Roman"> <!--mstheme--></font></TD>
<TD WIDTH="20" VALIGN="TOP"><!--mstheme--><font face="Times New Roman">
<A HREF="mailto:?subject=An article from Microsoft&body=This article is from the Microsoft Windows 2000 Web site. http://www.microsoft.com/windows2000/guide/server/features/dirlist.asp"><IMG SRC="/windows2000/images/icoEmail2.gif" WIDTH="20" HEIGHT="15" BORDER="0"></A>
<!--mstheme--></font></TD>
<TD VALIGN="TOP" NOWRAP><!--mstheme--><font face="Times New Roman">
<A CLASS="finePrint" HREF="mailto:?subject=An article from Microsoft&body=This article is from the Microsoft Windows 2000 Web site. http://www.microsoft.com/windows2000/guide/server/features/dirlist.asp">Send this document<BR />to a colleague</A><BR />
<!--mstheme--></font></TD>
<TD WIDTH="15"><!--mstheme--><font face="Times New Roman"><IMG SRC="/windows2000/images/ts.gif" WIDTH="15" HEIGHT="1" /><!--mstheme--></font></TD>
<TD WIDTH="28" VALIGN="TOP" NOWRAP><!--mstheme--><font face="Times New Roman">
<A HREF="file:///D:/Documents and Settings/ericbrus/My Documents/My Webs/myweb12/server/features/dirlist.asp"><IMG SRC="/windows2000/images/icoPrinter.gif" WIDTH="22" HEIGHT="15" BORDER="0"></A>
<!--mstheme--></font></TD>
<TD VALIGN="TOP" NOWRAP><!--mstheme--><font face="Times New Roman">
<A CLASS="finePrint" HREF="file:///D:/Documents and Settings/ericbrus/My Documents/My Webs/myweb12/server/features/dirlist.asp">Printer-friendly<BR>version</A><BR>
<!--mstheme--></font></TD>
<TD WIDTH="15"><!--mstheme--><font face="Times New Roman"><IMG SRC="/windows2000/images/ts.gif" WIDTH="15" HEIGHT="1" /><!--mstheme--></font></TD>
<!--mstheme--></font></TD>
</TR>
</TABLE><!--mstheme--><font face="Times New Roman">
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="../../_themes/copy-of-tilt/atlbull1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="Times New Roman"><A HREF="#heading1">Introduction: What Is a Directory Service?</A>
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="../../_themes/copy-of-tilt/atlbull1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="Times New Roman"><A HREF="#heading2">Why Have a
Directory Service?</A>
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="../../_themes/copy-of-tilt/atlbull1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="Times New Roman"><A HREF="#heading3">What Is
<TD><!--mstheme--><font face="Times New Roman"><A NAME=heading2></A><H1><!--mstheme--><font color="#400040">Why Have a Directory Service?<!--mstheme--></font></H1><!--mstheme--></font></TD>
<TD align=right><!--mstheme--><font face="Times New Roman"><A HREF="#top" CLASS=finePrint>Back to Top</A><!--mstheme--></font></TD>
</TR>
</TABLE><!--mstheme--><font face="Times New Roman">
<TD><!--mstheme--><font face="Times New Roman"><A NAME=heading3></A><H1><!--mstheme--><font color="#400040">What Is Active Directory?<!--mstheme--></font></H1><!--mstheme--></font></TD>
<TD align=right><!--mstheme--><font face="Times New Roman"><A HREF="#top" CLASS=finePrint>Back to Top</A><!--mstheme--></font></TD>
</TR>
</TABLE><!--mstheme--><font face="Times New Roman">
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="../../_themes/copy-of-tilt/atlbull1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="Times New Roman">End users must use multiple user accounts and
passwords to log in to different systems, and they must know the exact
locations of information on the network.
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="../../_themes/copy-of-tilt/atlbull1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="Times New Roman">Administrators must understand how to manage each
directory within the network and must duplicate many steps when procedures,
such as adding a new employee to a company, involve many different
directories.
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="../../_themes/copy-of-tilt/atlbull1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="Times New Roman">Application developers must write different logic
for every directory that their applications need to access. <!--mstheme--></font><!--msthemelist--></td></tr><!--msthemelist--></table><!--mstheme--><font face="Times New Roman">
<P>The proliferation of customized directory services
translates directly into a continually rising cost of ownership: it requires
greater management, necessitates more complex applications, and adversely
affects the productivity of the end user. In the near term, companies need to
find ways to halt this trend and minimize the total number of directories that
they have through proactive consolidation. Over the longer term, the best
solution is to standardize based on technologies that provide the required
levels of scalability, standards-based interoperability, and operating system
integration. </P>
<P>Active Directory is the first enterprise-class directory
service that is scalable, built from the ground up using Internet-standard
technologies, and fully integrated with the operating system. In addition to
providing comprehensive directory services to Windows applications, Active
Directory is designed to be a consolidation point for isolating, migrating,
centrally managing, and reducing the number of directories that companies have.
This makes Active Directory the ideal long-term foundation for corporate
information-sharing and common management of network resources, including
applications, network operating systems, and directory-enabled devices. </P>
<P>The following section gives an overview of the core
Active Directory technologies. A detailed presentation of this material is
available as a Windows Media<SUP><FONT size=1>TM</FONT></SUP> event, that you can access from the Related Links
<TD><!--mstheme--><font face="Times New Roman"><A NAME=heading5></A><H1><!--mstheme--><font color="#400040">How Does Active Directory Work?<!--mstheme--></font></H1><!--mstheme--></font></TD>
<TD align=right><!--mstheme--><font face="Times New Roman"><A HREF="#top" CLASS=finePrint>Back to Top</A><!--mstheme--></font></TD>
</TR>
</TABLE><!--mstheme--><font face="Times New Roman">
Active Directory uses objects to represent network
resources such as users, groups, machines, devices, and applications. It uses
containers to represent organizations, such as the marketing department, or
collections of related objects, such as printers. It organizes information in a
tree structure made up of these objects and containers, similar to the way the
Windows operating system uses folders and files to organize information on a
computer.
</p><br>
<IMG height=211 src="ad-fig1.gif" width=403></A>
<br><br><font size="2"><span style="COLOR: black; FONT-FAMILY: Arial; FONT-SIZE: 8pt; mso-bidi-font-size: 12.0pt; mso-fareast-font-family: Times New Roman; mso-bidi-font-family: Times New Roman; mso-ansi-language: EN-US; mso-fareast-language: EN-US; mso-bidi-language: AR-SA">Figure 1: Active Directory organizes information
hierarchically to ease network use and management.</span><br>
</font><p>
</p>
<br>
<p>
In addition, Active Directory manages the relationships
among objects and containers to provide a single, centralized, comprehensive
view. This makes resources easier to find, manage, and use in a highly
distributed network. The Active Directory hierarchy is flexible and
configurable, so organizations can organize resources in a way that optimizes
their usability and manageability.
</p>
<p>
In Figure 1 above, containers are used to represent
collections of users, machines, devices, and applications. Containers can be
nested (created one-inside-the-other) to reflect accurately the company’s
organizational structure. In this case, marketing and personnel organization
containers represent those respective departments, and their relationship to one
another, within the company. Grouping objects in the directory lets
administrators manage objects on a macro-level (as collections) rather than
one-by-one. This increases management efficiency and accuracy while letting
organizations align network management with their business processes.
information about network elements in the form of objects. These objects can be
assigned attributes, which describe specific characteristics about the object.
This lets companies store a wide range of information in the directory and
tightly control access to it.
</p>
<br>
<IMG height=227 src="ad-fig2.gif" width=401></A>
<br><br><font size="2"><span style="COLOR: black; FONT-FAMILY: Arial; FONT-SIZE: 8pt; mso-bidi-font-size: 12.0pt; mso-fareast-font-family: Times New Roman; mso-bidi-font-family: Times New Roman; mso-ansi-language: EN-US; mso-fareast-language: EN-US; mso-bidi-language: AR-SA">Figure 2: Active Directory objects and attributes are
protected by access control lists.</span><br>
</font><p>
</p>
<br><p>
As illustrated in Figure 2 above, object- and
attribute-level security lets administrators precisely control access to
information stored in the directory. For example, a user object stored in the
directory for Bob Jones has attributes for Bob’s name, e-mail address,
phone number, and Social Security number. The Active Directory lets
administrators assign access privileges for each attribute of the object, as
well as for the entire object. In this case, the system administrator has
allowed global access to the Bob Jones object, but has locked access of the
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="../../_themes/copy-of-tilt/atlbull1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="Times New Roman">Makes use of existing systems through
interoperability. <!--mstheme--></font><!--msthemelist--></td></tr><!--msthemelist--></table><!--mstheme--><font face="Times New Roman">
security. </STRONG>By setting access control privileges on directory objects
and the individual data elements that make them up. <!--mstheme--></font><!--msthemelist--></td></tr><!--msthemelist--></table><!--mstheme--><font face="Times New Roman">
<p>
<A NAME=heading10></A><H3><!--mstheme--><font color="#400040">How Active Directory Strengthens Security<!--mstheme--></font></H3>
<P>One of the most important architectural advantages of
Windows 2000 Server is the integration of Active Directory and its advanced
security features that enable a new level of data protection. This is
particularly important for organizations that do business over the
Internet.</P>
<IMG height=267 src="ad-fig5.gif" width=491></A>
<br><br><font size="2"><span style="COLOR: black; FONT-FAMILY: Arial; FONT-SIZE: 8pt; mso-bidi-font-size: 12.0pt; mso-fareast-font-family: Times New Roman; mso-bidi-font-family: Times New Roman; mso-ansi-language: EN-US; mso-fareast-language: EN-US; mso-bidi-language: AR-SA">
<P>Figure 5: Active Directory provides Internet-ready
security services to protect data while facilitating access.</P></span><br>
</font><p>
</p>
<br><p>
<P>As illustrated in Figure 5 above, Active Directory acts
as the central authority for governing authentication of user identity and
controlling access to network resources. It supports a number of authentication
mechanisms used to prove identity upon logon to Windows 2000, including
Kerberos, x.509 certificates, and smart cards. Once a user is authenticated and
logged on, all resources in the system are protected and access is granted or
denied based on a single authorization model. This means that organizations
don't have to protect resources one way for users who logon via the intranet and
another way for those who use digital certificates to access resources over the
Internet.</P>
<P>In addition, Active Directory natively supports a fully
integrated public key infrastructure and Internet secure protocols, such as LDAP
over SSL, to let organizations securely extend selected directory information
beyond their firewall to extranet users and e-commerce customers. In this way,
Active Directory strengthens security and speeds deployment of e-business by
letting administrators use the same tools and processes to manage access control
and user privileges across internal desktop users, remote dial-up users, and
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="../../_themes/copy-of-tilt/atlbull1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="Times New Roman">Takes advantage of existing investments and ensures
flexibility. Standards-based interfaces to all features make use of
investments and ensure flexibility for future applications and
infrastructure.
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="../../_themes/copy-of-tilt/atlbull1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="Times New Roman">Consolidates management of multiple application
directories. Using open interfaces, connectors, and synchronization
mechanisms, organizations can consolidate directories including Novell's
NDS, LDAP, ERP, e-mail, and other mission-critical applications.
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="../../_themes/copy-of-tilt/atlbull1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="Times New Roman">Allows organizations to deploy directory-enabled
networking. Network devices from leading vendors such as Cisco and 3COM can
use the directory to let administrators assign quality of service and
allocate network bandwidth to users based on their role in the company.
<!--msthemelist--><tr><td valign="baseline" width="42"><img src="../../_themes/copy-of-tilt/atlbull1.gif" width="15" height="15" hspace="13" alt="bullet"></td><td valign="top" width="100%"><!--mstheme--><font face="Times New Roman">Allows organizations to develop and deploy
directory-enabled applications. Using the fully extensible directory
architecture, developers can build applications that deliver functionality
tailored to the needs of the end user. <!--mstheme--></font><!--msthemelist--></td></tr><!--msthemelist--></table><!--mstheme--><font face="Times New Roman">
<p>
<A NAME=heading12></A><H3><!--mstheme--><font color="#400040">How Active Directory Extends Interoperability<!--mstheme--></font></H3>
<P></P>
<P>Active Directory provides a central integration point
for bringing diverse systems together and for consolidating directories and
management tasks. It does this by exposing all of the Windows 2000 directory
features through standards-based interfaces such as LDAP, ADSI, JADSI, and MAPI
so companies can consolidate existing directories and develop directory-enabled
applications and infrastructure. One example of how Microsoft is using Active
Directory in its own product-line is Microsoft Exchange. The Exchange server has
been integrated with Active Directory to enable companies to manage
Windows 2000 user accounts and Exchange mailboxes in one place.
</P>
<IMG height=239 src="ad-fig6.gif" width=446></A>
<br><br><font size="2"><span style="COLOR: black; FONT-FAMILY: Arial; FONT-SIZE: 8pt; mso-bidi-font-size: 12.0pt; mso-fareast-font-family: Times New Roman; mso-bidi-font-family: Times New Roman; mso-ansi-language: EN-US; mso-fareast-language: EN-US; mso-bidi-language: AR-SA">
<P>Figure 6: Active Directory provides a platform for
integrating and extending systems through open interfaces, connectors, and
synchronization mechanisms.
</P> </span><br>
</font><p>
As shown in Figure 6 above, Active Directory also
provides a development platform for directory-enabled applications. This lets
application developers control the behavior of an application based on the
user’s role in the company. For example, a directory-enabled application
could reference a user’s profile in the directory and provide specific
menu items and functionality based on his or her job function. That way, a user
in personnel could see the "Change Salary" menu item in an HR
application, while a user in finance would not see that menu, even if the two
users share a computer.
</p>
<P>Just as organizations can improve the way their
directory service and applications work together, so can they improve the way
their network hardware and software work with their directory service. By
providing a platform for directory-enabled networks, Active Directory lets
companies match network resource allocation to their business-process
requirements. In particular, administrators can allocate network bandwidth to
users based on their business needs. For example, an administrator could create
a policy that ensures that users in the finance department are allocated
additional bandwidth when they are busy closing books at the end of the month.
</P>
<P>The benefits of Active Directory can be extended beyond
the Windows environment. The open synchronization mechanisms within Active
Directory ensure interoperability of the Windows platform with a wide variety of
applications and devices. For example, native support for LDAP, DirSync, and
ADSI interfaces enables leading vendors such as Cisco, SAP, BAAN, and 3COM to
integrate with Active Directory to provide simplified and powerful management of
