Glossary

A

Access control entry (ACE) An entry in an access control list (ACL) that defines the level of access for a user or group.

Access control list (ACL) A set of data associated with a file, directory, or other resource that defines the permissions users or groups have for accessing it. In Active Directory, the ACL is a list of access control entries (ACEs) stored with the object it protects. In Microsoft Windows NT, an ACL is stored as a binary value called a security descriptor.

Account lockout A security feature that disables a user account if failed logons exceed a specified number in a specified period of time. Locked accounts can't log on and must be unlocked by an administrator.

Active Directory In Microsoft Windows 2000 Server, Active Directory replaces the Windows NT collection of directory functions with an integrated implementation that includes DNS, DHCP, LDAP, and Kerberos.

Active Server Pages (ASP) A specification for dynamically created Web pages that contain either Microsoft Visual Basic or Microsoft JScript code. When a user requests such a page, the script is executed on a server and the page is transmitted to the user as an HTML document.

ActiveX A loosely defined set of technologies that allows software components to interact with each other in a networked environment.

ActiveX control A software component that adheres to the ActiveX specification and can operate in an ActiveX-compliant environment.

Address A precise location where a piece of information is stored in memory or on disk. Also, the unique identifier for a node on a network. On the Internet, the code by which an individual user is identified. The format is username@hostname, where username is your user name, logon name, or account number, and hostname is the name of the computer or Internet provider you use. The host name might be a few words strung together with periods.

Address Resolution Protocol (ARP) A TCP/IP and AppleTalk protocol that provides IP-address-to-MAC (media access control) address resolution for IP packets.

Advanced Configuration Power Interface (ACPI) An industry specification defining power management on a range of computer devices. ACPI compliance is necessary for devices to use the power management capabilities in Windows 2000.

Allocation unit The smallest unit of managed space on a hard disk or logical volume. Also called a cluster.

Anonymous FTP A way to use the FTP program to log on to another computer to copy files when you don't have an account on that computer. When you log on, enter anonymous as the user name and your address as the password. This gives you access to publicly available files. See File Transfer Protocol (FTP).

AppleTalk Local area network architecture built into Macintosh computers to connect them with printers. A network with a Windows 2000 server and Macintosh clients can function as an AppleTalk network with the use of AppleTalk network integration (formerly Services for Macintosh).

Associate To connect files having a particular extension to a specific program. When you double-click a file with the extension, the associated program is launched and the file you clicked is opened. In Windows, associated file extensions are usually called registered file types.

Asynchronous Transfer Mode (ATM) A network technology based on sending data in cells or packets of a fixed size. It is asynchronous in that the transmission of cells containing information from a particular user isn't necessarily periodic.

Attribute A characteristic. In Windows 2000 file management, it is information that shows whether a file is read-only, hidden, compressed, encrypted, ready to be backed up (archived), or should be indexed.

Audit policy Defines the type of security events to be logged. It can be defined on a server or an individual computer.

Authentication Verification of the identity of a user or computer process. In Windows 2000 and Windows NT, authentication involves comparing the user's security identifier (SID) and password to a list of authorized users on a domain controller.

B

Backup domain controller (BDC) In a Windows NT domain, a computer that stores a backup of the database that contains all the security and account information from the primary domain controller (PDC). The database is regularly and automatically synchronized with the copy on the PDC. A BDC also authenticates logons and can be promoted to a PDC when necessary. In a Windows 2000 domain, backup domain controllers aren't required; all domain controllers are peers, and all can perform maintenance on the directory. Windows NT 3.51 and 4 BDCs can participate in a Windows 2000 domain when it is running in mixed mode.

Backup media pool A logical set of backup storage media used by Windows 2000 Backup.

Bandwidth On a network, the transmission capacity of a communications channel stated in megabits per second (Mbps). For example, Ethernet has a bandwidth of 10 Mbps. Fast Ethernet has a bandwidth of 100 Mbps.

Binding A software connection between a network card and a network transport protocol (such as TCP/IP).

BOOTP Boot Protocol. Used on TCP/IP networks to enable a diskless workstation to learn its own IP address, the location of a BOOTP server on the network, and the location of a file to be loaded into memory to boot the machine. This allows a computer to boot without a hard disk or a floppy disk.

Broadcasting To simultaneously send a message to everyone on a network. See multicasting.

Browser service The service that maintains a current list of computers and provides the list to applications when needed. When a user attempts to connect to a resource in the domain, the Browser service is contacted to provide a list of available resources. The lists displayed in My Network Places and Active Directory Users and Computers (among others) are provided by the Browser service. Also called the Computer Browser service.

C

Certificate A credential used to prove the origin, authenticity, and purpose of a public key to the entity that holds the corresponding private key.

Certificate authority (CA) The service that accepts and fulfills certificate requests and revocation requests and that can also manage the policy-directed registration process a user completes to get a certificate.

Certificate revocation list (CRL) A digitally signed list (published by a certificate authority) of certificates that are no longer valid.

Child domain Domains located directly beneath another domain name (parent domain). For example, Engineering.scribes.com is a child domain of scribes.com, the parent domain. Also called a subdomain.

Child object An object inside another object. For example, a file is a child object inside a folder, which is the parent object.

Cluster A set of computers joined together in such a way that they behave as a single system. Clustering is used for load balancing as well as fault tolerance. Members of a cluster are referred to as nodes.

Cluster service The collection of software on each node that manages all cluster-specific activity.

Console tree The default left pane in Microsoft Management Console (MMC) that shows the items contained in a console.

Container An Active Directory object that has attributes and is part of the Active Directory namespace. Unlike other objects, it doesn't usually represent something concrete. It is a package for a group of objects and other containers.

Cross-link trust A transitive trust relationship between two Windows 2000 domains in different domain trees but within the same forest. Cross-link trusts must be explicitly created.

D

Daemon A background program that runs unattended, gathering information or performing other tasks.

Delegation Assigning administrative rights over a portion of the name-space to another user or group.

Directory service Provides the means for storing directory data and making this data available to network users and administrators. For example, Active Directory stores information about user accounts, such as names, passwords, phone numbers, and so on, and enables other authorized users on the same network to access this information.

Disk quota A limitation set by an administrator on the amount of disk space available to a user.

Distinguished name (DN) In the context of Active Directory, "distinguished" means the qualities that make the name distinct. The distinguished name identifies the domain that holds the object as well as the complete path through the container hierarchy used to reach the object.

Distributed file system (Dfs) A file management system in which files can be located on separate computers but are presented to users as a single directory tree.

DNS name servers Servers that contain information about part of the Domain Name System (DNS) database. These servers make computer names available to queries for name resolution across the Internet. Also called domain name servers.

Domain In Windows 2000, a group of computers that share a security policy and a user account database. A Windows 2000 domain is not the same as an Internet domain. See domain name.

Domain controller A server in a domain that accepts account logons and initiates their authentication.

Domain local group A local group used on ACLs only in its own domain. A domain local group can contain users and global groups from any domain in the forest, universal groups, and other domain local groups in its own domain.

Domain name In Active Directory, the name given to a collection of networked computers that share a common directory. On the Internet, the unique text name that identifies a specific host. A machine can have more than one domain name, but a given domain name points to only one machine. Domain names are resolved to IP addresses by DNS name servers.

Domain Name System (DNS) A service on TCP/IP networks (the Internet included) that translates domain names into IP addresses. This allows users to employ friendly names like FinanceServer or Ourbusiness.com when querying a remote system, instead of using an IP address such as 198.45.233.59.

Domain naming master The one domain controller assigned to handle the addition or removal of domains in a forest. See Operations Master.

Downlevel Term used to describe Microsoft services for clients, servers, and networks prior to Windows 2000, when viewed from Windows 2000.

Dynamic Data Exchange (DDE) Communication between processes implemented in the Windows family of operating systems. When programs that support DDE are running at the same time, they can exchange data by means of conversations. Conversations are two-way connections between two applications that transmit data alternately.

Dynamic Host Configuration Protocol (DHCP) A TCP/IP protocol used to automatically assign IP addresses and configure TCP/IP for network clients.

Dynamic-link library (DLL) A program module that contains executable code and data that can be used by various programs. A program uses the DLL only when the program is active, and the DLL is unloaded when the program closes.

E

Enterprise Term used to encompass all of a business's operation, including all remote offices and branches.

Environment variable A string of environment information such as a drive, path, or filename associated with a symbolic name. The System option in Control Panel or the Set command from the command prompt can be used to define environment variables.

Ethernet A local area network protocol developed by Xerox Corporation in 1976. Ethernet supports data transfer rates of 10 Mbps and uses a bus topology and thick or thin coaxial, fiber-optic, or twisted-pair cabling. A newer version of Ethernet called Fast Ethernet supports data transfer rates of 100 Mbps, and an even newer version, Gigabit Ethernet, supports data transfer rates of 1000 Mbps.

Extended partition A nonbootable portion of a hard disk that can be subdivided into logical drives. There can be only a single extended partition per hard disk.

F

File allocation table (FAT) A file system consisting of a table that keeps track of the size and location of files on a hard disk.

File Transfer Protocol (FTP) A method of transferring one or more files from one computer to another over a network or telephone line. Because FTP has been implemented on a variety of systems, it's a simple way to transfer information between usually incongruent systems such as a PC and a minicomputer.

Firewall A protective filter for messages and logons. An organization connected directly to the Internet uses a firewall to prevent unauthorized access to its network. See proxy server.

Folder redirection An option in Group Policy to place users' special folders such as My Documents on a network server.

Forest A group of one or more Active Directory trees that trust each other through two-way transitive trusts. All trees in a forest share a common schema, configuration, and Global Catalog (GC). When a forest contains multiple trees, the trees don't form a contiguous namespace. Unlike trees, a forest doesn't need a distinct name.

Fully qualified domain name (FQDN) A domain name that includes the names of all network domains leading back to the root to clearly indicate a location in the domain namespace tree. An example of an FQDN is Accts.finance.dataflointl.com or Sales.europe.microsoft.com.

G

Gateway A device used to connect networks using dissimilar protocols so that information can be passed from one to another.

Global Catalog (GC) Contains a full replica of all directory objects in its host domain plus a partial replica of all directory objects in every domain in the forest. A GC contains information about all objects in all domains in the forest, so finding information in the directory doesn't require unnecessary queries across domains. A single query to the GC produces the information about where the object can be found.

Global group A group that can be used in its own domain and in trusting domains. However, it can contain user accounts and other global groups only from its own domain.

Globally unique identifier (GUID) Part of the identifying mechanism generated by Active Directory for each object in the directory. If a user or computer object is renamed or moved to a different name, the security identifier (SID), relative distinguished name (RDN), and distinguished name (DN) will change, but the GUID will remain the same.

Group Policy Setting of rules for computers and users in Windows 2000. Group Policy includes the registry-based policy found in Windows NT Server 4 but is also able to store policies for file deployment, application deployment, logon/logoff scripts, startup/shutdown scripts, domain security, Internet Protocol security (IPSec), and so on.

Group Policy object (GPO) A collection of policies stored in two locations: a Group Policy container (GPC) and a Group Policy template (GPT). The GPC is an Active Directory object that stores version information, status information, and other policy information (for example, application objects). The GPT is used for file-based data and stores software policy, script, and deployment information. The GPT is located in the system volume folder of the domain controller.

H

Hive One of five sections of the registry on a hard disk. Each hive is a discrete body of keys, subkeys, and values that record configuration information for the computer. Each hive is a file that can be moved from one system to another but can be edited only by using the Registry Editor.

Host Any device on the network that uses TCP/IP. A host is also a computer on the Internet you might be able to log on to. You can use FTP to get files from a host computer and use other protocols (such as Telnet) to make use of the host computer.

Hosts file A local ASCII text file that maps host names to IP addresses. Each line represents one host, starting with the IP address, one or more spaces, and then the host's name.

Hypermedia A system that can link text, pictures, sound, video, or all four.

Hypertext A system of writing and displaying text that enables the text to be linked in multiple ways, available at several levels of detail. Hyper-text documents can also contain links to related documents, such as those referred to in footnotes.

Hypertext Markup Language (HTML) A system used for writing pages for the World Wide Web. HTML allows text to include codes that define fonts, layout, embedded graphics, and hypertext links.

Hypertext Transfer Protocol (HTTP) The method by which Web pages are transferred over the network.

I

IntelliMirror A suite of technologies that allows a complete operating environment to follow the user to other computers, as well as offline. Components include the user's profiles, data, and applications.

Internet The vast collection of interconnected networks that all use TCP/IP and that evolved from ARPANET of the late 1960s and early 1970s. The Internet connects roughly 70,000 independent networks into a global network.

Internet Control Message Protocol (ICMP) A protocol used to report problems encountered with the delivery of data, such as unreachable hosts or unavailable ports. ICMP is also used to send a request packet to determine whether a host is available. The receiving host sends back a packet if it is available and functioning. See ping.

Internet Explorer Microsoft's Windows-based, Winsock-compliant program for browsing the World Wide Web.

Internet Protocol (IP) The inter-network layer protocol used as a basis of the Internet. IP enables information to be routed from one network to another in packets and then reassembled when they reach their destination.

Internet Protocol next generation (IPng) or IP version 6 (IPv6) A new version of Internet Protocol. The official name of IPng is IPv6, where "v6" stands for version 6. The current version of IP is version 4, also known as IPv4. IPng is an evolutionary upgrade and will coexist with version 4 for some time.

Internet Relay Chat (IRC) A system that enables Internet users to talk with each other in real time over the Internet.

Internetwork Packet Exchange/ Sequenced Packet Exchange (IPX/SPX) Transport protocols used in Novell NetWare networks.

IP number or IP address A four-part number separated by periods (for example, 165.113.245.2) that uniquely identifies a machine on the Internet. Every machine on the Internet has a unique IP number; if a machine doesn't have an IP number, it isn't really on the Internet. Most machines also have one or more domain names that are easier for people to remember.

IPSec Internet Protocol security. An Internet Engineering Task Force (IETF) standard for creating virtual private networks (VPNs).

J

Java An advanced programming language similar to C and C++ used in Web pages to provide animation and other advanced features that make Web pages unique.

K

Kerberos An identity-based security system that authenticates users at logon. It works by assigning a unique key, called a ticket, to each user who logs on to the network. The ticket is then embedded in messages to identify the sender of the message. The Kerberos security protocol is the primary authentication mechanism in the Windows 2000 operating system.

Kernel The part of the executive (or operating system) that manages the processor. The kernel performs thread scheduling and dispatching, interrupt and exception handling, and multiprocessor synchronization.

L

Lightweight Directory Access Protocol (LDAP) A protocol used to access a directory service. LDAP is a simplified version of the Directory Access Protocol (DAP), which is used to gain access to X.500 directories. LDAP is the primary access protocol for Active Directory.

LISTSERV A family of programs that manage Internet mailing lists by distributing messages posted to the list, adding and deleting members automatically.

Lmhosts file An ASCII text file like Hosts but used to associate IP addresses to host names inside a network. To remember which is which, remember Lmhosts as LAN Manager Hosts.

Local area network (LAN) A group of connected computers, usually located close to one another (such as in the same building or the same floor of the building) so that data can be passed among them.

Log on The act of entering into a computer system; for example, "Log on to the network and read your e-mail."

Logon The account name used to gain access to a computer system. Unlike a password, the logon name isn't a secret.

Logon script or logoff script Typically a batch file set to run when a user logs on or logs off a system. A logon script is used to configure a user's initial environment. A logoff script is used to return a system to some predetermined condition. Either script can be assigned to multiple users individually or through Group Policy.

M

Media access control (MAC) address A unique 48-bit number assigned to network interface cards by the manufacturer. MAC addresses are used for mapping in TCP/IP network communication.

Member server A computer running Windows 2000 Server or Windows NT Server that is not a domain controller. Member servers can be dedicated to managing files or printer services or other functions. A member server doesn't verify logons or maintain a security database.

Mirror 1. Two partitions on two hard disks configured so that each will contain identical data to the other. If one disk fails, the other contains the data and processing can continue. 2. An FTP server that provides copies of the same files as another server. Some FTP servers are so popular that other servers have been set up to mirror them and spread the FTP load to more than one site.

Mixed mode A domain in which domain controllers running both Windows 2000 and earlier versions of Windows NT coexist. In mixed mode, the domain features from previous versions of Windows NT Server are still enabled, while some Windows 2000 features are disabled. Windows 2000 Server domains are installed in mixed mode by default. In mixed mode, the domain might have Windows NT 4 backup domain controllers present. Nested groups aren't supported in mixed mode.

Modem (modulator/demodulator) A device that connects a computer and a telephone line to allow the computer to talk to other computers through the system. Modems convert the computer's digital signals into analog waves that can be transmitted over standard voice telephone lines. Modem speeds are measured in bits per second (bps)—also sometimes expressed as kilobits (thousands of bits) per second (Kbps). For example, 28.8 Kbps and 28,800 bps are the same measurement—28,800 bits per second.

Multicasting Simultaneously sending a message to more than one destination on a network. Multicasting is distinguished from broadcasting in that multicasting sends to only selected recipients.

Multimaster replication A feature of Active Directory, multimaster replication automatically propagates every object (such as users, groups, computers, domains, organization units, security policies, and so on) created on any domain controller to each of the other participating domain controllers. All domain controllers contain the same directory data, so the domain doesn't depend on a single source for directory information.

Multitasking Computer legerdemain by which tasks are switched in and out of the processor so quickly that it appears they are all happening at once. The success of a multitasking system depends on how well the various tasks are isolated from one another.

Multithreading The simultaneous processing of several threads inside the same program. Because several threads can be processed in parallel, one thread doesn't have to finish before another one can start. See thread.

N

Name resolution The process of mapping a name to its corresponding address.

Namespace A name or group of names defined according to a naming convention; any bounded area in which a given name can be resolved. Active Directory is primarily a name-space, as is any directory service. The Internet uses a hierarchical name-space that partitions names into categories known as top-level domains, such as .com, .edu, and .gov.

Native mode The condition of a domain when all domain controllers have been upgraded to Windows 2000 and the administrator has enabled native mode operation. See mixed mode.

Net Logon service Accepts logon requests from any client and provides authentication from the Security Accounts Manager (SAM) database of accounts.

NetBIOS Enhanced User Interface (NetBEUI) A small and fast protocol that requires little memory but can't be routed. Remote locations linked by routers can't use NetBEUI to communicate.

Network Two or more computers connected for the purpose of sharing resources.

Network News Transfer Protocol (NNTP) A protocol defined for distribution, inquiry, retrieval, and posting of news articles on the Internet.

Newsgroup On the Internet, a distributed bulletin board system about a particular topic. USEnet News (also known as Netnews) is a system that distributes thousands of news-groups to all parts of the Internet.

Node A location on a tree structure with links to one or more items below it. On a LAN, a device that can communicate with other devices on the network. In clustering, a computer running Windows 2000 Advanced Server that is a member of a cluster.

NTFS file system The native file system for Windows 2000 and Windows NT. Supports long filenames, a variety of permissions for sharing files, and a transaction log that allows the completion of any incomplete file-related tasks if the operating system is interrupted.

O

Object An object is a particular set of attributes that represents something concrete, such as a user, a printer, or an application. The attributes hold data describing the thing that is identified by the object. Attributes of a user might include the user's given name, surname, and e-mail address. The classification of the object defines which types of attributes are used. For example, the objects classified as users might allow the use of attribute types like common name, telephone number, and e-mail address, whereas the object class of organization allows for attribute types like organization name and business category. An attribute can take one or more values, depending on its type.

Object identity Every object in Active Directory has a unique identity. Objects can be moved or renamed, but their identities never change. Objects are known internally by their identity, not their current name. An object's identity is a globally unique identifier (GUID), which is assigned by the Directory System Agent (DSA) when the object is created. The GUID is stored in an attribute, the object GUID, which is part of every object. The object GUID attribute can't be modified or deleted. When storing a reference to an Active Directory object in an external store (for example, a database), you should use the object GUID because, unlike a name, it won't change.

Operations Master Active Directory operations that are single master—that is, operations that are not permitted to occur at different places in the network at the same time. Examples of these operations include the primary domain controller (PDC) emulator, schema modification, domain naming, and the relative identifier (RID) allocator.

Organizational unit (OU) A container object in Active Directory used to separate computers, users, and other resources into logical units. An organizational unit is the smallest entity to which Group Policy can be applied.

P

Packet The basic unit of information sent over a network. Each packet contains the destination address, the sender's address, error-control information, and data. The size and format of a packet depends on the protocol being used.

Page A document, or collection of information, available over the World Wide Web. A page can contain text, graphics, video, and sound files. Also, a portion of memory that the virtual memory manager can swap to and from a hard disk.

Paging A virtual memory operation in which pages are transferred from memory to disk when memory becomes full. When a thread accesses a page that's not in memory, a page fault occurs and the memory manager uses page tables to find the page on disk and then loads the page into memory.

Peer-to-peer A network in which two or more machines can communicate with each other without the need for any intermediary device. On a peer-to-peer network, a computer can be both a client and a server.

Ping A network management tool that checks to see whether another computer is available and functioning. It sends a short message to which the other computer automatically responds. If the other computer doesn't respond to the ping, you usually can't establish communications.

Point of presence (POP) A physical site in a geographic area where a network access provider, such as a telecommunications company, has equipment to which users connect. The local telephone company's central office in a particular area is also sometimes referred to as their POP for that area.

Point-to-Point Tunneling Protocol (PPTP) A protocol that provides router-to-router and host-to-network connections over a telephone line (or a network link that acts like a telephone line). See Serial Line Internet Protocol (SLIP).

Post Office Protocol (POP) A protocol by which a mail server on the Internet lets you access your mail and download it to a PC or Macintosh. Most people refer to this protocol with its version number (POP2, POP3, and so on) to avoid confusing it with points of presence (POPs).

Primary domain controller (PDC) In a Windows NT domain, the server that authenticates domain logons and maintains the security policy and master database for a domain. In Windows 2000, running in mixed mode, one of the domain controllers in each domain is identified as the PDC for compatibility with down-level clients and servers.

Primary partition A portion of the hard disk that's been marked as a potentially bootable logical drive by an operating system. MS-DOS can support only a single primary partition, but Windows NT and Windows 2000 can support multiple partitions. Only four primary partitions can live on any hard disk.

Profile Loaded by the system when a user logs on, the profile defines a user's environment, including network settings, printer connections, desktop settings, and program items.

Proxy server A server that receives Web requests from clients, retrieves Web pages, and forwards them to clients. Proxy servers can dramatically improve performance for groups of users by caching retrieved pages. Proxy servers also provide security by shielding the IP addresses of internal clients.

Public-key cryptography A method of secure transmission in which two different keys are used—a public key for encrypting data and a private key for decrypting data.

Q

Quality of Service (QoS) A set of standards for assuring the quality of data transmission on a network.

R

Redundant array of independent disks (RAID) A range of disk management and striping techniques to implement fault tolerance.

Relative distinguished name (RDN) Active Directory uses the concept of a relative distinguished name (RDN), which is the part of the distinguished name that is an attribute of the object itself.

Relative identifier (RID) The part of the security identifier (SID) that is unique to each object.

Remote Access Service (RAS) Allows users to connect from remote locations and access their networks for file and printer sharing and e-mail. The computer initiating the connection is the RAS client; the answering computer is the RAS host.

Remote Authentication Dial-In User Service (RADIUS) A security authentication system used by many Internet service providers (ISPs). A user connects to the ISP and enters a user name and password. This information is verified by a RADIUS server, which then authorizes access to the ISP system.

Remote Installation Services (RIS) Allows clients to boot from a network server and use special preboot diagnostic tools installed on the server or to automatically install Windows 2000 Professional on the client system.

Replication On network computers, enables the contents of a directory, designated as an export directory, to be copied to other directories, called import directories.

Requests for comments (RFCs) An evolving collection of material that details the functions within the TCP/IP family of protocols. Some RFCs are official documents of the Internet Engineering Task Force (IETF), defining the standards of TCP/IP and the Internet, whereas others are simply proposals trying to become standards, and others fall somewhere in between. Some are tutorial in nature, whereas others are quite technical.

Router A special-purpose computer (or software package) that handles the connection between two or more networks. Routers look at the destination addresses of the packets passing through them and decide which route to use to send them.

S

Schema A definition of the object classes and attributes that can be stored in Active Directory. Like other objects in Active Directory, schema objects have an access control list (ACL) to limit alterations to only authorized users.

Schema master The single domain controller assigned to track all updates to a schema within a forest.

Scope In DHCP, the range of IP addresses available to be leased to DHCP clients by the DHCP service. In groups, scope describes where in the network permissions can be assigned to the group.

Security Accounts Manager (SAM) Manager of user account information including group membership. A logon service of both Windows 2000 and Windows NT.

Security Identifier (SID) A unique number assigned to every computer, group, and user account on a Windows 2000 or Windows NT network. Internal processes in the operating system refer to an account's SID rather than a name. A deleted SID is never reused.

Serial Line Internet Protocol (SLIP) A protocol used to run IP over serial lines or telephone lines using modems. Rapidly being replaced by Point-to-Point Tunneling Protocol (PPTP).

Server A computer that provides a service to other computers on a network. A file server, for example, provides files to client machines.

Site In Active Directory, an area of one or more well-connected subnets. When users log on to a site, clients use Active Directory servers in the same site. See well connected.

Smart card A credit card-sized device that securely stores user credentials such as passwords, certificates, public and private keys, and other types of personal information.

Snap-in A tool that can be added to a console supported by the Microsoft Management Console (MMC). You can add a snap-in extension to extend the function of a snap-in.

Socket An endpoint to a connection. Two sockets form a complete path for a bidirectional pipe for incoming and outgoing data between networked computers. The Windows Sockets API is a networking API for programmers writing for the Windows family of products.

Subdomain A domain in the DNS namespace that is located directly under another domain. See child domain.

Subnet The portion of a TCP/IP network in which all devices share a common prefix. For example, all devices with an IP address that starts with 198 are on the same subnet. IP networks are divided using a subnet mask.

Superscope A collection of scopes grouped into a single administrative whole. Grouping scopes together into a superscope makes it possible to have more than one logical subnet on a physical subnet.

SystemRoot The path and folder where the Windows 2000 system files are located. The value %SystemRoot% can be used in paths to replace the actual location. To identify the SystemRoot folder on a computer, type %SystemRoot% at a command prompt.

T

Telnet The protocol and program used to log on from one Internet site to another. The Telnet protocol/program gets you to the logon prompt of another host.

Terminal A device that allows you to send commands to another computer. At a minimum, this usually means a keyboard, a display screen, and some simple circuitry. You will usually use terminal software in a personal computer—the software pretends to be, or emulates, a physical terminal and allows you to type commands to another computer.

Thread An executable entity that belongs to one (and only one) process. In a multitasking environment, a single program can contain several threads, all running at the same time.

Transitive trust The standard trust between Windows 2000 domains in a domain tree or forest. Transitive trusts are always two-way trusts. When a domain joins a domain tree or forest, a transitive trust relationship is established automatically.

Transmission Control Protocol/Internet Protocol (TCP/IP) The protocol that networks use to communicate with each other on the Internet.

Tree A tree in Active Directory is just an extension of the idea of a directory tree. It's a hierarchy of objects and containers that demonstrates how objects are connected, or the path from one object to another. Endpoints on the tree are usually objects.

Trojan horse A destructive program designed to disguise itself as a benign application. Unlike viruses, Trojan horses don't replicate themselves, but they can be just as dangerous.

Trust relationship A security term meaning that one workstation or server trusts a domain controller to authenticate a user logon on its behalf. It also means a domain controller trusts a domain controller in another domain to authenticate a logon.

U

Uniform Resource Locator (URL) The standard way to give the address of any resource on the Internet that is part of the World Wide Web. For example, http://www.capecod.net /~fcollege/index.htm. The most common way to use a URL is to enter it into a Web browser program, such as Microsoft Internet Explorer or Netscape Navigator.

Universal group A group that can be used anywhere in a domain tree or forest. Members can come from any domain, and rights and permissions can be assigned at any domain. Universal groups are available only when the domain is in native mode.

Universal Naming Convention (UNC) A PC format for indicating the location of resources on a network. UNC uses the following format: \\Server\Shared_ resource_path. To identify the Example.txt file in the Sample folder on the server named Ample, the UNC would be \\Ample\Sample\Example.txt.

UNIX A computer operating system designed to be used by many computer users at the same time (multiuser) with TCP/IP built in. The most common operating system for servers on the Internet.

User account A user's access to a network. Each user account has a unique user name and security ID (SID).

User profiles Information about user accounts. See profile.

V

Viewer A program used by Gopher, Wide Area Information Server (WAIS), or Web client programs to show files with contents other than text. You use a viewer to display graphics or video files or to play sound files.

Virtual Reality Modeling Language (VRML) A file format for 3-D models and scenes that is used primarily on the World Wide Web. VRML objects and scenes can be viewed and inter-actively navigated with a VRML browser, and VRML scenes can have embedded hyperlinks, allowing for a type of three-dimensional Web site.

W

Well connected Sufficiently fast and reliable for the needs of Active Directory clients and servers. The definition of "sufficiently fast and reliable" for a particular network depends on the work being done on the specific network.

Wide area network (WAN) Any Internet or network that covers an area larger than a single building or campus.

Windows Internet Name Service (WINS) A name resolution service that converts computer names to IP addresses in a routed environment.

Windows Sockets (Winsock) Winsock is a standard way for Windows-based programs to work with TCP/IP. You can use Winsock if you use SLIP to connect to the Internet.

Workstation In Windows NT, a computer running the Windows NT Workstation operating system. In a wider context, used to describe any powerful computer optimized for graphics or computer-aided design (CAD) or any of a number of other functions requiring high performance.

World Wide Web (WWW) or Web A hypermedia-based system for accessing information on the Internet.

X

X.500 A standard for a directory service established by the International Telecommunications Union (ITU). The same standard is also published by the International Standards Organization/International Electro-technical Commission (ISO/IEC). The X.500 standard defines the information model used in the directory service. All information in the directory is stored in entries, each of which belongs to at least one object class. The actual information in an entry is determined by attributes that are contained in that entry.

Z

Zone A part of the DNS namespace that consists of a single domain or a domain and subdomains managed as a single, separate entity.