Chapter 40. Windows NT Domains

SOME OF THE MAIN TOPICS IN THIS CHAPTER ARE

Workgroups and Domains

Windows NT User Groups

Managing User Accounts

Passwords and Policies

Strategies to Minimize Logon Problems

The Windows NT domain is a collection of users and resources. It is the primary unit of user and resource administration. Administrators in any particular domain can control the addition or modification of user accounts in their domain and can control which resources any user can access, along with the type of access. To begin to understand the logon process under Windows NT, you should first become cognizant of how users and security information is organized into user groups and domains and how these interact. Understanding how domains operate in the Windows NT environment makes it easier for you to plan an integration with, or upgrade to, Windows 2000. When you upgrade your network to include only Windows 2000 computers, you'll find that instead of primary and backup domain controllers, you'll have only domain controllers (that are neither primary nor backup), which are essentially peers on the network. It is important to understand how primary and backup domain controllers work if you plan to keep both Windows NT and Windows 2000 computers in the same network.

In this chapter we examine the tools an administrator can use to manage users of a Windows NT 4.0 server. In the next chapter we look at managing users of Windows 2000/Windows 2003 servers using the Microsoft Management Console utility. As a prerequisite to the next chapter, you might want to first read Chapter 31, "Using the Active Directory."

Note

Windows Server 2003 servers are now coming to market, and Windows XP Professional has been available as a replacement for Windows NT 4.0 Workstation as well as Windows 2000 Professional. However, the basic concepts of the Windows domain are important to understand, whether or not your network contains Windows NT servers. These domains were incorporated into the Windows 2000 Active Directory as container objects. The trust relationships that you have to establish manually, as described in this chapter, are now transitive and automatic in the Active Directory. Yet, for those still using Windows NT 4.0, as well as those who have upgraded to Windows 2000 or Windows Server 2003, the concepts covered in this chapter can be useful. If you are still using Windows NT 4.0 domains, consider this chapter to be a guide to managing those domains. If you have already upgraded to the Active Directory, you should read this chapter to understand how domains have changed in the Active Directory, as well as to understand how to manage Windows NT 4.0 domains in your directory if you have a mixed-mode network that contains both Windows NT 4.0 domains and Windows 2000/Windows Server 2003 domain container objects.

Windows NT 4.0 has had several years to settle down. With the latest service packs that Microsoft and other third parties have provided, you can expect to see NT 4.0 used in networks for a few more years, despite the advent of Windows 2000 and Windows Server 2003 and their implementation of Active Directory. Windows NT 4.0 is a stable platform, and you needn't upgrade your systems as long as you can still support the applications important to your users. For example, there have been several releases of Microsoft Office since Office 97, but these newer products have been slow to be adopted because Office 97 provides most of the functionality that many businesses need today. If you do have a need to upgrade to newer software applications, you might want to consider Windows 2000 or Windows Server 2003.

Tip

If you are not yet considering a move away from Windows NT 4.0 Server domains, you might want to review the availability and support schedule published at www.microsoft.com/ntserver/ProductInfo/Availability/Retiring.asp.

Upgrading to Windows 2000 can be expensive from both a hardware and a software point of view. Planning the namespace for the Active Directory, used in Windows 2000 and Windows Server 2003, can be a complex task as well. A carefully managed Windows NT 4.0 network can continue to serve you for a few more years, but availability and support are dwindling. It would be a good idea to start planning your migration strategy early, because an adequate Active Directory model is much harder to design and implement than an adequate Windows NT 4.0 domain.

This chapter will walk you through the Windows NT 4.0 domain management utilities. The next chapter, Chapter 41, "Windows 2000 and Windows Server 2003 User and Computer Management Utilities," will introduce you to the new Microsoft Management Console (MMC), which is a consistent interface used to manage many aspects of Windows 2000/2003 (as well as the client operating system Windows XP Professional). You will also learn in that chapter how to manage users and user groups under Windows 2000.

Before you read that chapter, however, explore the concepts in this chapter so that you will better understand what a domain is. In Chapter 41, you will then find it easier to understand how these domains are incorporated into the Active Directory.