Active Directory under One Roof

As we stated at the beginning of the chapter, it is common to find the Unix/Linux staff "owning" the internal DNS. However, the Active Directory folks need their own DNS sandbox. Hence, they need what's called a delegated subdomain to allow them near autonomy in their own world without disturbing the existing DNS.

Using Linux to Create a DNS Server and a Delegated Subdomain

To create a DNS domain, corp.com , you need a DNS server to answer queries about that domain. It needs to hand out all sorts of information about computers in corp.com , such as the IP address of its client systems or the IP address of the mail server. And your Linux server can do this job beautifully.

However, some of your systems will be part of a DNS subdomain, ad.corp.com . That allows you to have a separate namespace for machines that are part of your Active Directory domain. And you can configure the DNS server to expressly delegate queries regarding the ad.corp.com subdomain to the server you're creating for Active Directory. The first Domain Controller in ad.corp.com will be WinDC1 with a fully qualified domain name of windc1.ad.corp.com .

Previously, we elected to install DNS while bringing the first Linux server online. Here, you'll turn on that DNS service and configure it to respond directly to queries about hosts in the corp.com domain, such as linserv1.corp.com itself. You'll also configure it to tell clients that they should send queries regarding the ad.corp.com subdomain to the Windows Domain Controller. That means that the Linux server doesn't have to be explicitly aware of each and every Active Directory domain member. Nor does the Windows Active Directory server have to be aware of every system in the corp.com domain that is not a domain member.

By the time you're done, all of your Linux clients in corp.com should be able to "see" any Windows client that's registered in the ad.corp.com Windows DNS.

Configuring the DNS Server with Webmin

Now that you have Webmin installed, you can take advantage of it to set up DNS in a relatively painless way. First, log in to Webmin. Then select Networking BIND DNS Server. This page provides tools to configure the BIND (Berkeley Internet Name Daemon) DNS server.

Here you can configure general settings that affect the server as a whole. You'll want to:

• Configure forwarding for queries about domains other than corp.com itself.

• Add "A" (address records) to resolve the names of your host systems in the corp.com domain to IP addresses.

• Set up subdomain delegation, instructing clients to send queries regarding the ad.corp.com subdomain to windc1.ad.corp.com .

Forwarding for Queries Outside the corp.com Domain

Other systems within the corp.com domain will be looking to linserv1.corp.com to answer all of their DNS queries. But naturally linserv1 is not authoritative for other domains beyond corp.com , such as winlinanswers.com . When a client asks linserv1 for the IP address of www.WinLinAnswers.com , the BIND DNS server software can ferret out the answer directly. Depending on your networking equipment, you might have a router that also acts as a DNS server (that's what we have on our network). Forward queries for which you are not authoritative to your router, 192.168.2.1, in this example. As a fallback, you'll also configure the server to look things up directly if the forwarder you send the query to doesn't respond.

To configure forwarding options for the DNS server, follow these steps:

1. Log into Webmin as described above.

2. Click on "Servers."

3. Click on "BIND DNS Server."

4. Click on "Forwarding and Transfers."

5. In the "IP address" column of the "Servers to forward queries to" table, enter 192.168.2.1 , as shown in Figure 1.29.

6. Select "Yes" for "Lookup directly if no response from forwarder."

7. For "Maximum zone transfer time", select "Default."

8. For "Zone transfer format", select "Default."

9. For "Maximum concurrent zone transfers," select "Default."

10. Click "Save." You will be returned to the "BIND DNS Server" page.

Figure 1.29: Forwarding configuration for DNS

Creating the corp.com DNS Zone

Linserv1 is ultimately responsible, or authoritative, for all queries about hosts in the corp.com domain. With the exception of hosts in the ad.corp.com subdomain, it should answer those queries directly. You're almost ready to add address records, known as "A" records, for each host in the corp.com domain that is not in the ad.corp.com subdomain.

But first, you need to create a DNS zone for the corp.com domain. In BIND, a zone is a particular domain or other entity for which the server is configured to respond to queries. You'll do this using the "Create Master Zone" link on the "BIND DNS Server" page, which is counter-intuitively hidden away in the "Existing DNS Zones" section. A master zone is one for which the server holds the records directly, rather than fetching them from another master. Master-slave DNS configuration is beyond the scope of this book. Your zone will be a forward lookup zone, meaning that it resolves names to IP addresses. You'll designate linserv1 as the master serverthe first and only DNS server for corp.com in this simple configuration. You'll also specify a contact e-mail address for DNS- related questions from other administrators.

To create the corp.com DNS zone, follow these steps, continuing from where you left off:

1. Immediately beneath "Existing DNS Zones," click "Create Master Zone."

2. The "Create Master Zone" page appears.

3. For "Zone Type," choose "Forward (Names to Addresses)."

4. For "Domain name / Network," enter corp.com .

5. For "Records file," choose "Automatic."

6. For "Master server," enter linserv1.corp.com .

7. For "Email address," enter [e-mail] .

8. Accept the defaults for the remaining settings, which are beyond the scope of this book.

9. Click "Create" to create the zone.

10. The "Edit Master Zone" page appears.

Adding Address Records for Hosts in the corp.com Domain

Now you can add the "A" records for the two hosts in corp.com, linserv1.corp.com and lincli1.corp.com , that are not part of the ad.corp.com subdomain. You will also add an "A" record for windc1.ad.corp.com itself, even though it is a part of the ad.corp.com subdomain. You do this to avoid a "chicken and egg" problem. When you delegate queries for the ad.corp.com subdomain to windc1.ad.corp.com , clients can't ask windc1.ad.corp.com to look up its own address! You escape this problem by adding an "A" record for this one host on the Linux server.

Adding "A" records is accomplished very easily with Webmin. When you complete the "Create Master Zone" page, you are automatically taken to the "Edit Master Zone" page. Here you can click "Address" to add your "A" records. On the Add Address Record page, enter hostnames and IP addresses. Here you can choose to abbreviate the name to just the portion without the domain (for example, lincli1 ) or specify the full name with a trailing period (.) to signify that the domain should not be appended (for example, windc1.ad.corp.com. ). You'll use the first form for lincli1 and linserv1 and the second form for windc1.ad.corp.com because the shorter version, windc1.ad , is more than a bit confusing!

To add "A" records for the hosts in the corp.com domain, just continue with these steps:

1. Click "Address" (the giant "A" icon, hard to miss !) The "Add Address Record" page appears.

2. In the "Name" field, enter linserv1 .

3. In the "Address" field, enter 192.168.2.202 .

4. Accept the defaults for the remaining options, which are beyond the scope of this book.

5. Click "Create" to add the address record. The "Add Address Record" page reappears, ready to accept another address record.

6. Repeat steps 25 with the name lincli1 and the address 192.168.2.203 .

7. Repeat steps 25 with the name windc1.ad.corp.com . (note the trailing ., which is required) and the address 192.168.2.226 .

8. Click "Module Index" to return to the "BIND DNS Server" page.

Delegating the ad.corp.com Subdomain to the Active Directory Server

You've come to the final stage of DNS configuration. You're ready to delegate queries regarding the ad.corp.com subdomain to windc1.ad.corp.com , the Active Directory server. To do that, you'll need to add an additional name server or NS record to the corp.com zone.

To delegate queries for the ad.corp.com subdomain to windc1.ad.corp.com , follow these steps:

1. Scroll down if necessary and click corp.com near the bottom of the "BIND DNS Server" page, under the "Existing DNS Zones" heading. The "Edit Master Zone" page appears.

2. Click the "Name Server" icon.

3. In the "Zone Name" field, enter ad.corp.com .

4. In the "Name Server" field, enter windc1.ad.corp.com . (note the trailing period (.), which is required).

5. Accept the default for the "Time-To-Live" field.

6. Click "Create" to add the NS record.

Starting the DNS Server, Now and on Every Reboot

That's ityour Linux DNS configuration is complete! To start the DNS server, simply use the "Start DNS Server" link on the "BIND DNS Server" page. Then, since this feature is absent from Webmin, you'll need to take care of a few command-line steps to ensure that BIND is restarted every time the system reboots.

Starting the DNS server is the easiest part. Follow these steps:

1. Click "Module Index" if the "BIND DNS Server" page is not already displayed.

2. Scroll to the bottom of the page.

3. Click "Start Name Server." That's it!

Configuring the DNS server to restart every time you reboot linserv1 is just a little bit harder. When you selected packages to install on your Linux server ( linserv1 ), you included the DNS server package. The necessary software is already present on the server but has not yet been configured to start running each time the server is rebooted. Fortunately, there's a simple command-line utility the root user can use to configure Fedora to start various services at boot time. That utility is called chkconfig .

Every service in Fedora Linux is controlled by a script in the directory /etc/init.d . One of these is /etc/init.d/named , which controls the naming daemon (the BIND DNS server). Fedora decides which of these scripts should actually be run at startup time. The chkconfig command configures Fedora to include or exclude various scripts from the list to actually be started at boot time and stopped at system halt time.

Note 

A thoroughly optional note for experts: the "list" of scripts to be started at boot time is actually implemented as a subdirectory containing cleverly named symbolic links to the scripts. These symbolic links are given numeric names that lead them to sort in the correct order so that the services start in the right order. You can see some of these symbolic links in the directory /etc/rc3.d . However, a full discussion of the rcN.d directories is beyond the scope of this book, since chkconfig does the job very well.

To ensure the DNS server is always activated upon reboot:

1. To access the command line, click the Fedora icon in the upper-left corner and select System Tools Terminal.

2. When the terminal window appears, type su - and press Enter to switch to the root user account. Enter the root password when prompted ( p@ssw0rd in our examples).

3. At the prompt, instruct the server to activate the DNS server on future reboots by entering the command chkconfig named on .

Tip 

Yes, the word really is named , and it is pronounced name dee . This is the naming daemon.

Tip 

If the chkconfig utility complains that the named service is not installed (possibly because you did not select that package when installing Fedora), it's not too late to solve the problem. You can install it now via the up2date package manager utility, accessible by selecting Applications System Settings Add / Remove Applications. If the chkconfig command is not found, double-check your su command. If you didn't include the -, type exit to go back to your non-root account, then do su - again to ensure you have your PATH environment variable set up correctly to find chkconfig and similar utilities.

Allowing DNS Queries through the Firewall

You configured your Linux server with a strong firewall that doesn't allow most traffic through. In order to accept DNS queries from other systems, you must relax Fedora's firewall rules to allow connections on port 53. You'll need to allow both UDP and TCP traffic. The DNS standard allows both types, and Windows systems in particular sometimes take advantage of the TCP option in addition to the more common UDP method.

Select Applications System Settings Security Level. Enter the root password when prompted.

In the Security Level application shown previously in Figure 1.28, add the ports 53:tcp and 53:udp to the comma-separated list of ports to be allowed through the firewall. Then click "OK."

Testing the DNS Server

You now have a DNS server that can answer simple queries about two hosts in the corp.com domain. You can verify your success by using the host command to look up the address of lincli1.corp.com :

 host lincli1.corp.com 

This will produce the following output:

 lincli1.corp.com has address 192.168.2.203 

You are also ready to forward all queries regarding hosts in the ad.corp.com subdomain to the Active Directory server. Now it's time to actually set up Active Directory on your Windows server. Once your Active Directory server is up and running , you can test the delegation easily using the following command:

 host  myhost  .ad.corp.com 

Where myhost is, of course, the name of a host that exists in the Active Directory. Again, in our little world, Active Directory doesn't yet exist. That's what you'll do next .

Setting an Authoritative Time Source for Linux

How can you keep the clocks of your Linux and Windows systems synchronized? The best way is to configure them to use the same authoritative time source. You'll configure linserv1.corp.com to use the master time servers at the United States Naval Observatory, and you'll configure lincli1.corp.com and other Linux systems to use linserv1.corp.com as a time source. You can accomplish these things thanks to Fedora's support for the Network Time Protocol, or NTP.

To configure linserv1.corp.com as an authoritative time source:

1. Select Applications System Settings Date & Time. The "Date/Time Properties" tool appears.

2. Click the "Network Time Protocol" tab.

3. Check the "Enable Network Time Protocol" box.

4. Select the first server listed in the list box and click "Delete" to remove it.

5. Repeat step 4 for all of the remaining servers.

6. In the "Server:" field, enter 192.5.41.40 .

7. Click "Add."

8. Repeat steps 8 and 9, this time entering the server 192.5.41.41 .

9. Click "OK" to save your work.

That completes NTP configuration for linserv1 . For lincli1 , follow the same steps, except that you should add linserv1.corp.com as the only NTP server.

Installing Your Active Directory

Now that the Linux folks have delegated ad.corp.com to the Windows folks, you'll be ready to proceed. To have an Active Directory, you need a Domain Controller, and you're almost there with WinDC1. You just need to tell it it's a Domain Controller. You do so by clicking Start Run and typing dcpromo .

When you do this, you'll be prompted to install Active Directory. It takes several screens to do the deed. After you see the "Welcome to the Active Directory Installation Wizard" screen, click "Next" to continue.

Operating System Compatibility

At this screen, you'll be informed that older Windows clients and Samba clients (such as what you'll use in Chapter 4) might have trouble making contact to a Windows 2003 server. This is because Windows 2003 uses SMB Signing, a way of ensuring the data isn't being modified as it goes across the wire. For now, click "OK."

Domain Controller Type

At this screen, you'll choose "Domain controller for a new domain" because this is the first Domain Controller you've created. If you decide to add additional Domain Controllers for testing, you'll choose the other option "Additional domain controller for an existing domain."

Create New Domain

Here, you are presented with three options.

Domain in a new forest This is what you want. This creates a brand spankin' new domain.

Child domain in an existing domain tree If you already had a domain, you could add other domains as a child. You're not going to do this.

Domain tree in an existing forest This will create a new, noncontiguous namespace in the forest. If you had company.com and you wanted to create subsidiary.com , you'd choose this option. Both company.com and subsidiary.com would be in the same forest.

New Domain Name

This is where you'll specify the Fully Qualified Domain Name of your new domain. For the purposes of this book, call it ad.corp.com , as seen in Figure 1.30, but in the real world you can call it anything you like.

Figure 1.30: Remember, your Active Directory is to be self-contained in its own domain entitled ad.corp.com .

Tip 

Again, in this book, this domain will be a delegated subdomain of your Linux-owned DNS domain called corp.com .

Once you've entered the domain name, click "Next."

NetBIOS Domain Name

This screen presents you with the name "older clients" (such as Windows 9X and Windows NT) use when talking to the domain. Choose whatever you like, but it's customary to pick a name that's darn close to the name you chose one screen earlier. The dcpromo wizard will choose the leftmost element of the name you've entered, so for this book, go with the recommended name of AD.

Database and Log Folders

Active Directory needs to store its database stuff somewhere. It's suggesting some defaults. For testing, the defaults will be fine.

Shared System Volume

This is the location of the Windows SYSVOL directory. It holds logon scripts and the file-based components of Group Policy Objects. Like the previous setting, it will recommend a default, which is fine.

DNS Registration Diagnostics

On this screen, as seen in Figure 1.30, you'll be prompted about how to handle DNS. You already set up the DNS server components; they're just waiting for you. When you were bringing up this server, you told the server to look to itself for DNS information.

With that in mind, choose the second option, "Install and configure the DNS server on this computer, and set this computer to use this DNS Server as its preferred DNS server." This is shown selected in Figure 1.31.

Figure 1.31: Select the second option and make sure your Windows 2003 CD-ROM is in the drive.

Permissions

This screen helps prevent anonymous users from enumerating all the users in the domain. You'll have two choices here: "Permissions compatible with pre-Windows 2000 server operating systems" and "Permissions compatible only with Windows 2000 or Windows Server 2003 operating systems." Best practices dictate to choose the latter, so that's what you should choose here.

Directory Services Restore Mode Administrator Password

In this book, you don't need to worry about what happens if the Active Directory requires repair. However, when bringing up a new Domain Controller, a special password is required for Active Directory emergencies.

For now, you can enter the same password you've been using all along, p@ssw0rd . (That's an at sign as the second character and a zero for the letter O .)

Summary Screen

At this screen, as shown in Figure 1.32, you'll get one last chance to verify your settings and make sure you're happy. When ready, click "Next."

Figure 1.32: Make sure your settings are correct and select "Next" to install Active Directory.

At this point you'll be off and running, and your first Domain Controller (WinDC1) will be born into your domain ( ad.corp.com ). Your Domain Controller's Fully Qualified Domain Name (FQDN) will be WinDC1.ad.corp.com .

Completing the Active Directory Installation Wizard

Eventually, you'll get to the "Completing the Active Directory Installation Wizard screen." Here, you'll be prompted to click Finish, then Active Directory will install. At the end, you'll reboot the machine.

Once completed, go ahead and log in. The Administrator account (and associated password) you created when you installed the server has been migrated to Active Directory, so you can use the same password, p@ssw0rd .

Installation of Windows XP

Loading Windows XP from the ground up is similar to loading Windows 2003 from the ground up. As with Windows 2003 and SP1, it's highly recommended that you also create an installation of Windows XP with Service Pack 2 already slipstreamed into it. References for how to create slipstreamed CD-ROMs were provided earlier.

In this section, we're not going to describe every detail of a Windows XP setup. However, you'll likely want to have the same settings we did while writing this book. That way, your test lab will match ours. Here are the specific screens you'll need to pay attention to:

• Computer Name and Administrator Password This screen will appear similar to the one previously shown in Figure 1.5. Here, you'll be able to enter the computer name and password for the local machine's Administrator account. Again, in Windows, usernames aren't case sensitive. (In Linux, login names are case sensitive.)

  For the experiments presented in this book, call your Windows XP machine xppro1 (though for readability, we'll usually type it out as XPPro1.) I'm also suggesting that you set the local Administrator password to p@ssw0rd . (That's an at sign as the second character and a zero for the letter O .) This password is strong enough for the default strength requirements for both Windows and Linux.

• Networking Settings and TCP/IP Properties Page At this point you'll be able to specify "Typical settings" or "Custom Settings." Typical settings means that the machine will try to request an IP address via DHCP. You haven't yet set up DHCP, so for now, select Custom Settings, then proceed to change the TCP/IP settings to a static IP address. In the examples, you'll set XPPro1's IP address information as follows :

  • IP address: 192.168.2.227

  • Subnet Mask: 255.255.255.0

  • Default Gateway: 192.168.2.1

  • Preferred DNS Server: 192.168.2.226 (which is the IP address of WinDC1.ad.corp.com the Domain Controller and DNS server you just created)

• Workgroup or Computer Domain Screen You'll have the opportunity to join a domain or plunk yourself in a workgroup. You can add yourself to the domain at this point. You'll need to provide credentials as anyone in the domain; you needn't have administrative credentials to add a computer account.

  Sometimes, for seemingly no reason at all, you cannot join the domain from this screen. Typically, it's because there is some kind of DNS name resolution problem. If you are unable to join the domain at this point, for now, leave this machine in a workgroup. After the Windows XP machine is fully up and running, try to fix the name resolution problem, and once again try to join the domain. Do this by right-clicking over My Computer and selecting Properties. Then, on the Computer Name tab click the Change button. At that point, you should be able to enter the name of the domain to join, provide credentials, and join!

 

Managing Windows DNS

Windows DNS is essential to the proper care and feeding of Active Directory. To that end, we'll briefly explore two areas to make sure you're properly caring for Active Directory and its oh-so-important DNS.

To do this, you'll run the DNS Server manager on your Windows 2003. Do this by launching the DNS manager via Start Programs Administrative Tools DNS. When you do, the DNS manager console will launch as seen in Figure 1.33.

Figure 1.33: Use the Forwarders tab to forward to the LinServ1 domain controller that owns corp.com .

Ensuring Windows DNS is Working Correctly

First things first you need to make sure that after you installed Active Directory the DNS is working properly. After the DNS manager is up and running, drill down into WINDC1 Forward Lookup Zones ad.corp.com . You'll see several key entries as shown in the background window in Figure 1.33. Specifically, you want to make sure the following entries are automatically generated before continuing:

• _msdcs

• _sites

• _tcp

• _udp

• DomainDNSZones

• ForestDNSZones

This isn't the place to delve into each Active Directory DNS entry. However, if these are not present, don't immediately panic. First, go get a cup of coffee, wait 30 minutes, close then reopen the DNS manager, and see if they magically appear. These entries could just be being built in Active Directory's first several minutes of life.

If after 30 minutes they're still not present, you may have to do some Active Directory troubleshooting.

Here is a list of the key MSKB articles that can help you if you're having trouble making the key records appear:

• MSKB 260371: Troubleshooting Common Active Directory Setup Issues in Windows 2000

• MSKB 241505: SRV Records Missing After Implementing Active Directory and DNS

• MSKB 241515: How to Verify the Creation of SRV Records for a Domain Controller

• MSKB 237675: Setting Up the Domain Name System for Active Directory

You can simply Google for MSKB and the number to find the articles you need.

Setting Up Windows DNS for Forwarding

On the Windows side of the house, you're missing one last piece of the puzzle. That is, you need to instruct your Windows Active Directory DNS server where to go if it doesn't have the answer to where things are in corp.com . This is called forwarding . The idea is that if the DNS servers in ad.corp.com don't know where to go, they'll forward the request to a DNS server that does. In this case, you want your ad.corp.com DNS server ( windc1.ad.corp.com ) to forward to linserv1.corp.com when it doesn't know the answer.

To finish setting up, there's not a lot you need to configure right now. The only thing you need to change is where this machine forwards to. That is, when a DNS client such as a Windows XP machine, a Linux machine, or this machine itself needs to look up an address that your DNS server doesn't have, where is it going to look? That's where the forwarding address comes in. To set the forwarding address, right-click over the server name (highlighted in Figure 1.33) and select "Properties," then select the "Forwarders" tab, as shown in Figure 1.33.

Enter the IP address of your corp.com Linux server, click "Add," and select "OK." The idea is that if this server doesn't know where to look, well, your linserv1.corp.com Linux server that owns corp.com should know the answer. And, if LinServ1 doesn't know the answer, it will ask your ISP.

At this point, you should be able to open Internet Explorer and get to, say, www.google.com or anywhere else. This is because your Windows 2003 machine's DNS client (set in the network card's properties) now sends its queries to the Windows DNS server, and it can forward to the Linux DNS server when it needs to.

Post Active Directory Installation Tasks

Once Active Directory is loaded and ready to go, there are a few housekeeping items you need to do before continuing. Then, you'll need to set your Windows 2003 machine so that it knows about an authoritative time source. Additionally, you'll activate your Windows 2003 installation. Finally, you'll run Windows Update on your Windows 2003 machine to ensure you're up to date with the latest security patches.

Let's do these things now.

Setting an Authoritative Time Source

Sure, your computer has an internal BIOS clock, but Windows needs something authoritative to hang its hat on. So to keep Windows happy (and to keep a gaggle of events out of the event log), you really should set an authoritative time source. Contrary to popular and misunderstood beliefs, for Active Directory networks you only need to perform this procedure one timehereon the first Active Directory Domain Controller. This first Domain Controller has a special role as the master timekeeper. All other machines will hierarchically request the time from this machine. All you need to do is tell it what your authoritative time source is. To that end, the command is

 net time /setsntp:  servername  

The best server to request is one of the master time servers at the United States Naval Observatory. To request it, simply run either the command

 net time /setsntp:192.5.41.41 

or

 net time /setsntp:192.5.41.209 

Find out more about the SNTP service in MSKB 314054.

Product Activation

Depending on the version of Windows 2003 your company is licensed for, you may or may not have to activate your copy of Windows. If activation is required, you'll see a balloon pop-up at some point after initial setup, similar to what is seen in Figure 1.34. By clicking the balloon (or the little keys icon in the system notification area by the clock if the balloon isn't present), you'll be able to activate Windows via the Activation Wizard (not shown).

Figure 1.34: You must activate most editions of Windows Server 2003.

In our examples, we've ensured our Windows 2003 computer can see the Internet. Because of this, the Activation Wizard will use our Internet connection, do what it has to do, and close. If your Windows 2003 cannot see the Microsoft mothership, you will have to use the dial-up activation service that is assisted by the wizard.

Windows Update

Once you can see the Internet and Windows has been activated, you should take a moment to surf on over to windowsupdate.microsoft.com . You might be asked to install the latest version of the update software. After that, zip through the Express Install, which will get you up to date on any security fixes. You may have to reboot your Windows 2003 server when finished.

Running Windows Update on your Windows 2003 server doesn't magically protect all your other Windows clients and servers. However, Microsoft does have some magic that will do this. It's called Software Update Services, or SUS, and it has a follow-up Windows Server Update Services (with the doofy acronym WSUS).

Note 

Space limits us from delving into either SUS or WUS technology; however, you can check out two articles that I wrote about SUS to help you protect all your Windows clients and servers on an ongoing basis: http://mcpmag.com/Features/article.asp?EditorialsID=336 and http://mcpmag.com/Features/article.asp?EditorialsID=342 . Also check out an article my pal Don Jones wrote about WSUS: www.redmondmag.com/ columns /article.asp?editorialsid=905