Windows 2000 Active Directory Configuration
Active Directory Users and Computers
Active Directory Users and Computers is a Microsoft Management Console snap-in. It is started by selecting "Start", "Programs", "Administrative Tools", and "Active Directory Users and Computers". Only members of the Domain Admins or Enterprise Admins group can use this tool. This tool is used to create, configure, locate, move, and delete objects including:
- User (automatically published)
- Group (automatically published)
- Computer (Those in the domain are automatically published)
- Contact (automatically published)
- Organizational Unit (automatically published)
- Shared folder
- Printer (Most are automatically published) - Windows NT shared printers are not published automatically.
It is also used to publish resources, control security and access to objects, and set up administrative control of objects to users. Published resources allow users to find and use them without knowing what server they reside on. Most browse lists do not cross subnet boundaries, but published resources are seen across subnets. These published resources may be browsed from "My Network Places". The "Computer Management" administrative tool or "Active Directory Users and Computers" is used to publish resources in Active Directory.
Active Directory Administration
Active Directory is normally administered from domain controllers but can be administered from a Windows 2000 Professional workstation by using the ADMINPAK tool. It is on the Windows 2000 CDROM in the directory /i386/Adminpak.msi.
Action Items that can be selected from the domain:
View Menu items:
- Advanced Features - Used to set object permissions.
When using Active Directory Users and Computers, once the domain is highlighted, the following options are available by selecting the menu item, "Action", and "New".
To configure an object, click the + next to the domain name, and highlight the object. The following selections are available by selecting "Action":
Searching With Windows Explorer
Windows Explorer can be used to search for Active Directory objects. This is done by selecting "View", Explorer Bar", and "Search".
Publishing is the act of making an object publically browseable and accessible using Active directory. Most objects are automatically listed in Active Directory when they are created, but some objects must be published to be made available. Things that are not automatically published:
Moving AD Objects
- Windows NT shared printers
- Computers outside the domain.
From Active Directory Users and Computers click the + next to the domain name, and highlight the object. Right click on the object in the right pane to be moved, and select Move. Expand any container objects required, and highlight the container to move the object to, then click "OK".
To move an object to another directory, use the command line program called MoveTree.exe. This program is part of the "Windows 2000 Support Tools "on the Windows 2000 Server or above CD in \Support\Tools.
When a user is moved from one OU to another the following is true:
- The user inherits permissions from the new OU.
- The user loses permissions from the original OU.
- The users and groups that could manage the user still can manage the user.
The MoveTree.exe tool is used to move an OU from one domain to another.
The "Delegation of Control Wizard" or "Active Directory Users and Computers" can be used to delegate OU administrative control to a specific user.