"We wanted a managed desktop -- that was one of the big business drivers for Windows 2000. We were going to let Windows 2000 settle in on the server side, and then add Active Directory," says Jeff Starke, technical analyst for Cincinnati-based Cinergy, which has 1.5 million utility customers in Indiana, Kentucky and Ohio. "But we had to change our plans because you can't get group policy without Active Directory."

Change is a big theme for the deregulated utility market, which has seen its share of mergers and acquisitions, and Cinergy's strategy was to build an infrastructure that could support potential business moves. "We wanted an architecture that gave us more flexibility," Starke says. Cinergy -- the largest non-nuclear electric supplier in the United States -- has 9,000 employees in nine countries, and owns and runs power generation, transmission and distribution operations in Europe and Africa as well as in the United States.

But like other Active Directory pioneers, Cinergy learned the directory product isn't always sufficiently flexible. Once you name your domain, the domain structure is set in stone; the only way to change it is to reinstall and rebuild the directory from the ground up. Let's say, for instance, Cinergy had made "cinergy.com" its root. If Cinergy acquired another utility company or two, it would be stuck with the Cinergy domain name -- even if the acquisitions resulted in a new company name.

Starke and his team worked around Active Directory's naming restriction by setting up what he calls a parent-child relationship: The main or parent domain is called cincorp.net (more of a placeholder), and cinergy.com and its other subdomains are the children, sitting below cincorp.net. "So if we wanted to add another business, we could easily do that" by putting it under the cincorp.net main domain, he says.

This also adds another layer of security. "Each domain has its own set of user accounts, and we limit cincorp.net's number of accounts to only a few," Starke says.

Each of Cinergy's desktops is categorized in one of three policy groups. The most common category prevents the user from configuring the workstation and his or her network access policy, and a second group lets authorized users add or remove hardware and printers, for example, but not reconfigure the entire machine. The third group gets more leeway; users have freedom to make changes to their desktops, for instance.

Starke says Cinergy so far has gotten about 99.9 percent availability of its Active Directory domain controllers and 100 percent availability of Active Directory itself. "That's a huge win," he says.

The company spent a full year planning its directory but needed only a couple of weeks to install it. Cinergy studied where to place its domain controllers, the configuration itself and the business side of Active Directory, Starke says. "Things went smoothly because we planned it so thoroughly," he adds. When Cinergy installed the domain controllers, the process didn't disrupt the client machines.

Now Cinergy is considering the possibility of using single sign-on, which would mean integrating user authentication -- digital certificates or otherwise -- with Active Directory so a user would have to sign onto the network only once to access his or her applications.