Network Computingwww.networkcomputing.com

	Issue TOC Print full article Print this page Download as PDF E-Mail this URL Discuss this article Flame the author     In this article Introduction Customizing Your Script The ABCs of AD

When you add a second Microsoft Windows 2000 domain controller, Active Directory becomes a distributed database. Installing Active Directory automatically upgrades a member server to become a domain controller. There is no primary AD domain controller.

Active Directory services, along with the AD database, authenticate domain users, administer installation policies and manage desktop practices and software. The directory package also comes with management tools. Depending on the type of change you're making to Active Directory, each management role or process resides on one server in each domain. So when a systems administrator makes a change to the Active Directory schema, only one domain controller in the enterprise can make that change to the database. Similarly, when a new domain is created, only one domain controller can add the domain to the database. When there's just one domain controller, all management roles and the Active Directory global catalog reside on that server. As you create more controllers and the database becomes distributed, the roles and the global catalog can be dispersed among them.

Once the Active Directory database resides on more than one domain controller, it's a good idea to frequently record which server is performing what AD-operations role. AD comes with utilities that document which domain controller plays what role, but it's easier to use the AD management console (MMC) snap-in because it's graphical user interface-based.

Active Directory's backup is usually performed with the backup wizard. Beware, however, that when you mark the System State checkbox, the backup utility only archives the AD database, the AD checkpoint file and the AD logs for a single controller. You have to back up each controller individually with the wizard. Not all controllers need their database archived, however, so take a close look at how AD uses each domain controller.

With the AD distributed database, replication is the key to ensuring that changes to one controller's copy of the database is sent to all domain controllers. A single domain controller does not notify each controller - it's a round-robin process. Replication helps the recovery of an updated database under typical emergency conditions (unlike Gulf Coast Community College's situation), such as when a single domain controller is lost or when that controller's AD database becomes corrupted.