What Active Directory Domains Do for Us
I know that some of you already know what domains are for and, if you fit in that category, then feel
free to skip this section. If you’re wondering what’s new in Active Directory in Windows Server 2003,
then of course I’ll cover that here, but for a quick overview of what’s new in AD, please flip back
to Chapter 1 for a short summary of 2003’s AD-oriented improvements. For those looking for a bit
of “why we’re here in the first place,” here’s a look at what domains do for us.
Domains do several things for us. I’ve suggested a few, but here’s a more complete list. They:
◆
Keep a central list of users and passwords.
◆
Provide a set of servers to act as “authentication servers” or “logon servers” known as
domain
controllers
.
◆
Maintain a searchable index of the things in the domain, making it easier for people to find
resources—“which share do we keep the Sales figures on, anyway?”
◆
Let you create users with different levels of powers, from nearly powerless guest accounts to
regular user accounts to all-powerful domain-wide administrators. But they also let you create
subadministrators, user accounts with
some
of the power of domain-wide admins but not all
of their power.
◆
Allow you to subdivide your domains into subdomains called organization units or OUs.
You can then assign varying amounts of control and power over these OUs to particular
individuals. This lets you create what might be called “departmental administrators”—users
with lots of power but only over a small group of machines and users.