Network Migration to NT 5.0

If you keep up with the latest developments in the Windows NT 5.0 infrastructure, your head is swimming with a myriad of new terms. You've heard about forests, trees, sites, Kerberos trusts, and Active Directory (AD). But, how familiar are you with NT 5.0 networking? NT 5.0 brings so many new concepts to Microsoft networking that seeing how all the new operating system's (OS's) pieces fit together can be challenging. Of all the questions people ask me about NT 5.0, I hear most often, "What will the new OS mean for my network?" A look at a fictitious midsized network's upgrade from NT 4.0 to NT 5.0 can help answer this question.

Meet BigCorporation
BigCorporation, my fictitious firm, has an NT 4.0 network that includes 19 servers and serves 500 users in three offices. Of the company's 500 users, 250 work at BigCorporation's headquarters in Maryland, 95 work in a branch office in Ohio, and 155 work in a branch office in New York. BigCorporation's network comprises four NT domains in a single master domain model.

The company's administrators manage all user accounts from an accounts domain called BIGCORP (the master domain), and each of the company's offices has a resource domain. The resource domains are MARYLAND, OHIO, and NEWYORK. Each resource domain has a one-way trust relationship with the accounts domain, and each office houses a Backup Domain Controller (BDC) in the BIGCORP domain that handles local authentication requests. Figure 1 depicts BigCorporation's domain structure. Table 1 lists each BigCorporation server's NetBIOS name and explains the server's function.

BigCorporation decision makers chose the single master domain model for their NT 4.0 network because this domain configuration keeps administrative costs down. The configuration keeps centralized control over the accounts database within the company's IS group, because giving each site's administrators account operator permissions in the BIGCORP domain would give them rights over all the company's accounts. But, the configuration's resource domain structure lets administrators at each site perform routine tasks such as backing up servers, starting and stopping services, and rebooting servers. Local administration of the resource domains is more cost-effective than remote administration.

BigCorporation's network uses TCP/IP as the primary protocol. Each office has a Dynamic Host Configuration Protocol (DHCP) and Windows Internet Naming Service (WINS) server, and each office uses two adjacent, private class-C address blocks for servers and workstations. Table 2 lists these subnets. Each resource domain's DHCP and WINS server gives its address to clients in its domain for use as a primary WINS server and gives clients the address of an enterprisewide WINS server in the BIGCORP domain for use as a secondary WINS server. The resource domains' WINS servers are push/pull replication partners with the BIGCORP domain's WINS server. (For information about WINS push/pull replication, see Mark Minasi, "Advanced WINS Features," September 1997.)

Because BigCorporation delegates administration tasks, it decided to upgrade to NT 5.0. AD will let BigCorporation reduce its number of domains from four to one, provide local administrators with administrative rights for user accounts and resources at each site, and reduce the number of servers the network requires. (For more information about AD, see Mark Minasi, Inside Out, November 1997 through February 1998.) BigCorporation uses an eight-step approach to upgrade from NT 4.0 to NT 5.0.

Step 1
Designing the New Infrastructure
NT 5.0 introduces the concept of Organizational Units. OUs are administrative boundaries in AD that organize user and resource objects. Think of an OU as a directory in a file system and think of the OU's users and resources as files within the directory. You can assign a user administrative rights for one OU's accounts and resources but exclude the same user from administrative rights for other OUs' accounts and resources within the same domain. This flexible account and resource organization contrasts with NT 4.0 organization, in which domain boundaries are the administrative boundaries. BigCorporation collapses its four-domain infrastructure into one domain and organizes the domain's accounts and resources into OUs. Delegating administration becomes straightforward when you can grant separate administrative rights for each OU.

BigCorporation administrators design an NT 5.0 network that consists of three OUs: OU-MARYLAND, OU-OHIO, and OU-NEWYORK. Each OU contains all the user accounts and resources for its office. BigCorporation's IS department defines access control lists (ACLs) for the OUs so that each office's local administrators have permission to reset passwords, reboot servers, start and stop services, and perform backup operations on their OU's objects but not on the other OUs' objects.

"But wait," you say. "Won't rolling the four domains into one domain increase traffic over the WAN?" Microsoft anticipated the possibility of an increase in traffic and borrowed the concept of sites from Exchange and Systems Management Server (SMS) for controlling traffic over slower links. Microsoft defines a site as a collection of computers with a local affinity. A more common definition of site is one or more well-connected subnets. This definition leaves unclear how to determine which subnets are well-connected, but one Microsoft document targets 512 kilobits per second (Kbps--about one-third the speed of a T1 circuit and four times the speed of a full ISDN Basic Rate Interface--BRI--connection) as an appropriate amount of bandwidth for devices within the same site. Microsoft doesn't recommend using links slower than 512Kbps or high-speed links that are too saturated to produce at least 512Kbps of bandwidth to connect machines within an NT 5.0 site. NT 5.0's 512Kbps minimum connection speed for machines within a site is substantially higher than Exchange's current minimum speed (128Kbps) for intrasite connections, but the difference isn't surprising. AD's multimaster replication creates a lot of work within NT 5.0 sites. (For more information about multimaster replication, see Mark Minasi, "NT 5.0 Gets Better and Better--Mostly," December 1997.)

BigCorporation uses the TCP/IP subnets Table 2 lists to create three sites: SITE-MARYLAND, SITE-OHIO, and SITE-NEWYORK. BigCorporation defines each site with a /23 addressing scheme, which translates into a subnet mask of 255.255.254.0. By defining each site's IP address range, BigCorporation ensures that every NT system in the domain can differentiate between other machines in its site and systems outside its site (i.e., systems it has slow connections to). NT 5.0 adjusts replication according to site boundaries to minimize traffic over BigCorporation's WAN links.

   Previous  [1]  2  Next