Windows 2000 active directory administration

->>>> Click Here to Download <<<<<<<-

Make sure that you reinstall this file. Make new backups of at least the first two Windows domain controllers that you upgraded to Windows Server in each domain in the forest. Locate the backups of the Windows computers that you upgraded to Windows Server in locked storage so you don't accidentally use them to restore a domain controller that now runs Windows Server Optional Perform an offline defragmentation of the Active Directory database on the domain controllers that you upgraded to Windows Server after the single instance store SIS has completed Windows upgrades only.

The SIS reviews existing permissions on objects stored in Active Directory, and then applies a more efficient security descriptor on those objects. The SIS starts automatically identified by event in the directory service event log when upgraded domain controllers first start the Windows Server operating system. You benefit from the improved security descriptor store only when you log an event ID event message in the directory service event log: This event message indicates that the single instance store operation has completed and serves as a queue the administrator to perform of offline defragmentation of the Ntds.

The offline defragmentation can reduce the size of a Windows Ntds. For more information about how to defragment the Active Directory database, click the following article number to view the article in the Microsoft Knowledge Base:. Otherwise, incrementally delete distributed link tracking objects from Active Directory. For more information, click the following article number to view the article in the Microsoft Knowledge Base:.

If you bulk delete thousands of DLT objects or other objects, you may block replication because of a lack of version store. EXE to perform an offline defragmentation of the Ntds. Configure the best practice organizational unit structure. Microsoft recommends that administrators actively deploy the best practice organizational unit structure in all the Active Directory domains, and after they upgrade or deploy Windows Server domain controllers in Windows Domain mode, redirect the default containers that earlier-version APIs use to create users, computers, and groups to an organizational unit container that the administrator specifies.

For additional information about the best practice organizational unit structure, view the "Creating an Organizational Unit Design" section of the "Best Practice Active Directory Design for Managing Windows Networks" white paper.

Repeat steps 1 through 10 as required for each new or upgraded Windows Server domain controller in the forest and step 11 Best Practice organizational unit structure for each Active Directory domain.

Before you upgrade Windows domain controllers to a production Windows domain, validate and refine your upgrade process in the lab. If the upgrade of a lab environment that accurately mirrors the production forest performs smoothly, you can expect similar results in production environments. For complex environments, the lab environment must mirror the production environment in the following areas:. An understanding of the upgrade process and complexity of the environment combined with detailed observation determines the pace and degree of care that you apply to upgrading production environments.

Environments with a small number of domain controllers and Active Directory objects connected over high availability wide area network WAN links might upgrade in only a few hours.

You may have to take more care with enterprise deployments that have hundreds of domain controllers or hundreds of thousands of Active Directory objects. In such cases, you may want to perform the upgrade over the course of several weeks or months.

On domain controllers with insufficient disk space, use the following steps to free up additional disk space on the volume that hosts the Ntds. Delete any user or memory dump files. Temporarily remove or relocate files that you can access from other servers or easily reinstall. Delete old or unused user profiles. To do so, click Start , right-click My Computer , click Properties , click the User Profiles tab, and then delete all the profiles that are for old and unused accounts.

Don't delete any profiles that may be for service accounts. Perform an offline defragmentation. An offline defragmentation of the Ntds. Perform the offline defrag by using other local volumes if one is available. Or, use space on a best connected network server to perform the offline defragmentation.

If the disk space is still not sufficient, incrementally delete unnecessary user accounts, computer accounts, DNS records, and DLT objects from Active Directory. Active Directory does not delete objects from the database until tombstonelifetime number of days by default, 60 days have passed and the garbage collection completes.

If you reduce tombstonelifetime to a value lower than end-to-end replication in the forest, you may cause inconsistencies in Active Directory. Skip to main content. This browser is no longer supported. Skip to main content. This browser is no longer supported. Download Microsoft Edge More info. Contents Exit focus mode. Is this page helpful? Please rate your experience Yes No. We cannot process tax exempt orders online.

If you wish to place a tax exempt order please contact us. Add to cart. These accounts are designed to provide the basic setup necessary to grow your network. Three types of default accounts are provided:. Built-In User and group accounts installed with the operating system, applications, and services. Implicit Special groups created implicitly when accessing network resources; also known as special identities. Note: Although you can modify the default users and groups, you can't delete default users and groups created by the operating system.

The reason you can't delete these accounts is that you wouldn't be able to re-create them. The SIDs of the old and new accounts wouldn't match, and the permissions and privileges of these accounts would be lost.

Built-in user accounts have special uses on Windows While all Windows systems have one built-in account called LocalSystem, other built-in user accounts may be available.

LocalSystem is a pseudo-account for running system processes and handling system-level tasks. The account is available on the local system only. You can't change the settings for the LocalSystem account with the user administration tools. Users can't log on to a computer with this account.

Note: While users can't log on to a computer with the LocalSystem account, certain processes can log on using this account. For example, Windows services can be configured to log on to a computer using the System account. For more information, see the section of Chapter 3 entitled "Managing System Services.

When you install add-ons or other applications on a workstation or server, other default accounts may be installed. You can usually delete these accounts. These accounts are defined in Active Directory when they're configured on a domain.

However, they're defined as local users when they're configured on a stand-alone server or workstation. Another built-in account that you may see is TSInternetUser. This account is used by Terminal Services. Two predefined user accounts are installed with Windows —Administrator and Guest.

With workstations and member servers, predefined accounts are local to the individual system they're installed on. Predefined accounts have counterparts in Active Directory.

These accounts have domain-wide access and are completely separate from the local accounts on individual systems. Administrator is a predefined account that provides complete access to files, directories, services, and other facilities.

You can't delete or disable this account. In Active Directory, the Administrator account has domain-wide access and privileges. Otherwise, the Administrator account generally has access only to the local system. Although files and directories can be protected from the Administrator account temporarily, the Administrator account can take control of these resources at any time by changing the access permissions.

Tip To prevent unauthorized access to the system or domain, be sure to give the account an especially secure password. Also, because this is a known Windows account, you may want to rename the account as an extra security precaution. In most instances you won't need to change the basic settings for this account.

However, you may need to change its advanced settings, such as membership in particular groups. You'll find more information on these groups in the next section.

Real World In a domain environment, you'll use the local Administrator account primarily to manage the system when you first install it. This allows you to set up the system without getting locked out. You probably won't use the account once the system has been installed. Instead, you'll probably want to make your administrators members of the Administrators group.