Ad Replaces Sam

Windows 2000 Active Directory replaced Windows NT 4.0 Security Account Manager Database, providing not only increased functionality and scalability, but also enhanced security through more-granular levels of permissions, sophisticated encryption, and two-way, resilient authentication protocol (with Kerberos). With the Windows 2003 platform, Microsoft takes full advantage of these features by allowing more flexibility in the way Active Directory information is partitioned and replicated.

Starting with Windows 2000, Active Directory has been divided into three "logical" partitions (physically residing in the NTDS.DIT file on each domain controller) -- domain, configuration, and schema. The domain partitions store information specific to each domain (accessible primarily via Active Directory users and computers) and shared among all domain controllers in the same domain (partially replicated to all Global Catalogs in the forest).

The configuration partition contains forest-wide information (accessible primarily via Active Directory sites and services) and is shared among all domain controllers in the forest. The schema partition consists of definitions of all objects and their properties that can exist in the other two partitions; it is also shared forest-wide.

This mechanism for partitioning Active Directory data has been extended in Windows 2003 domains by the introduction of the application partition. Several features differentiate it from its three older counterparts:

Most importantly, application partitions are intended for custom, Windows 2003 Active-Directory-aware applications. Although they are typically created by such applications, you can also experiment with application partitions using the NTDSUTIL command line utility. For example, you can create your custom application partition with the following steps:

After typing NTDSUTIL at the command prompt, you will be presented with ntdsutil prompt. Start by typing domain management. (Typing ? lists available commands.)

To proceed, you must establish a connection to one of existing domain controllers. This is done from the connection context, which is accessed by typing connection at the domain management prompt.

Next, type in connect to server dc_name, where dc_name is the name of the domain controller to which you intend to connect. You can also provide alternate credentials if you do not want to use the same account you are logged on as.

Once a connection is established, type quit to return to domain management context.

Type create nc partition_name dc_name where partition_name and dc_name are, respectively, the names of the application partition and the domain controller hosting it. The application directory partition is expressed in the fully qualified notation. For example, an application partition called app-one.serverwatch.com would take the form dc=app-one,dc=serverwatch,dc=com.

You can also create additional replicas of the partition created on another domain controller