Setting Up a Global Group

Creating a new global group is easy. However, once you create a global group you can’t rename it. In order to rename the group you’ll need to create a new group with the name you want to use and assign permissions and users as appropriate. To create a new global group follow exercise 7-15.

Exercise 7-15: Creating a new global group

1. Open User Manager for Domains.
2. Select the domain to which you want to add a global group.
3. Click User | New Global Group.
4. Enter the Group Name and a Description.
5. Select the members you want to add to the group in the right side pane.
6. Click Add.
7. Click OK. You'll see the screen shown in Figure 7-15.

Setting Up a Local Group

Unlike global groups, local groups can be created on a domain controller, member server, or a workstation. Therefore, you can use User Manager for Domains or User Manager to create the group. Like global groups, local groups can’t be renamed. Follow Exercise 7-16 to create a local group.

Exercise 7-16: Creating a new local group

1. Open User Manager for Domains or User Manager.
2. Select the domain or computer to which you want to add a local group.
3. Click User | New Local Group.
4. Enter the Group Name: and a Description. Figure 7-16 shows the screen used to enter this information.

5. Click Add.
4. Select the groups and users you want to add to the group. You can select users from your local machine or trusted domain. Figure 7-17 shows the screen used to enter this information.

7. Click OK.
8. Click OK.

NT’s NetLogon Service

The netlogon service used in Windows NT 4.0 Server domain computing is described in the first section of Chapter 6. When you log on to the network from a remote location, the netlogon service establishes a secure communications channel with the first available domain controller that recognizes the computer as a member of its domain. The netlogon service on the domain controller passes the request to the domain controller’s security subsystem, where the username and password are verified against the domain’s directory service database. If the username and password are correct, the domain controller creates an access token and informs you of a successful match.

Pass-Through Authentication

Pass-through authentication occurs when you choose a domain to log on to from your NT computer, but your computer doesn’t have an account in that domain. When your computer starts it creates a secure communications channel with the domain controller for which it is a member. The connection provides the winlogon process in your local computer with the list of domains available to the workstation. Only the member domain and all trusting domains are displayed in the initial logon list box. This is the same domain controller that responds to the logon request to the domain in which your computer is a member. However, it serves a different role when you choose to log on to a trusted domain.

When logging on to a trusted domain, your request is passed from the domain controller where your secure communications channel exists to the trusting domain’s domain controller. That domain controller then processes the logon and returns a token to your domain controller. Logon then occurs just as it does in domain logon between the trusted and trusting domains, except that another step occurs, in which your member domain controller notifies your computer of a successful logon.

Configuring NetLogon Service

netlogon serviceThe netlogon service not only helps authenticate users, it also manages changes to the directory service database. Use the following key to configure the netlogon service:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetLogon\Parameters

Configurable options are discussed in the following paragraphs.

Pulse

The interval after which the netlogon service looks for new changes to the database and sends a pulse (change notice) to the BDC's (default: 5 minutes).

PulseConcurrency

The number of backup domain controllers that pulses are sent concurrently. A higher number increases the amount of network bandwidth required at each synchronization (default: 10).

PulseMaximum

The interval after which the netlogon service will send a pulse to the BDC's to verify the synchronization level, whether or not there are new changes to the database (default: 2 hours)

PulseTimeOut1

Defines how long (in seconds) the PDC waits for a non-responsive BDC. When a BDC receives a pulse, it must respond within this time period. If not, the BDC is considered to be non-responsive. A non-responsive BDC is not counted against the PulseConcurrency limit, allowing the PDC to send a pulse to another BDC in the domain. If this number is too large, a domain with a large number of non-responsive BDC's will take a long time to complete a partial replication. If this number is too small, a slow BDC may be falsely accused of being non-responsive. When the BDC finally does respond, it will partially replicate from the PDC—unduly increasing the load on the PDC (default: 5 seconds)

PulseTimeOut2

Defines how long (in seconds) a PDC waits for a BDC to complete partial replication. Even though a BDC initially responds to a pulse (as described for PulseTimeout1), it must continue making replication progress or the BDC will be considered non-responsive. Each time the BDC calls the PDC, the BDC is given another PulseTimeout2 seconds to be considered responsive. If this number is too large, a slow BDC (or one that has its replication rate artificially governed) will consume one of the PulseConcurrency slots. If this number is too small, the load on the PDC will be unduly increased because of the large number of BDC's doing a partial sync.

This parameter only affects the cases where a BDC cannot retrieve all the changes to the directory service database in a single RPC call. This will only happen if a large number of changes are made to the database (default: 300 seconds).

Randomize

Specifies the BDC backoff period (in seconds). When the BDC receives a pulse, it will back off between zero and Randomize seconds before calling the PDC. The pulse is sent to individual BDC's, so this parameter should be small. Randomize should be smaller than PulseTimeout1. Consider that the time to replicate a directory service database change to all the BDC's in a domain will be greater than:

[(Randomize/2) * NumberOfBDC'sInDomain] / PulseConcurrency

When this value is not specified in the Registry, NetLogon determines optimal values depending on the domain controller’s load (default: 1 second).

ReplicationGovernor

Limits the amount of bandwidth the domain synchronization process can consume. Forces the netlogon service to sleep between calls and use smaller buffers to allow other network traffic to pass. This is usually configured for slow WAN links, so that directory service database replication won’t consume all your bandwidth. Setting ReplicationGovernor to 50% will use a 64K buffer rather than a 128K buffer and will only have a replication call outstanding on the net a maximum of 50% of the time. Do not set the ReplicationGovernor too low, or replication may never complete. A value of 0 will cause Netlogon to never replicate. The directory service database will be allowed to get completely out of sync. (default: 100% of available bandwidth).

The ReplicationGovernor is set on BDCs only, not on the PDC.

Certification Summary

In order to pass the NT Server 4.0 Core Technologies exam, you need to fully understand the four different NT domain models: single domain, master domain, multiple master domain, and complete trust domain. Be sure to understand the trust relationships involved with each model and which users and groups can be granted access to different domains. Another item to remember is how to configure the netlogon service, especially the ReplicationGovernor. The ReplicationGovernor is used to limit the amount of bandwidth used for synchronizing domains, usually over a slow WAN link.

Two-Minute Drill

Review Questions: Just read, or Click HERE to launch interactive Self Test

1. Domain A trusts domain B. What needs to be done so that the administrator in domain A can be an administrator of domain B?
1. Create a local group in domain A
2. Create a local group in domain B
3. Add the Administrators local group in domain A to domain B’s Domain Admins global group
4. Add the Domain Admins group in domain A to domain B’s local administrator group
2. You changed the ReplicationGovernor on a BDC to a lower value. What effect does this have? (choose all that apply)
1. Lowers buffers on BDC and lowers frequency of call to the PDC
2. Limits the available bandwidth for domain synchronization
3. Reduces the wait time for the PDC to timeout
4. Increases the number of BDC that can concurrently synchronize
3. You have two domains, Sales and Marketing. You want all users in both domains to have access to a resource in the Sales domain. You also only want to use one group to manage access to the resource. What 3 steps must you perform?
1. Create a local group in Sales
2. Create a local group in Marketing
3. Add all users to a local group in Marketing
4. Add all users to a local group in Sales
5. Make Sales the trusted domain and Marketing the trusting domain
6. Make Marketing the trusted domain and Sales the trusting domain
4. Ten Scientists each work on their own computer. Each user is responsible for security and backing up of their own computer’s information. When they need to share information they must ensure only the intended person has access. Which model should you use?
1. Single domain
2. Master domain
3. Complete Trust
4. Workgroup
5. Which variable in the registry do you change to slow down replications of accounts?
1. ReplicationGovernor
2. PulseConcurrency
3. PulseMaximum
4. Pulse
6. User Sally in domain A needs to access a share in domain B. Domain B trusts domain A. What needs to be done to let Sally access the share? (Choose the best Answer)
1. Put Sally’s account in a local group with permissions in domain B
2. Put Sally in a global in domain A, add that global group to a local group in domain B, then give the local group permissions to the share
3. Put Sally in a global in domain B, add that global group to a local group in domain B, then give the local group permissions to the share
4. Put Sally in a local in domain A, add that local group to a global group in domain B, then give the local group permissions to the share
7. In a corporate office you have 1five0 users with 5 servers in a centralized office. MIS wants to keep complete control of user accounts and resources. Which model should you use?
1. Single domain
2. Master domain
3. Multiple master domain
4. Complete trust domain
8. In a corporate office you have 2000 users spread out over three3 buildings. MIS wants to keep complete control of user accounts, but wants the departmental manager to control local resources. Which model should you use?
1. Single domain
2. Master domain
3. Multiple master domain
4. Complete trust domain
9. Production trusts domain Sales. You create a local group in domain Production. What can this group contain? (Choose all that apply)
1. Users from Production
2. Global groups from Sales
3. Global groups form Production
4. Users from Sales
10. What’s the maximum number of trusts available in NT 4.0?
1. 128
2. 256
3. 512
4. unlimited
11. What’s the total recommended number of domain controllers for a single domain with 10,000 users?
1. 3
2. 4
3. 5
4. 6

Answers to Chapter 7 Self Test

1. D. Adding the global group Domain Admins from domain A into domain B’s local group Administrators properly assigns groups. Remember: users into global, global into local, local gets permissions.
2. A, B. Reducing the ReplicationGovernor on a BDC limits the available bandwidth for synchronization by lowering buffers and frequency of calls to the PDC.
3. A, D, F. First you create a one-way trust so that users can get from Marketing to Sales. Then create a local group in Sales. Finally, add all users to the local group you just created. It doesn’t follow to add users to global groups then global groups to local, but you may see this type of question on the test. You really need to understand how groups and users accounts work through trust relationships.
4. D. A workgroup works best in this situation. There isn’t a need for sharing data among all scientists, so a central server isn’t necessary. A workgroup allows each scientist to secure his own information.
5. A. The ReplicationGovernor controls the buffers and frequency of replication.
6. B. You might want to choose A, but it isn’t the best answer (although it works). The best answer follows the guideline: users into global, global into local, local gets permissions.
7. A. A single domain is the best domain to choose for centralized management of user accounts and resources.
8. B. The master domain is best for centralized management of user account and decentralized management of resources. However, if you get more than 40,000 users you’ll need to use the multiple master domain model.
9. A, B, C, D. The only thing that can’t go into the local group would be other local groups.
10. D. NT 4.0 can support an unlimited number of trusts. You may need to increase the amount of nonpaged pool memory or add physical RAM to get more trusts, but the limit of trusts in endless.
11. D. This might have tricked you. Did you choose C? The reason it is six domain controllers is because it includes the PDC. If I asked what is the recommended number of BDC's the answer would be five.