Glossary


Per Seat Licensing

The Per Seat licensing mode requires a Client Access License (CAL) for each client computer that will access a particular BackOffice server product on any server within the network. Once a client computer is licensed for a particular product, the computer can be used to access that product on any server. Any user can log on to that single computer without requiring additional CALs.

If you select the Per Seat licensing mode on a server, any number of licensed computers can be used to connect to the server. However, you must purchase a CAL for each computer whether it uses a Microsoft client operating system (such as Windows 98 or Windows 2000 Professional) or any other client operating system supported by Windows 2000 Server.

Having a valid Per Seat mode Client Access License guarantees access only to a server configured in the Per Seat mode. It does not guarantee a client access to a server that is licensed in the Per Server mode. Such a connection also consumes one of the licenses assigned to the pool of available Per Server licenses assigned to the server. Therefore, the client can connect only if there are fewer connections than the limit allowed on the server.

The Per Seat option is often the most economical one for networks in which clients tend to concurrently connect to more than one server.

Per Server Licensing

With Per Server licensing, Client Access Licenses for a particular server product (such as Windows 2000 Server) are assigned to a server running the product. The number of CALs assigned to the server determines the number of concurrent connections that can be made to that server.

A connection is to a server and not to an individual share point or printer on the server. For example, if you are logged on to a workstation and you connect to \\server\apps and \\server\public from that workstation, that constitutes a single connection and uses only one CAL. However, if you log on to two different workstations using the same username and connect to the server from both, that is considered two connections and uses up two Per Server CALs.

With Per Server licensing, you must have at least as many CALs dedicated a server product as the maximum number of client computers that will connect to that product concurrently. If a network has multiple servers, each server licensed in Per Server mode must have at least as many CALs dedicated to it as the maximum number of clients that will connect to it at any one time.

After the limit is reached on a server, it does not allow additional connections. Clients attempting to connect to the server display an error message. Connections made by administrators are counted in the total number of concurrent connections, but after the limit is reached administers are still allowed to connect. This permits them to manage a lockout situation. Other users can connect only after enough clients (including administrators) have disconnected to get below the limit.

The Per Server licensing mode is primarily for when a network has only one server. Per Server may also be the most economical licensing mode for servers used only occasionally. For example, if a company with 200 employees uses a Windows 2000 Server for dial-up networking, but anticipates that only 50 employees will dial in at any one time. The company should then license Windows 2000 Server in Per Server mode and acquire 50 Windows 2000 Server Client Access Licenses for that server. Per Server mode is usually the most economical licensing mode for special use servers, such as dialup, internet, or bulletin board servers that clients access only occasionally

Security Identifier

A security identifier (SID) is unique number that identifies user, group, and computer accounts. Every account on your network is issued a unique SID when the account is first created. Internal processes in Windows 2000 refer to an account's SID rather than the account's user or group name. If you create an account, delete it, and then create an account with the same user name, the new account will not have the rights or permissions previously granted to the old account because the accounts have different SID numbers. SID is also called security ID or security identifier.

Windows 2000 Remote OS Installation

Windows 2000 Remote Installation Services simplify the task of installing an operating system on client computers throughout the organization. It provides a mechanism for computers to connect to a networked server during the initial boot process, and then allow the server to control a local installation of Windows 2000 Professional.

The Remote Installation Service was designed to reduce the costs currently incurred by organizations that today must either pre-install the client computer or physically visit each client to install the operating system (OS). By combining Remote Installation Services with other IntelliMirror features-user documents and settings, software installation, and group policy-companies will benefit from better disaster recovery with easier OS and application management, resulting in fewer service calls to helpdesk staff.

SRV (service) Resource Record

An SRV resource record allows multiple servers providing a similar TCP/IP-based service to be located by using a single DNS query operation. This record enables you to maintain a list of servers for a well-known server port and transport protocol type ordered by preference for a DNS domain name. For example, in Windows 2000 Server, it provides the means to locate domain controllers that use Lightweight Directory Access Protocol (LDAP) service over TCP port 389.

Security Groups and Distribution Groups

A group may be a security group or a distribution group.

Security groups are listed in access control lists (ACLs), which define permissions on resources and objects. Security groups can also be used as an e-mail entity. Sending an e-mail message to the group sends the message to all the members of the group.

Distribution groups are not security enabled. They cannot be listed in ACLs. Distribution groups can be used only with e-mail applications (such as Exchange), to send e-mail to collections of users.

How groups impact logon

When a user logs on to the network, Windows 2000 determines the groups of which the user is a member. Windows 2000 creates a security token and assigns it to the user. The security token lists the user account ID and the ID of all the security groups the user is a member of. This token is sent to any computer that the user accesses, so that the target computer can determine whether the user has any rights or permissions at that computer by comparing all the IDs contained in the token against the permissions listed for any resources at that computer. (The target computer also checks whether any of the IDs in the token belong to any local groups at the target computer.)

Sometimes you may want to create a group only for e-mail purposes, with no intention of using that group to assign resource permissions to its members. By creating that group as a distribution group instead of a security group, you improve performance because distribution groups are ignored when Windows 2000 builds the user security token during the logon process. This also reduces the size of the token, improving performance as the token is sent to various computers the user accesses.

Converting between security and distribution groups

A group can be converted from a security group to a distribution group, and vice versa, at any time, but only if the domain is in native mode. No groups can be converted when a domain is in mixed mode.

Group Policy

Group policies define the various components of the user's desktop environment that a system administrator needs to manage; for example, the programs that are available to users, the programs that appear on the user's desktop, and Start menu options. To create a specific desktop configuration for a particular group of users, you use the Group Policy snap-in. Group Policy settings you specify are contained in a group policy object, which is in turn associated with selected Active Directory objects-sites, domains, or organizational units.

Group Policy includes settings for User Configuration, which affect users, and Computer Configuration, which affect computers.

Network Address Translation

Private addresses cannot receive traffic from Internet locations. Therefore, if an intranet is using private addresses and communicating with Internet locations, the private address must be translated to a public address. A network address translator (NAT) is placed between an intranet that uses private addresses and the Internet, which uses public addresses. Outgoing packets from the intranet have their private addresses translated by the NAT into public addresses. Incoming packets from the Internet have their public addresses translated by the NAT into private addresses.

Multicast Technology

A group of TCP/IP host computers can use a multicast IP address to send directed communication to all computers who share the use of the group address with. Most IP addresses are unique and specific to a single network computer; however, multicast addresses are shared by many computers.

When the destination address for an IP datagram is an IP multicast address, the datagram is forwarded to all members of a multicast group, which is a set of zero or more hosts identified by the address. The membership of a multicast group is dynamic which means that individual hosts can join or leave the group at any time.

Membership and use of multicast groups is unrestricted and can be compared to membership and use of a group e-mail address: Group membership can be any size, and hosts can be members of many multicast groups.

You can permanently reserve multicast group addresses or temporarily assign and use them. A permanent group is made by permanently reserving a Class D IP address (224.0.0.0 to 239.255.255.255) with the Internet Assigned Numbers Authority (IANA). The reserved address then becomes a well-known address, indicating a specific multicast group that exists regardless of whether or not group member hosts are present on the network.

For multicast IP addresses not permanently reserved with the IANA, all Class D addresses that remain unreserved can then be used dynamically to assign and form temporary multicast groups. These temporary groups can exist as long as one or more hosts on the network are configured with the group's address and actively share in its use.

Internet Authentication Service (IAS)

The Internet Authentication Service (IAS) component of Microsoft Windows 2000 Server performs centralized authentication, authorization, auditing, and accounting of users who connect to a network using virtual private network (VPN) and dial-up functionality.

IAS implements the IETF standard Remote Authentication Dial-In User Service (RADIUS) protocol, which enables use of a homogenous or heterogeneous network of dial-up or VPN equipment.

Microsoft Management Console (MMC)

The Microsoft Management Console (MMC) provides a framework for hosting administrative tools called consoles.

A console is defined by the items on its console tree, which may include folders or other containers, World Wide Web pages, and other administrative items. A console has one or more windows that can provide views of the console tree, and the administrative properties, services, and events that are acted on by the items in the console tree.

The main MMC window provides commands and tools for authoring consoles. The authoring features of MMC and the console tree itself may be hidden when a console is in User Mode. Microsoft Management Console is also called MMC. See also console tree; snap-in.

Authoritative Restore

In Backup, distributed services such as Active Directory are contained in a collection known as the System State data. When you back up the System State data on a domain controller, you are backing up all Active Directory data that exists on that server (along with other system components such as the SYSVOL directory and the registry). In order to restore these distributed services to that server, you must restore the System State data. However, if you have more than one domain controller in your organization, and your Active Directory is replicated to any of these other servers, you will need to perform what is called an authoritative restore in order to ensure that your restored data gets replicated to all of your servers.

During a normal restore operation, Backup operates in non-authoritative restore mode. That is, any data that you restore, including Active Directory objects, will have their original update sequence number. The Active Directory replication system uses this number to detect and propagate Active Directory changes among the servers in your organization. Because of this, any data that is restored non-authoritatively will appear to the Active Directory replication system as though it is "old," which means the data will never get replicated to your other servers. Instead, the Active Directory replication system will actually update the restored data with newer data from your other servers. Authoritative restore solves this problem.

To authoritatively restore Active Directory data, you need to run the Ntdsutil utility after you have restored the System State data but before you restart the server. The Ntdsutil utility lets you mark Active Directory objects for authoritative restore. When an object is marked for authoritative restore its update sequence number is changed so that it is higher than any other update sequence number in the Active Directory replication system. This will ensure that any replicated or distributed data that you restore is properly replicated or distributed throughout your organization.

The Ntdsutil utility and accompanying documentation can be found in the \support\reskit\netmgmt folder on the Windows 2000 installation CD.