Windows 2000: holy grail or fool's crusade?

Beta 3, the most recent version of the biggest Windows OS ever, offers lots of long-awaited features and new capabilities sure to thrill adventurous early adopters

Summary
If you're feeling adventurous, hidden treasures abound in the newest version of Windows 2000 for the brave souls who are eager to deploy its added features and services. This overview of the Beta 3 release provides a roadmap to your Windows 2000 odyssey. (6,000 words)

By Rawn Shah

If you watched Indiana Jones and the Last Crusade, you'll remember the scene near the end of the movie, in which the hero has to walk through a booby-trapped passage that leads to the holy grail. To reach his goal, and to avoid getting his head chopped off and falling to his death, he has to perform a number of tasks. The only clues he has at hand are research notes left to him by a professorial father figure. He not only has to decipher the notes, but must translate their meaning on the spot or suffer the unkind consequences. You don't have to be Indiana Jones to know what he's going through. Just sign up to test out some Microsoft beta software.

For the would-be adventure hero, the most exciting new trial-by-fire is the all-important Beta 3 version of Windows 2000. Released at the tail end of April, Beta 3 is simultaneously described by Microsoft as "ready for evaluation" (according to the marketing brochures) and "not yet complete" (according to Microsoft VP Jim Allchin). Several Windows hardware vendors have already started offering workstations and server products configured with Windows 2000 Beta 3. Evaluation versions of Beta 3 are commercially available at $60 a copy under the Corporate Preview Program. If you are one of those ready to rush out and grab a copy of the new OS, you may wish to hold off until you read about what's in store for early adopters.

It is not as simple as just installing the software on a machine -- you should use your first Windows 2000 installation as a model for the later migration of your entire network. And you will have to migrate to an all-Windows 2000 network eventually. It's the only way to take full advantage of all the new OS has to offer.

You must take into account a number of considerations before planning a move to Windows 2000, if you intend to do it properly. This article is a not-so-brief primer on the new features and functionality of Windows 2000. It's a thorough rundown of the improvements to the OS, so doubtless only some of this information will be relevant to your needs. But even if you're not eagerly awaiting every new feature and capability, there's plenty to look forward to in this Windows overhaul.

Looks aren't everything
Windows 2000 was originally named NT version 5.0 and has more in common with the NT side of the Windows family and than the Windows 9x side. The name change was intended to neatly combine the two brand names, as well as the two vastly different operating systems, into one package. Unfortunately, Microsoft found out the hard way that combining the disparate OSs is going to take much more effort than they expected. Microsoft VP Steve Ballmer announced back at this year's WinHEC meeting that yet another consumer version stemming from the Windows 9x OS line (which still has a 16-bit kernel) is due in the future. The grand unifying theory of bringing NT/2000 together with 9x will have to wait. But at this point, too much money has been spent focusing on the name change, and so there is no going back to NT 5.0.

Currently, Microsoft's plan is to put four versions of Windows 2000 on the market:

     

  • Windows 2000 Professional (the former NT Workstation)
  • Windows 2000 Server (the former NT Server)
  • Windows 2000 Advanced Server (the former NT Server, Enterprise Edition)
  • Windows 2000 DataCenter Server, a new class of server that should take the platform to even greater heights

     

The first three will be released around the same time, with the DataCenter version coming three months later.

The desktop itself isn't too different than that of Windows 9x or NT 4.0. However, looks aren't everything. Small cosmetic changes are visible, such as the integration of Internet Explorer 5.0 into the desktop shell, fewer icons on the taskbar, and a generally sparser look. (See Figure 1.)

But the real differences are all under the skin. We're talking new hardware support, a better filesystem, greater stability, new network protocol support, a central directory service, properly implemented clustering services and load balancing, and much more. Table 1 offers an overview of just a small portion of the new or enhanced services available with Windows 2000 in each of the different versions.

 


Figure 1. The Windows 2000 Server Desktop

 
Features of the Windows 2000 operating system family
 

Windows 2000

Professional

Windows 2000 Server

Windows 2000 Advanced Server

Windows 2000 DataCenter

Maximum number of CPUs

2

2

4

16

Maximum memory

4 GB

4 GB

64 GB

64 GB

Active Directory (AD) Services

AD Client-only

AD Server

AD Server

AD Server

Security

Kerberos client, IPSec

Kerberos Authentication Server, Certificate Server, IPSec,

Kerberos Authentication Server, Certificate Server

Kerberos Authentication Server, Certificate Server

Network services

Client services (DHCP, PPP, PPTP, L2TP, WINS, Web, FTP, Telnet)

Client and servers (Dynamic DNS, DHCP, PPP, PPTP, L2TP, WINS, Web, FTP, routing & remote access)

Client and servers (Dynamic DNS, DHCP, PPP, PPTP, L2TP, WINS, Web, FTP, routing & remote access)

Client and servers (Dynamic DNS, DHCP, PPP, PPTP, L2TP, WINS, Web, FTP, routing & remote access)

Other services

N/A

Terminal Server, Intellimirror

Cluster Server, Windows Load Balancing System,

Terminal Server, Intellimirror

Cluster Server, Windows Load Balancing System, Terminal Server, Intellimirror

Table 1. Features of the Windows 2000 operating system family

Hardware
The three versions of Windows 2000 server -- Server, Advanced Server, and DataCenter Server -- provide different levels of multiprocessing: two, four and up to sixteen CPUs are supported, respectively. This goes for both Intel and Alpha versions. Windows 2000 Professional will support a maximum of two processors in a workstation. It remains to be seen how well any Windows server works in configurations higher than four processors. Diminishing returns on increased numbers of processors have kept Windows from going too far beyond that. Even those vendors with proprietary extensions to six- and eight-processor models have not been able to push the hardware to the limit.

Windows 2000 Advanced Server and DataCenter Server take advantage of a feature of the Pentium chip family, called the Physical Address Extension bits, to increase the amount of physical memory that can be supported by the system. The previous limit of 4 GB on Intel-based servers was a detriment to supporting large database applications on NT. With this new feature, Intel servers can have up to 64 GB of physical RAM. On Alpha systems, the hardware memory model already supports significantly larger memory, but had been limited to 28 GB under NT 4.0. With Windows 2000, the OS memory management system has also been enhanced to support 64 GB of RAM on Alpha systems as well. There are two catches, though. The first is that hardware vendors have not yet released Intel servers with this capability. However, it is likely that they will make some announcements in conjunction with the final release. The other catch is that this feature will not be supported in the Windows 2000 Professional or the low-end server versions of the OS.

Windows 2000 is also the first Windows server OS that will take advantage of the capabilities of the Intelligent I/O (I20) system available on most Intel servers today. I20 was developed by a group of vendors to reduce processor-intensive tasks created by data transfers between I/O devices on peripheral buses. Thus, disk-controller-to-disk-controller or disk-controller-to-peripheral-printer data transfers can be performed without using too many active cycles on the processor, in turn freeing it up to do the intensive processing. It achieves this functionality through a separate I20 co-processor based primarily on the Intel i960 CPU core. To date, NetWare is the only released system that actually makes use of I20, despite the fact that it has been around since 1997.

Driver model and power management
A significant achievement for Windows 2000 is the replacement of the device driver model to one akin to that of the Windows 9x systems. This means that NT can now support plug-and-play devices as well as better power management services. Although the drivers are literally the same under Win98 and Win2000, you cannot simply take the driver for one and hope to run it on the other. Device driver developers are required to compile their drivers with the system libraries for the appropriate version. In this respect, the driver model primarily benefits developers.

Plug-and-play, also known as dynamically loadable device drivers, has been much a much sought-after item for NT administrators. Because devices can be attached or removed at any point in the system operation, this feature also relates to the power management of the devices. Efficient power management is an important part of desktop systems but is absolutely crucial on portable systems. By slowing or shutting down some devices and components on the system when they are not in use, the system cuts down on power consumption. On desktop systems, this is an important component of wake-on-activity services. Because most desktops can go idle for hours at a time, you can save considerably on power bills if the system goes into sleep mode, shutting down most components except for those that monitor input activity. This feature is implemented in wake-on-LAN capable systems and is a facet of the Desktop Management Interface.

Device drivers can now be signed and certified by the Windows Hardware Quality Labs at Microsoft. Certification doesn't just mean that Microsoft has verified that the driver is a well-tested production model appropriate for your use. It also indicates that Microsoft will include it in its list of supported hardware, and can provide some support for OS problems with the device. Unsigned drivers may still work with the system, but you don't have the assurance that Microsoft has tested them; however, the hardware vendor may already have done intensive tests of their own.

Soon to follow is a driver verifier tool that allows administrators to test the OS interface to drivers and isolate each one for allocation to certain pools only. The tool will also verify the parameters for creating an IRQ request through the kernel. This fairly low-level exposure of the inner workings of drivers will probably only be used by the most experienced administrators or systems programmers.

Disk and filesystems
NTFS is still the dominant filesystem in Windows 2000, but this version has been greatly enhanced. Table 2 shows a comparison of the various filesystems that are supported under Windows 2000. The storage capacity remains the same, but interesting new features include autoencrypting volumes, dynamic mounting and unmounting of volumes without rebooting, per-user volume quotas, sparse files, and a distributed file tree.

 
Comparison of various Windows 2000 usable filesystems
Feature FAT-16 FAT-32 NTFS 4 NTFS 5
Maximum storage capacity 2 GB 64 GB 1.84 x 1010 GB 1.84 x 1010 GB
Minimum disk size 1 MB 1 MB 8 MB 7 MB
Volume level compression No Yes Yes Yes
File- or directory-level compression No No Yes Yes
Per-user quotas No No Third-party Yes
Encryption No No Third-party Yes
Multiple disk spanning volumes No No Yes Yes
Disk mirroring No No Yes Yes
Disk striping No No Yes Yes

Fault-tolerance

No

No

Yes

Yes

Access permissions

No

No

Yes

Yes

Access control lists

No

No

Yes

Yes

Transaction-based disk operations

No

No

Yes

Yes

Distributed filesystem features

No

No

No

Yes

Usable by Windows 95

Yes

Yes in Service Release 2

No

No

Usable by Windows 98 Yes Yes No No
Usable by Windows NT 4.0 Yes Third-party Yes No
Usable by Windows 2000 Yes Yes Yes Yes
Mounting, unmounting, or resizing volumes without rebooting No No Third-party Yes with dynamic disks support enabled

Table 2. Comparison of various Windows 2000 usable filesystems

The improved version of NTFS supports new features for encryption built into the filesystem. All data stored on an encrypted filesystem (EFS) volume is encrypted and any read or write access first goes through the new CryptoAPI component of the operating system, which checks both user permissions and user authenticity keys.

The new version also includes the ability to mount, unmount, resize, repartition, and format drives on the fly. Using Disk Administrator (as opposed to fdisk or any other tools) you can create filesystems that in turn produce what are known as dynamic volumes. These volumes can then be resized at will to add new unpartitioned space to an existing volume while it is still in operation. (It's really just a form of RAID 0 striping.) In other words, if your user drive runs out of space, you can pop in a new drive, partition it, and combine its disk space with the existing user volume, all without affecting system operation.

This NTFS finally includes per-user disk quotas as part of the filesystem and user policy system. At last, you can make strict limits on how much disk space each user is allowed to take up on a single volume. Here Microsoft is playing catch-up with the rest of the industry. NetWare, for example, can provide user quotas down to individual directories rather than whole disk volumes -- an ability with which NTFS still can't compete.

Also supported are sparse files, a method that saves on allocating space to large files until that portion is actually written to disk. Thus, a 100-GB file might only use 30 GB of actual disk space until the other content is saved to disk. This feature is useful mostly to random-write files in which data is nonsequential but still needs to be kept in a specific order. Databases often use such large random-write files to contain their tables.

The Distributed File System (DFS) available with Windows 2000 Servers allows you to combine drives, or directories within drives, to create a single, larger virtual filesystem. This is very similar to the Network File System (NFS)'s ability to concatenate several independent volumes into a single large directory tree. DFS maintains data on individual servers spread throughout the network, but maintains caches of the portions not local to the server. It also manages a distributed file locking mechanism that allows users anywhere on the network to access a file while maintaining its data consistency during write operations.

Directory services
The Active Directory (AD) system is possibly the single most important added feature in Windows 2000. This is the first real directory service put out by Microsoft, mainly to compete with the likes of NetWare Directory Services and servers based on Lightweight Directory Access Protocol (LDAP). Within Windows 2000, AD functions as a data repository service for the local system, application servers, and domain servers.

The AD database maintains information in a hierarchical tree structure, representing every application data object within its nodes. For example, Windows 2000 replaces the flat domain system of NT 4.0 with a hierarchical tree based upon Internet domains. Each domain server in Windows 2000 maintains its own tree of users and groups, which can then be combined with that of other domain servers to create an entire forest of domain trees. Each domain is still handled by its own server, but it is now possible to access any object in the entire forest.

Gathering multiple domain trees into a forest mirrors the multi-master domain model that the NT 4.0 domain system offered, albeit at great difficulty. Microsoft smartly made AD backwards compatible with clients in an NT 4.0 domain system. To non-Windows 2000 clients and NT 4.0 domain controllers, the AD servers look just like other NT 4.0 domain controllers, as they all support the same APIs and services. An NT 4.0 domain controller can be upgraded to a Windows 2000 Server system without disrupting the existing network configuration.

Replication of AD information can be done either for a whole domain tree or in subtrees known as contexts. Each context may reside on a separate server and can be combined into a single domain. Multiple servers can contain replications of the naming contexts as needed between sites. This minimizes the amount of information that has to be replicated between the sites, thereby achieving greater cost savings through lower bandwidth usage.

Windows 2000 implements Dynamic DNS, the latest version of Domain Name Services for IP-based hosts. This allows names and addresses to be dynamically mapped to each other, rather than the traditional static tables that had to be loaded each time a host's name was changed. DDNS is a vital component of an environment that uses the Dynamic Host Configuration Protocol (DHCP) to assign IP address information to other machines.

Under the old system, DHCP clients could be assigned randomly selected addresses from a pool during boot time. Thus, a client's host name and IP address could change at different points in the session. This feature makes DHCP unsuitable for servers. It could also cause many firewalls and Internet hosts to reject access from clients whose host name and IP address did not match. DDNS works very much like the current DNS system, except that the server can now access requests to modify addresses from DHCP servers and can dynamically reload static tables.

AD and DDNS together obviate the need for Windows Internet Name Services (WINS). This service was created to support a common distribution system for NetBIOS name services. WINS is a direct analogue to DNS, except that it transfers the NetBIOS names and addresses of machines instead of IP host names. Although NetBIOS can use TCP as its delivery protocol, it implements its own naming system on top of the delivery protocol. With the refocus on using IP host names rather than NetBIOS names for system services, there is no real need for WINS, assuming, of course, a pure Windows 2000 environment. Windows 2000 servers will likely still need WINS to support Windows 98 and older machines.

Networking
One feature set that admins will love in Windows 2000 Server is its remote access service and networking capabilities. (See Figure 2.) These capabilities are a boon to all users, from those with a small home office network to those using a large LAN. The new routing and remote access services (RRAS) can manage a variety of interfaces, including LAN connections, dial-on-demand modems, virtual private networks (VPNs), and private network spaces (network address translation -- NAT). When used as an NAT, it properly translates addresses at the IP and transport (TCP or UDP) levels and can also firewall traffic to specific TCP and UDP ports. Packet filters allow you to control data leaving or entering the interfaces from any source and to any destination node or network. You can set up the scope of any multicast IP traffic and create your own groups, if necessary.

 


Figure 2. Windows 2000 routing and remote access services

RRAS can run both static and dynamic routing protocols on each network to which the server is connected, including RIPv2, OSPF, and IGMP (for Cisco routers). The server can also act as a DHCP relay agent to pass on DHCP client requests to other networks if they are not supported. If you use dial-up modems to connect, you can set up dial-on-demand for your network. Similarly, you can set up a call-back from your ISP, if you have incoming data from the outside world but are not yet connected.

Windows 2000 now supports new protocol features that improve security and quality of service. In addition, the OS has added support for new hardware technologies like asynchronous transfer mode (ATM). The IP Security protocol (IPSec) defines network packet-level data encryption rules and services between any machines that support it. Essentially, this encrypts all data on a per-packet basis, just as it is being transferred over the network. It reduces or eliminates the need for higher-level security, unless that is also desired.

Unfortunately, IPSec can be hard on the system because it needs to run encryption and decryption algorithms for each packet. On a busy network server, this additional overhead can significantly reduce performance as traffic increases. It does, however, provide the best level of security and is the nexus of communications for virtual private networks. With IPsec installed on each machine, you can directly include remote computers in your domain with less worry that someone is going to peek at your data.

Microsoft already has other methods of creating VPN systems, with Point-to-Point Tunneling Protocol and Layer 2 Tunneling Protocol. These two protocols work at the data-link layer (Ethernet or PPP WAN connections) below the network layer (IP or IPX). This approach can allow any number of different non IP-based protocols to communicate through the VPN channel, but unfortunately, it's limited to Windows OSs only. IPSec has been implemented on most Unix platforms, and there are even hardware accelerators that can offload the encryption/decryption processing for it.

Windows 2000 supports four different forms of quality of service (QS) systems. (See Table 3.) A QS system absolutely guarantees that computers on a network will be able to communicate with each other at a certain security, management, route, or speed level. QS implies that some communications on the network will run at a higher priority than others. With best-effort network protocols like TCP/IP and IPX, QS opens the door to a whole new generation of services that perform exactly as required. Until now, almost all such networks try to make the best effort to deliver packets but fall short of delivering them on time, through specific routes, or in proper sequence.

 
Supported QS protocols
QS protocol Protocol level Services
IP Precedence/diff-serv Network Priority
IEEE 802.1p Data-link Priority, security with 802.1q
RSVP Network Priority, security (with IPSec), Network path, guaranteed delivery (with TCP)
SBM Network Priority

Table 3. Supported QS protocols

The QS services in Windows 2000 include support for IP Precedence, the IEEE 802.1p protocol, the Internet Resource Reservation Setup Protocol (RSVP), and Subnet Bandwidth Manager (SBM). The IP Precedence support uses three long-ignored bits that exist in every IP packet. These precedence bits indicate which packets will be preferred for transfer over others. The IEEE 802.1p protocol defines a three bit priority level within the IEEE Ethernet Frame. This protocol functions in much the same way as the first method, only it does so at the data-link layer, rather than the IP Network layer. IEEE 802.1p works within the context of an IEEE 802.1q Virtual LAN, using other frames to distribute information on computer membership within the Virtual LAN group.

RSVP is an Internet standard that defines QS levels for each device along the network path, including routers, switches and hubs. Basically, it is a patch method that implements guaranteed service on unguaranteed or best-effort networks, like the current IP system. Because QS cannot work if any member of the network does not support it, RSVP attempts to find network paths that can support the minimum and required levels of QS as requested by the user's application.

SBM takes a different route, assuming that computers under its umbrella do not support QS sessions. SBM assigns one server to monitor the network performance of all the other machines and manages the data connections to the best of its knowledge. For example, it takes a 10 Mbps Ethernet connection assigned to a machine and determines how much bandwidth is left once applications start connecting to it. Thus, it can apportion more of its service as requested by the next application. RSVP and SBM both require smart agents that actively monitor how much network traffic is in use or available, and how this traffic is being delivered.

Windows 2000 is the first major platform to support all of these QS systems as a part of the OS. Unfortunately, that means you'll have to wait for most other platforms to catch up before these services become widely used.

Security
The most significant improvement in security is the move to a Kerberos 5-based authentication scheme for network logins. This is a certificate-based method for logging into any server or domain from the network. Because user identifying tickets (and never the password) are sent over the wire, this scheme ensures direct protection of user accounts. This system allows distributed login, also known as single sign-on, from any client station to any server on the network without requiring complicated authentication on individual servers. The Kerberos login server interfaces both with Active Directory, which contains user account information, and the Certificate server, which maintains unique certificates for machines or users.

Other improvements discussed in this article are the use of IP Security Protocol, the encrypted fileystem (EFS), group policies, and object-level security in the domain structure (in ActiveDirectory).

Management
The Microsoft management console (MMC) creates a unified interface to a number of different system management tools. A common framework for accessing existing applications like User Manager, Disk Administrator, Performance Monitor and others makes for much easier management. And treating these administrative tools as MMC snap-ins makes them significantly easier to get at.

The taskpad system can interface with the MMC snap-ins through Web pages to provide a simpler interface that projects only the necessary information. Administrators can limit what appears on the Web page, thus allowing operators to perform only their tasks without having to get total access to the management system. All data snapshots or listviews from snap-ins also can be exported into plain text files for analysis by other non-MMC applications.

Microsoft has implemented a common interface based upon the Distributed (formerly Desktop) Management Task Force's Web-Based Enterprise Management (WBEM) standard, which creates a common interface to devices, management tools and system components with which any WBEM-compliant management tool can interface. Microsoft, Dell, Cisco, Compaq, Intel, Novell, SCO, HP, IBM, and Sun are all members of the DMTF, but to date only Microsoft and Cisco have released WBEM-based products. Windows 2000 still supports SNMP-based management, but only through SNMP agents and a basic SNMP management tool.

Microsoft has finally caught on and added a task scheduling system to the OS. Similar to the Unix cron daemon, this task system was previously available only in the resource kits for NT but has now been incorporated into the general release. There is an added folder in Explorer that lists all the tasks scheduled by the user.

A new scripting interface known as the Windows Scripting Host (WSH) provides a common object-based method to access system services through several Microsoft programming and scripting languages, like Visual Basic, VBScript, J++, and JScript. Think of WSH as a direct method for executing scripts on the system, the same way Active Server Pages do on Internet Information Server.

System stability
To make the system more robust, many system service changes no longer require reboots for a change to take effect. For example, changing network protocol information or adding new plug-and-play devices no longer require a reboot. The same goes for changing video resolution, mouse properties, or adding space to NTFS 5 dynamic volumes. Some server applications like SQL Server or Exchange no longer require a reboot in their latest versions (v7.0 and v5.5/Platinum, respectively.)

In order to avoid file mismatches, essential system files can now no longer be replaced. All vital system files are cataloged and verified for corruption or mismatches after a boot. A similar system is used to prevent dynamically linked libraries (DLL) from mismatching in applications. Multiple versions of DLLs with the same name can now coexist -- the system determines which DLL is needed and selects the appropriate match. Also, new service packs from Microsoft can now be slipstreamed into the system. You no longer have to reinstall the service pack when an application modifies or installs new versions of system files.

Clustering, load balancing, and distributed services
Clustering is a standard component of Advanced Server and DataCenter Server. It is still limited to single-node failover clustering, but more applications have been made cluster-aware, including most of the system startup services, modem pools on both servers, distributed file services, network address assignment, and system upgrades. Active Directory is not a cluster-aware service, but it does support replicated images of the directory on multiple servers to provide high availability.

A separate network load balancing system based upon the Windows Load Balancing Service (WLBS) allows multiple servers to balance out application services. The system links Web servers, FTP servers, and Windows Terminal Server, and also allows connections through Microsoft proxy servers.

With load balancing, you can support up to 32 nodes within the balancing cluster. This service requires the first machine to receive incoming requests, which it then redirects to the next available server for actual processing, rewriting IP addresses when appropriate. In truth, WLBS is a software implementation of a Layer-4 switch that manages TCP and UDP connections between multiple servers. It is not dependent on the application, but changes network information and can be set up with any type of IP-based network application. It provides high-availability of the applications handled by the service.

Windows Terminal Server is now directly integrated into the system, rather than a separate version of NT. You need to specifically install WTS, because it makes changes to the kernel environment in order to support multi-user sessions. The system is identical to that of the NT 4.0 Terminal Server Edition, so there should be nothing surprising here if you have seen that before. It's highly recommended that you install WTS even if you don't expect that your users will need it. This will at least allow administrators to access and manage the entire system remotely.

Remote management
Two new management features make Windows 2000 worthwhile for the desktop: remote installation and Intellimirror. The first allows you to install Windows 2000 Professional or Server on any remote machine from an existing Windows 2000 Server. It takes advantage of a new remote booting technology available in several major network interface cards, known as the Portable Execution Environment (PXE). This boots the system into a mini-OS which allows the administrator to partition and format drives, and to install the operating system remotely. The concept has been employed very successfully in an existing product for all other Windows platforms by a company called ON Technology. Since this process is basically a full installation over the network, it does not suffer the limitations of other techniques, such as "ghosting" (duplicating a preconfigured drive), which require absolutely identical hardware platforms and a hack to modify the system global user identifier (GUID).

Intellimirror is a new creation that allows a sysadmin to specify applications, data files, and preferences that each user on the network may need. When a user moves from one machine to the next, the applications and data are replicated and installed from the server onto that machine. Hence, your data moves with you to wherever you work. The files are stored on the server at all times with only a local copy transmitted to wherever the user sits. After they log out, the resources are resynchronized with the server's copy. It appears that Microsoft is taking a page from the network computing method and making it real: software and data that moves with you wherever you go. Of course, the catch is that the terminal where you go to has be an Intellimirror client (currently only on a Windows 2000 system).

These two new features combined make the life of the administrator significantly easier. Workstation, user, and data deployment is a time consuming task for any large network. By allowing administrators and users to access machines remotely to perform these low-level and privileged tasks, Windows 2000 reduces the time, energy and planning usually required for large deployment projects. Microsoft has even stated that Intellimirror directly competes with Terminal Server and may even prove to be a better performer since it does not load all processing on the server side.

Groups and policies
To go with the new AD system, user groups have also changed. Under NT 4.0, groups were either local to a machine or global to a single NT domain. For users in one NT domain global group to access resources on another domain, you had to create matching group names and access privileges in the other domain. This approach creates an unruly spaghetti of links between users, groups, and domains that quickly becomes a headache to manage.

With AD, local groups exist within single systems and global groups within a single domain. In addition, a new group type called the universal group allows users to span multiple domain trees. This provides users with access to the resources of other domains without having to duplicate that group on each and every domain.

The policy system has also changed since NT 4.0. What used to be just policies per system or domain can now be applied to a computer, an organizational group, a site, a domain, or even multiple domains. The concept remains the same. It still boils down to a common set of rules and rights on what a user can and cannot do on the system.

Should I be an early adopter?
Overall, it seems that Windows 2000 was designed to work, or at least work well, in an environment with other Windows 2000 platforms. There is backward compatibility with other Windows systems. But there are so many new, valuable services that you'd have to migrate your entire network over to Windows 2000 to take full advantage of them.

What's more, some of these services are specific to Windows. Microsoft's motto "Embrace and Extend" is to blame here. They have once again taken many standard protocols and created extensions that work exclusively in the Windows environment. Sure, you can still interface Windows 2000 systems with other Windows or non-Windows platforms through these extensions, but you won't get the full benefit.

To be fair, Windows 2000 is not just about selling more OSs. Some of its improvements are much-needed and very handy. For example, LDAP does not define a security model for each object in the directory, but rather leaves this to the platform. Active Directory integrates the access control list structure and security model of Windows NT into the directory on a per-object level, giving a tight and focused level of security. This may not be a bad idea in the long run, since these new features can be very useful.

Microsoft is exploring quite a bit of new territory with this OS, from support for QS and Internet Printing Protocol, to LDAP Directory Services, and ATM. Now that these protocols and systems have been included in a major OS platform, we will likely see them grow in popularity and usage. It is high time that this happened. Now we can throw out some of the sloppiness that exists in network services today. Many of the network protocols in use now were designed with little foresight, or had different needs and uses that are simply no longer relevant to today's business environment.

Others did not take into account the scale and utility that the Internet would demand these days. For example, the Windows NetBIOS printing and the Unix LPD protocol are both insecure, and somewhat inflexible in the types of devices and document formats and services they can support. Another example is the current Internet Protocol itself, which has no real built-in security or guaranteed services at all. On the home front, the NT domain model becomes hopelessly inefficient when it is scaled beyond a few hundred computers. It is about time that most systems be migrated over to avail themselves of the new services and features that Windows 2000 offers.

Getting W2K-ready
Windows 2000 is going to need a bigger machine. It's tough to say whether this will be true for the final release, but for the beta Server version, 900 MB of storage and 128 MB of RAM is barely breathing room. (Microsoft recommends 256 MB of RAM for the Server.) The Professional version takes less storage but 128 MB is still the minimum. As for processors, anything higher than a 200 MHz Pentium II-class system is appropriate. The larger models, Advanced Server and DataCenter Server, will take even more than that. Although one can set up a Unix server system providing many similar services for a fraction of these hardware requirements, the system may not be able to support all the features of the Windows 2000 environment.

There is a steep learning curve for using most of Windows 2000's new services. Planning a deployment project will require you to consider not only your NT servers, but all other IP-based network servers. For example, you really do need to run the Dynamic DNS server in Windows 2000 to keep Active Directory happy. That means considering the introduction of not only another DNS server but also a DHCP server and perhaps a WINS server. Although the system is more stable than earlier beta versions, there have been many concerns regarding application compatibility and rampant bugs. As common sense dictates, only test it in a safe environment -- that is, on a separate server and workstation LAN. Consider duplicating your existing servers (hardware, data and all) and attempt an upgrade from that system. Although the beta version contains drivers for thousands of devices that have been signed by Microsoft, consider keeping track of the devices and driver files for comparison.

Deploying Windows 2000 now is a journey for an adventurous soul like our courageous hero Dr. Jones. Along the way, there will be pitfalls, nests of snakes, angry villagers, and supernatural forces at play as you implement Windows 2000 across your network. But with a little bit of luck and a whole lot of planning, you may just be able to get away with the golden treasure of a reliable network operating system.