Active Directory design help.

[Cary Shultz]

-----Original Message-----
Hello,
I am seeking opinions on WIN2000 Active Directory design.
My company is small with only 3 servers (Exchange, main1
and main2) I have 50 users all in one building.
Information Technology will be centralised and I will use
the company Internet name as the domain name. I have only
one subnet, will have 2 DNS/WINS servers, 1 DHCP. My
Active Directory should facilitate either the company
beeing sold or the company buying another company. I will
be developing remote access so users can work from home. I
wanted to separate my IT department from the rest of the
company so I can install test servers etc..
What would be the best way to design this Active Directory?

Any opinion is welcome as I want to do this right.

Thank you
.

This sure does sound like a test question!

Anyway, if you are going to have WIN2000/WINXP Clients
your WINS Servers may not be necessary. That would depend
on any applications...

I would put the Exchange Server on a WIN2000 Member
Server. I would use the second DC as the File and Print
Server. I would use DFS and IPSec.

For remote access I would install Terminal Services in
Remote Admin Mode on all three Servers so that two admins
can connect to the same server at the same time. I would
use RIS to install WIN2000 Pro with integrated Service
Pack 3 and $OEM$ to install as many Critical Updates and
Recommended Updates as possible, install IE6 SP1 and then
use a batch file to do the remaining. I would use GPO to
install Office 2000 SP3 ( advanced assigned with .mst file
to the user configuration ) and Adobe Acrobat Reader 6.0 (
published to the user configuration ). I would also
install the Admin templates from the Office Resource Kit
so that I could use GPOs to configure the Office 2000
applications.

I would install the IIS Lockdown on the Exchange Server
with the URL Scan and then configure Exchange so that
remote users do not need to enter the "/exchange" at the
end of the URL ( which would be either mail.yourdomain.com
or owa.yourdomain.com ).

There are several other things that I would do but this
should get you started.

HTH,

Cary

 

[Chris Pratt]

I would

use RIS to install WIN2000 Pro with integrated Service
Pack 3 and $OEM$ to install as many Critical Updates and
Recommended Updates as possible, install IE6 SP1 and then
use a batch file to do the remaining.

Hi Cary,

You state that you would use $OEM$ to install as many critical updates. How
does that work? we use RIS but put the updates on afterwards using Windows
Update and our own SUS server.

Thanks

Chris Pratt - MCP

 

[Cary Shultz]

-----Original Message-----

Hi Cary,

You state that you would use $OEM$ to install as many critical updates. How
does that work? we use RIS but put the updates on afterwards using Windows
Update and our own SUS server.

Thanks

Chris Pratt - MCP


.

Chris,

Maybe this is not the prefered way but I am trying to
avoid - for the time being - using SUS and Windows
Updates. I have not had any time to look at SUS yet. So,
having said that...

What I do is as follows:

1) on the RIS Server create an i386 folder and copy the
contents of the WIN2000 Pro I386 folder to that one.
2) on the RIS Server create a SP3 folder and copy the
extracted WIN2000 SP3 contents to that one.
3) run the update.exe -s:e:\ to assimilate ( or integrate,
whatever you choose to call it ) the SP to the OS
4) create an image
5) on the RIS Server go to Setup \ Images \ English \
Images and then to the "win2000.pro" folder. At the same
level as the i386 folder I create an $OEM$ Folder.
6) inside this folder I create a $1 folder and inside that
folder I create a DRIVERS folder ( inside of which is the
NIC, VIDEO and AUDIO folders - where I do include the
drivers for both the Video Card and Sound Card )
7) back to the $OEM$ folder - I simply copy all 23 of the
Critical and Recommended Updates that "work" in this
folder. Naturally, I include a CMDLINES.txt file and use
QCHAIN...I also include DirectX 9.0a in this folder and
include .\blahblah in the cmdlines.txt file as the very
last line so that DIrectX 9.0a is installed. Also, I have
to change the ristndrd.sif so that OemPreinstall = Yes and
all the other obvious changes.
8) when the machine boots up .Net Framework 1.1 is
installed - via GPO ( naturally, computer configuration ).
9) I log on as a domain admin and install IE6SP1 and reboot
10) I log on again as domain admin and run a batch file
that installs the other updates ( there are four of
the 'newer" Q files that have the WINDOWS2000-KB819696-X86-
ENU format that I have to expand and use
\update\update.exe ) and patches. I am just working on
MSXML 3.0 and Windows Media Player 9.0..once I have those
two I have a complete set up.

Seems like a lot of work - and it has been. But once I
get IE6SP1 installed via GPO to the computer
configuration - still working on that little wrapper! - I
will be able to run that batch file via [GuiRunonce] with
the AutoLogon = Yes and the AutoLogonCount = 1...totally
automated. And it takes a bit under 30 minutes for all of
this fun to happen.

I then log on as the user in question and Office 2000 SP3
( advanced assigned to user configuration with
corresponding .mst file ) and Adobe Acrobat Reader 6.0 (
published to user configuration ) are installed via GPO.

There are a couple of other things that I do, such as
create a SYSTEM folder in the $1 folder. Inside this
folder I have a QuickTime 6.3 folder ( with the full file
so that all I need to do is to double click and it will be
installed ) and a UTILITIES folder, inside of which are
four utilities ( GPOTOOL, GPRESULT, QFECHECK AND NETDIAG )
so that I have them readily available should I need to do
anything on that user's machine.

I took a look at the "recommended" way to include the
hotfixes and SP integrated with the OS but it looks like
even more work...

I realize that this is only good for the initial set up
and that I will forever be updating this image. I look at
it in this light: There are always going to be updates and
patches. I will start with a "foundation" that I know is
solid and works. I mean, my set up know takes only 30
minutes from the time I stick in the RIS Floppy to the
time the user is ready to go with a fully functional
production workstation.

And I admit that I will eventually get to SUS. And I
admit that I will eventually get to WIN2000 SP4. I just
need a bit of time to make sure that it works. I have
heard of several situations where SP4 does no-nos...which
I am sure are "environment-specific" to those situations.
I just do not want to be added to that list at any of my
client's locations. Most of my clients are still running
WIN98!!!! Money is tight here in SW Virginia...Not at all
like it used to be in Beverly Hills!

I am also going to start working on the WINXP situation as
there are a couple of newer clients who run nothing but
WINXP Pro...

Anyway, that is how I do things. I need to play with SUS
in a test environment for a bit. I have heard of
situations where SUS messes up Exchange. I am sure that
these two or three situations were caused by the person
doing the SUS not knowing what he was doing...just do not
want to be another one on that list, as well.

Sorry for the novel!

Cary

 

[Daniel S]

That looks pretty impressing Cary, I've only really worked with Ghosting
and sysprep but there seems to be some advantages in what you're doing.
I'm interested in trying to setup the same sort of thing at the place I'm
working at the moment. Is there a resource where I can get specifics as I
don't know anything about QCHAIN and CMDLINES.txt etc.

Thanks, Daniel

-----Original Message-----

Hi Cary,

You state that you would use $OEM$ to install as many critical updates. How
does that work? we use RIS but put the updates on afterwards using Windows
Update and our own SUS server.

Thanks

Chris Pratt - MCP


.

Chris,

Maybe this is not the prefered way but I am trying to
avoid - for the time being - using SUS and Windows
Updates. I have not had any time to look at SUS yet. So,
having said that...

What I do is as follows:

1) on the RIS Server create an i386 folder and copy the
contents of the WIN2000 Pro I386 folder to that one.
2) on the RIS Server create a SP3 folder and copy the
extracted WIN2000 SP3 contents to that one.
3) run the update.exe -s:e:\ to assimilate ( or integrate,
whatever you choose to call it ) the SP to the OS
4) create an image
5) on the RIS Server go to Setup \ Images \ English \
Images and then to the "win2000.pro" folder. At the same
level as the i386 folder I create an $OEM$ Folder.
6) inside this folder I create a $1 folder and inside that
folder I create a DRIVERS folder ( inside of which is the
NIC, VIDEO and AUDIO folders - where I do include the
drivers for both the Video Card and Sound Card )
7) back to the $OEM$ folder - I simply copy all 23 of the
Critical and Recommended Updates that "work" in this
folder. Naturally, I include a CMDLINES.txt file and use
QCHAIN...I also include DirectX 9.0a in this folder and
include .\blahblah in the cmdlines.txt file as the very
last line so that DIrectX 9.0a is installed. Also, I have
to change the ristndrd.sif so that OemPreinstall = Yes and
all the other obvious changes.
8) when the machine boots up .Net Framework 1.1 is
installed - via GPO ( naturally, computer configuration ).
9) I log on as a domain admin and install IE6SP1 and reboot
10) I log on again as domain admin and run a batch file
that installs the other updates ( there are four of
the 'newer" Q files that have the WINDOWS2000-KB819696-X86-
ENU format that I have to expand and use
\update\update.exe ) and patches. I am just working on
MSXML 3.0 and Windows Media Player 9.0..once I have those
two I have a complete set up.

Seems like a lot of work - and it has been. But once I
get IE6SP1 installed via GPO to the computer
configuration - still working on that little wrapper! - I
will be able to run that batch file via [GuiRunonce] with
the AutoLogon = Yes and the AutoLogonCount = 1...totally
automated. And it takes a bit under 30 minutes for all of
this fun to happen.

I then log on as the user in question and Office 2000 SP3
( advanced assigned to user configuration with
corresponding .mst file ) and Adobe Acrobat Reader 6.0 (
published to user configuration ) are installed via GPO.

There are a couple of other things that I do, such as
create a SYSTEM folder in the $1 folder. Inside this
folder I have a QuickTime 6.3 folder ( with the full file
so that all I need to do is to double click and it will be
installed ) and a UTILITIES folder, inside of which are
four utilities ( GPOTOOL, GPRESULT, QFECHECK AND NETDIAG )
so that I have them readily available should I need to do
anything on that user's machine.

I took a look at the "recommended" way to include the
hotfixes and SP integrated with the OS but it looks like
even more work...

I realize that this is only good for the initial set up
and that I will forever be updating this image. I look at
it in this light: There are always going to be updates and
patches. I will start with a "foundation" that I know is
solid and works. I mean, my set up know takes only 30
minutes from the time I stick in the RIS Floppy to the
time the user is ready to go with a fully functional
production workstation.

And I admit that I will eventually get to SUS. And I
admit that I will eventually get to WIN2000 SP4. I just
need a bit of time to make sure that it works. I have
heard of several situations where SP4 does no-nos...which
I am sure are "environment-specific" to those situations.
I just do not want to be added to that list at any of my
client's locations. Most of my clients are still running
WIN98!!!! Money is tight here in SW Virginia...Not at all
like it used to be in Beverly Hills!

I am also going to start working on the WINXP situation as
there are a couple of newer clients who run nothing but
WINXP Pro...

Anyway, that is how I do things. I need to play with SUS
in a test environment for a bit. I have heard of
situations where SUS messes up Exchange. I am sure that
these two or three situations were caused by the person
doing the SUS not knowing what he was doing...just do not
want to be another one on that list, as well.

Sorry for the novel!

Cary

 

[Cary Shultz]

-----Original Message-----
That looks pretty impressing Cary, I've only really worked with Ghosting
and sysprep but there seems to be some advantages in what you're doing.
I'm interested in trying to setup the same sort of thing at the place I'm
working at the moment. Is there a resource where I can get specifics as I
don't know anything about QCHAIN and CMDLINES.txt etc.

Thanks, Daniel

-----Original Message-----
I would
use RIS to install WIN2000 Pro with integrated Service
Pack 3 and $OEM$ to install as many Critical Updates and
Recommended Updates as possible, install IE6 SP1 and then
use a batch file to do the remaining.

Hi Cary,

You state that you would use $OEM$ to install as many critical updates. How
does that work? we use RIS but put the updates on afterwards using Windows
Update and our own SUS server.

Thanks

Chris Pratt - MCP


.

Chris,

Maybe this is not the prefered way but I am trying to
avoid - for the time being - using SUS and Windows
Updates. I have not had any time to look at SUS yet. So,
having said that...

What I do is as follows:

1) on the RIS Server create an i386 folder and copy the
contents of the WIN2000 Pro I386 folder to that one.
2) on the RIS Server create a SP3 folder and copy the
extracted WIN2000 SP3 contents to that one.
3) run the update.exe -s:e:\ to assimilate ( or integrate,
whatever you choose to call it ) the SP to the OS
4) create an image
5) on the RIS Server go to Setup \ Images \ English \
Images and then to the "win2000.pro" folder. At the same
level as the i386 folder I create an $OEM$ Folder.
6) inside this folder I create a $1 folder and inside that
folder I create a DRIVERS folder ( inside of which is the
NIC, VIDEO and AUDIO folders - where I do include the
drivers for both the Video Card and Sound Card )
7) back to the $OEM$ folder - I simply copy all 23 of the
Critical and Recommended Updates that "work" in this
folder. Naturally, I include a CMDLINES.txt file and use
QCHAIN...I also include DirectX 9.0a in this folder and
include .\blahblah in the cmdlines.txt file as the very
last line so that DIrectX 9.0a is installed. Also, I have
to change the ristndrd.sif so that OemPreinstall = Yes and
all the other obvious changes.
8) when the machine boots up .Net Framework 1.1 is
installed - via GPO ( naturally, computer configuration ).
9) I log on as a domain admin and install IE6SP1 and reboot
10) I log on again as domain admin and run a batch file
that installs the other updates ( there are four of
the 'newer" Q files that have the WINDOWS2000-KB819696- X86-
ENU format that I have to expand and use
\update\update.exe ) and patches. I am just working on
MSXML 3.0 and Windows Media Player 9.0..once I have those
two I have a complete set up.

Seems like a lot of work - and it has been. But once I
get IE6SP1 installed via GPO to the computer
configuration - still working on that little wrapper! - I
will be able to run that batch file via [GuiRunonce] with
the AutoLogon = Yes and the AutoLogonCount = 1...totally
automated. And it takes a bit under 30 minutes for all of
this fun to happen.

I then log on as the user in question and Office 2000 SP3
( advanced assigned to user configuration with
corresponding .mst file ) and Adobe Acrobat Reader 6.0 (
published to user configuration ) are installed via GPO.

There are a couple of other things that I do, such as
create a SYSTEM folder in the $1 folder. Inside this
folder I have a QuickTime 6.3 folder ( with the full file
so that all I need to do is to double click and it will be
installed ) and a UTILITIES folder, inside of which are
four utilities ( GPOTOOL, GPRESULT, QFECHECK AND NETDIAG )
so that I have them readily available should I need to do
anything on that user's machine.

I took a look at the "recommended" way to include the
hotfixes and SP integrated with the OS but it looks like
even more work...

I realize that this is only good for the initial set up
and that I will forever be updating this image. I look at
it in this light: There are always going to be updates and
patches. I will start with a "foundation" that I know is
solid and works. I mean, my set up know takes only 30
minutes from the time I stick in the RIS Floppy to the
time the user is ready to go with a fully functional
production workstation.

And I admit that I will eventually get to SUS. And I
admit that I will eventually get to WIN2000 SP4. I just
need a bit of time to make sure that it works. I have
heard of several situations where SP4 does no- nos...which
I am sure are "environment-specific" to those situations.
I just do not want to be added to that list at any of my
client's locations. Most of my clients are still running
WIN98!!!! Money is tight here in SW Virginia...Not at all
like it used to be in Beverly Hills!

I am also going to start working on the WINXP situation as
there are a couple of newer clients who run nothing but
WINXP Pro...

Anyway, that is how I do things. I need to play with SUS
in a test environment for a bit. I have heard of
situations where SUS messes up Exchange. I am sure that
these two or three situations were caused by the person
doing the SUS not knowing what he was doing...just do not
want to be another one on that list, as well.

Sorry for the novel!

Cary

.

Daniel,

First off, it is a lot of work. However, I truly believe
that I can build a good solid foundation with this
method. It takes a bit of time to collect all of the
updates and patches and you need to spend a bit of time
testing.

For example, I found that eventhough two particular
hotfixes ( q329115 and q328310 ) are included in the
$OEM$ / cmdlines.txt file integration after I install
IE6SP1 I need to install them again. I determined this by
using qfecheck.exe...Also, if you go to Windows Update
after installing IE6SP1 you will also see that they show
up again. However, if I do not include them in the
$OEM$ / cmdlines.txt integtration two other hotfixes need
to be reinstalled.

QCHAIN, in short, allows you to install multiple hotfixes
without having to restart your computer. CMDLINES.txt
allows you to harness the power of $OEM$. Enkidu is
correct in that $OEM$ is normally used for installing
device drivers. However, that is only one of the many
things that you can use $OEM$ to do...

I am not a fan of GHOST and Sysprep. I feel that - while
in some situations they are very beneficial - you are not
using WIN2000 to its fullest ( aka GPO ). I understand
how back in the WINNT days it was a God send. However, we
now have RIS. My set up takes 30 minutes from the time I
stick in the RIS Boot Disk to the time the user is working
with a fully functional PC. Mind you, this is more for
the initial set up. SUS would indeed be something to look
at for maintaining the client updates....

Anyway, here are some MS KB Articles on QChain, QFECHECK,
cmdlines.txt and $OEM$:

http://support.microsoft.com/default.aspx?scid=kb;en-
us;296861

http://support.microsoft.com/default.aspx?scid=kb;EN-
US;282784

http://support.microsoft.com/default.aspx?scid=kb;en-
us;249149

http://support.microsoft.com/default.aspx?scid=kb;en-
us;246184

This is just a beginning. YOu can also find a lot of
really good information in Mark Minasi's "Mastering
Windows 2000 Server"...

HTH,

Cary