The advantages of Active Directory

Most computers running Windows XP Professional on large networks are clients in an Active Directory domain running Windows 2000 Server or Windows Server 2003. Much like a phone book acts as a directory of people’s phone numbers and street addresses, Active Directory acts as a directory for resources on a network. Active Directory catalogs information about all the objects on a network, including users, computers, and printers, and makes that information available throughout a network. Active Directory provides a consistent way to name, find, manage, and secure information about these resources.

In a workgroup environment, each computer running Windows XP Professional is responsible for maintaining its own security database. Local user accounts are used to log on to the computer and to control access to resources on the computer. Security and administration in a workgroup are distributed. You must create local user accounts on each computer, and although you can often manage a computer remotely, you must manage each computer separately. The larger the network you are working with, the more overhead this distributed management creates. Active Directory simplifies the security and administration of resources throughout a network (including the computers that are part of the network) by providing a single point of administration for all objects on the network. Active Directory organizes resources hierarchically in domains, which are logical groupings of servers and other network resources. Each domain includes one or more domain controllers. A domain controller is a computer running Windows 2000 Server or Windows Server 2003 on which Active Directory is installed. The domain controller stores a complete replica of the domain directory. To simplify administration, all domain controllers in the domain are peers. You can make changes to any domain controller, and the updates are replicated to all other domain controllers in the domain.

One big advantage that Active Directory provides is a single logon point for all network resources, so a user can log on to the network with a single user name and password, and then access any resources to which the user account is granted access. An administrator can log on to one computer and administer objects on any computer in the network. Windows XP Professional provides a wide range of security settings that you can enforce. You can enforce these settings locally by configuring them on each computer (and that is the way you have to do it in a workgroup environment). In an Active Directory environment, you can use a feature named Group Policy to enforce settings on all computers on the network. This allows the network administrator to make changes faster and improve network functionality without requiring user intervention to invoke changes.