Active Directory was new to Windows 2. Server and further enhanced for Windows Server 2. Windows Server 2. Active Directory provides a single reference, called a directory service, to all the objects in a network, including users, groups, computers, printers, policies and permissions. For a user or an administrator, Active Directory provides a single hierarchical view from which to access and manage all of the networks resources. Why implement Active DirectoryThere are many reasons to implement Active Directory. First and foremost, Microsoft Active Directory is generally considered to be a significant improvement over Windows NT Server 4. Active Directory has a centralized administration mechanism over the entire network. It also provides for redundancy and fault tolerance when two or more domain controllers are deployed within a domain. Active Directory automatically manages the communications between domain controllers to ensure the network remains viable. Users can access all resources on the network for which they are authorized through a single sign on. All resources in the network are protected by a robust security mechanism that verifies the identity of users and the authorizations of resources on each access. Even with Active Directorys improved security and control over the network, most of its features are invisible to end users therefore, migrating users to an Active Directory network will require little re training. Active Directory offers a means of easily promoting and demoting domain controllers and member servers. Systems can be managed and secured via Group Policies. It is a flexible hierarchical organizational model that allows for easy management and detailed specific delegation of administrative responsibilities. Perhaps most importantly, however, is that Active Directory is capable of managing millions of objects within a single domain. Basic divisions of Active Directory. Active Directory networks are organized using four types of divisions or container structures. These four divisions are forests, domains, organizational units and sites. Forests The collection of every object, its attributes and attribute syntax in the Active Directory. Domain A collection of computers that share a common set of policies, a name and a database of their members. Organizational units Containers in which domains can be grouped. They create a hierarchy for the domain and create the structure of the Active Directorys company in geographical or organizational terms. Sites Physical groupings independent of the domain and OU structure. Sites distinguish between locations connected by low and high speed connections and are defined by one or more IP subnets. Forests are not limited in geography or network topology. A single forest can contain numerous domains, each sharing a common schema. Domain members of the same forest need not even have a dedicated LAN or WAN connection between them. A single network can also be the home of multiple independent forests. In general, a single forest should be used for each corporate entity. However, additional forests may be desired for testing and research purposes outside of the production forest. Domains serve as containers for security policies and administrative assignments. All objects within a domain are subject to domain wide Group Policies by default. Likewise, any domain administrator can manage all objects within a domain. Furthermore, each domain has its own unique accounts database. Thus, authentication is on a domain basis. Once a user account is authenticated to a domain, that user account has access to resources within that domain. Active Directory requires one or more domains in which to operate. As mentioned before, an Active Directory domain is a collection of computers that share a common set of policies, a name and a database of their members. A domain must have one or more servers that serve as domain controllers DCs and store the database, maintain the policies and provide the authentication of domain logons. With Windows NT, primary domain controller PDC and backup domain controller BDC were roles that could be assigned to a server in a network of computers that used a Windows operating system. Windows used the idea of a domain to manage access to a set of network resources applications, printers and so forth for a group of users. The user need only to log in to the domain to gain access to the resources, which may be located on a number of different servers in the network. One server, known as the primary domain controller, managed the master user database for the domain. One or more other servers were designated as backup domain controllers. The primary domain controller periodically sent copies of the database to the backup domain controllers. A backup domain controller could step in as primary domain controller if the PDC server failed and could also help balance the workload if the network was busy enough. With Windows 2. 00. Server, while domain controllers were retained, the PDC and BDC server roles were basically replaced by Active Directory. It is no longer necessary to create separate domains to divide administrative privileges. Within Active Directory, it is possible to delegate administrative privileges based on organizational units. Domains are no longer restricted by a 4. Active Directory domains can manage millions of objects. As there are no longer PDCs and BDCs, Active Directory uses multi master replication and all domain controllers are peers. Organizational units are much more flexible and easier overall to manage than domains. OUs grant you nearly infinite flexibility as you can move them, delete them and create new OUs as needed. However, domains are much more rigid in their existence. Domains can be deleted and new ones created, but this process is more disruptive of an environment than is the case with OUs and should be avoided whenever possible. Active Directory Management Gateway Service install problem. I need a 2. 00. 8 domain test environment to serve as a Power. Shell playground, so I have Virtual PC loaded, and have created two test machines. One loaded with Windows 2. Server Standard Edition, 3. The other is Windows 7, 3. The 2. K8 machine is dcpromod to a domain controller. The system requirements for loading ADMGS are that it be running Active Directory Domain Services which it is, and that it have. NET Framework 3. 5 wSP1. I was unable to install ADMGS with 3. SP1. in place, and have since installed. NET 4. 0 and still cannot install ADMGS. This machine does have SP2 installed, and is current on all windows updates. From the link http www. Family. ID0. 08. Im trying to install Windows. KB9. 68. 93. 4 x. When I try, I get the message The update does not apply to your system. If I try to install an incorrect version, I get a dialogue I would expect The version of Windows you have installed does not. So Im puzzled by this. I feel like I meet the installation criteria, and if Im seeing this, other people should be too. But Im not finding anything searching for an answer, so here I am.