486DX\33.

12MB RAM (16MB recommended on x86 and required on RISC)

110 MB Free disk space.

486DX\33.

16MB RAM

125 MB Free disk space.

Supports Back Office Products.

Tuned for file & print and applications.

Supports 256 inbound RAS connections.

Fault Tolerance

IIS

Apps and the subsystem run in user mode.

Low Priority, no direct hardware access, assigned address space.

NT executive runs in Kernel mode to protect it from user apps.

Full memory and hardware access

Device Drivers – control access to hardware.

MicroKernel – thread scheduling and interrupt handling

HAL – separates NT from different hardware interfaces to make NT more portable.

NT can access up to 4GB of RAM. NT maps the memory in 4kb blocks called pages. A Virtual Memory Manager intercepts requests to be sent to memory and checks for enough pages in RAM. If there are not enough pages then pages that have not been accessed in a while are moved to the hard drive for storage. There is a file on the hard drive called pagefile.sys that stores these pages.

The recommended size of the paging file is RAM +12MB. I.e. In a system with 128MB RAM, the page file should be 140MB.

Domains require an NT Server to be a domain controller and to house the account database for all users and computers in the domain.

Domains give you the advantage of centralized management of resources and security.

One logon provides access t all resources in the domain.

Workgroups require no Domain controller and are good for small numbers of computers (10 or less)

Windows NT requires a mandatory logon to use the system.

A local security authority (LSA) pass the username and password info to the domain controller. The domain controller’s Security Accounts Manager (SAM) verifies the username and password against its database and the results are passed back to the LSA if approved. The LSA then creates an access token with the granted access rights. This token will be used to access all resources during this logon preventing the user from being constantly authenticated.

All computers accessing a domain must have a computer account in that domain. This can be created through the Server Manager tool or a system being built can join the domain during the install with proper administrative rights.

Before installing Windows NT, check to see that all of your systems hardware is on the Hardware Compatibility List (HCL).

Windows NT uses a System Partition and a Boot Partition. These can both be on the same partition or on different partitions.

The Boot Partition contains the system files.

The System partition is the one you boot from. (Makes sense huh?)

You park in a driveway and drive on a parkway.

Supported by Windows 95, NT, MS-DOS and OS2. It is necessary to use FAT on the system partition in order to dual boot (run two OS’s). NT does not support FAT32.

FAT partitions can be converted to NTFS by running Convert.exe

Only supported by Windows NT. NTFS is more secure and allows you to give security to the file level

Any other OS running on the same physical system will not be able to access the NTFS drives. Any OS coming in remotely will be able to access NTFS.

During an install, you can choose either NTFS or FAT. The Setup program formats the partition as FAT regardless and then later converts to NTFS if that is what you chose. FAT has a maximum partition size of 4GB so you will only be able to create a 4GB partition during the install. You can get around this by putting the drive as a second drive in another system running NT and format a partition larger than 4GB.

There are three types of server in a Domain Environment.

Primary Domain Controller (PDC) – Maintains the master copy of the directory database.

Authenticates users. This is the first server in a domain. It is required and there can only be one in a domain.

Backup Domain Controller (BDC) - Contains a copy of the account database.

Authenticates Users. This acts as a backup in case a PDC fails and helps to load balance authentication. In the event of a PDC failure, the BDC can be promoted to a PDC.

Member Server – Used for Apps and File and Print Servers. Can be a member of a workstation or a domain. It can never be promoted to a BDC or PDC without a total rebuild.

Security Identifiers (SID’s) – All computers in a domain are issued a SID. This is NT’s method of insuring that you belong in the domain. A computer without a SID from that domain will be denied access.

The PDC and BDC’s all share the same SID. For this reason, you cannot move a PDC or a BDC to another domain without a total reinstall.

A member server or workstation however can be moved to a new domain and will be issued a new SID from the new domain.

To change the name of a domain, first change the name on the PDC. This will issue a new Domain SID. Then change the domain on all of the domain members.

Windows NT has two licensing modes: Per Server or Per Seat. You will need to choose one during the install of the Server.

Per Server – One Client Access License (CAL) is needed for each concurrent connection to a server. I.e. if you want ten clients to connect to Server A at the same time, you will need 10 client licenses for Server A. If you want the same ten people to be connected to Server B at the same time, you will need ten more client licenses.

Per Seat – One CAL is required for each client. The client then has the option to access all of the Servers in the organization.

It is possible to do a one-time conversion from per server to per seat licensing.

Windows NT comes with a CD and 3 floppy disks.

There are four setup options: Typical, Portable, Compact and Custom.

After booting with the 3 floppy disks, The setup application is called winnt.exe or winnt32.exe

Winnt.exe is used from 16 bit operating systems such as DOS or Windows95.

Winnt32.exe is used from 32 bit operating systems – NT. This is used to upgrade or reinstall.

Some switches to be aware of are:

/ox – causes winnt.exe to not install but only to create the three boot disks.

/b – installs without the use of the three boot disks. Good for network installs or bootable CD-ROM’s

/u – unattended install

/udf – unattended install with a uniqueness database file.

There are several other switches that you can see by running winnt.exe /? But these are the most common.

By running Winnt or winnt32 with the /u or /udf switch, you can perform an unattended install.

You create an unattended.txt file with answers to the questions that are asked during setup.

You can create answer files for different locations so you can choose different answers.

These answer files can be further customized with Uniqueness Database Files (UDF’s) which contain user and computer names.

These are strictly text files that can be modified with any text editor.

You can use Sysdiff.exe to automate the install of Apps.

My recommendation is to bag the whole unattended install and purchase Ghost cloning software from www.ghostsoft.com.

The easiest and safest method of making registry changes is through the control panel.

The registry can also be edited directly using Regedit and Regedt32. Both of these tools make changes that have immediate effect on the registry.

The Registry is divided into 5 subtrees.

HKEY_LOCAL_MACHINE – Configuration data for the local computer. Used by apps, drivers and the OS. Part of this data tells the OS which drivers to load at boot.

HKEY_USERS – two subkeys -. DEFAULT contains the default system profile. The SID of the user currently logged on.

HKEY_CURRENT_USER – stores information about the user currently logged on and stores a copy in the Profiles folder.

HKEY_CLASSES_ROOT - Contains software config data. Provides compatibility with the win3.1 database.

HKEY_CURRENT_CONFIG – Contains data about the active hardware profile.

Policies

A system Policy is a set of registry settings that will overwrite the local machine and current user registry keys. Upon logging on to the domain, the system checks the NetLogon share for a policy file. This file is called ntconfig.pol for NT clients or config.pol for 95 clients.

1) If user changes are specified for that user, these changes merge into the current portion of the registry.

2) If there is no policy for that user, but for groups that user belongs to, these are merged into the registry in order of priority. Then the default user policy is merged in.

3) If there are no user or group policies for that user then the default system policy is merged into the current user portion of the registry.

4) If system policy is defined for the computer, this is merged into the local computer portion of the registry. If not, the default computer portion is merged in.

You may have up to four primary partitions, three if you have an extended. Primary partitions cannot be broken down further. Multiple primary partitions allow you to isolate OS’s. To dual boot NT with DOS or 9.x, the primary partition must be fat. The Windows NT partition must be a primary partition.

Volume sets do not provide any fault tolerance.

If a volume set spans 10 physical disks and you lose one, you lose all data from the volume set.

Boot and System partitions can not reside on a volume set.

An NTFS volume set can be extended to add additional space without losing any data. A fat volume set has to be converted to NTFS to extend without losing data.

Stripe sets do not provide any fault tolerance.

If a stripe set spans 10 physical disks and you lose one, you lose all data from the stripe set.

Boot and System partitions can not reside on a stripe set.

Stripe and Volume sets are created from within Disk Administrator.

Windows NT uses a file called the boot.ini to find the boot partition when starting up. If the boot partition was on an extended partition that was renumbered due to a Primary partition being added, the boot.ini must be manually changed to reflect this.

RAID1 – Disk Mirroring - using the NT fault tolerant drive (ftdisk.sys) to write to two physical disks at the same time. The boot and system partitions can reside on a mirror set. You will lose write performance as you are writing to two consecutive disks but you will gain read performance as you read from both disks simultaneously. If one drive in a mirror fails, the system will keep functioning. If you mirror two 4Gig drives, you will have 4Gig of storage space, this can get expensive hardware wise. To recover from a disk failure, go to disk administrator and choose break mirror from the fault tolerance menu. Replace the disk or choose space from another disk and choose recreate mirror.

Disk Duplexing – also falling under the RAID1 category. This is the same as mirroring except each disk has its own disk controller.

RAID5 – Stripe Sets with Parity – You need 3 to 32 disks to make up a stripe set with parity. Like stripe sets, the data is written to disks in 64K blocks. Data is written to each disk in sequence. One block will be written to the first disk, the next block will be written to the second disk and so on. For every write, some algorithms are performed to give us our ‘parity information’. This parity information allows NT to recreate data in the event of a disk failure. The parity info is written across all disks in the array thus giving the ability to recreate data in the event of a disk loss.

Ex. You have a 10 physical disk RAID 5 array. One of the disks dies. You can replace the failed disk, go to Disk Administrator and choose regenerate stripe set from the fault tolerance menu and NT will do the calculation from the parity info on the other 9 disks and recreate your data.

The Boot and system partition may not reside on a stripe set. You will lose some write performance, as the parity calculations have to be done for each write. In a 5 disk RAID 5 array, you will be able to have 4 disks worth of data and one disk worth of parity info. The parity info will take up 1/5 of each disk, not be all on one disk. In a 8-disk RAID 5 array, you will have 7 disks worth of data. (See the pattern).

You can recover from the loss of one disk, but if you lose 2 or more disks, you can not recover. (Hope you had a good backup). (Remember ‘one can be done, two you’re screwed’)

Hardware RAID – this is independent of the operating system. Vendors offer hardware with array controllers that handle writing the data to the disks. This method is quicker because the OS does not need to get involved but is also more expensive.

A DHCP server must have a static IP address. A scope is set up which is a range of valid IP addresses that a DHCP server can assign. If you have multiple DHCP servers, they must each have a unique scope to avoid assigning duplicate IP addresses. You can have multiple scopes on a DHCP server.

For redundancy, you should share part of your scope with another DHCP server.

Ex. You have the subnet 222.222.222.x. You can give a scope of 222.222.222.1 to 222.222.222.188 to your primary DHCP server and a scope of 222.222.222.189 to 222.222.222.254 to a secondary server. This will allow clients to obtain a lease if the primary DHCP server is down but will avoid the leasing of duplicate IP’s. Microsoft’s recommendation is to have 75% of the addresses in the primary and 25% in the secondary. DHCP can also hand out many other pieces of information including Routers, DNS Servers, and WINS Servers… These can be configures on a global level, scope level or client level.

WINS is responsible for resolving NetBIOS names to IP addresses. When a WINS client boots up it announces itself to the WINS server. The WINS server stores the name and IP of the client in the database to hand out on future requests. This enables you to connect to a server named Appsserver by name instead of having to remember Appsserver’s IP address. The WINS database is dynamic.

Domain Name System (DNS)

DNS is responsible for resolving Fully Qualified Domain Names (FQDN) names to IP addresses. DNS is static and all entries must be manually added. DNS enables you to connect to www.CERTguide.com instead of having to remember 24.128.102.7. DNS allows connection to the Internet using Internet naming standards.

Windows NT uses a browse list to store all of the NetBIOS names of computers on the network. The PDC of a domain is the domain master browser and collects the information for the browse list. This information is handed to the Master Browser. There is one master browser in each subnet. The master browser distributes the browse list to the backup browser who distributes the list to the clients when requested.

To insure that there is only one master browser per subnet, an election is held when one can not be located. An election packet is passed around and examined by each system to see if it is the most qualified. Qualifications include OS (NTserver then NTWS then win9x then Win3.x), OS version (NT4 then NT3.51…), Browser config (Browser, Potential Browser, Non Browser)

Browser configuration is set in the registry under:

\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\MaintainServerList

Values are:

Yes - attempt to become a browser, default for domain controllers

No - Never participate in an election

Auto – Participate in election to see if most qualified, default for member servers and WS’s

RAS allows remote connection to the network by use of a phone line.

Serial Line Internet Protocol (SLIP) – uses TCP/IP connection or serial lines. SLIP requires a static IP and cannot use DHCP or WINS. No support for IPX/SPX or NetBEUI. Passwords are transmitted as clear text.

Point to Point Protocol (PPP) – enhancement to SLIP. Supports TCP/IP, IPX/SPX and NetBEUI. Can automatically assign IP addresses.

Multilink – combines multiple physical lines to increase bandwidth. Both the client and the RAS server need to have multilink protocol enabled.

Point to Point Tunneling Protocol (PPTP) – can transfer IP, IPX, or NetBEUI PPP packets over a TCP/IP network. This protocol allows the use of the Internet as a virtual private network.

Callback Security - requires the RAS server to call the client back either at a specified number or at a number the client puts in.

RAS supports NetBEUI, TCP/IP and IPX/SPX.

TCP/IP can either assign using DHCP or from a static pool.

Gateway Services for NetWare(GSNW) - used for occasional access to a NetWare server by a Microsoft client.  The NT server connects to the NetWare File server  and shares a directory.  Microsoft clients can then access the share on the server running GSNW.  This avoids having to install CSNW on all of the clients. 

1)  Set up a user account on the NetWare server with the same name and password as the NT server running GSNW.
2)  Give the account the appropriate permissions on the NetWare side.
3) Create a group account called NTGateway on the NetWare server.
4) Place the user account that you set up on both the NT and NetWare side in step one in the NTGateway group.

Ntldr - loads the Operating System - NT changes the boot sector so Ntldr loads at startup.

Boot.ini - builds the Operating System selection menu

Bootsect.dos - called by Ntldr if you choose to load an alternate OS(DOS, Win95, IBM O/S2 v1)

NTdetect.com - Inventories hardware and passes to Ntldr.

Ntbootdd.sys(SCSI with BIOS disabled only) - accesses SCSI devices during boot.

Ntoskrnl.exe - The NT kernel located in systemroot\system32

System - contains system configuration settings - controls which drivers and services are loaded.

Device Drivers - support for various device drivers such as ftdisk and scsidisk.

Hal.dll - Hardware Abstraction Layer protects the kernel and the NTexecutive from platform specific hardware differences.

NTdetect failed means that NTdetect.com is missing.

The following file is missing or corrupt  Ntoskrnl.exe means the Ntoskrnl is missing or the boot.ini is pointing to the wrong drive.

The Emergency Repair Disk will remedy all of these problems.

Ex. Multi(0)disk(0)rdisk(1)partition(2)

Multi/SCSI – identifies the disk controller. SCSI indicates that the SCSI bios is not enabled. Everything else uses multi including SCSI with bios enabled. (x) Is the ordinal number of the hardware adapter. If there are two SCSI controllers, the first will be (0); the second will be (1).

Disk(x) – SCSI bus number. Always set to 0 for multi. Only used with SCSI

Rdisk(x) – ordinal number of the disk. Only used with multi.

Partition(x) – ordinal number of the partition.

All of the above are numbered starting with (0) except partition which starts numbering with (1).

2) Edit the boot.ini to reflect the proper ARC path if necessary.

3) Copy the following files to the floppy.  Ntldr, NTdetect.com, Boot..ini, and Ntbootdd.sys (for SCSI systems with BIOS disabled)

If you install a video driver or a SCSI driver, et. al, and NT crashes, shut it off and back on and press the space bar at boot to get to the last known good configuration.   Once you log on again the configuration will be overwritten.

You must be an administrator or power user to create an ERD.

The user creating the ERD must have permissions to the systemroot\Repair folder.

Run rdisk.exe to create the ERD.  You must run Rdisk /s to include the SAM and security information.

2) Select repair a damaged installation instead of installing.

3) You will be prompted for the repair disk.

You will have four choices to repair:

Inspect Registry files - replaces registry files with files from disk.  Any system changes since disk was updated will be lost.
Inspect Startup environment - will rebuild the boot.ini.  Useful if win9.x is installed after NT
Verify NT system files - checks Ntldr, NToskrnl and will prompt to replace if the one on the system does not match the disk.
Inspect boot sector - use when no OS on the computer boots.

There are two Built in accounts  - Guest and  administrator

In addition to these built in accounts, you can create accounts with the appropriate permissions that they need.

Domain user accounts are created with User Manager for Domains.  The account is created in the master directory on the Primary Domain Controller(PDC)  A copy of this directory is stored on all Backup Domain Controllers(BDC)'s.  These changes may take a few minutes to get to all of the BDC's thus preventing logon to the new account.  After making changes, you may choose to manually sync the database by using sever manager or typing net accounts /sync at the command prompt.

Local User accounts can be created on a member server or workstation and will allow local access to the computer.

Domain user accounts can be created from workstations or 9.x boxes if you have the administrative tools installed.

All usernames must be unique and may contain up to 20 characters.  You may restrict user logon hours and systems they are able to logon to.  You may also assign a user a home directory and grant dialin permissions.

Each username is assigned a unique security identifier(SID).  This is what stores the users rights and permissions in the directory.  If you delete a user account and recreate one with the same name, it will have a different SID and will not hold the same rights and permissions.  If you rename an account however it will hold the same SID and will have identical permissions.  If Jack leaves the office and Jill starts, rename Jack's account if you want Jill to have the same access.

Roaming profiles are stored on a server so a user can see his\her desktop wherever they log on.

Personal Profiles - Assign a profile to each user that they can update.  The updated copy will remain on the server so their settings will follow them.

Mandatory Profiles - Can be assigned to many  users so an administrator only has to update one profile.  Users will not be able to update a mandatory profile and will be forced to use the same desktop settings each time they log on.

Users can be assigned to a group.  A group is a collection of users that you can assign rights and permissions to.  Any member added to the group will automatically inherit the rights and permissions from the group.  Only users with administrative rights can create groups.  Groups are created from within User Manager for Domains.

NT uses two types of groups:  Global and Local.

Local - Local groups are given rights to a task or permissions to resources.  Local groups can include Global groups or individual user accounts from any domain that has the appropriate trust set up.  Local groups on a Domain Controller can be given rights or permissions to any domain controller within the domain.

Global -  Global groups are used to organize user accounts.  A global group can only include users from its own domain and cannot include other groups.  Global groups are created on the PDC in the domain where the account resides.  Global groups are added to local groups to give permissions or rights to the users.