Copyright: Thursday, January 20, 2000 15:36:30


A Windows NT domain in the multiple master domain model that contains user accounts.


In Active Directory Migration Tool, agents are dispatched to individual computers to perform operations that can only be performed locally. An agent runs as a service on the individual computer. Examples of operations performed by an agent include changing the computer's logon domain, updating security permissions on resources, and migrating local profiles.

See also dispatcher.


Software that determines what pending tasks should be done next and assigns the available resources to accomplish the tasks. It may execute other programs or generate a list for human operators to follow. In Active Directory Migration Tool, the dispatcher sends agents to individual computers and monitors their progress.

See also agent.


A form of restructure, where one or more child domains are restructured into their parent domain.

See also restructure.


A form of restructure, where two or more domains are combined into a smaller number of domains.

See also restructure.


The process of moving user accounts, groups, or computer accounts in a Windows NT domain to a Windows 2000 native mode domain. Domain migration can be achieved either by upgrading the Windows NT domain to Windows 2000, or by creating an ideal Windows 2000 forest, and moving the objects from the Windows NT domain to a Windows 2000 domain in the new forest.

See also domain upgrade; native mode.


The process of changing the current domain structure to an ideal domain structure. This involves creating or identifying the appropriate destination for users and groups in the forest and cloning or moving users and groups from their current location.


The process of upgrading a Windows NT domain to Windows 2000 by upgrading the primary domain controller (PDC). This domain is now a Windows 2000 mixed mode domain. After the first upgrade the backup domain controllers (BDCs) can be upgraded. When all of the BDCs have been upgraded, the domain can be switched into native mode.

See also mixed mode; native mode.


A collection of one or more Windows 2000 domains that share a common schema, configuration, and global catalog and are linked with two-way transitive trusts.

See also intraforest migration; interforest migration.


The process of moving security principals and resources from one Windows 2000 domain in a forest to another Windows 2000 domain in the same forest.

See also interforest migration; forest.


The process of moving security principals and resources from a Windows NT domain or a Windows 2000 domain in one forest to a Windows 2000 domain in a different forest.

See also intraforest migration; forest.


A user account that is a member of a particular group.


The default domain mode setting on Windows 2000 domain controllers. Mixed mode allows Windows NT and Windows 2000 backup domain controllers to co-exist in a domain. Mixed mode does not support the universal and nested group enhancements of Windows 2000. The domain mode setting can be changed to Windows 2000 native mode when all Windows NT domain controllers are removed from a domain.

See also native mode; Windows 2000 Server Help.


The condition in which all domain controllers in the domain have been upgraded to Windows 2000 and an administrator has enabled native mode operation through Active Directory Users and Computers. Features such as universal groups, domain local groups, group nesting, and SID History are available in native mode.

See also mixed mode; SID History; Windows 2000 Server Help.


A Windows NT domain that is used for hosting file, print, and other application services.


A Windows NT or Windows 2000 entity that is automatically assigned a security identifier for access to resources. A security principal can be a user, group, or computer. Windows 2000 uses Active Directory for account management of security principals.


A set of information attached to an object that specifies the permissions granted to users and groups, as well as the security events to be audited.


A unique number that identifies user, group, and computer accounts. Every account on your network is issued a unique SID when the account is first created. Internal processes in Windows 2000 refer to an account's SID rather than the account's user or group name. If you create an account, delete it, and then create an account with the same user name, the new account will not have the rights or permissions previously granted to the old account because the accounts will have different SID numbers. Security identifier is also called security ID or SID.

See also SID History.


An attribute of migrated user and group accounts that holds the security identifier (SID) previously assigned to the account. After Windows 2000 is deployed and after the Windows NT account domain is decommissioned, SID History guarantees resource access from the cloned accounts during the migration process. The attribute is named sIDHistory.

See also SID.


The domain from which security principals or resources are being migrated. A source domain can be a Windows NT 4.0 domain or a Windows 2000 domain. Target and source domains can be in the same or different forests.

See also forest; security principal; target domain.


The security principal object to be migrated.

See also security principal; SID History; target object.


The domain into which the security principals or resources are being migrated. The target domain must be a Windows 2000 domain in native mode. Target and source domains can be in the same or different forests.

See also domain migration; forest; native mode; security principal; target object.


The security principal in the target domain whose attributes have been migrated from a source object and whose SID History contains the SID of the source object.

See also security principal; SID; SID History; source object; target domain.


Local groups defined on primary and backup domain controllers running Windows NT 4.0 and earlier and used to grant access to resources on these domain controllers. A shared local group is shared across all domain controllers in the domain and it exists only within the domain in which it is defined.