Active Directory (AD), a distributed database of objects such as users, groups, computers, and policies, is primarily used to control security-authentication and access to resources. However, it is also the key technical infrastructure for the centralized administration of computer settings with Group Policy, which in turn is a requirement for other management technologies such as IntelliMirror.

In addition to being a requirement for Group Policy, AD also makes it easier to use other technologies, such as Windows Management Instrumentation (WMI). For example, if an administrator needed to run a script against every PC in an organization, the administrator could query AD for a list of all the PCs, then run the script against that collection of PCs. But because organizations were reluctant to deploy AD, they were unable to take advantage of these integral management features of Windows. (For more on WMI, see the sidebar “New Scripting Attitude“.)

Windows Server 2003 contains many features aimed at making the design, configuration, and maintenance of AD easier, and will especially benefit large, geographically dispersed organizations and those that have been reluctant to upgrade to AD because they fear irreversible design mistakes. AD was introduced in Windows 2000, but enhancements in Windows Server 2003 make AD more flexible, more efficient, and easier to manage, migrate, and deploy. Some of these enhancements, however, come at the cost of increased complexity and will require substantial administrator effort and expertise.