8/26/98The DESY WindowsNT Group1 Windows NT at DESY l Status report l new developments for the automation of administrative tasks l outlook to our preparations

DESY 8/26/98The DESY WindowsNT Group2 Summary - Domain Structure l one domain model l DESY group structure in the flat NT4 name space n special naming conventions n 40 living groups n group administrators n TEM is used for user/group administration n NetInstall is used for the application support

DESY 8/26/98The DESY WindowsNT Group3 Summary - (central) Infrastructure 1 PDC 2 BDC (Hamburg + Zeuthen) 1 Home Directory Server Cluster at Hamburg 1 Server at Zeuthen 2 nodes plus 70 GByte RAID3/5 32 GByte RAID 1 Application Server Cluster at Hamburg 1 Server at Zeuthen 2 nodes plus 35 Gbyte RAID3/5 16 GByte SW RAID 1 Mail Server 2 Print Server (Hamburg + Zeuthen) 1 Utility Server, 1 IIS, 1 Dfs Server 2 WINS (Hamburg + Zeuthen)

DESY 8/26/98The DESY WindowsNT Group4 NEWS l statistics n ~ 800 NT clients (active on the domain during last 2 month) n 1300 registered users n nearly 600 daily active users/PC’s (connected to central servers) l NetInstall in production since mid of May Yellow n 200 Yellow Green n 60 Green l Mail Server in production l Application/Script Server

DESY 8/26/98The DESY WindowsNT Group5 Workstations online

DESY 8/26/98The DESY WindowsNT Group6 Connections during the day

DESY 8/26/98The DESY WindowsNT Group7 Users on Home Directory Servers

DESY 8/26/98The DESY WindowsNT Group8 NetInstall Status l Production environment just now with 200 and 60 active workstations l To get simple access and support for central services the NI environment is necessary. basic setup: Perl, Scripting Host, userconfig., home directory setup l Problems with the green setup remote support, helpdesk, complicated package setup l HERA controls and Zeuthen with own NI databases replicated from the central ASG-DB plus own packages l Migration to NI5 in Autumn hierarchical databases, multiple servers internal replication,…., still SMS compliant ----> the right time to jump on

DESY 8/26/98The DESY WindowsNT Group9 NT Mail l in production since April/Mai n IMAP server from UW V n the MTA is sendmail V8.8.6 n the client is Netscape Communicator V4.05 l problems with the logging scheme of the inbox n sendmail is not able to append new mail on an open inbox n workaround under test l a possible migration to PMDF is in discussion (end of the year)

DESY 8/26/98The DESY WindowsNT Group10 Domain automation - the tasks l Tasks for group administrators n most of them handled with the TEM n user account maintenance (password reset, management of parts of the user environment like mail forwarding, user registry updates, …) n group management l more global tasks n creating new user accounts (embedded in the common DESY user registry) n creating new global user groups n moving users (homedir’s) between servers and/or groups n moving group file systems/shares between servers n Dfs maintenance n print server maintenance

DESY 8/26/98The DESY WindowsNT Group11 Domain automation - the problems l Most of the scripts and programs must run under a domain administrator account. l The responsible persons to do the jobs are normal users without special privileges, perhaps group admins. l Security has to be guaranteed over the whole process n authentication n user rights - who is allowed to do what l Integrity of the systems has to be guaranteed n job/task control (to execute it at the right place and time) n checks for parameters

DESY 8/26/98The DESY WindowsNT Group12 Domain automation - approach l Core of the solution will be the MS Transaction Server l The access should be flexible as much as possible n normally from a web browser over the IIS n direct by special applications n independent from programming and script languages l simple and central management/maintenance n central management of the jobs/tasks - one configuration file n access control by the help of the transaction server

DESY 8/26/98The DESY WindowsNT Group13 Domain automation - scheme IIS Transaction Server Script / Program Execution.DLL Client indirect - via SSL Client direct Configuration File DomainAuto.cfg Roles ASP

DESY 8/26/98The DESY WindowsNT Group14 IIS & Transaction Server l Why accessing the IIS via SSL? n Necessary to ensure secure access and authentication over the LAN/internet - “password” security Level is required n Certificate Authority - self made, planed to become sub CA from DFN (CERT) l DCOM interface is used to access the transaction server n Authentication is done automatically (NTLM-A.) n Packet privacy is used n Object and functions are defined by the DLL added to the transaction server Set scriptObj = CreateObject(“DomainAuto.DomainAuto.1”) scriptObj.InvokeScript (“scripname”, “param1 param2”)

DESY 8/26/98The DESY WindowsNT Group15 Inside the MTS %WINDIR%\system32\DomainAuto.cfg #comment #format: (separator = tab) #ScriptName Script Role Flag0/1 DeleteComputer C:\scripts\dc.bat RoleDC 1 # DeleteUser C:\scripts\du.bat Admins 0 Set obj = CreateObject(“DomainAuto.DomainAuto.1”). obj.InvokeScript(“DeleteUser”,”name..”) Roles RoleDC: GroupAdm usg_ Scripts Admins: DomainAdmins C:\scripts\dc.bat C:\scripts\du.bat

DESY 8/26/98The DESY WindowsNT Group16 NT5 preparations l first steps n setup of a test domain n planing of requirements n task list l Usage of Technology already available n IIS n Transaction Server

DESY 8/26/98The DESY WindowsNT Group17 The DESY WindowsNT Group l Henner Bartels fulltime) l Volker Heynen l Ernst-Axel Knabbe l Wolfgang Krechlok l Klaus-Dieter Perger fulltime) l Rolf Rettinger l Helga Schwendicke l Cristian Trachimow l Gunter Trowitzsch