#EDIR DATA#
DOCTYPE='BOOK' PUBLICID='' SYSTEMID='/dtd/docbook.dtd'Introduction to NetWare Directory ServicesIntroduction to NetWare Directory ServicesNovell, Inc.DisclaimerNovell, Inc. makes no representations or warranties with
respect to the contents or use of this manual, and specifically
disclaims any express or implied warranties of merchantability or
fitness for any particular purpose. Further, Novell, Inc. reserves the
right to revise this publication and to make changes to its content,
at any time, without obligation to notify any person or entity of such
revisions or changes.Further, Novell, Inc. makes no representations or warranties
with respect to any NetWare software, and specifically disclaims any
express or implied warranties of merchantability or fitness for any
particular purpose. Further, Novell, Inc. reserves the right to make
changes to any and all parts of NetWare software, at any time, without
any obligation to notify any person or entity of such changes.TrademarksThe following are registered trademarks of Novell, Inc.: DR DOS, Fastpath, LAN WorkPlace, LANalyzer, NetWare, NetWare Name Service, Novell Press, UnixWare, WordPerfect.UNIX is a registered trademark of Novell, Inc. in the United States and other countries, licensed exclusively through X/Open Company, Ltd.The following are trademarks of Novell, Inc.: Advanced NetWare, Enterprise Certified NetWare Engineer, ECNE, EXOS, FirstMail, Global MHS, HSM, Hardware Specific Module, Hot Fix, IPX, IPX/SPX, IPXWAN, Internetwork Packet Exchange, LSL, Link Support Layer, MLI, MLID, MSL, MSM, MacIPX, MacNCP, MacNDS, Media Support Module, Mirrored Server Link, Multiple Link Interface, Multiple Link Interface Driver, NCP, NDR, NDS, NE/2, NE/2-32, NE1000, NE1500T, NE2000, NE2100, NE3200, NE32HUB, NLM, NLSP, NMS, NSE Pro, NTR2000, NVT, NetSync, NetWare 3, NetWare 4, NetWare 4.01, NetWare 4.1, NetWare Application Notes, NetWare Care, NetWare Client, NetWare Core Protocol, NetWare DOS Requester, NetWare Directory Services, NetWare Express, NetWare IPX Router, NetWare Link Services Protocol, NetWare Link/Frame Relay, NetWare Link/PPP, NetWare Link/X.25, NetWare Loadable Module, NetWare Logotype (teeth logo), NetWare MHS, NetWare Management Agent, NetWare Management System, NetWare Message Handling Service, NetWare MultiProtocol Router, NetWare Navigator, NetWare Peripheral Architecture, NetWare Ready, NetWare Requester, NetWare Runtime, NetWare SFT, NetWare SFT III, NetWare Tools, NetWare UAM, NetWare/IP, Netware Notify, Network Support Encyclopedia Professional Volume, Novell Labs, Novell Research Reports, Novell Virtual Terminal, ODI, Open Data-Link Interface, Packet Burst, Personal NetWare, RX-Net, RXNet/2, Red Box, SFT, SFT III, SMS, SPX, Sequenced Packet Exchange, Storage Management Services, Streams, TSM, Topology Specific Module, Transaction Tracking System, TTS, VLM, Virtual Loadable Module, "Yes, It Runs With NetWare Logo", and the "Yes, NetWare Tested and Approved Logo".The following are registered service marks of Novell, Inc.: Novell Technology Institute, NetWire.The following are service marks of Novell, Inc.: Novell Registry, Certified NetWare Administrator, CNA, Certified NetWare Engineer, CNE, Certified NetWare Instructor, CNI, Novell Authorized Service Center, NASC, Novell Technical Support.The following are collective marks of Novell, Inc.: Novell Authorized Reseller, Technical Support Alliance, TSA.3Com, 3+Share, and TokenLink are registered trademarks of 3Com Corporation.4.3BSD is a trademark of the Regents of University of California, Berkeley.ARCnet is a registered trademark of Datapoint Corporation.AT is a registered trademark of International Business Machines Corporation.AT&T is a registered trademark of American Telephone & Telegraph.Adobe and PostScript are registered trademarks of Adobe Systems Incorporated.Apple, AppleShare, AppleTalk, EtherTalk, ImageWriter, LaserWriter, LocalTalk, Macintosh, and MultiFinder are registered trademarks, and Finder and Mac are trademarks, of Apple Computer, Inc.Btrieve is a registered trademark of Btrieve Technologies, Inc.Canon is a registered trademark of Canon, Inc.COMPAQ is a registered trademark of COMPAQ Computer Corporation.Cisco Systems is a trademark of Cisco Systems, Inc.Citizen is a registered trademark of Tokei Kabushiki Kaisha.Claris is a trademark and MacWrite is a registered trademark of Claris Corporation.CompuServe is a registered trademark of CompuServe, Inc.DEC, DECnet, and Digital are trademarks of Digital Equipment Corporation.DeskJet, DeskWriter, LaserJet, PaintJet, PaintWriter, and PCL are registered trademarks of Hewlett-Packard Company.Diablo is a registered trademark of Xerox Corporation.DynaText is a registered trademark of Electronic Book Technologies, Inc.Epson is a registered trademark of Seiko Epson Corporation.EtherPrint is a trademark of 3Com Corporation.TokenPrint is a registered trademark of Dayna Communications.EtherFlex is a registered trademark of Extended Systems International.GatorBox is a registered trademark of Cayman Systems.Hewlett Packard, HP, HP-GL, LaserJet, and PCL are registered trademarks of Hewlett-Packard Company.Hayes is a registered trademark of Hayes Microcomputer Products, Inc.IBM, OS/2, Micro Channel, ProPrinter, and PS/2 are registered trademarks and AFP, Presentation Manager, and SAA are trademarks of International Business Machines Corporation.Intel is a registered trademark and Pentium is a trademark of Intel Corporation.LaserBridge is a registered trademark of Sonic Systems.Lotus is a registered trademark of Lotus Development Corporation.MS-DOS and Microsoft are registered trademarks and LAN Manager is a trademark of Microsoft Corporation.MacPlot is a registered trademark of Microspot.NEC, Spinwriter, and Pinwriter are registered trademarks of NEC Corporation.NFS is a registered trademark of Sun Microsystems, Inc.Okidata and MicroLine are registered trademarks of Oki Electric Industry Co., Ltd.PageMaker is a registered trademark of Aldus Corporation.Panasonic is a registered trademark of Panasonic Office Automation.PowerPrint is a trademark of GDT Softworks, Inc.SQL Server is a trademark of Sybase, Inc.SprintTalk is a registered trademark of Digital Products.Ultra is a trademark of Hayes Microcomputer Products, Inc.Unicode is a registered trademark of Transoft Ltd.Word is a registered trademark of Microsoft Corporation.XT is a trademark of International Business Machines Corporation.Xerox is a registered trademark and XNS is a trademark of Xerox Corporation.cc:Mail is a trademark of cc:Mail, a Division of Lotus.All other trademarks, service marks, certification marks, and
collective marks --- registered or not --- are the property of their
respective owners.Copyright Notices© Copyright 1983-1994 Novell, Inc. All rights reserved. No
part of this publication may be reproduced, photocopied, stored on a
retrieval system, or transmitted without the express written consent
of the publisher.TYPE="VERT"Novell, Inc.122 East 1700 SouthProvo, UT 84606U.S.A.User Comment FormNovell encourages and welcomes your feedback and suggestions on ways we can improve our manuals. You can help us by sharing your comments and suggestions about how our manuals could be made more useful to you, and about any inaccuracies or information gaps they contain.Submit your comments by printing this User Comment form (click on the icon to display the form, then select "Print" from the "File" menu), filling it in, then faxing or mailing it to us.LABEL="0" FLOAT="0"User Comment FormFILEREF="ucomment.tif"PAGENUM=7 ID="BP1"How to Use This ManualRENDERAS="SECT1"IntroductionIntroduction to NetWare Directory Services has two purposes: MARK=BULLETTo help you understand the features provided by 
NetWare ® Directory ServicesTM (NDS) technologyTo help you plan the implementation of the NDSTM technology on your networkThis manual is directed to network supervisors responsible for planning and implementing the NetWare 4.1 software and NDS technology on the network.You should read this manual before you upgrade to or install NetWare 4.1 software.RENDERAS="SECT1"IDXID="w2672"BOOK="_idx" COLLECTION="nw41" TIDREF="i1167"
Documentation IDXID="w2673"BOOK="_idx" COLLECTION="nw41" TIDREF="i830"
ConventionsThis manual uses the following Novell® conventions.RENDERAS="SECT2"Asterisk ( * )An asterisk denotes a trademarked name belonging to a third-party company. Novell trademarks are denoted with specific trademark symbols (®, TM, etc.).An ownership listing of all (Novell and third-party) trademarks cited in a manual can be found either on the disclaimer page in the front or in a "Trademarks" section at the back of printed manuals. A trademarks list is also available in the DynaText* online documentation.PAGENUM=8 ID="BP2"RENDERAS="SECT2"CommandsBoldface characters indicate items that you type, such as commands and options. You can use any combination of uppercase and lowercase letters.For example:FORMAT="LINESPECIFIC"MOREINFO="NONE"C:\A INSTALLRENDERAS="SECT2"Delimiter Bar ( | )In syntax examples, a delimiter bar separating two command options indicates that you can choose one of the options.For example:FORMAT="LINESPECIFIC"MOREINFO="NONE"-S | -RDo not type the bar.RENDERAS="SECT2"DOS CommandsDOS commands and command option letters are shown in uppercase letters. For example: FTPD.Because DOS is not case-sensitive, you can type DOS commands in uppercase or lowercase letters.RENDERAS="SECT2"DOS Filenames, Directory Names, and PathnamesDOS filenames, directory names, and pathnames are shown in uppercase letters. For example, AUTOEXEC.BAT.Because DOS is not case-sensitive, you can type these names in uppercase or lowercase letters.PAGENUM=9 ID="BP3"RENDERAS="SECT2"EllipsesEllipses in syntax examples indicate that parameters, options, or settings can be repeated.For example, in the commandFORMAT="LINESPECIFIC"MOREINFO="NONE"LOGIN SERVER1/SUPERVISOR /option...you could replace option with any number of available options.RENDERAS="SECT2"EmphasisItalic type indicates emphasized text. For example:Remember to load the driver before you install the application.RENDERAS="SECT2"IconsChecklists, which often contain prerequisites, are marked with the "Checklist" icon to the left of this text.Procedures to follow in order to accomplish a specified task are marked with the "Procedure" icon to the left of this text.Additional or "nonessential" but noteworthy information is marked with the "Note" icon to the left of this text.Vital information about system or software requirements, etc., that deserves particular attention is marked with the "Important" icon to the left of this text.Guidelines or tips about fine-tuning, optimizing, etc., which might be applicable to your site or situation but maybe not to all, are emphasized with the "Suggestion" icon to the left of this text.Warnings about potential danger to data, hardware, or person are emphasized with the "Warning" icon to the left of this text. PAGENUM=10 ID="BP4"RENDERAS="SECT2"Key NamesAngle brackets surround the name of a key. For example, MOREINFO="NONE"<Enter> corresponds to the MOREINFO="NONE"Enter key on your keyboard. MOREINFO="NONE"<Ctrl>+<c> means hold down the MOREINFO="NONE"Ctrl key and simultaneously type the letter MOREINFO="NONE"c (in lowercase, in this case).RENDERAS="SECT2"OptionsIn syntax examples, braces indicate that you are required to choose one of the enclosed options. For example, the following notation means that you must include a 0 or a 1 in the command:FORMAT="LINESPECIFIC"MOREINFO="NONE"{0, 1}RENDERAS="SECT2"Square BracketsIn syntax examples, boldface type enclosed in square brackets indicates command options that you can type as needed. For example:FORMAT="LINESPECIFIC"MOREINFO="NONE"FTP [ -D ] [ -F ]RENDERAS="SECT2"System ResponseMonospace type shows system-generated responses that appear on your workstation screen. For example:FORMAT="LINESPECIFIC"MOREINFO="NONE"TNVT220>RENDERAS="SECT2"VariablesItalic type indicates variables---descriptive item names, such as command parameters---that you replace with appropriate values.For example, in the command:FORMAT="LINESPECIFIC"MOREINFO="NONE"FTP -F remote_host you type the name of a computer on your network in place of remote_host.PAGENUM=11 ID="BP5"RENDERAS="SECT1"Supplemental DocumentationThe following publications provide supplemental information specifically related to NetWare Directory Services technology and software.MARK=BULLET"An Introduction to NetWare Directory Services," Novell Application Notes, Apr 93 (Novell part no. 164-000032-004)."Implementing Naming Standards for NetWare Directory Services," Novell Application Notes, Feb 94 (Novell part no. 164-000036-002)."Migrating to NetWare 4.0: An Example," Novell Application Notes, Apr 93 (Novell part no. 164-000032-004)."NetWare 4.0 Bindery Emulation: An Overview," Novell Application Notes, Jun 93 (Novell part no. 164-000032-006)."NetWare 4.0 Performance Tuning and Optimization: Part 1," Novell Application Notes, May 93 (Novell part no. 164-000032-005)."NetWare 4.0 Performance Tuning and Optimization: Part 2," Novell Application Notes, Jun 93 (Novell part no. 164-000032-006)."Novell's Corporate-Wide Upgrade to NetWare 4," Novell Application Notes, Jan 94 (Novell part no. 164-000036-001)."Planning a NetWare 4.0 Directory Tree," Novell Application Notes, Apr 93 (Novell part no. 164-000032-004)."Planning for NetWare 4.0 Installation, Server Migration, and Coexistence," Novell Application Notes, Apr 93 (Novell part no. 164-000032-004)."Time in the NetWare Environment," Novell Application Notes, Jan 94 (Novell part no. 164-000036-001)."Time Synchronization in NetWare 4.x," Novell Application Notes, Nov 93 (Novell part no. 164-000032-011)."Understanding NetWare Directory Services Rights," Novell Application Notes, Apr 93 (Novell part no. 164-000032-004).PAGENUM=12 ID="BP6""Upgrading to NetWare 4: The Chase Manhattan Bank's CC and FMI Groups," Novell Application Notes, Jan 94 (Novell part no. 164-000036-001)."Using the DOS Requester with NetWare 4.0," Novell Application Notes, Apr 93 (Novell part no. 164-000032-004).RENDERAS="SECT1"Online HelpMARK=BULLETContext-sensitive help. If you are using a NetWare menu utility and want more information about how to complete a task, press MOREINFO="NONE"<F1>.If you are unsure how to use a command, type the command name and add the /? option for help. For example, for help with the RIGHTS command, type "RIGHTS /?".Online MS Windows help. Microsoft* (MS) Windows help viewer allows you to read NetWare help developed for the MS Windows environment. To access the NetWare help screens within MS Windows, press <MOREINFO="NONE"F1> or the "?" button.DynaText online documentation. The DynaText viewer allows you to read NetWare documentation from your DOS, MS Windows, Macintosh*, UNIX®, or OS/2* workstation.All NetWare 4TM and 3.12 documentation except the Quick Access Guide are available on the NetWare Online Documentation CD-ROM.RENDERAS="SECT1"Additional Help ResourcesMARK=BULLETCustomer service. You can contact your Novell Authorized ResellerCLM representative for technical assistance.Most Novell Authorized Resellers have Certified NetWare EngineerSM representatives on their staffs ready to assist users with their networking problems.Novell Authorized Service CenterSM (NASC) locations. NASCSM facilities are local support providers authorized and supported by Novell. They provide both telephone and on-site assistance, and should be your first source for technical support.PAGENUM=13 ID="BP7"For the Novell Authorized Service Center nearest you, in the U.S. and Canada call 1-800-338-NASC.Hardware documentation. Many network problems occur because of malfunctioning hardware.If you can isolate a problem to a certain computer component or cable segment, check the manuals that came with the hardware involved.NetWare Management SystemTM
 (NMS) services. NMSTM services 
help you manage the cabling system, computers, software, and other components of the network.For more information about using NMS on your network, contact your Novell Authorized Reseller.Other Novell publications. Novell Application Notes and the Novell Research ReportsTM publications cover technical aspects of NetWare-based system design, implementation, and management.Application Notes is a collection of technical articles published monthly. Research Reports is published as the research becomes available.To purchase subscriptions and back issues of these publications from within the United States or Canada, call the Novell Research Order Desk at 1-800-UPDATE1. From other locations, call 801-429-5380.Third-party books and periodicals. Books on NetWare, including books published by Novell PressTM publishing, are available at most bookstores.In addition, numerous networking periodicals give advice on configuring, managing, and troubleshooting your network.NetWire® forum on the CompuServe* bulletin board. A fairly inexpensive way to get up-to-date advice and patches is through NetWire on the CompuServe bulletin board.To open a CompuServe account, call one of the following numbers and ask for "Representative 200":MARK=BULLETIn the United States or Canada: 1-800-524-3388In the United Kingdom: 0800-289-378In Germany: 0130-37-32In other European countries: 44-272-255-111PAGENUM=14 ID="BP8"In locations other than the United States, Canada, or Europe, use the appropriate country code for the U.S. and call 614-457-0802. Ask for "Representative 200." This phrase identifies you as a Novell customer.Technical Support Database and NetWire forum on the Internet. The Novell FTP sites support access through FTP, Gopher, and World Wide Web (WWW) systems. Over 9,000 documents exist on the WWW system for providing technical hints and information.To access the Novell Internet sites, log in as ANONYMOUS and use your E-mail address as your password.   Contact one of the following site addresses:TYPE="VERT"In the United States: ftp.novell.comIn Germany: ftp.novell.deIn the United Kingdom: ftp.salford.ac.ukIn Canada: novell.nrc.caSee public areas in these sites for possible listings of other sites' addresses. FaxBack Service. Novell provides a FaxBack Service for obtaining additional product information to help with support needs.To access the Novell FaxBack Service, complete the following steps.MARK=BULLETWithin the continental United StatesTYPE="VERT"1. Dial 1-800-NETWARE (1-800-638-9273).2. Press #1 (the "Presale Product Information and Upgrade Information" option).3. Again press #1 (the "Receive Product Information via Fax" option).Outside the continental United StatesDial 1-801-429-2772. You are connected directly to the FaxBack Service.Follow the directions provided on the phone. You are prompted to enter a document number and then a fax number to send the document to.Network Support Encyclopedia Professional VolumeSM (NSE Pro) package. This encyclopedia gives customers access to regularly updated information on products and services---plus patches, fixes, and more---from Novell and other vendors.PAGENUM=15 ID="BP9"The NSE ProSM package is distributed on CD-ROM on a subscription basis. Updates are sent out several times each year. More information is available on NetWire or from your Novell Authorized Reseller.Troubleshooting hardware and software. Specialized hardware and software packages, such as the Novell LANalyzer® software, are available to help you isolate network problems.RENDERAS="SECT1"User CommentsWe are continually looking for ways to make our products and our documentation as easy to use as possible.You can help us by sharing your comments and suggestions about how our documentation could be made more useful to you and about inaccuracies or information gaps it might contain.Submit your comments either by filling out the "User Comments" form at the end of this document or by writing to us directly at the following address:TYPE="VERT"Novell, Inc.Technical Publications MS C-23-1122 East 1700 South Provo, UT 84606 USAWe appreciate your comments.LABEL=""PAGENUM=1 ID="BP10"ConceptsRENDERAS="SECT1"OverviewThe IDXID="w2674"BOOK="_idx" COLLECTION="nw41" TIDREF="i2724"
NetWare® Directory ServicesTM (NDS) technology is a distributed name service that provides global access to all network resources regardless of where they are physically located.Users log in to a multiserver network and view the entire network as a single information system. This system is the basis for increased productivity and reduced administrative costs.This section provides you with conceptual information to assist you in understanding the NDSTM technology and its features. RENDERAS="SECT1"ContentsThis section is divided into four chapters, with the following information are discussed on the indicated pages:COLS=3 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="19*"COLNAME=2 COLWIDTH="12*"COLNAME=3 COLWIDTH="4*"VALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"PurposeCOLNAME=2 ROTATE="0" MOREROWS="0"ChapterCOLNAME=3 ROTATE="0" MOREROWS="0"PageCOLNAME=1 ROTATE="0" MOREROWS="0"To learn more about NetWare Directory Services features in NetWare 4TMCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM64377"Chapter 1, "Understanding NetWare Directory Services"COLNAME=3 ROTATE="0" MOREROWS="0"IDREF="FM64377"3COLNAME=1 ROTATE="0" MOREROWS="0"To learn more about management features in NetWare Directory ServicesCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM28872"Chapter 2, "Understanding Management Features"COLNAME=3 ROTATE="0" MOREROWS="0"IDREF="FM28872"29COLNAME=1 ROTATE="0" MOREROWS="0"To learn more about bindery services in NetWare Directory ServicesCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM20685"Chapter 3, "Understanding Bindery Services"COLNAME=3 ROTATE="0" MOREROWS="0"IDREF="FM20685"37COLNAME=1 ROTATE="0" MOREROWS="0"To learn more about time synchronization in NetWare Directory ServicesCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM92269"Chapter 4, "Understanding Time Synchronization in NDS"COLNAME=3 ROTATE="0" MOREROWS="0"IDREF="FM92269"49LABEL="1"PAGENUM=3 ID="BP11"ID="FM64377"Understanding NetWare Directory ServicesRENDERAS="SECT1"OverviewThis chapter introduces and describes the NetWare® Directory ServicesTM (NDS) technology and its functionality within your networkThe following topics are discussed on the indicated pages:COLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="22*"COLNAME=2 COLWIDTH="4*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"TopicCOLNAME=2 ROTATE="0" MOREROWS="0"PageVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM21563"What are Directory Services? COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM21563"3COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM37802"The Directory Tree COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM37802"6COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM28349"Context and Names COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM28349"20To understand the technology and functionality provided in the NDSTM software, you must first understand some of the basic features of directory service technology and its implementation in the Novell® NetWare Directory Services products.RENDERAS="SECT1"ID="FM21563"What are Directory Services?Directory services are databases of information with powerful facilities for storing, accessing, managing, and using diverse kinds of information about users and resources in computing environments.RENDERAS="SECT2"Standard IDXID="w2675"BOOK="_idx" COLLECTION="nw41" TIDREF="i1080"
Directory ServicesPAGENUM=4 ID="BP12"Directories have traditionally been a component of the computing or network infrastructure that provide services to applications, such as E-mail, human resources, and network management applications. However, no integrated network resource of directory services has been available to applications and users alike. Users and organizations within computing environments have begun to recognize the need for a common, distributed directory that provides services to all network applications and users across disparate platforms including hosts, minicomputers, and network systems.This need is driven by an overall connectivity paradigm, the continuing trend towards downsizing, and the need for directory integration and centralized management.The IDXID="w2676"BOOK="_idx" COLLECTION="nw41" TIDREF="i2727"
NetWare Directory Services technology provided by Novell maintains a single, network-wide directory that is accessible from multiple points by users and applications.RENDERAS="SECT2"NetWare 
Directory IDXID="w2677"BOOK="_idx" COLLECTION="nw41" TIDREF="i2724"
ServicesNetWare Directory Services (NDS) is an object-oriented implementation of directory services that allows you to build sophisticated naming schemes and databases across network-wide resources.The NDS architecture provides global access to all network resources regardless of where the resources are physically located---forming a single information system. The following table provides a brief discussion of the IDXID="w2678"BOOK="_idx" COLLECTION="nw41" TIDREF="i2724"
features and benefits of NDS.You will encounter several new terms as you work with NDS. These will be defined in the following discussion of the basic architecture and design of NDS.PAGENUM=5 ID="BP13"LABEL="1-1" PGWIDE=0 TOCENTRY="1" Features and Benefits Provided by NetWare Directory ServicesCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="6*"COLNAME=2 COLWIDTH="29*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"FeatureCOLNAME=2 ROTATE="0" MOREROWS="0"BenefitVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Simple AdministrationCOLNAME=2 ROTATE="0" MOREROWS="0"The single point of administration provided in the NDS architecture allows for simple and cost-effective management of your entire network and its resources. Each supervisor of your network uses the same management utilities and database of resource objects regardless of each supervisor's physical location on the network. Network resources, such as users and groups, also maintain a single point of access to the network. This allows you to maintain a single identity for each resource you create throughout the entire network.COLNAME=1 ROTATE="0" MOREROWS="0"Advanced SecurityCOLNAME=2 ROTATE="0" MOREROWS="0"NDS provides the architecture that allows you to build a full range of security. NDS incorporates the advanced RSA (Rivest, Shamir, and Adleman, developers of this particular public key encryption system) security features that make encrypted, single- login authentication to network resources possible.NDS security is based on a top-down architecture. All rights to network resources are established through Access Control Lists (ACLs) that allow for sophisticated, but easily managed administration.COLNAME=1 ROTATE="0" MOREROWS="0"UsabilityCOLNAME=2 ROTATE="0" MOREROWS="0"The hierarchical database structure of the NDS design reduces network traffic and makes retrieving objects and properties very easy and efficient. You can search the entire Directory tree to locate an object, and a search can be initiated at any level of the Directory tree. Enhanced searching techniques allow objects to be located in a variety of ways, such as using relational expressions and wild cards. Also, objects in the Directory tree do not advertise. Traffic is generated only when an application asks the Directory for information. However, there is some traffic maintained to allow for synchronization of NDS.COLNAME=1 ROTATE="0" MOREROWS="0"ReliabilityCOLNAME=2 ROTATE="0" MOREROWS="0"The replicated nature of NDS creates a fault-tolerant system to ensure that you have no single point of failure in your network system. If implemented correctly, your network maintains operation through routine hardware and software maintenance. The synchronization of the Directory replicas is automatic and does not require any administrative intervention. COLNAME=1 ROTATE="0" MOREROWS="0"FlexibilityCOLNAME=2 ROTATE="0" MOREROWS="0"The hierarchical design of NDS allows for easy alteration of the network structure. Components of the network can be merged or split as needed. You can move objects from one part of the Directory tree to another. COLNAME=1 ROTATE="0" MOREROWS="0"ScaleabilityCOLNAME=2 ROTATE="0" MOREROWS="0"NDS has a modular design that allows you to customize it for any size and type of network. This means that as your organization changes to incorporate more resources and services, or downsizes to meet more specialized needs, the architecture and management of your network remains the same.COLNAME=1 ROTATE="0" MOREROWS="0"InteroperabilityCOLNAME=2 ROTATE="0" MOREROWS="0"NDS provides compatibility with existing Novell and third-party products. Specifically, NDS is capable of providing bindery services used in the NetWare 2 and NetWare 3TM network operating systems. This allows for an easier and more flexible transition of bindery-based NetWare servers, utilities, and client software to NDS. Furthermore, NDS provides centralized management of your bindery-based (NetWare 2 and NetWare 3) server and resources in the network.NDS also provides an external synchronization process for exchanging information with other naming and directory services, which allows for a seamless sharing of information between NDS and other service providers, such as those providing services on the information superhighway.COLNAME=1 ROTATE="0" MOREROWS="0"Future-LookingCOLNAME=2 ROTATE="0" MOREROWS="0"The functionality that defines how the Directory tree is constructed can be modified and expanded to suit your present and future needs. If the default definitions do not meet your needs, you can create an entirely new set of definitions or make modifications to parts of the existing definitions. PAGENUM=6 ID="BP14"RENDERAS="SECT1"ID="FM37802"The Directory TreeNetWare Directory Services was developed as a hierarchical design with multilevels of organizational units, users, groups, and network resources. This hierarchical structure is referred to as the Directory tree. The Directory tree is formed by organizing objects in a multilevel structure.RENDERAS="SECT2"Hierarchical IDXID="w2679"BOOK="_idx" COLLECTION="nw41" TIDREF="i1082"
Tree StructureNetWare Directory Services (NDS) is consistent with the emerging international standard, X.500. The X.500 specification was developed by the IEEE (Institute of Electrical and Electronic Engineers) to provide a standard method for organizing information that is accessed transparently on a global basis.PAGENUM=7 ID="BP15"Information such as telephone directories, corporate organizational structures, and directories of available services are all accessible through products compatible with this specification.Much of the current development for accessing services available on the information superhighway is being done according to the X.500 specification.Much of the current development for accessing services available on the information superhighway is being done according to the X.500 specification. NetWare Directory Services (NDS) is consistent with this emerging international standard. The X.500 specification was developed by the IEEE to provide a standard method for organizing information that is accessed transparently on a global basis. Information such as telephone directories, corporate organizational structures, and directories of available services are all accessible through products compatible with this specification.RENDERAS="SECT2"Directory IDXID="w2680"BOOK="_idx" COLLECTION="nw41" TIDREF="i1082"
SchemaThe Directory schema is the rules that define how the Directory tree is constructed. The schema define specific types of information that dictate the way information is stored in the Directory database.The following information is defined by the schema:MARK=BULLETAttribute Information. Describes what type of additional information an object can or must have associated with the object. Attribute types are defined within the schema by specific constraints and a specific syntax for their values.Inheritance. Determines which objects will inherit the properties and rights of other objects.Naming. Determines the structure of the Directory tree, thus identifying and showing an object's reference name in the Directory tree.Subordination. Determines the location of objects in the Directory tree, thus identifying and showing an object's location in the Directory tree.The basis for all entries in an NDS database is a set of defined object classes referred to as the base schema. Object classes such as servers, users, and print queues are some of the base object classes defined by the base schema. PAGENUM=8 ID="BP16"For a complete list of the base object classes, as well as other Directory information, IDREF="FM63536"see Appendix A, "NDS Object Classes and Properties," on page 137 for more information.The NDS schema can be modified and expanded to suit the specific needs of your organization. Object class definitions can be added to and modified for the existing base schema.RENDERAS="SECT2"ID="FM31768"Directory ObjectsDirectory objects consist of categories of information, known as properties, and the data included in those properties. This information is stored in the Directory database.The Directory database contains three types of objects:MARK=BULLET[Root] object (Directory tree name)Container objectsLeaf objectsThe following figure illustrates the hierarchy of Directory objects in NetWare Directory Services. (The icons represent the objects as they appear in the NetWare Administrator graphical utility.)PAGENUM=9 ID="BP17"LABEL="1-1" FLOAT="0"ID="FM89920"Hierarchy of Directory ObjectsFILEREF="n41ds04a.tif"These objects represent both actual and logical resources in the network, such as users and printers, or groups and print queues.Directory objects are structures that store information, not the actual entity represented by the object. For example, a Printer object stores information about a specific printer and helps manage how the printer is used, but it is not the actual printer itself.This Directory tree structure has the tree growing upside down, starting with the name of the tree or [Root] object at the top of the tree and branching downward. Once the [Root] object is named, you reference that object by its given name. The following figure illustrates how objects can be laid out to form the Directory tree.PAGENUM=10 ID="BP18"LABEL="1-2" FLOAT="0"Objects Used in a Directory TreeFILEREF="n41ds56a.tif"The Directory tree name ([Root] object) is automatically placed at the top of the tree by the NetWare 4 installation program. Branches of the Directory tree consist of container objects and all of the objects they hold. These container objects can also contain other container objects. Leaf objects are at the ends of the branches and do not contain any other objects.The following figure illustrates that the Directory tree is formed by container objects and leaf objects branching down from the tree name or [Root] object.PAGENUM=11 ID="BP19"LABEL="1-3" FLOAT="0"Objects Formed from [Root] in a Directory TreeFILEREF="n41ds55a.tif"RENDERAS="SECT3"ID="FM83303"[Root] IDXID="w2681"BOOK="_idx" COLLECTION="nw41" TIDREF="i3876"
ObjectThe [Root] object represents the name of the Directory tree. It resides at the top of the tree and branches downward. Once the [Root] object is named, you reference that object by its given name. The [Root] object can be created only by the NetWare 4 installation program, which automatically places it at the top of the tree. Once the [Root] object is named, it cannot be renamed or deleted.The [Root] object of a Directory tree should not be confused with the root directory in the file system. In the file system, the root directory is the first directory on a volume. It bears no relation to the [Root] object of a Directory tree.The Directory tree name or [Root] object can have trustees, and the rights granted to these trustees flow down the tree. One example is the User object ADMIN, which is created automatically during installation.By default, ADMIN receives a trustee assignment including the Supervisor right to the [Root] object of the Directory tree. This gives ADMIN all rights to all objects and properties in the tree, so that it can be used to initially log in and set up the tree. IDREF="FM23852"See "User Object ADMIN" on page 29 for more information. The [Root] object can also be a trustee. However, you should give careful consideration before making [Root] a trustee of another object. If you do, every object in the tree has the same rights as the [Root] object by virtue of inheritance. In effect, you assign every user that logs in rights to the [Root] object. IDREF="FM53664"See "Security Equal To" on page 20 for more information.PAGENUM=12 ID="BP20"RENDERAS="SECT3"ID="FM63488"Container 
ObjectsContainer objects hold (or contain) other Directory objects. Container objects are a means of logically organizing all other objects in the Directory tree. Just as directories are used to group related files together in a file system, container objects are used to group related items in the Directory tree.A container object that contains other Directory objects is known as a parent 
object.There are four kinds of container objects: MARK=BULLETCountryLocalityOrganizationOrganizational UnitNDS support of Country and Locality as container objects provides useful class definitions for organizing and naming objects within a Directory tree that are represented by countries or regions of your organization.  However, Directory tree structures based on centrally located organizations might not benefit from the added level of complexity.NDS container objects are defined as follows:MARK=BULLETCountry
 (C). A level below the [Root] object, the Country object designates the countries where your network resides and organizes other objects within the country.This object is optional.You can use a Country object to designate the country where your organization headquarters reside or, if you have a multinational network, to designate each country that is a part of your network.Normally, you need to create a Country (C) object if you have a global network that spans multiple countries or you plan to participate in the information superhighway.PAGENUM=13 ID="BP21"The Country object is not part of the NetWare 4 default server installation; that is, you are not prompted for a Country object when you install NetWare 4 software.  Nevertheless, you can create a Country object during the server installation. See "BOOK="instlenu" COLLECTION="nw41"Install Server Software," in Chapter 2, Installation for more information on installing a server.Locality
 (L). A level below the [Root] object, Organizational (O) object, or Organizational Unit (OU) object, the Locality (L) object designates the location where this portion of your network resides and organizes other objects within the location.This object is optional. You can use a Locality object to designate the region where your organization headquarters reside or, if you have a multinational network, to designate each area that is a part of your network.Locality objects can reside under Country (C), Organization (O), and Organizational Unit (OU) objects. They can also hold Organization (O) and Organizational Unit (OU) objects.The Locality object is not part of the NetWare 4 default server installation; that is, you are not prompted for a Locality object when you install NetWare 4 software.  Nevertheless, you can create a Locality object during the server installation. IDREF="FM45845"See "Install the first server and set up the Directory tree." on page 97 for more information.Organization
 (O). An Organization object helps you organize other objects in the Directory tree. It also allows you to set defaults for User objects you create in the Organization container.You can use an Organization object to designate a company, a division of a company, a university or college with various departments, a department with several project teams, etc.Every Directory tree must contain at least one Organization object.Organization objects must be placed directly below the [Root] object, unless a Country or Locality object is used.Organizational Unit
 (OU). An Organizational Unit object helps you to organize leaf objects in the Directory tree. It also allows you to set defaults in a login script and to create a user template for User objects you create in the Organizational Unit container.PAGENUM=14 ID="BP22"You can use an Organizational Unit object to designate a business unit within a company, a department within a division or university, a project team within a department, etc.This object is optional. When used, Organizational Units must be placed directly below an Organization, another Organizational Unit, or a Locality object.RENDERAS="SECT3"ID="FM72822"Leaf ObjectsDirectory leaf objects are objects that do not contain any other objects. These represent actual network entities such as users, servers, printers, computers, etc. You create leaf objects within a container object. The following figure lists the leaf objects you can create. (The icons represent the leaf objects as they appear in the NetWare Administrator graphical utility.)LABEL="1-4" FLOAT="0"ID="FM68453"Leaf Objects You Can CreateFILEREF="n41ds05a.tif"IDREF="FM37385"See Appendix B, "Referencing and Using Leaf Objects," on page 149 for more information.RENDERAS="SECT3"Object PropertiesPAGENUM=15 ID="BP23"Each type of object (such as a User object, Organization object, or Profile object) has certain properties that hold information about the object. For example, a User object's properties include a login name, E-mail address, password restrictions, group memberships, etc. A Profile object's properties include profile name, login script, and volume.Some properties are required for a specific object before setup of that object is complete. Other properties are optional and can be added later as the need arises. The following figure shows the relationship between object, property, and value.

FILEREF="n41ds02a.tif"In many cases, you can enter more than one value for a property. For example, you could enter a home, mobile, and work telephone number for a user.NetWare utilities allow you to search for objects that have specific property values. For example, you could search for all users who have a certain area code in their telephone number. When the area codes are found, the utility returns a list of all the objects with that area code in their properties.Or, you can request information on a specific object. The utility searches only for that object, and you receive information on that object's properties that you have access to.To make searching for an object property easier, enter information for the optional properties when creating container and leaf objects. Entering information in objects' properties can help you track and manage those objects. Also, if you define properties using a consistent format, after you have created the objects, you can use the NetWare Administrator, NETADMIN, or NLIST utility to search for and list these objects. You can also search for their various properties.For example, you might want to search for all User objects at a certain location, such as building M1. You cannot easily list all objects located in building M1 if you have entered "Bldg. M1," "BLDG M1," and "M1" as values in the Location property of multiple User objects.PAGENUM=16 ID="BP24"Standardizing the value for the Location property for all User objects at the site (such as M1, M2, and M3) makes it possible to search for objects located in each building.RENDERAS="SECT3"ID="FM82583"Object and Property 
RightsNetWare 4 software uses four different categories of rights:MARK=BULLETFile system directory rightsFile system file rightsNDS object rightsNDS property rightsPrevious versions of NetWare had file system directory and file rights and very limited access levels to bindery objects existent in NetWare 2 and NetWare 3 networks. NetWare 4 adds NDS object and NDS property rights, which determine what you can do within the Directory tree. Because the Directory tree is a hierarchical tree structure, rights assigned in the Directory tree flow down through the tree. This is an important concept to understand and consider when designing your Directory tree. The concept of rights flowing down through the tree is referred to as inherited rights. This functionality is provided by the 
Inherited Rights Filter (IRF). An 
IRF is a list of rights that can be assigned for any object in a lower container than a parent container within the tree hierarchy. It controls the rights that a trustee can inherit from container objects. IDREF="FM97993"See "Inherited Rights Filter" on page 19 for more information.To provide better access control to the pieces of information (properties) contained in NDS objects, object and property rights are assigned separately.RENDERAS="SECT4"Object RightsObject rights control what trustees of an object can do with that object. Object rights control the object as a single entity in the Directory tree, but do not allow the trustee to access information stored in that object's properties (unless the trustee has the Supervisor object right, which also includes the Supervisor property right).PAGENUM=17 ID="BP25"The following table describes object rights you can assign to a trustee.All object rights of a subordinate object can be blocked by an Inherited Rights Filter (IRF) initiating at the point where the object right is granted.   LABEL="1-2" PGWIDE=0 TOCENTRY="1"ID="FM62078"Object RightsCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="6*"COLNAME=2 COLWIDTH="20*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"RightCOLNAME=2 ROTATE="0" MOREROWS="0"DescriptionVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"SupervisorCOLNAME=2 ROTATE="0" MOREROWS="0"Grants all rights to the object and to all its properties. COLNAME=1 ROTATE="0" MOREROWS="0"BrowseCOLNAME=2 ROTATE="0" MOREROWS="0"Grants the right to see the object in the Directory tree. Also allows a user performing a search to see the object if it matches the search value. (This is true only when comparing the base object class or Relative Distinguished Name; otherwise, the Compare right for property objects is required.)COLNAME=1 ROTATE="0" MOREROWS="0"CreateCOLNAME=2 ROTATE="0" MOREROWS="0"Grants the right to create a new object within a container object in the Directory tree. This right applies only to container objects because leaf objects cannot contain other objects.COLNAME=1 ROTATE="0" MOREROWS="0"DeleteCOLNAME=2 ROTATE="0" MOREROWS="0"Grants the right to delete an object from the Directory tree. However, a container object cannot be deleted unless all the objects in the container are deleted first. The Write right for all existing object properties is also needed to delete objects.COLNAME=1 ROTATE="0" MOREROWS="0"RenameCOLNAME=2 ROTATE="0" MOREROWS="0"Grants the right to change the Relative Distinguished Name of the object, in effect changing the naming property. This changes the object's Distinguished Name. IDREF="FM95918"See "Name Types" on page 24RENDERAS="SECT4"ID="FM83485"Property 
RightsWhile object rights allow you to see an object, delete an object, create a new object, etc., only the Supervisor property right allows you to see the information stored in an object's properties.To see the information in an object's properties, you must have the correct property rights. Property rights control access to each property in an object.PAGENUM=18 ID="BP26"Property rights apply only to NDS object properties, not to the objects themselves. NDS allows you flexibility in deciding what property information others can access.For example, if you include a telephone number as a property for a User object, you can prevent anyone else from seeing the specified telephone number by using an Inherited Rights Filter (IRF) to disable the Read right to that particular property (IDREF="FM97993"see "Inherited Rights Filter" on page 19). At the same time, you can still allow the person to view other properties, such as the user's address.The following table describes 
property 
rights you can assign to a trustee  LABEL="1-3" PGWIDE=0 TOCENTRY="1"ID="FM31948"Property RightsCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="6*"COLNAME=2 COLWIDTH="20*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"RightCOLNAME=2 ROTATE="0" MOREROWS="0"DescriptionVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Add or Delete SelfCOLNAME=2 ROTATE="0" MOREROWS="0"Allows you to add or remove yourself as a value of the property, but you cannot change any other values of the property.This right is only used for properties where your User object can be listed as a value, such as group membership lists or mailing lists.This right is included in the Write right; that is, if the Write right is given, Add or Delete Self operations are also allowed.COLNAME=1 ROTATE="0" MOREROWS="0"CompareCOLNAME=2 ROTATE="0" MOREROWS="0"Allows you to compare any value to an existing value of the property. The comparison can return True or False, but cannot give the value of the property.COLNAME=1 ROTATE="0" MOREROWS="0"ReadCOLNAME=2 ROTATE="0" MOREROWS="0"Allows you to read the values of the property.This right includes the Compare right; that is, if the Read right is given, Compare operations are also allowed.COLNAME=1 ROTATE="0" MOREROWS="0"SupervisorCOLNAME=2 ROTATE="0" MOREROWS="0"Gives you all rights to the property. The Supervisor property right can be blocked with an Inherited Rights Filter. IDREF="FM97993"See "Inherited Rights Filter" on page 19for more information.COLNAME=1 ROTATE="0" MOREROWS="0"WriteCOLNAME=2 ROTATE="0" MOREROWS="0"Allows you to add, change, or remove any values of the property.This right includes the Add or Delete Self right; that is, if the Write right is given, Add or Delete Self operations are also allowed.The Write right to the Access Control List (ACL) property is the same as giving the Supervisor right to the object---the right to grant rights. PAGENUM=19 ID="BP27"RENDERAS="SECT4"Access 
Control ListThe information about who can access object properties is stored in the object itself, in a property known as the Access Control List (or ACL). An object's ACL lists all objects that are trustees of the object. The ACL property also stores the object's Inherited Rights Filter.To change the trustee's access to an object, you would change the trustee's entry in the object's ACL. Only trustees with the Write right for the ACL property can change the trustee assignments or the Inherited Rights Filter.Each object listed in an ACL can have different rights to that object's properties. For example, if ten users are listed in a Modem object's ACL as trustees, each of those ten users can have different rights to that Modem object and to its properties. One object might have the Read right, another might have the Delete right, etc.See "BOOK="cncptenu" COLLECTION="nw41"Access Control List (ACL)" in Concepts for more information.RENDERAS="SECT4"ID="FM97993"Inherited 
Rights Filter While trustee assignments grant access to an object, the Inherited Rights Filter (IRF) prevents rights from automatically spreading from one object to another.In the Directory tree, an object can automatically receive, or inherit, rights granted to its parent objects. The IRF can be used to block any or all of these inherited rights so that no objects can receive them.PAGENUM=20 ID="BP28"Through inheritance, every object and property in the Directory can have an Inherited Rights Filter.See "BOOK="cncptenu" COLLECTION="nw41"Inherited Rights Filter" in Concepts for more information.RENDERAS="SECT4"Effective RightsThe combination of inherited rights, trustee assignments in an ACL, and Security Equal To (lists the rights other objects have within a container that the User object has equal security to) are known as effective rights.An object's effective rights are what control its access to another object and that object's properties.See "BOOK="cncptenu" COLLECTION="nw41"Effective Rights" in Concepts for more information.RENDERAS="SECT4"ID="FM53664"Security 
Equal ToA property of every User object that lists the rights other objects have within a container compared to the rights of that User object. The user is granted all rights that any object (such as a User, Group, or Printer object) in that list is granted, both to objects and to files and directories.Use the Security Equal To property to give a user temporary access to the same information or rights another user has access to. When a user is added to the membership list of a Group object or the occupant list of an Organizational Role object, the Group or Organizational Role is listed in that user's Security Equal To list. By using the Security Equal To property, you avoid having to review the whole directory structure and determine which rights need to be assigned to which directories, files, and objects.See "BOOK="cncptenu" COLLECTION="nw41"Security Equal To" in Concepts for more information.RENDERAS="SECT1"ID="FM28349"Context and NamesIn NetWare Directory Services (NDS), IDXID="w2682"BOOK="_idx" COLLECTION="nw41" TIDREF="i813"
context refers to the location of an object in the Directory tree. This context is important for NDS to locate specified network resources. PAGENUM=21 ID="BP29"The complete context, or path, from an object to the [Root] of the Directory tree identifies and forms the object's IDXID="w2683"BOOK="_idx" COLLECTION="nw41" TIDREF="i1156"Distinguished 
Name. The context, or path, from an object to another object of the Directory tree identifies and forms the object's IDXID="w2684"BOOK="_idx" COLLECTION="nw41" TIDREF="i3730"Relative 
Distinguished Name (
RDN).For example, in the following figure, the context for the User object ESAYERS is OU=DESIGN.OU=LONDON.OU=MFG.O=ACME.C=US and the Distinguished Name would be ESAYERS.DESIGN.LONDON.MFG .ACME.US. The context for the User object RJONES is OU=HR.OU=HQ .O=ACME.C=US and its Distinguished Name would be RJONES.HR.HQ .ACME.US.The Relative Distinguished Name for the User object RJONES in relation to the Organizational Unit (OU) SALES is RJONES.HR.HQ.SALESPAGENUM=22 ID="BP30"LABEL="1-5" FLOAT="0"ID="FM11132"Context in a Directory TreeFILEREF="n41ds53a.tif"Because names and contexts can be confusing for users, consider using the following IDXID="w2685"BOOK="_idx" COLLECTION="nw41" TIDREF="i2604"
guidelines:MARK=BULLETLimit the levels of container objects you have in your Directory tree.Since it is difficult for some users to remember long Distinguished Names with multiple layers of Organizational Unit (OU) objects, you might choose to have no more than two or three levels of OU objects. Maintain short names within the hierarchy.PAGENUM=23 ID="BP31"Because each object is identified by its relative location within the Directory tree, use a naming scheme that is both practical and functional for your organization.For example, name servers for their function within a specific organization, and name printers for their type and location.Use 
Alias objects for accessing objects not in current contexts.For example, if RJONES wants to use Accounting's printer, you can create an Alias object for that printer and put it in RJONES' context. This way, RJONES can find the printer in his own context and he doesn't have to remember the longer "real" name of that printer. Avoid using IDXID="w2686"BOOK="_idx" COLLECTION="nw41" TIDREF="i2571"
spaces in IDXID="w2687"BOOK="_idx" COLLECTION="nw41" TIDREF="i4219"
names.When naming objects, you can use spaces in the name. But spaces appear as underscores in some utilities.In other utilities, you might have to enclose the name in quotes to avoid having the utilities treat the two-word name as two separate commands or objects. RENDERAS="SECT2"Name ContextThe location of an object within the Directory tree, or name context, is also important when logging in. When a user logs in to the network, an available server begins a process called mutual authentication.Based on the current context and the login name provided, authentication identifies the User object to other servers in the tree and verifies that the object has rights to use certain resources.Authentication allows a user who has logged in to the network to access any servers, volumes, printers, etc., in the network that the user has rights to. Conversely, if the users lacks rights, access is denied. Authentication checks a user's rights to both Directory and file system resources. This is one way you, as a network supervisor, can regulate security. Authentication works in combination with the Access Control List to provide network security. IDREF="FM83485"See "Property Rights" on page 17 for more information. PAGENUM=24 ID="BP32"Also see "BOOK="cncptenu" COLLECTION="nw41"Name Context" and "BOOK="cncptenu" COLLECTION="nw41"Authentication" in Concepts for more information.RENDERAS="SECT2"Common NamesAll leaf objects in the Directory have a IDXID="w2688"BOOK="_idx" COLLECTION="nw41" TIDREF="i695"common name (CN). For User objects, the common name is the login name displayed in the Directory tree. For example, the common name for Edwin Sayer's User object is ESAYERS.Other leaf objects also have common names displayed in the Directory tree.RENDERAS="SECT2"ID="FM95918"Name TypesNames in the Directory tree have two name types: typeful and typeless. A IDXID="w2689"BOOK="_idx" COLLECTION="nw41" TIDREF="i4615"
typeful name includes the name type (OU, O, etc.) of each object when identifying the Distinguished Name of that object. A IDXID="w2690"BOOK="_idx" COLLECTION="nw41" TIDREF="i4617"
typeless name excludes the name type for each object in a name. A name type distinguishes the specific object you are referring to, such as a User object or an Organizational Unit object. For example, the following typeless nameFORMAT="LINESPECIFIC"MOREINFO="NONE"ESAYERS.DESIGN.LONDON.MFG.ACME.USis expressed with the name types asFORMAT="LINESPECIFIC"MOREINFO="NONE"CN=ESAYERS.OU=DESIGN.OU=LONDON.OU=MFG.O=ACME.C=USwhere CN is the common name of the leaf object, OU is the Organizational Unit name, and O is the Organization name. In most cases, you do not need to use name types.Any time you move from one container object to another, you change context. Whenever you 
change IDXID="w2691"BOOK="_idx" COLLECTION="nw41" TIDREF="i813"
contexts, you might need to indicate the Distinguished Name of the object you are changing context to.If you are referring to an object in the same container as your User object, you need only refer to the object by its common name. PAGENUM=25 ID="BP33"All Distinguished Names must be unique within a Directory tree. In addition, all container and object names must be unique within that container. The NDS database recognizes only one common name of the same name within each container.RENDERAS="SECT2"ID="FM60348"Object 
Naming 
RulesMARK=BULLETThe name must be unique in the branch (container) of the Directory tree where the object is located.The name can be up to 64 characters in length.You can use any special characters. But if the object needs to be accessed from a client workstation running a version of NetWare earlier than NetWare 4, you should avoid using IDXID="w2692"BOOK="_idx" COLLECTION="nw41" TIDREF="i4221"
special IDXID="w2693"BOOK="_idx" COLLECTION="nw41" TIDREF="i619"
characters.For a list of these special characters, IDREF="FM53855"see "Naming Restrictions for Bindery Services" on page 26.Object names are displayed with uppercase and lowercase letters as they were first entered, but they are not case-sensitive. Therefore, "ManagerProfile" and "MANAGERPROFILE" are considered to be identical names.Spaces and underscores can be used, and they are displayed as spaces. Therefore, "Manager_Profile" and "Manager Profile" are considered to be identical names.If you use a space in a name, you must place quote marks around that text string whenever you use a command line utility that includes that text string. For this reason, spaces are not recommended.Country objects can have only two-character names.If you anticipate 
managing objects created from different 
code pages, you must limit object names and properties to those characters common to all the applicable code tables.  Nondisplayable IDXID="w2694"BOOK="_idx" COLLECTION="nw41" TIDREF="i4641"
Unicode* IDXID="w2695"BOOK="_idx" COLLECTION="nw41" TIDREF="i619"
characters for your code page are represented by an ASCII 3 character (a "heart" symbol). For more information, see "BOOK="cncptenu" COLLECTION="nw41"Unicode" in Concepts.PAGENUM=26 ID="BP34"RENDERAS="SECT3"IDXID="w2696"BOOK="_idx" COLLECTION="nw41" TIDREF="i2603"IDXID="w2697"BOOK="_idx" COLLECTION="nw41" TIDREF="i2603"
Naming 
Restrictions forID="FM17060"NetWare Server ObjectsMARK=BULLETThe first NetWare Server object for a NetWare 4.1 server must be created with INSTALL. The object is given the same name as the physical server. Rules for naming physical servers are in the MOREINFO="NONE"<F1> Help of INSTALL.If you create a NetWare Server object for a server other than a NetWare 4.1 server, you must use the physical server name as well, because NetWare Directory Services must search for the server on the network to verify its existence.Because of these restrictions, we recommend renaming Server objects by changing their names in the AUTOEXEC.NCF file.For more information on NetWare Server objects, see "BOOK="cncptenu" COLLECTION="nw41"Object" in Concepts.RENDERAS="SECT3"IDXID="w2698"BOOK="_idx" COLLECTION="nw41" TIDREF="i2603"IDXID="w2699"BOOK="_idx" COLLECTION="nw41" TIDREF="i2603"ID="FM53855"Naming Restrictions for Bindery ServicesWhen you create objects to be accessed from a client workstation running the NetWare Client shell software, such as NETX, the names of the objects must follow bindery naming rules or the NetWare Client shell software cannot recognize them. Object names in bindery services are interpreted follows:MARK=BULLETSpaces in object names are replaced by underscoresObject names are cut off after the 47th characterYou cannot use the following characters in an object name that must be accessed from a client running a version of NetWare earlier than NetWare 4:TYPE="VERT"/ Slash\ Backslash: Colon, Comma* Asterisk? Question markThe object naming rules apply to most objects. Additional rules applying to NetWare Server objects and objects viewed through bindery services are described in a separate chapter. IDREF="FM20685"See Chapter 3, "Understanding Bindery Services," on page 37 for more information.PAGENUM=27 ID="BP35"RENDERAS="SECT3"Naming Restrictions for IDXID="w2700"BOOK="_idx" COLLECTION="nw41" TIDREF="i2603"IDXID="w2701"BOOK="_idx" COLLECTION="nw41" TIDREF="i2603"
International SupportIDXID="w2702"BOOK="_idx" COLLECTION="nw41" TIDREF="i4641"
UnicodeIDXID="w2703"BOOK="_idx" COLLECTION="nw41" TIDREF="i619"
is a wide character encoding scheme that provides the basis for internationalization of the information in an NDS database. All character strings exchanged between an NDS server and a client workstation are in Unicode. The NetWare client software handles the translation of Unicode strings.Occasionally, however, you might use characters that Unicode cannot translate. When this happens, the character is substituted in your display as a "heart"
symbol in DOS and as a box  in MS Windows.Substituted characters can prevent NDS from recognizing an object. See "BOOK="cncptenu" COLLECTION="nw41"Code Page" and "BOOK="cncptenu" COLLECTION="nw41"Unicode" in Concepts for more information.RENDERAS="SECT1"ID="FM28568"ID="FM68709"Where to Go from HereCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="13*"COLNAME=2 COLWIDTH="13*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"If you want toCOLNAME=2 ROTATE="0" MOREROWS="0"Go toVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Use the management features included with NDSCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM28872"Chapter 2, "Understanding Management Features," on page 29COLNAME=1 ROTATE="0" MOREROWS="0"Use bindery services with NDSCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM20685"Chapter 3, "Understanding Bindery Services," on page 37COLNAME=1 ROTATE="0" MOREROWS="0"Use time synchronization with NDSCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM92269"Chapter 4, "Understanding Time Synchronization in NDS," on page 49COLNAME=1 ROTATE="0" MOREROWS="0"Plan, manage, and implement NDSCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM62032""Planning, Implementing, and Managing," on page 63LABEL="2"PAGENUM=29 ID="BP36"ID="FM28872"Understanding Management FeaturesRENDERAS="SECT1"OverviewThis chapter describes the 
management features provided in the IDXID="w2704"BOOK="_idx" COLLECTION="nw41" TIDREF="i2318"
NetWare® Directory Services TM (NDS) technology on your network.The following topics are discussed on the indicated pages:COLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="22*"COLNAME=2 COLWIDTH="4*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"TopicCOLNAME=2 ROTATE="0" MOREROWS="0"PageVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM23852"User Object ADMIN COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM23852"29COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM67604"Directory PartitionsCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM67604"31COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM76515"Partition Replicas COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM76515"33COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM68742"Directory Synchronization COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM68742"35COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM58014"Management Utilities COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM58014"35Management of the NDSTM architecture includes the creation and management of objects and the distribution of the Directory partitions and replicas.Management utilities are provided to build and maintain the Directory tree hierarchy and objects, and to help you maintain the NDS databases within your network.RENDERAS="SECT1"ID="FM23852"User 
Object 
ADMINThe very first time the network supervisor logs in, it is as the User object ADMIN---the single User object created by default during the NetWare 4TM software installation. However, NetWare 4 does not require you to limit yourself to one network supervisor.PAGENUM=30 ID="BP37"When the ADMIN object is created on the first NetWare 4 server you 
install, it is 
granted all rights (including the Supervisor right) to every object and property in the Directory tree. This gives ADMIN complete control of the tree until you assign other User objects explicit rights and delete or mask ADMIN.As part of this assignment, ADMIN receives the Supervisor object right to the NetWare Server object. This in turn gives ADMIN the Supervisor right to the root directory of all volumes attached to the server, so ADMIN can be used to manage all directories and files on every volume in the Directory tree.However, user ADMIN does not have any special significance like that of SUPERVISOR in previous versions of NetWare. ADMIN is granted rights to create and manage all objects simply because it is the first object created.The following 
rights
 are also granted at installation to provide basic network functionality:MARK=BULLET[Public] has the Browse object right to the [Root] object.This means that all users can browse the entire Directory tree. The container object where the Volume object SYS resides is granted Read and File Scan rights to the SYS:PUBLIC directory.This means that when users are created in that container, they can access all utilities located in the SYS:PUBLIC directory.Users outside the container object that holds the SYS:PUBLIC directory should be made part of a group with explicit rights to the SYS:PUBLIC directory.Users are granted the Read right to all attributes and the Write right to the login scripts attributed on their own User objects.As other User objects are created in the Directory, you can grant the Supervisor object right to selected objects or to entire Directory subtrees.Other objects that receive the Supervisor object right are allowed to create and manage other container objects and their leaf objects. This allows network control and management to be as centralized or as distributed as you want to make it.After you have assigned another User object the Supervisor object right to the [Root] object, you can rename or delete ADMIN.PAGENUM=31 ID="BP38"Never delete user ADMIN without having assigned the Supervisor right to the [Root] object or to another User object. Neglecting to do so can be disastrous, because you eliminate supervising control of the Directory tree.  This warning also applies to other sections of the Directory tree where you have an ADMIN object defined. At each level of the tree where you have ADMIN defined, be sure you also have a User object with explicit an Supervisor right.  It is also important to remember that 
rights can be granted at a container, and they can also be taken away. If all rights are filtered at a container and if there is not a user in that container with all rights, then there is a container without full administrative rights. This can cause problems. If you experience these problems, contact a Novell Authorized ResellerCLM or Novell Technical SupportSM representative.RENDERAS="SECT1"ID="FM67604"Directory 
PartitionsDirectory partitions are logical divisions (or portions) of the Directory database that can be replicated. They form a distinct unit of data in the Directory tree used to store and replicate Directory information.NDS partitions are not related to the logical disk partitions that exist on server hard disks.The fact that an NDS database can be separated into partitions located on servers across the network enables it to be referred to as a IDXID="w2705"BOOK="_idx" COLLECTION="nw41" TIDREF="i924"distributed 
database. The partitioning of the NDS information is completely transparent to network users, making the network look like a single, cohesive collection of resources.Partitions are created to increase performance and provide ease of management and scalability.A partition is a IDXID="w2706"BOOK="_idx" COLLECTION="nw41" TIDREF="i4328"IDXID="w2707"BOOK="_idx" COLLECTION="nw41" TIDREF="i1042"subtree or branch of the IDXID="w2708"BOOK="_idx" COLLECTION="nw41" TIDREF="i1082"
Directory tree. Each partition is named according to the [Root]-most container object within the partition (the one that is closest to the [Root], also called the Partition Root Entry). The [Root] object (also at the top of the tree) is always included in the first partition created, which is known as the[Root] partition.When a partition is subordinate to another in the Directory tree, it is referred to as a child partition. The partition above it is referred to as the parent partition. PAGENUM=32 ID="BP39"The following illustration shows a 
parent partition in relation to its child partition in a Directory tree.LABEL="2-1" FLOAT="0"Parent and Child PartitionsFILEREF="n41ds21a.tif"Some characteristics of a Directory partition are as follows:MARK=BULLETA partition contains only NDS objects and related data. It does not include any information about the file system directories and files.An NDS object can exist in only one partition.PAGENUM=33 ID="BP40"Partitions are stored only on NetWare 4 servers.A single NetWare 4 server can contain multiple partitions.Partitions cannot overlap each other.RENDERAS="SECT1"ID="FM76515"
Partition
 ReplicasA IDXID="w2709"BOOK="_idx" COLLECTION="nw41" TIDREF="i3792"replica is an instance of a partition. You can create an unlimited number of replicas for each partition and store them on any NetWare 4 servers on the network.RENDERAS="SECT2"PurposeIDXID="w2710"BOOK="_idx" COLLECTION="nw41" TIDREF="i3792"
Replicas are created for two reasons:MARK=BULLETIDXID="w2711"BOOK="_idx" COLLECTION="nw41" TIDREF="i1056"IDXID="w2712"BOOK="_idx" COLLECTION="nw41" TIDREF="i1056"
Directory Fault Tolerance. If a disk crashes or a server goes down, a replica on a server in another location can still authenticate users to the network and provide information on objects in the disabled server's replica.With the same information distributed on several servers, you are not dependent on any single server being up to authenticate you to the network or to provide services to you.You can store a replica of one partition with a replica of another partition on the same server.Directory replication does not provide fault tolerance for the file system. Only information about Directory objects is replicated.  To provide fault tolerance for your files, you must mirror or duplex your hard disks and enable the Transaction Tracking SystemTM (TTS) feature.  The TTSTM feature must be enabled for NDS to work. See "BOOK="cncptenu" COLLECTION="nw41"Transaction Tracking System" in Concepts and "BOOK="superenu" COLLECTION="nw41"Protecting Database Integrity with TTS" in Chapter 7 of Supervising the Network for more information.IDXID="w2713"BOOK="_idx" COLLECTION="nw41" TIDREF="i4812"Faster Access Across a 
WAN Link. If users currently use a WAN link to access particular Directory information, you can decrease access time and WAN traffic by placing a replica containing the needed information on a server that users can access locally.PAGENUM=34 ID="BP41"However, in some cases, WAN traffic could increase due to the amount of synchronization required.Distributing replicas among servers on the network allows quick and reliable access because information is retrieved from the nearest available server containing the specified information.RENDERAS="SECT2"TypesThere are four IDXID="w2714"BOOK="_idx" COLLECTION="nw41" TIDREF="i3792"
types of replicas you can create:MARK=BULLETMaster replica. A writable replica that contains all object information for the partition. All partition operations (create, merge, move, creating a replica, deleting a replica, repair) occur from the master replica of the given partition.Only one master replica can be defined for each partition.Read/write replica. Contains the same object information as the master replica. Allows modifications (writes) when a master replica of the given partition is already defined somewhere else.There can be any number of read/write replicas.Client workstations can update master and read/write replicas only.Read-only replica. Contains the same object information as the partition, but the information can only be read. Used where reading of the partition is required, but writes to the partition should not occur.A read-only replica cannot be used on a server where bindery services is required because bindery services requires a writable replica. When bindery services is set, use either a master or read/write replica.  The default setting in the NetWare 4 installation program copies a  read/write replica of the partition that a bindery server is being upgraded to.  IDREF="FM20685"See Chapter 3, "Understanding Bindery Services," on page 37 for more information.Subordinate reference replica. Cannot be modified by any user. Automatically placed on a server by NDS if the parent partition has a master, read/write, or read-only replica on the server and the child partition does not exist on the server.PAGENUM=35 ID="BP42"If you add a read/write or read-only replica of the child partition to the server, the subordinate reference replica is removed.RENDERAS="SECT1"ID="FM68742"Directory IDXID="w2715"BOOK="_idx" COLLECTION="nw41" TIDREF="i1042"
SynchronizationIDXID="w2716"BOOK="_idx" COLLECTION="nw41" TIDREF="i4355"When changes are made to objects within a partition, those changes are automatically sent to all other replicas of that partition. This ensures that the global Directory database remains consistent. Only changes are sent to other replicas. For example, if a user changes a phone number, only the new phone number is sent, not the entire User object.The master replica participates in the partition synchronization process by exchanging updates with other replicas, but it is not a controlling entity in this process. Similarly, each read/write replica synchronizes with the other replicas of the partition. Read-only replicas also synchronize with other replicas, but they receive updates only from other servers.An NDS database is a "loosely consistent" database. As changes occur, all replicas of a partition do not always contain exactly the same information at every instant. In fact, the contents of the replicas most likely vary slightly at any given time. However, these replicas eventually converge to a consistent state once the changes are distributed to all replicas.Some changes are sent immediately to other replicas, such as changes to a user's password. Other, less critical changes, such as a user's last login time, are collected locally for a short period of time before being sent out to the network.For this synchronization to occur, each replica must be contacted. Each replica maintains a record of the location of each of its replicas. The locations are stored in the partition's replica property, with one property entry for each replica of the partition. The collection of replica properties of a partition forms a list of the replicas, sometimes called a IDXID="w2717"BOOK="_idx" COLLECTION="nw41" TIDREF="i3792"replica ring or IDXID="w2718"BOOK="_idx" COLLECTION="nw41" TIDREF="i3792"replica list.RENDERAS="SECT1"ID="FM58014"ManagementIDXID="w2719"BOOK="_idx" COLLECTION="nw41" TIDREF="i2317"
 UtilitiesManagement utilities help you build and maintain your Directory Tree hierarchy and objects, as well as helping you maintain the Directory databases within your network.PAGENUM=36 ID="BP43"IDREF="FM86103"See Chapter 7, "Managing NetWare Directory Services," on page 115 for more information about the use of the management utilities.RENDERAS="SECT1"Where to Go from HereCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="13*"COLNAME=2 COLWIDTH="13*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"If you want toCOLNAME=2 ROTATE="0" MOREROWS="0"Go toVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Use NDS in your networkCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM64377"Chapter 1, "Understanding NetWare Directory Services," on page 3COLNAME=1 ROTATE="0" MOREROWS="0"Use bindery services with NDSCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM20685"Chapter 3, "Understanding Bindery Services," on page 37COLNAME=1 ROTATE="0" MOREROWS="0"Use time synchronization with NDSCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM92269"Chapter 4, "Understanding Time Synchronization in NDS," on page 49COLNAME=1 ROTATE="0" MOREROWS="0"Plan, manage, and implement NDSCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM62032""Planning, Implementing, and Managing," on page  63COLNAME=1 ROTATE="0" MOREROWS="0"Use the management utilitiesCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM86103"Chapter 7, "Managing NetWare Directory Services," on page 115LABEL="3"PAGENUM=37 ID="BP44"ID="FM20685"Understanding Bindery ServicesRENDERAS="SECT1"OverviewThis chapter describes the management procedures used for setting up and maintaining 
bindery services when you implement the NetWare® Directory ServicesTM (NDS) technology on your network.The following topics are discussed on the indicated pages:COLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="22*"COLNAME=2 COLWIDTH="4*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"TopicCOLNAME=2 ROTATE="0" MOREROWS="0"PageVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM71030"Setting Up Bindery Services COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM71030"39COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM16606"Setting Bindery Context COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM16606"40Some applications and services which run in the NetWare 4TM environment do not currently take full advantage of NDSTM technology. To enable users of these services to access them from the NetWare 4 environment, Novell created bindery services.With IDXID="w2720"BOOK="_idx" COLLECTION="nw41" TIDREF="i458"
bindery services, NDS imitates a flat structure for leaf objects within a set of Organization (O) and Organizational Unit (OU) objects. Thus, when bindery services is enabled, all objects within the specified container's bindery context can be accessed both by NDS objects and by bindery-based servers and client workstations. Bindery services applies only to leaf objects in the specified container objects. The container object where bindery services is set is called the IDXID="w2721"BOOK="_idx" COLLECTION="nw41" TIDREF="i439"bindery context. You can change the 
bindery context by using the appropriate parameters with the SET or SERVMAN server utility. IDREF="FM36681"See "SET (NDS Parameters)" on page
130 or "BOOK="utlrfenu" COLLECTION="nw41"SET" in Utilities Reference.PAGENUM=38 ID="BP45"IDXID="w2722"BOOK="_idx" COLLECTION="nw41" TIDREF="i452"
The following figure illustrates bindery services when aIDXID="w2723"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"
 bindery context is set at an Organizational Unit object.LABEL="3-1" FLOAT="0"ID="FM66562"Bindery Services in a Directory TreeFILEREF="n41ds01a.tif"A read/write replica of the Directory partition that provides the bindery context is stored on the server that you want bindery services enabled on. However, by default, only the first three servers installed on a partition or upgraded from a bindery to NDS receive a replica of the partition during the installation procedure and are able to subsequently support bindery services. You can still add replicas to other servers if needed for bindery services.If a read/write or master replica is not present, you must use the Partition Manager utilities to add one to the server. IDREF="FM86103"See Chapter 7, "Managing NetWare Directory Services," on page 115 for information and procedures.The installation program also sets the bindery context in the IDXID="w2724"BOOK="_idx" COLLECTION="nw41" TIDREF="i364"
AUTOEXEC.NCFIDXID="w2725"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"IDXID="w2726"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"
 file for upgraded bindery-based servers only. The bindery context exists, but no static bindery services exists. The IDXID="w2727"BOOK="_idx" COLLECTION="nw41" TIDREF="i4089"
SETIDXID="w2728"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"IDXID="w2729"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"
command allows you to set up to 16 semicolon-delimited contexts. These can be both valid and invalid contexts.PAGENUM=39 ID="BP46"Every ten minutes the validity of these contexts is verified, and static bindery services exists only in those contexts which prove to be valid. The SET command then reflects a set of bindery contexts, but some choices might be invalid and are thus ignored.If IDXID="w2730"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"
bindery IDXID="w2731"BOOK="_idx" COLLECTION="nw41" TIDREF="i458"
context is not set, NDS IDXID="w2732"BOOK="_idx" COLLECTION="nw41" TIDREF="i452"
cannot support bindery services. Bindery services is server-centric. If a client workstation does a bindery login, the login script is coming from the MAIL directory on the server that the client is logging in to. Any changes to the user's bindery login script are made on a single server and are not be distributed to any other servers.You cannot 
disableIDXID="w2733"BOOK="_idx" COLLECTION="nw41" TIDREF="i452"
 bindery services if the bindery is being accessed. The bindery objects are always available unless the bindery is closed through bindery services.RENDERAS="SECT1"ID="FM71030"Setting
 Up IDXID="w2734"BOOK="_idx" COLLECTION="nw41" TIDREF="i452"
Bindery ServicesWhen you plan and implement bindery services, you need to consider the following.RENDERAS="SECT2"Created IDXID="w2735"BOOK="_idx" COLLECTION="nw41" TIDREF="i458"
ObjectsMARK=BULLETIf bindery files exist for the User object GUEST and the Group object EVERYONE, the objects are upgraded. However, if these files do not exist, the objects are not automatically created.If you require the user GUEST or group EVERYONE, or if you use a service that requires either, you must create such a user or group.For example, if you are using NetWare NFS*, which requires the group EVERYONE, you must create the group and add users to the group manually.The User object SUPERVISOR is automatically created but is not used under NDS. (You can create a User object SUPERVISOR and assign ADMIN-equivalent rights to this user in order to use the SUPERVISOR account in NDS.)PAGENUM=40 ID="BP47"However, the user SUPERVISOR does exist as a bindery services User object. Although it is not visible under NDS, it can be accessed through a bindery services login. These two user objects are unique and separate objects.During the upgrade process from NetWare 3TM to NetWare 4TM software, all users except SUPERVISOR and all groups are upgraded to NDS objects. The user SUPERVISOR is upgraded, but with supervisory rights for that server's file system and bindery context only. The supervisor does not appear as an NDS object.RENDERAS="SECT2"Inaccessible IDXID="w2736"BOOK="_idx" COLLECTION="nw41" TIDREF="i458"
InformationIDXID="w2737"BOOK="_idx" COLLECTION="nw41" TIDREF="i1801"Bindery services users cannot access NDS information that is not in the bindery. This information includes, but not limited to, the following items:MARK=BULLETE-mail namePhone numberPrint job configurationsAliasesProfilesNDS login scriptsRENDERAS="SECT2"Limited IDXID="w2738"BOOK="_idx" COLLECTION="nw41" TIDREF="i458"
PartitioningIDXID="w2739"BOOK="_idx" COLLECTION="nw41" TIDREF="i3231"The bindery context for a server can be IDXID="w2740"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"IDXID="w2741"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"
set to a container stored on a different server, but this will not be valid until a master or read/write replica is placed on that server.It is also possible to set the bindery context for a server to a container that is not part of a writable replica, but the context will not be accessible through bindery services.RENDERAS="SECT1"ID="FM16606"Setting Bindery ContextOnly objects at the bindery context are available for bindery services. The IDXID="w2742"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"IDXID="w2743"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"
bindery context should be set in the IDXID="w2744"BOOK="_idx" COLLECTION="nw41" TIDREF="i364"
AUTOEXEC.NCF file on each server, although it can also be set at the server with the SET command.PAGENUM=41 ID="BP48"Each server can support up to 16 containers that comprise the bindery context. Each bindery context is the name of the container where bindery services is available on the server.RENDERAS="SECT2"In a IDXID="w2745"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"IDXID="w2746"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"
Single-Level Directory TreeIf the Directory contains only one container level (that is, if the Directory is flat), there is only one possible bindery context. For example, the following figure shows a Directory tree with only one level. LABEL="3-2" FLOAT="0"Bindery Context in a Flat Directory TreeFILEREF="n41ds26a.tif"In effect, this structure is like a bindery and is not scalable like NDS. Because there is only one container object, the bindery context for the servers can be set to O=ACME, using the following command in the AUTOEXEC.NCF file:FORMAT="LINESPECIFIC"MOREINFO="NONE"SET BINDERY CONTEXT=ACME.USBecause the user objects are also located within the O=ACME container object, those users can log in to either server under bindery services.RENDERAS="SECT2"In a IDXID="w2747"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"IDXID="w2748"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"
Multiple-Level Directory TreeIf the Directory tree hierarchy contains more levels, the bindery context has a more noticeable effect on a user's ability to access bindery services. For example, consider the Directory tree shown in the following figure.PAGENUM=42 ID="BP49"LABEL="3-3" FLOAT="0"Two Different Bindery Contexts in a Directory TreeFILEREF="n41ds27a.tif"This Directory tree has five container objects, each designated by the naming type O or OU:FORMAT="LINESPECIFIC"MOREINFO="NONE"O=ACME
OU=HQ.O=ACME
OU=HR.OU=HQ.O=ACME
OU=ACCT.OU=HQ.O=ACME
OU=PAY.OU=HQ.O=ACMEThis Directory tree also contains two servers, each with its bindery context set as follows:PAGENUM=43 ID="BP50"FORMAT="LINESPECIFIC"MOREINFO="NONE"SET BINDERY CONTEXT=HQ.ACMEFORMAT="LINESPECIFIC"MOREINFO="NONE"SET BINDERY CONTEXT=ACCT.HQ.ACMERENDERAS="SECT2"For a IDXID="w2749"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"IDXID="w2750"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"
Specific ServerA server's bindery context can be set to any OU or O that is present in a replica on that server.For example, given the partitions defined in IDREF="FM16255"Figure 3-4, you could set the bindery context of ACCT_SRV1 to any one of the following containers:MARK=BULLETOU=HQO=ACMEOU=DETROITPAGENUM=44 ID="BP51"LABEL="3-4" FLOAT="0"ID="FM16255"Bindery Contexts for a Specific ServerFILEREF="n41ds28a.tif"This Directory tree represents three partitions of the ACMECORP tree. If there were only one partition, the bindery context could be set to any OU, O, or set of OU and O in the tree. But because multiple partitions exist, any context you set in a different partition must be set to the [Root] of the tree.Nevertheless, the bindery context must specify the containers that hold the users that want to log in to that server under bindery services.For example, suppose you want to set the bindery context for the server PROD1_SRV2 in this tree to OU=HQ so that user ESAYERS can log in to that server with a bindery login. You would enter the following command in that server's AUTOEXEC.NCF file:PAGENUM=45 ID="BP52"FORMAT="LINESPECIFIC"MOREINFO="NONE"SET BINDERY CONTEXT=HQ.MFG.ACMEThis command sets the bindery context to the OU=HQ container and provides the path NDS uses to find that container. In this case, the command specifies that the bindery context OU=HQ is contained in OU=MFG.O=ACME.Be careful when IDXID="w2751"BOOK="_idx" COLLECTION="nw41" TIDREF="i439"
changing
 a server's IDXID="w2752"BOOK="_idx" COLLECTION="nw41" TIDREF="i813"
bindery context. IDXID="w2753"BOOK="_idx" COLLECTION="nw41" TIDREF="i3773"
Removing a container from that server's IDXID="w2754"BOOK="_idx" COLLECTION="nw41" TIDREF="i439"
bindery context prevents all users in that container from using bindery services.RENDERAS="SECT2"For IDXID="w2755"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"IDXID="w2756"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"
Multiple Servers in the Same Bindery ContextIf a user needs IDXID="w2757"BOOK="_idx" COLLECTION="nw41" TIDREF="i56"
access to several servers, you could use the same container in the bindery context for all of those servers; however, Server objects do not need to be located in their bindery contextThe following figure illustrates how to locate each Server object within the same container as the User object.PAGENUM=46 ID="BP53"LABEL="3-5" FLOAT="0"Multiple Servers in the Same Bindery ContextsFILEREF="n41ds29a.tif"In this example, ESAYERS can access both servers, TEST_SRV2 and TEST_SRV3, within the OU=TEST bindery context. However, if  you remove the container holding ESAYERS from the bindery context setting of either server, ESAYERS can't log in to the changed server through bindery services.Make sure that each server you want to set in the bindery context has a writable (master or read/write) replica of the partition with the Organizational Unit (OU) you want.PAGENUM=47 ID="BP54"RENDERAS="SECT2"For IDXID="w2758"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"IDXID="w2759"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"
Objects in Different Bindery ContextsIdeally, all objects a user wants to IDXID="w2760"BOOK="_idx" COLLECTION="nw41" TIDREF="i56"
access under bindery services should be located in the same bindery context. However, this is not always possible or practical.You can set multiple bindery contexts for users who need to access objects outside of their own bindery contexts. For example, consider the Directory tree in the following figure. LABEL="3-6" FLOAT="0"ID="FM81808"Multiple Bindery Contexts in the Same Directory TreeFILEREF="n41ds30a.tif"PAGENUM=48 ID="BP55"To set the bindery contexts in this figure to the container OU=HQ where ESAYES and SWILLIAMS can access the objects in the other bindery contexts, you would enter the following command in the server's AUTOEXEC.NCF file where the users are located:FORMAT="LINESPECIFIC"MOREINFO="NONE"SET BINDERY CONTEXT=ACCT.HQ.ACME;PROD1.DETROIT.MFG.ACME;TEST.DETROIT.MFG.ACME;SALES.ACME;To set multiple bindery contexts, you must set the contexts to the [Root] of the tree. You can also set IDXID="w2761"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"
multiple bindery contexts with the IDXID="w2762"BOOK="_idx" COLLECTION="nw41" TIDREF="i4101"
SET utility. You can set up to 16 contexts per server.Use a semicolon to separate contexts. For more information, see "BOOK="utlrfenu" COLLECTION="nw41"SET" in Utilities Reference.Do not change a server's bindery context once you set it. Changing a server's bindery context prevents all bindery services users (from the original context) who need to log in to that server from accessing bindery services. Changing the server's bindery context can also disable access to print queues.RENDERAS="SECT1"Where to Go from HereCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="13*"COLNAME=2 COLWIDTH="13*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"If you want toCOLNAME=2 ROTATE="0" MOREROWS="0"Go toVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Use NDS in your networkCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM64377"Chapter 1, "Understanding NetWare Directory Services," on page 3COLNAME=1 ROTATE="0" MOREROWS="0"Use the management features included with NDSCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM28872"Chapter 2, "Understanding Management Features," on page 29COLNAME=1 ROTATE="0" MOREROWS="0"Use time synchronization with NDSCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM92269"Chapter 4, "Understanding Time Synchronization in NDS," on page 49COLNAME=1 ROTATE="0" MOREROWS="0"Plan, manage, and implement NDSCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM62032""Planning, Implementing, and Managing," on page
63LABEL="4"PAGENUM=49 ID="BP56"ID="FM92269"Understanding Time Synchronization in NDSRENDERAS="SECT1"OverviewThis chapter describes the management procedures used for setting up and maintaining time synchronization in your implementation of the NetWare® Directory ServicesTM (NDS) technology on your network.The following topics are discussed on the indicated pages.COLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="22*"COLNAME=2 COLWIDTH="4*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"TopicCOLNAME=2 ROTATE="0" MOREROWS="0"PageVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM65897"Time Stamps COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM65897"49COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM60956"Time Servers COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM60956"50COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM53795"Time Source Server FunctionsCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM53795"55COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM27092"Choosing a Time Synchronization Method COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM27092"56Time synchronization is important to the operation of NDSTM technology because it establishes the order of events. It is a method of ensuring that all servers in a Directory tree report the same time.Clocks in computers can deviate slightly, resulting in different times on different servers. Time synchronization corrects these deviations so that all servers in a Directory tree report the same time and provide a time stamp to order NDS events.RENDERAS="SECT1"ID="FM65897"Time IDXID="w2763"BOOK="_idx" COLLECTION="nw41" TIDREF="i4478"
StampsWhenever an event occurs in the Directory, such as when a password is changed or an object is renamed, NDS requests a time stamp. A time stamp is a unique code that identifies the event and notes the time of its occurrence. PAGENUM=50 ID="BP57"Every NDS event is assigned a time stamp so that the order in which replicas are updated is correct by means of the time set in the time stamp. This time stamp is used in the event of collisions (multiple changes to the same object from different servers) on the network to determine the source location and sequence of events.Time stamps are especially important when Directory partitions are replicated and need to be concurrent with one another. This is important because some events, such as deleting or creating an object, need a method of recording the order of these events. If no method existed, NDS might try to create an object and then delete it.NDS uses time stamps toMARK=BULLETEstablish the order of events (such as object creation and Directory partition replication)Record "real world" time valuesSet expiration datesRENDERAS="SECT1"ID="FM60956"
Time ServersWhen you install NetWare 4.1 on a server, you are prompted to designate it as a Single Reference, Primary, Reference, or Secondary time server.Each designation performs a particular time synchronization function, as explained in the following sections.RENDERAS="SECT2"Single 
ReferenceSingle Reference time servers provide time to Secondary time servers and to their own client workstations.This server determines the time for the entire network and is the only Reference server at the time it is running that provides a source of time on the network. The network supervisor sets the time on the Single Reference time server (It is possible for the time to be synchronized to an external clock.)Because the Single Reference time server is the source of time on the network, all other servers must be able to contact it.PAGENUM=51 ID="BP58"The following figure illustrates a Single Reference time server providing time to Secondary time servers and to its own client workstations. The Secondary time servers, in turn, provide time to their own client workstations.LABEL="4-1" FLOAT="0"ID="FM14099"Single Reference Time ServerFILEREF="n40ds32a.tif"The Single Reference time server works on networks of any size, but the TIMESYNC configuration shown inIDREF="FM14099"Figure 4-1 is used primarily for small networks that don't include WAN links.If you use a Single Reference time server, don't use any Primary or Reference time servers on the network because the time references will conflict.PAGENUM=52 ID="BP59"RENDERAS="SECT2"PrimaryPrimary time servers synchronize the time with at least one other Primary time server or with a Reference time server, and they provide the time to Secondary time servers and directly to client workstations. Primary time servers also "poll" with other Primary or Reference time servers to "vote" what theIDXID="w2764"BOOK="_idx" COLLECTION="nw41" TIDREF="i4478"
 common 
network time should be. Primary time servers adjust their internal clocks to synchronize with that common network time. Because all Primary servers adjust their clocks, network time might drift slightly.The following figure shows Primary time servers in various locations providing time to their respective Secondary time servers. Secondary time servers, in turn, provide time to their client workstations.LABEL="4-2" FLOAT="0"Primary Time ServersFILEREF="n41ds07a.tif"PAGENUM=53 ID="BP60"Place a Primary time server in each geographically distinct area so that secondary servers and client workstations can access them without using WAN links.Use a Primary time server on larger networks to increase Directory IDXID="w2765"BOOK="_idx" COLLECTION="nw41" TIDREF="i1056"IDXID="w2766"BOOK="_idx" COLLECTION="nw41" TIDREF="i1056"
fault tolerance by providing redundant paths for Secondary time servers.If a Primary time server goes down, the Secondary time server can get the time from an alternate Primary time server.You must have at least one other Primary time server or a Reference time server that a Primary time server can contact. Whenever Primary and Reference time servers are on a network, they must be able to contact each other for polling.RENDERAS="SECT2"ReferenceReference time servers provide a time that all other time servers and client workstations can synchronize with.Reference time servers can be synchronized with an external time source, such as a radio atomic clock.A Reference time server acts as a central point to set network time by. Eventually, all Primary time servers adjust their clocks to agree with a Reference time server.Reference time servers do not adjust their internal clocks; instead, the Primary servers' internal clocks are adjusted to synchronize with the Reference time server.The following figure shows a Reference time server synchronized to an external clock. The Reference time server, in turn, provides time to its own Secondary servers and client workstations, as well as to a Primary time server at another location.PAGENUM=54 ID="BP61"LABEL="4-3" FLOAT="0"Reference Time ServerFILEREF="n41ds06a.tif"Use a Reference time server when it is important to have a central point to control time on the network. Usually, only one Reference time server is installed on a network. If you use more than one Reference time server on a network, you must synchronize each Reference time server with the same external time source, such as a radio atomic clock.You must have at least one Primary time server that the Reference time server can contact in order to poll the servers to vote on a correct time.Whenever Primary and Reference time servers are on a network, they must be able to contact each other for polling and voting.RENDERAS="SECT2"SecondarySecondary time servers obtain the time from a Single Reference, Primary, or Reference time server. They adjust their internal clocks to synchronize with the network time, and they provide the time to client workstations.A Secondary time server doesn't participate in determining (polling and voting) the correct network time.If you have designated a server on the network as a Single Reference time server, then designate all other servers on the network as Secondary time servers.PAGENUM=55 ID="BP62"If you have designated several servers on the network as Primary or Reference time servers, then designate all other servers on the network as Secondary time servers.To keep network traffic to a minimum, use Secondary time servers that are close in proximity to Primary or Reference time servers.For 
optimal 
time synchronization, minimize the number of intervening routers and slow LAN segments between Secondary time servers and their Single Reference, Primary, or Reference time server.RENDERAS="SECT1"ID="FM53795"Time Source Server FunctionsThe Single Reference, Primary, and Reference time servers are all IDXID="w2767"BOOK="_idx" COLLECTION="nw41" TIDREF="i4478"time source servers. That is, they provide time to the network. Secondary servers do not provide a time to other servers; they only receive a time from a time source server. (They do, however, provide time to client workstations.)Time source servers use one of two methods to find each other, SAP or custom configuration.RENDERAS="SECT2"ID="FM14763"SAP
 (Service 
Advertising Protocol)By default, Primary, Reference, and Single Reference time servers use SAP to announce their presence on the network.Primary and Reference time servers use the SAP information to determine which other servers to poll in order to determine the network time.Secondary time servers use the SAP information to choose a time server to follow.An advantage of the SAP method is that it allows for quick installation without regard to the network layout. It also allows automatic reconfiguration if operating modes are changed or if new servers are added to the network.The SAP method, however, generates additional network traffic.  The SAP method can also be disruptive in large network environments where "test" servers come and go, especially if the test server is configured as a time source (Single, Reference, or Primary time server).PAGENUM=56 ID="BP63"RENDERAS="SECT2"Custom 
ConfigurationCustom configuration of your time servers gives you more control over time synchronization, but it requires more planning to synchronize servers efficiently.An advantage of custom configuration is that you maintain complete control of the time synchronization environment.Also, custom configuration helps eliminate nonessential network SAP traffic, as well as errors associated with accidental reconfiguration.It is also possible to list the specific time source servers that a server should contact.It is possible to specify that a server should not listen for SAP information from other time source servers and that it is not to advertise its presence using SAP.The custom configuration does require additional time for planning and installation.  It is also more difficult to install or remove Primary, Reference, or Single Reference time servers on the network. You must manually change the approved server list maintained on each server.RENDERAS="SECT1"ID="FM27092"Choosing a 
Time Synchronization MethodYou can use both the SAP and custom configuration methods on the same network. However, the custom configuration information that is stored on the server always takes precedence over the SAP information received by the server. If a server does not have custom configuration information, SAP information is used for time synchronization. On small networks, where it is unlikely that servers will be added or reconfigured after initial installation, you should use a Single Reference time server using SAP. (These are the installation defaults.)  On larger networks, or on networks subject to frequent reconfiguration when servers are added or removed, you should use a custom configuration.The following tables and figures discuss and illustrate the major points of each type of time server.PAGENUM=57 ID="BP64"LABEL="4-1" PGWIDE=1 TOCENTRY="1" Single Reference Time ServerCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="9*"COLNAME=2 COLWIDTH="26*"VALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"FunctionCOLNAME=2 ROTATE="0" MOREROWS="0"Provides time to Secondary time servers and client workstations.COLNAME=1 ROTATE="0" MOREROWS="0"UseCOLNAME=2 ROTATE="0" MOREROWS="0"Works for all networks, regardless of size, but is used primarily for a small LAN.Installed by default with NetWare 4 installation.COLNAME=1 ROTATE="0" MOREROWS="0"CautionsCOLNAME=2 ROTATE="0" MOREROWS="0"Because the Single Reference time server is the sole source of time on the network, all other servers must be able to contact it.No Primary or Reference time servers are allowed on the network.LABEL="4-4" FLOAT="0"Example of a Network Using a Single Reference Time ServerFILEREF="n40ds32a.tif"PAGENUM=58 ID="BP65"LABEL="4-2" PGWIDE=1 TOCENTRY="1" Primary Time ServerCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="9*"COLNAME=2 COLWIDTH="26*"VALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"FunctionCOLNAME=2 ROTATE="0" MOREROWS="0"Synchronizes the time with at least one other Primary time server or with a Reference time server, and provides the time to Secondary time servers and workstations.Polls other Primary or Reference time servers and then votes with them to synchronize the time. COLNAME=1 ROTATE="0" MOREROWS="0"UseCOLNAME=2 ROTATE="0" MOREROWS="0"Use on larger networks to increase fault tolerance by providing redundant paths for Secondary time servers. If a Primary time server goes down, the Secondary time server can get the time from an alternate Primary time server. Use a Primary time server for every 125-150 Secondary servers.Place one in each geographically distant area so that Secondary time servers and client workstations can access them without using WAN links.COLNAME=1 ROTATE="0" MOREROWS="0"CautionsCOLNAME=2 ROTATE="0" MOREROWS="0"You must have at least one other Primary time server or with a Reference time server that a Primary time server can contact.PAGENUM=59 ID="BP66"LABEL="4-5" FLOAT="0"Example of a Network Using Primary Time ServersFILEREF="n41ds64a.tif"LABEL="4-3" PGWIDE=1 TOCENTRY="1" Reference Time ServerCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="9*"COLNAME=2 COLWIDTH="26*"VALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"FunctionCOLNAME=2 ROTATE="0" MOREROWS="0"Provides a time that all other time servers and client workstations can synchronize with. Polls other Primary or Reference time servers and then votes with them to synchronize the time. Because a Reference time server does not change its clock, Primary time servers must reach consensus with the time that a Reference time server provides.COLNAME=1 ROTATE="0" MOREROWS="0"UseCOLNAME=2 ROTATE="0" MOREROWS="0"Use when it is important to have a central point to control time on the network.COLNAME=1 ROTATE="0" MOREROWS="0"CautionsCOLNAME=2 ROTATE="0" MOREROWS="0"Usually, only one Reference time server is installed on a network; however, because the Reference time server must poll at least one other time server, you must install a Primary time server or another Reference time server on the same network. If there is more than Reference time server, each must be synchronized with the same external time source.PAGENUM=60 ID="BP67"LABEL="4-6" FLOAT="0"Example of a Network Using a Reference Time ServerFILEREF="n41ds63a.tif"LABEL="4-4" PGWIDE=1 TOCENTRY="1" Secondary Time ServerCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="9*"COLNAME=2 COLWIDTH="26*"VALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"FunctionCOLNAME=2 ROTATE="0" MOREROWS="0"Obtains the time from a Single Reference, Primary, or Reference time server and provides the time to client workstations.COLNAME=1 ROTATE="0" MOREROWS="0"UseCOLNAME=2 ROTATE="0" MOREROWS="0"If you have designated a server on the network as a Single Reference time server, then designate all other servers on the network as Secondary time servers.If you have designated several servers on the network as Primary or Reference time servers, then designate all other servers on the network as Secondary time servers.Associate Secondary time servers to Primary or Reference time servers that are physically close in order to keep network traffic to a minimum.For the best time synchronization, require each Secondary time server to contact a Single Reference, Primary, or Reference time server with as few intervening routers and slow WAN segments as possible.COLNAME=1 ROTATE="0" MOREROWS="0"CautionsCOLNAME=2 ROTATE="0" MOREROWS="0"You can have a Secondary time server contact another Secondary time server for the time.However, you should be cautious when removing a Secondary time server if other Secondary time servers are contacting it for time. This might cause the other Secondary servers to be too many hops away from a time source server to synchronize with.PAGENUM=61 ID="BP68"RENDERAS="SECT1"Where to Go from HereCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="13*"COLNAME=2 COLWIDTH="13*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"If you want toCOLNAME=2 ROTATE="0" MOREROWS="0"Go toVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Use NDS on your networkCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM64377"Chapter 1, "Understanding NetWare Directory Services," on page 3COLNAME=1 ROTATE="0" MOREROWS="0"Use the management features included with NDSCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM28872"Chapter 2, "Understanding Management Features," on page 29COLNAME=1 ROTATE="0" MOREROWS="0"Use bindery services with NDSCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM20685"Chapter 3, "Understanding Bindery Services," on page 37COLNAME=1 ROTATE="0" MOREROWS="0"Plan, manage, and implement NDSCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM62032""Planning, Implementing, and Managing," on page 63LABEL=""PAGENUM=63 ID="BP69"ID="FM62032"Planning, Implementing, and ManagingRENDERAS="SECT1"OverviewThe NetWare Directory ServicesTM (NDS) technology requires you to set up a Directory tree for implementing NDSTM on your network. Efficient planning and management can make your implementation simple and easy to do. This section will provide you with a conceptual overview only. Additional sources of information for planning your Directory tree are Novell Education classes and Novell Application NotesTM. For more information on classes at a Novell Authorized Education CenterCLM facility, in the U. S. and Canada call 1-800-233-3382 or 1-801-429-5508.RENDERAS="SECT1"ContentsThis section is divided into three chapters, with the following information discussed on the indicated pages:COLS=3 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="19*"COLNAME=2 COLWIDTH="12*"COLNAME=3 COLWIDTH="4*"VALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"PurposeCOLNAME=2 ROTATE="0" MOREROWS="0"ChapterCOLNAME=3 ROTATE="0" MOREROWS="0"PageCOLNAME=1 ROTATE="0" MOREROWS="0"To learn more about planning a NetWare Directory treeCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM26542"Chapter 5, "Planning NetWare Directory Services Implementation"COLNAME=3 ROTATE="0" MOREROWS="0"IDREF="FM26542"65COLNAME=1 ROTATE="0" MOREROWS="0"To learn more about implementing NetWare Directory Services on your network.COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM47603"Chapter 6, "Implementing NetWare Directory Services"COLNAME=3 ROTATE="0" MOREROWS="0"IDREF="FM47603"95COLNAME=1 ROTATE="0" MOREROWS="0"To learn more about managing a NetWare Directory tree and databaseCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM86103"Chapter 7, "Managing NetWare Directory Services"COLNAME=3 ROTATE="0" MOREROWS="0"IDREF="FM86103"115LABEL="5"PAGENUM=65 ID="BP70"ID="FM26542"Planning NetWare Directory Services ImplementationRENDERAS="SECT1"OverviewThis chapter provides instruction for planning
 the implementation of the NetWare® Directory ServicesTM (NDS) technology in your network.The following topics are discussed on the indicated pages:COLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="22*"COLNAME=2 COLWIDTH="4*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"TopicCOLNAME=2 ROTATE="0" MOREROWS="0"PageVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM25663"Guidelines for Implementing NDS COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM25663"66COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM23102"Creating Naming Standards COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM23102"68COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM92771"Developing an Implementation Strategy COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM92771"71COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM25881"Organizing Objects into a Logical Hierarchy COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM25881"75COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM32301"Developing a Replication Strategy COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM32301"86COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM32583"Developing a Time Synchronization Strategy  COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM32583"89COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM15646"Developing a Security Strategy for the Directory Tree COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM15646"90COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM44169"Developing an Integration Strategy for Bindery Services COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM44169"92The size of your network determines the amount of planning necessary for 
implementing the NDSTM technology---the larger the network, the more planning might be required.A small network implementation of a Directory tree with only one container object needs minimal, if any, planning of the Directory tree structure. A large network with thousands of users, hundreds of servers, hundreds of printers, and dozens of network supervisors in various departments benefits greatly from advanced planning of the Directory tree structure. PAGENUM=66 ID="BP71"Regardless, a good implementation of NDS makes all of your network resources available in one information system, with an overall strategy for consistent and logical organization of network resources.Efficient planning enables your Directory tree toMARK=BULLETMake looking up information easier for usersMake administering the network easier for network supervisorsProvide fault tolerance for the Directory databaseDecrease traffic on the networkTo plan the implementation of NetWare Directory Services, consider the following issues:MARK=BULLETWhat organizational structure of the Directory tree makes the most sense for your network resources?How do you want the Directory database to be partitioned, and where do you want to store replicas of those partitions?How should time be kept and synchronized among the servers on the network?Although planning is important to a successful implementation, NDS does allow for subsequent changes to the Directory tree structure. NDS is very flexible and has been designed to allow restructuring as you change the structure of organizations, change locations, or merge Directory trees.RENDERAS="SECT1"ID="FM25663"Guidelines for IDXID="w2768"BOOK="_idx" COLLECTION="nw41" TIDREF="i1626"
Implementing NDSIDXID="w2769"BOOK="_idx" COLLECTION="nw41" TIDREF="i2726"You can design a IDXID="w2770"BOOK="_idx" COLLECTION="nw41" TIDREF="i1626"
Directory tree several different ways. You might want to develop different prototypes and test them in a lab environment to analyze the advantages and disadvantages of your design.Nevertheless, the necessary steps for implementing NDS are simple and remain essentially the same for small, medium, and large networks of any design.Some of the following guidelines are not necessary for smaller implementations of NDS; however, all of the guidelines can assist you in planning for any present and future implementations.PAGENUM=67 ID="BP72"To implement NDS on your network, you need to complete the following tasks:NUMERATION=ARABIC CONTINUATION="RESTARTS" INHERITNUM="IGNORE"Identify all potential Directory objects and create a NetWare Directory Services standards 
document that details how to name objects (Users, Printers, Servers, etc.) and how to name object property values, such as telephone numbers. You can distribute this document to network supervisors who are responsible for adding or moving objects in different parts of the Directory tree.You should use short names within the hierarchy because each object is identified by its relative location within the Directory tree. Use a IDXID="w2771"BOOK="_idx" COLLECTION="nw41" TIDREF="i2604"
naming scheme that is both practical and functional for your organization. For example, name servers for their function within a specific organization, and name printers for their type and location.See IDREF="FM23526"Appendix C, "Creating a Standards Document for NDS Object Classes and Properties," on page 157 for more information. See also "BOOK="superenu" COLLECTION="nw41"Creating Container Objects," "BOOK="superenu" COLLECTION="nw41"Creating Leaf Objects," and "BOOK="superenu" COLLECTION="nw41"Searching for Objects" in Chapter 1 of Supervising the NetWork.Choose a method of implementation.There are several ways of implementing a NDS:MARK=BULLETSet up small trees for different groups or departments in your organization and then merge those trees into one larger tree.IDREF="FM74321"See "Planning a Departmental Directory Tree (Merge Tree Method)" on page 72.Plan your directory tree from the top, or root level, down to the branches.IDREF="FM76110"See "Planning an Organizational Directory Tree" on page 74.Organize objects into a logical hierarchy.The hierarchy of your Directory tree should be as shallow as possible (five to eight levels) to facilitate access and manageability. However, NDS supports any degree of subordination you need to best support your organization's infrastructure.Decide on the model for your Directory tree.PAGENUM=68 ID="BP73"Your Directory tree can model your organization, unit, and workgroup breakdown charts, or it can follow administrative, geographical, and functional divisions present within your organization.See IDREF="FM98130""Creating Directory Tree Maps" on page 69 and IDREF="FM89544""Placing Leaf Objects in the Directory Tree" on page 81.Develop strategies for adequate replication of the partitions toProvide fault toleranceDecrease traffic over WAN linksDivide the Directory database into partitions based on logical boundaries, and then replicate the partitions where you want users to access them without having to go over WAN links.See IDREF="FM32301""Developing a Replication Strategy" on page 86.Choose a method for providing time synchronization for the Directory. You must designate which time servers you want to use as a time source servers (Single Reference, Reference, Secondary, or Primary).See IDREF="FM32583""Developing a Time Synchronization Strategy" on page 89.Develop a strategy for implementing NDS security.You can use the design of the tree to implement security for containers and the objects in the containers.See IDREF="FM15646""Developing a Security Strategy for the Directory Tree" on page 90.(Conditional) Develop a strategy for supporting bindery services.If you are upgrading from NetWare 2 or NetWare 3TM software, you should prepare binderies.IDREF="FM20685"See Chapter 3, "Understanding Bindery Services," on page 37; and also see "BOOK="upmigenu" COLLECTION="nw41"Bindery Services," in Chapter 2 of Upgrade.RENDERAS="SECT1"ID="FM23102"Creating IDXID="w2772"BOOK="_idx" COLLECTION="nw41" TIDREF="i2605"
Naming
 StandardsTo begin 
planning your Directory tree, look first at your organization's structure, functions, geography, and needs. NetWare Directory Services is designed to reflect a hierarchical structure. PAGENUM=69 ID="BP74"Generally, this means that your Directory tree will be patterned according to some logical structure of your organization locale, whether or not that structure is formal. Try to simplify the hierarchy as much as possible.For example, if your organization is formally divided into departments, you might decide to structure your Directory tree by departments as well. On the other hand, if people in several departments work together on long-term projects and need access to common resources, it might make more sense to divide your tree by project teams instead of departments. When planning your Directory tree, also consider who will be running the network. With NetWare 4TM software, you can centralize network administration so that a single person or small group of people control the entire network. You can also distribute administration so that many network supervisors throughout the enterprise or organization control their own portion of the Directory tree. If network administration will be distributed, everyone who will be administering the network must be involved in the planning. IDREF="FM23526"See Appendix C, "Creating a Standards Document for NDS Object Classes and Properties," on page 157.RENDERAS="SECT2"ID="FM98130"Creating 
Directory
Tree 
MapsWe recommend creating two maps of the tree when planning. The first and most important is the logical view map of the tree---in other words, names and placement of the Organizational Unit (OU) and other objects.The second is a physical view map of the placement of replicas---in other words, a view of every server and what replicas are stored on each.The following illustration shows partial examples of these maps. PAGENUM=70 ID="BP75"LABEL="5-1" FLOAT="0"ID="FM28019"Directory Tree View MapsFILEREF="n41ds03a.tif"RENDERAS="SECT3"Planning Naming IDXID="w2773"BOOK="_idx" COLLECTION="nw41" TIDREF="i2605"
StandardsPart of the process of developing the Directory tree maps is to determine names of objects. If there are standards in place for using the Directory, then the users can more fully navigate, use, and exploit the Directory tree. Searching and browsing rely heavily on the ability to do a lookup in the Directory based on criteria from the user. If the object names follow a standard, then searching is simpler.For example, if all laser printers are named "LJuniquename," where uniquename is more descriptive, then a search for all printers named "LJ*" is feasible.See IDREF="FM23526"Appendix C, "Creating a Standards Document for NDS Object Classes and Properties," on page 157 for more information.Use familiar naming conventions, such as users' E-mail names, to ensure that each user has a unique common name.PAGENUM=71 ID="BP76"RENDERAS="SECT3"Using Naming IDXID="w2774"BOOK="_idx" COLLECTION="nw41" TIDREF="i2605"
StandardsNaming standards detail the conventions you will use for naming Directory 
objects, including users, printers, print queues, and servers. Standards should also specify how you will enter 
property values (telephone numbers, addresses, etc.) for the objects. If you will be using bindery services, make sure the names are compatible with standards for bindery-based versions of NetWare. (IDREF="FM23526"See Appendix C, "Creating a Standards Document for NDS Object Classes and Properties," on page 157.)RENDERAS="SECT4"IDXID="w2775"BOOK="_idx" COLLECTION="nw41" TIDREF="i2605"
ConsistencyConsistent naming standards provide a guideline for network supervisors who will be adding file servers, creating users, modifying and moving objects, etc. Consistent standards also makes it easy for users to identify the resources available to them to search for specific items in the Directory tree. Although a consistent naming standard for the corporate network is important, you do not need to have it perfected before you implement NDS. You can IDXID="w2776"BOOK="_idx" COLLECTION="nw41" TIDREF="i2605"
rename
 containers and leaf objects and move subtrees to reflect any 
changes you want to implement. IDREF="FM86103"See Chapter 7, "Managing NetWare Directory Services," on page 115 for more information.RENDERAS="SECT4"IDXID="w2777"BOOK="_idx" COLLECTION="nw41" TIDREF="i2605"
Name LengthMake sure the 
naming schemes are short, yet as descriptive as possible. For example, "SW Engineering" could be shortened to "SWEng."All Directory object names can contain up to 64 characters in their Name property (the name given when an object is created). The IDXID="w2778"BOOK="_idx" COLLECTION="nw41" TIDREF="i1156"
Distinguished Name of an object is limited to 256 characters (including name types, periods and equal signs).However, concise (short) Organizational Unit (OU) names that are meaningful make it easier to use the Directory tree. Keeping names short reduces the amount of data going across the wire, simplifies logins, and makes names easier to remember. RENDERAS="SECT1"ID="FM92771"Developing an IDXID="w2779"BOOK="_idx" COLLECTION="nw41" TIDREF="i2726"
Implementation 
StrategyThere are several ways of implementing NDS:PAGENUM=72 ID="BP77"MARK=BULLETIDREF="FM74321"Planning a Departmental Directory Tree (Merge Tree Method) IDREF="FM76110"Planning an Organizational Directory Tree Using a combination of the first two planning methodsRENDERAS="SECT2"ID="FM74321"Planning a 
Departmental
Directory Tree (
Merge Tree Method)The defaults in the server installation program help you set up a small Directory tree with very little planning. By choosing the installation defaults, you are provided with some leaf objects (such as the ADMIN object), Directory partitions, and network time synchronization.You can set up small trees for different groups or departments in your organization and then merge those trees into one larger tree.Time services can be synchronized acrosscontainer objects.Once the Directory tree has been implemented in a departmental network, that network can easily be merged into a larger organizational Directory tree.The advantages of using this method of setting up your Directory tree includeMARK=BULLETLess planning requiredEasier modification of the Directory treeRENDERAS="SECT3"Tree 
RestructuringAlthough some planning is important to implement NDS successfully, your first plan is not your only chance to define the tree structure. NDS utilities allow for tree restructuring as organizations change structure, change location, or merge. IDREF="FM86103"See Chapter 7, "Managing NetWare Directory Services," on page 115 or the individual entries in Utilities Reference for more information.RENDERAS="SECT3"Merging Directory TreesWhen you merge Directory trees using the IDXID="w2780"BOOK="_idx" COLLECTION="nw41" TIDREF="i1252"
DSMERGE utility, the objects in the source tree become part of the target tree. The target [Root] object becomes the new root for objects that are moved from the source tree.PAGENUM=73 ID="BP78"The DSMERGE utility does not change Directory names or contexts within the containers. The Distinguished Names of objects in the new tree are the same as the names before the trees were merged.This utility does not allow you to merge container or leaf objects.Use the following IDXID="w2781"BOOK="_idx" COLLECTION="nw41" TIDREF="i1626"
guidelines for merging Directories trees:MARK=BULLETBefore performing a merge operation, ensure that the state of synchronization for all servers affected by the operation is stable. The following table provides recommendations for preparing source and target trees for merging.COLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="12*"COLNAME=2 COLWIDTH="12*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"ConditionCOLNAME=2 ROTATE="0" MOREROWS="0"ActionVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"No leaf object or aliases can exist at the root of the source tree.COLNAME=2 ROTATE="0" MOREROWS="0"Delete any aliases or leaf objects at the root of the source tree.COLNAME=1 ROTATE="0" MOREROWS="0"No similar names can exist on source and target trees.COLNAME=2 ROTATE="0" MOREROWS="0"Rename objects on the source and target tree if identical names exist.COLNAME=1 ROTATE="0" MOREROWS="0"No login connections can exist on either the source or target tree.COLNAME=2 ROTATE="0" MOREROWS="0"Close all connections on the source and target trees.COLNAME=1 ROTATE="0" MOREROWS="0"The version of NDS must be the same on both source and target trees.COLNAME=2 ROTATE="0" MOREROWS="0"Upgrade all non-4.1 servers that have a replica or the [Root] object.COLNAME=1 ROTATE="0" MOREROWS="0"Any server that contains a replica of the [Root] object on both source and target trees must be up and running.COLNAME=2 ROTATE="0" MOREROWS="0"Ensure that all servers containing a replica of the root partition on both source and target trees are up and running.Ensure that any WAN links affected are stable.COLNAME=1 ROTATE="0" MOREROWS="0"Schema on both source and target trees must be the same.COLNAME=2 ROTATE="0" MOREROWS="0"Ensure that source and target trees are time synchronized within two seconds of each other.In general, it is easier and faster to merge the smaller of the trees into the larger.PAGENUM=74 ID="BP79"You cannot share resources across separate Directory trees. Each tree has its own database of objects that is not visible from another tree. Be aware of this limitation if you are planning to create multiple trees. You can, however, access other trees through bindery services, or you can merge two trees in order to share data.COLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="11*"COLNAME=2 COLWIDTH="15*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"For more information aboutCOLNAME=2 ROTATE="0" MOREROWS="0"Refer toVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Merging trees COLNAME=2 ROTATE="0" MOREROWS="0""BOOK="utlrfenu" COLLECTION="nw41"DSMERGE," in Utilities Reference and "BOOK="superenu" COLLECTION="nw41"Merging NDS Trees," in Chapter 5 of Supervising the NetworkCOLNAME=1 ROTATE="0" MOREROWS="0"Moving subtreesCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="utlrfenu" COLLECTION="nw41"NetWare Administrator," in Utilities ReferenceCOLNAME=1 ROTATE="0" MOREROWS="0"Moving objectsCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="superenu" COLLECTION="nw41"Managing NetWare Directory Services Objects," in Chapter 1 of Supervising the NetworkCOLNAME=1 ROTATE="0" MOREROWS="0"Renaming objectsCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="superenu" COLLECTION="nw41"Managing NetWare Directory Services Objects," in Chapter 1 of Supervising the NetworkRENDERAS="SECT2"ID="FM76110"Planning an 
Organizational
 Directory Tree If your organizationIDXID="w2782"BOOK="_idx" COLLECTION="nw41" TIDREF="i2070"
 is 
large, you might want to implement an organizational Directory tree. Plan only the top levels, and then allow individual sites to create and administer their parts of the Directory tree. Consider the following strategies when planning this type of Directory tree:MARK=BULLETAfter installing the first server into the tree at the organizational level, log in and use the administrative utilities to create the next Organizational Unit (OU) levels in the Directory tree. Then create a User object in each OU with all rights in that container. Following the creation of the User objects, use a partition utility (PARTMGR or NetWare Administrator) to change each OU into a partition root (if the tree will be large enough for separate partitions at these OU levels). This allows the root network supervisor to give those User objects and passwords to other supervisors. Then those supervisors can help build the tree by installing servers in their respective Organizational Units while being administratively restricted to their particular portions of the tree.PAGENUM=75 ID="BP80"You should use only one Directory tree in your organization so that you can take advantage of the global features of NDS. Rather than create a separate tree for resources you want to deny access to, use features in NetWare 4 security to control the access to any part of the Directory tree.RENDERAS="SECT1"ID="FM25881"Organizing Objects into a Logical 
HierarchyKeeping your Directory tree structure as shallow as possible (five to eight levels) benefits both small and large Directory trees. Nevertheless, NDS supports any degree of subordination you need to best support your organization's infrastructure. Your Directory tree can model any or all of the following structures:MARK=BULLETOrganizational chart structureYou can begin with your organization chart, and then modify it according to network access requirements and other factors.Geographic structureYou can use geographic locations as Organizational Units. Then, you could use your organization chart for each location to organize those divisions.Functional structureIf users or groups in your department or organization perform similar functions, consider organizing your Directory tree by function. Such users are likely to share servers and other resources, so it makes sense to group them together.This is especially useful for groups of bindery services users.IDXID="w2783"BOOK="_idx" COLLECTION="nw41" TIDREF="i452"
Bindery 
services 
structureThe portions of the Directory used by bindery services users should use a combination of all three of the previously mentioned structures.Bindery services users should be grouped within bindery contexts defined by workgroups, shared resources, and information usage and exchange. Placing similar users in the same container object makes it easier to give bindery services users access to the resources they need.PAGENUM=76 ID="BP81"RENDERAS="SECT2"Planning the 
Directory 
Tree 
LevelsYou create the container objects to form the top level of the Directory tree for both departmental and organizational strategies. These container objects help you manage and organize the network by relating groups of objects, other container objects, and leaf objects.Consider the following when planning the tree levels:MARK=BULLETThe 
name of the 
Directory tree must be unique on the physical wire or backbone of the actual network hardware connection.The depth of the Directory tree should be no longer than 256 characters for the Distinguished Name, which is the IDXID="w2784"BOOK="_idx" COLLECTION="nw41" TIDREF="i1082"
full IDXID="w2785"BOOK="_idx" COLLECTION="nw41" TIDREF="i813"
context of the tree.Remember that each level you add to the tree can increase the length of a user's context. The shorter you can keep users' contexts, the less problem they will have remembering them.[Root] is named by the true name of the Directory tree, which is the name you use to name the Directory tree; therefore, it is part of the Directory tree and part of every object's context.Partitions or replicas should be placed close to the end user.For example, if there are departments in two cities that access the same resources in the Directory tree, such as printers or servers, then place a replica in both cities to accommodate both departments. Rights should be granted by exception. That is, you should grant rights at the container level, then at the group level, and then at an individual object level if necessary. RENDERAS="SECT2"Placing 
Container Objects in the Directory TreeContainer objects and their contents should be defined by workgroups, shared resources, and information usage. Use Organization (O) objects and Organizational Unit (OU) objects to build the Directory tree structure.PAGENUM=77 ID="BP82"RENDERAS="SECT3"Country and Organization ObjectsYou must include one or more Organization (O) objects in your Directory tree. Organizational Unit (OU) objects are optional. However, you should develop most of your Directory tree structure with these objects.Use of the 
Country 
(C) object is useful only in specific cases when the Country properties apply to your organizational structure or you are planning on participating in the information superhighway. IDREF="FM63536"See Appendix A, "NDS Object Classes and Properties," on page 137 for more information.You can create as many sibling 
Organization (O) objects as you need, and as many Organizational Unit (OU) objects underneath the Organization (O) objects as you need, to best structure your Directory tree.The following figure shows an example tree with one Organization (O) object and multiple Organizational Unit (OU) objects.PAGENUM=78 ID="BP83"LABEL="5-2" FLOAT="0"Directory Tree with an Organization Object and Multiple Organizational Unit ObjectsFILEREF="n41ds19a.tif"Another way to designate different IDXID="w2786"BOOK="_idx" COLLECTION="nw41" TIDREF="i4166"
site locations is to create the container object Country, which is placed between the [Root] object and the Organization object. Adding a Country object (C) to your tree, however, adds one more level of complexity to an object's context that might not be necessary.Normally, you need to create a 
Country object (C) when you have a global network that spans multiple countries or you plan to participate in the information superhighway.Much of the current development for accessing services available on the information superhighway is being done according to the X.500 specification. NetWare Directory Services (NDS) is consistent with this emerging international standard. PAGENUM=79 ID="BP84"The X.500 specification was developed by the IEEE (Institute of Electrical and Electronic Engineers) to provide a standard method for organizing information that is accessed transparently on a global basis. Information such as telephone directories, corporate organizational structures, and directories of available services are all accessible through products compatible with this specification.The Country object is not part of the NetWare 4 default server installation; that is, you are not prompted for a Country object when you install NetWare 4 software.  Nevertheless, you can create a Country object during the server installation. See "BOOK="instlenu" COLLECTION="nw41"Install Server Software," in Chapter 2 of Installation for more information on installing a server.RENDERAS="SECT3"Organizational Unit ObjectsYou can designate geographic locations, projects, products, etc., as 
Organizational Units (OU). An advantage to using a geographic structure for your 
Directory tree is that you can see where objects are physically located. Using geographical locations will assist in the placement of replicas.However, if users or other resources are moved between locations frequently, their contexts can change dramatically even though the organization might not.Because one goal of having a Directory tree is to provide a static database that is updated infrequently, broad geographic designations in which objects remain static, such as states or cities, might provide a more stable structure for your tree than one that is continually changing.The following figure shows an example Directory tree in which theMARK=BULLETOrganization (O) object is designated as the company ACME CorporationOrganizational Unit (OU) objects are designated as departmentsOrganizational Units at a lower level are designated as geographic locations (Detroit, London, and Tokyo) of those departmentsThe upper OU level reflects the management organization of the company, and the lower OU level divides the tree into physical locations. This tree requires data from each management OU in each site which makes it easy to administer. However, this tree may not facilitate placement of replicas.PAGENUM=80 ID="BP85"LABEL="5-3" FLOAT="0"ID="FM76855"Directory Tree with Organizational Unit Designations at Different LevelsFILEREF="n41ds43a.tif"Organizational Unit (OU) objects do not all have to be the same type. That is, you can designate a workgroup as an Organizational Unit and also designate a project as another Organizational Unit.You might want to organize your Directory tree by function if groups of users have the same functionality.The following figure shows a Directory tree in which MFG (Manufacturing) and HQ (ACME Headquarters) represent departments, and Tokyo and London represent geographical locations, all under the Organization ACME.LABEL="5-4" FLOAT="0"Directory Tree with Mixed Organizational Unit Object TypesFILEREF="n41ds35a.tif"PAGENUM=81 ID="BP86"Some areas of your tree might need more than one Organizational Unit (OU). In the current example, the Organizational Unit (OU) MFG contains another level of Organizational Units because MFG itself is a self-contained business unit, with its own Quality Assurance department, Engineering and Development department, etc. Therefore, another level of Organizational Units resides under the MFG Organizational Unit (OU) to allow the department network supervisors more flexibility in designing their portions of the Directory tree. Having different Organizational Units can help network supervisors customize the Directory tree for their particular needs.The tree in this example facilitates replication well, but it might be more difficult to manage than the example illustrated in IDREF="FM76855"Figure 5-3 on page 80.RENDERAS="SECT2"ID="FM89544"Placing 
Leaf 
Objects in the Directory TreeContainer objects and their contents should be defined by workgroups, shared resources, and information usage. Therefore, leaf objects representing resources used by a single group should be placed in the same container.Keep the following considerations in mind when placing leaf objects in the Directory tree:MARK=BULLETDesign your Directory tree so that users have shared access to resources. For example, if you have a high-speed printer in the organization that everyone needs access to, place the Printer object for that printer in a container where you can assign rights to allow everyone access to that Printer object. You can always add, delete, or move objects after you have installed your Directory tree. Create User objects only in the container object where they will typically log in. It is undesirable to create duplicate User objects for the same person.Plan how to use user templates in specific Organization (O) objects and Organizational Unit (OU) objects. For more information, see "BOOK="superenu" COLLECTION="nw41"Managing User Templates" in Chapter 1 of Supervising the Network.PAGENUM=82 ID="BP87"IDXID="w2787"BOOK="_idx" COLLECTION="nw41" TIDREF="i1626"
Rights should be 
granted by exception. That is, you should grant rights at the 
container level, then at the 
group
 level, and then on an 
individual object level if necessary. For more information on container rights, see IDREF="FM38513""Container Rights" on page 91.For more information on inheriting rights, see "BOOK="cncptenu" COLLECTION="nw41"Security" in Concepts. For more information on Group objects, see "BOOK="superenu" COLLECTION="nw41"Managing Group Objects" in Chapter 1 of Supervising the Network.RENDERAS="SECT2"Directory 
Tree 
Planning 
ExamplesThe following examples represent some of the planning conventions used for implementing NDS in small-to-medium- and medium-to-large-sized organizations.RENDERAS="SECT3"Small-to-Medium-Sized TreeAs an example of a small-to-medium-sized Directory tree, assume that the ACME Corporation headquarters has the following four offices within the city of New York:MARK=BULLETSales AccountingPayrollHuman Resources and PersonnelThe following figure shows the physical layout of the offices used in the example, illustrating some of the previously discussed planning guidelines.PAGENUM=83 ID="BP88"LABEL="5-5" FLOAT="0"Physical Layout of a Small-to-Medium Directory TreeFILEREF="n41ds24a.tif"Notice in this example that all the usernames start with the initial of the first name, followed by the last name. Also notice that the printers in ACCT.HQ end with "LJ" for LaserJet* printers and "APL" for Apple* printers.RENDERAS="SECT3"Medium-to-Large-Sized TreeAs an example of a medium-to-large-sized Directory tree, assume that the ACME Corporation has offices in the following three cities within the United States:MARK=BULLETSales and accounting offices located in the corporate headquarters in New York, New YorkA development and test facility in Detroit, MichiganManufacturing sites in Los Angeles, CaliforniaPAGENUM=84 ID="BP89"The following figure shows the physical layout of the offices, facilities, and sites used in the example, illustrating some of the previously discussed planning guidelines.LABEL="5-6" FLOAT="0"Physical Layout of a Medium-to-Large Directory TreeFILEREF="n41ds62a.tif"The following figure shows the logical layout for the example Directory tree for ACME Corporation and some example names for leaf objects.PAGENUM=85 ID="BP90"LABEL="5-7" FLOAT="0"Example Logical Layout and Leaf Object NamesFILEREF="n41ds25a.tif"Notice that in this example all the usernames start with the initial of the first name, followed by the last name. Also notice that the printers in ACCT.HQ ACME.US end with "LJ" for LaserJet printers and "APL" for Apple printers. The printers inTEST.DETROIT.MFG.ACME.US are using a similar convention.PAGENUM=86 ID="BP91"These are just examples of how naming standards can be used in the Directory tree. But however you decide to name your objects, you should standardize the naming throughout the Directory tree in order to exploit the Directory to its fullest. IDREF="FM23526"See Appendix C, "Creating a Standards Document for NDS Object Classes and Properties," on page 157 for ideas on how to standardize the naming of objects and properties in your Directory tree.RENDERAS="SECT1"ID="FM32301"Developing a IDXID="w2788"BOOK="_idx" COLLECTION="nw41" TIDREF="i3792"
ReplicationIDXID="w2789"BOOK="_idx" COLLECTION="nw41" TIDREF="i3794"
 StrategyIDXID="w2790"BOOK="_idx" COLLECTION="nw41" TIDREF="i4302"Replicas serve two purposes:MARK=BULLETProvide fault toleranceDecrease WAN link traffic at login and authenticationRENDERAS="SECT2"Providing Fault ToleranceIf your network covers a large geographical distance, you might consider placing IDXID="w2791"BOOK="_idx" COLLECTION="nw41" TIDREF="i1056"IDXID="w2792"BOOK="_idx" COLLECTION="nw41" TIDREF="i1056"
replicas of your partition on a server in another area. This accomplishes two things:MARK=BULLETIt allows users in that area to access your partition.It protects the existence of your partition if a disaster destroys your own servers and replicas.You should have at least three replicas of every Directory partition. If you lose a partition and you do not have a replica of that partition, you could permanently lose access to a part of your Directory tree.A tape backup can be used for disaster recovery (when all copies of a partition are gone). Ensure that your backup software uses object name and not object ID to back up the Directory.Restoring from a IDXID="w2793"BOOK="_idx" COLLECTION="nw41" TIDREF="i1056"IDXID="w2794"BOOK="_idx" COLLECTION="nw41" TIDREF="i1056"
tape IDXID="w2795"BOOK="_idx" COLLECTION="nw41" TIDREF="i406"
backup replaces data for objects being restored, but it deletes any changes made to objects after the tape backup was performed.The restored objects are synchronized with the same objects on other replicas if they exist.PAGENUM=87 ID="BP92"Directory replication does not provide fault tolerance for the file system. Only Directory information about objects is replicated.  To provide fault tolerance for your files, you must mirror or duplex your hard disks and enable the Transaction Tracking SystemTM (TTS) feature.  The TTSTM feature must be enabled for NDS to work. For more information, see "BOOK="superenu" COLLECTION="nw41"Protecting Database Integrity with TTS" in Chapter 7 of Supervising the Network.RENDERAS="SECT2"Decreasing IDXID="w2796"BOOK="_idx" COLLECTION="nw41" TIDREF="i4812"
WAN Link TrafficIf any users must access the Directory tree through a WAN, you can place a read-only IDXID="w2797"BOOK="_idx" COLLECTION="nw41" TIDREF="i3792"
replica of the necessary partition on a local server so you don't need to cross the WAN link. Storing a read-only or writable replica on servers that are across a WAN link can be helpful because it cuts down on the traffic that has to cross the link when users try to access the other partition's information. Nevertheless, there will be some increase in traffic due to the synchronization of replicas.Read-only replicas do not support user login. Do not create a replica of a server that users must attach to before they authenticate to the network.With a replica of a distant partition stored locally, users have immediate access to the objects they need. The only time that information needs to cross the link is when the replicas are being updated. However, remember that every server that carries a replica must receive all changes to any object within that partition. The more replicas of a given partition you have, the more time needed and the more WAN traffic that exists to fully synchronize the replicas.Before you begin distributing the replicas of the partitions, think about how much data you want in a partition. Because replicas are stored on servers, unnecessary information in a replica is an inefficient use of disk space and network traffic.If a partition becomes very large, and you only need to replicate a portion of it, you can use utilities to split the partition and then replicate only the necessary portion.The following figure shows one way to distribute replicas across the WAN on our example tree.PAGENUM=88 ID="BP93"LABEL="5-8" FLOAT="0"IDXID="w2798"BOOK="_idx" COLLECTION="nw41" TIDREF="i3792"Replica Distribution across a WANFILEREF="n41ds65a.tif"This example reflects the following:MARK=BULLETMaster replicas are stored at each local site. That is, a server at the New York site stores the master replica of SLS_SERV1, a server at the Los Angeles site stores the master replica of PROD_SERV1, etc.Servers in the Detroit location store replicas of SLS_SERV1 and PROD_SERV1 so that information is locally accessible to users in the Engineering and Quality Assurance departments.A server in the DESIGN office in Los Angeles stores a replica of [Root] so that developers in Los Angeles do not have to use a WAN link to access information from their counterparts in Detroit.A server in the New York office stores a replica of PROD1.DETROIT.MFG.ACME US to allow local access.PAGENUM=89 ID="BP94"Resource objects in the Detroit office seldom access objects in other parts of the Directory tree within the WAN. (This is because this office operates as a self-contained business unit within the organization.)This is only one way to place replicas. You must decide how to best eliminate single points of failure and provide your users with easy access to information according to your physical network layoutCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="11*"COLNAME=2 COLWIDTH="15*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"For more information aboutCOLNAME=2 ROTATE="0" MOREROWS="0"Refer toVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Partitions and replicasCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="superenu" COLLECTION="nw41"Creating and Managing Directory Services Partitions" in Chapter 5 of Supervising the NetworkCOLNAME=1 ROTATE="0" MOREROWS="0"PARTMGR text utility COLNAME=2 ROTATE="0" MOREROWS="0""BOOK="utlrfenu" COLLECTION="nw41"PARTMGR" in Utilities ReferenceCOLNAME=1 ROTATE="0" MOREROWS="0"Partition Manager in NetWare AdministratorCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="superenu" COLLECTION="nw41"Managing the NetWare Directory Tree" in Chapter 5 of Supervising the NetworkRENDERAS="SECT1"ID="FM32583"Developing a 
Time Synchronization IDXID="w2799"BOOK="_idx" COLLECTION="nw41" TIDREF="i4302"
StrategyWith time synchronization in NetWare 4, you can choose the default server installation or a custom configuration. IDREF="FM92269"See Chapter 4, "Understanding Time Synchronization in NDS," on page 49 for more information.Before you install NetWare 4, decide the following based on your physical network layout and your network time synchronization needs:MARK=BULLETWhat type of time servers do you need?Where should the time servers be located on the network so that fault tolerance is provided and network traffic is kept to a minimum?To enable time synchronization with INSTALL, you need to specify the type of time server the server you are installing on will be, the time zone you're in, and daylight savings time rules.When you install NetWare 4 on a server, you can choose the default time server, Single Reference (or Secondary, if this installation is not the first server you've installed in the Directory), to establish the type of time services that server provides. PAGENUM=90 ID="BP95"Or, you can designate the server as a Reference, Primary, or Secondary time server. Each designation performs a particular time synchronization function. If you do not want to use the installation default, you must know which time server function to designate on the server you are installing in order to implement a network-wide time synchronization plan. Provide a plan to all the local network supervisors who will install NetWare 4 on servers within the network so they can designate the correct time synchronization function on each server they install.COLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="11*"COLNAME=2 COLWIDTH="15*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"For more information aboutCOLNAME=2 ROTATE="0" MOREROWS="0"Refer toVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Different ways to set up time synchronization on larger networksCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM27092""Choosing a Time Synchronization Method" on page 56COLNAME=1 ROTATE="0" MOREROWS="0"Service Advertising ProtocolCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM14763""SAP (Service Advertising Protocol)" on page 55COLNAME=1 ROTATE="0" MOREROWS="0"Time serversCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM60956""Time Servers" on page 50COLNAME=1 ROTATE="0" MOREROWS="0"Time synchronizationCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM27092""Choosing a Time Synchronization Method" on page 56"BOOK="superenu" COLLECTION="nw41"Managing Network Time Synchronization" in Chapter 7 of Supervising the NetworkRENDERAS="SECT1"ID="FM15646"Developing a 
Security Strategy for the 
Directory 
TreeAccess 
control in NDS is very powerful and flexible, and it can also be very easy to implement.You can use the default security provided during the installation of the Directory tree and then add additional security as needed.You can further control access to objects within the tree in various ways, as explained in the following sections.RENDERAS="SECT2"Trustee IDXID="w2800"BOOK="_idx" COLLECTION="nw41" TIDREF="i4592"
AssignmentsGrant trustee IDXID="w2801"BOOK="_idx" COLLECTION="nw41" TIDREF="i4592"
assignments to any object or object's properties for any other object.PAGENUM=91 ID="BP96"RENDERAS="SECT2"ID="FM38513"Container 
RightsRights can be granted at a container level. This allows you to exploit the hierarchal structure of the Directory tree.By granting rights at the container, those rights are automatically available for every object in that container unless masked by an Inherited Rights Filter (IRF). IDREF="FM52254"See "Inherited Rights Filter" on page 91.RENDERAS="SECT2"Group 
Object 
RightsCreate 
Group objects to give groups of users limited or unlimited access to particular objects or their properties in the Directory tree.RENDERAS="SECT2"ID="FM52254"Inherited Rights 
FilterThe Inherited Rights Filter (IRF) is a list of rights that can be created for any object. It controls the rights that a trustee can inherit from parent container objects.Never delete user ADMIN without having assigned the Supervisor right to the [Root] object to another User object. Neglecting to do so can be disastrous, because you eliminate Supervisor control of the Directory tree.  This warning also applies to other sections of the Directory tree where you have an ADMIN object defined. At each level of the tree where you have ADMIN defined, be sure you also have a User object with an explicit Supervisor right.  It is also important to remember that rights can be granted at a container, and they can also be taken away. If all rights are masked at a container and if there is not a user in that container with all rights, then there is a container without full supervisory rights. If you experience this type of problem, contact a Novell Authorized ResellerCLM or Novell Technical SupportSM representative.RENDERAS="SECT2"Security EquivalencyUse the 
Security 
Equal To property to give a user temporary access to the same information or rights that another user has access to. When a user is added to the membership list of a Group object or the occupant list of an Organizational Role object, the Group or Organizational Role is listed in that user's Security Equal To list. PAGENUM=92 ID="BP97"By using a security equivalency, you avoid having to review the whole Directory tree structure and determine which rights need to be assigned to which directories, files, and objects.However, if an object in a user's Security Equal To list is deleted from the Directory tree, the user no longer has the rights granted through that object.Users who manage other users should be granted the Write right to this property. This allows user account managers to make users security equivalent to other users that they manage.Every object is security equivalent to all container objects that are part of its Distinguished Name. Because of this, you can make a container a trustee.Every object in a container object has the rights that are granted to that container, through the Security Equal To property. However, none of these container objects is listed in a user's Security Equal To list.The Security Equal To property is not transitive; that is, if Tom is security equivalent to Jill, and Jill is security equivalent to Bob, Tom is not security equivalent to Bob through Jill. The Security Equal To property grants Tom only those rights that Jill is explicitly granted.To add an object to a user's "Security Equal To" list, you must have at least the Write property right to the ACL property of the object you want to add to the list. However, you need the Browse object right to the Security Equal To property of the user to add a user to the list.In networks containing confidential data that only selected users should have access to, take care that you don't inadvertently give a user access to restricted information.COLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="11*"COLNAME=2 COLWIDTH="15*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"For more information aboutCOLNAME=2 ROTATE="0" MOREROWS="0"Refer toVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Inherited Rights FilterCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Inherited Rights Filter" in ConceptsCOLNAME=1 ROTATE="0" MOREROWS="0"Security and security examplesCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Security" in ConceptsRENDERAS="SECT1"ID="FM44169"Developing an 
Integration IDXID="w2802"BOOK="_idx" COLLECTION="nw41" TIDREF="i4302"
Strategy for IDXID="w2803"BOOK="_idx" COLLECTION="nw41" TIDREF="i452"
Bindery ServicesWhen planning a hierarchical Directory, consider applications and users that still rely on bindery services.PAGENUM=93 ID="BP98"Bindery-based users can access any object in the Directory by using multiple accounts. But this can result in significantly more work for the network supervisor (especially if numerous users need several accounts).Although multiple accounts might still be necessary in your Directory tree, thoughtful planning can reduce the number of accounts you need to create.Bindery services users should be grouped within bindery contexts defined by workgroups, shared resources, and information usage and exchange. Placing similar users in the same container object makes it easier to give bindery services users access to the resources they need.It is important to remember that the top level is the most important level of the Directory tree. All other levels of the tree branch off the top level. If you organize the top level well, you can organize your entire Directory tree more efficiently.RENDERAS="SECT2"IDXID="w2804"BOOK="_idx" COLLECTION="nw41" TIDREF="i2318"
Managing IDXID="w2805"BOOK="_idx" COLLECTION="nw41" TIDREF="i452"
Bindery ServicesOnce NDS is installed, user ADMIN can use the NETADMIN or NetWare Administrator utility to manage the Directory tree from a client workstation.Using the NetWare DOS 
RequesterTM software, your DOS-based client workstations can take full advantage of the NDS functionality and access the NDS administrative tools, such as IDXID="w2806"BOOK="_idx" COLLECTION="nw41" TIDREF="i2638"
NETADMIN and IDXID="w2807"BOOK="_idx" COLLECTION="nw41" TIDREF="i2691"
NetWare Administrator, for IDXID="w2808"BOOK="_idx" COLLECTION="nw41" TIDREF="i2723"
managing bindery services.See Chapter 7, "BOOK="superenu" COLLECTION="nw41"Maintaining the NetWare Server," in Supervising the Network for more information.The NetWare 
shell software (IDXID="w2809"BOOK="_idx" COLLECTION="nw41" TIDREF="i2897"
NETXIDXID="w2810"BOOK="_idx" COLLECTION="nw41" TIDREF="i2723"
) does not support the NDS administrative utilities. RENDERAS="SECT3"Changing IDXID="w2811"BOOK="_idx" COLLECTION="nw41" TIDREF="i439"
Bindery ContextThe bindery context is automatically set to the context  that you upgrade the server to.To change the default bindery context to, for example, O=Novell, you would use the following command at the server console or in the AUTOEXEC.NCF file on the server users are logging in to:PAGENUM=94 ID="BP99"FORMAT="LINESPECIFIC"MOREINFO="NONE"set bindery context=novellYou must use this SET command on each server that will use this bindery context. See "BOOK="instlenu" COLLECTION="nw41"Modify the AUTOEXEC.NCF File" in Chapter 3 of Installation.RENDERAS="SECT3"Changing Directory 
Tree 
StructureYou should always think about bindery services users when making changes to the hierarchical Directory. The slightest change in the structure of the tree could prevent some bindery services users from accessing the network or network objects.If you need to change the Directory, make sure that bindery services users will still have access to the necessary services. RENDERAS="SECT3"Moving Bindery 
ObjectsIf users are using bindery services within a specific container and that container is moved, you need to reset the bindery context to locate the moved servers that users are logging in to. RENDERAS="SECT1"Where to Go from HereCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="11*"COLNAME=2 COLWIDTH="15*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"If you want toCOLNAME=2 ROTATE="0" MOREROWS="0"Go toVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Use the management utilities for NDSCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM86103"Chapter 7, "Managing NetWare Directory Services," on page 115COLNAME=1 ROTATE="0" MOREROWS="0"Implement NDS on your networkCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM47603"Chapter 6, "Implementing NetWare Directory Services," on page 95COLNAME=1 ROTATE="0" MOREROWS="0"Install NetWare 4 softwareCOLNAME=2 ROTATE="0" MOREROWS="0"BOOK="instlenu" COLLECTION="nw41"InstallationLABEL="6"PAGENUM=95 ID="BP100"ID="FM47603"Implementing NetWare Directory ServicesRENDERAS="SECT1"OverviewIDXID="w2812"BOOK="_idx" COLLECTION="nw41" TIDREF="i2726"This chapter introduces several models that can be used for implementing the NetWare® Directory ServicesTM (NDS) technology on your network.COLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="22*"COLNAME=2 COLWIDTH="4*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"TopicCOLNAME=2 ROTATE="0" MOREROWS="0"PageVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM26157"Completing General Tasks and Guidelines for All Networks COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM26157"96COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM19398"Implementing NDS on Various Sizes of Networks COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM19398"101RENDERAS="SECT1"IntroductionImplementing the NDSTM technology on your network can be as simple or complex as you want it to be. The flexibility of NDS allows you to install and run it on a single server or many servers. You can also create an enterprise-wide system, using NDS, that spans multiple sites and countries, maintaining multiple partitions and partition replicas within a multilevel hierarchy of containers and objects.In either case, the NetWare 4TM software and IDXID="w2813"BOOK="_idx" COLLECTION="nw41" TIDREF="i2725"
NDS provideMARK=BULLETSimple administration and advanced security featuresReliable fault toleranceFlexible and usable implementation in both heterogeneous and mixed environmentsInteroperability with other directory services being developed for the information superhighwayPAGENUM=96 ID="BP101"The following discussion outlines the recommended tasks to be performed for implementing NDS features and functionality for all types of networks.RENDERAS="SECT1"ID="FM26157"Completing GeneralIDXID="w2814"BOOK="_idx" COLLECTION="nw41" TIDREF="i2371"
 Tasks and GuidelinesIDXID="w2815"BOOK="_idx" COLLECTION="nw41" TIDREF="i4175"
 for IDXID="w2816"BOOK="_idx" COLLECTION="nw41" TIDREF="i2070"
All IDXID="w2817"BOOK="_idx" COLLECTION="nw41" TIDREF="i2726"IDXID="w2818"BOOK="_idx" COLLECTION="nw41" TIDREF="i2726"
NetworksTo implement NDS on your network, you need to first complete the following general tasks:NUMERATION=ARABIC CONTINUATION="RESTARTS" INHERITNUM="IGNORE"Finalize and use any planning documents you have created to make a list of the Directory objects you will install.This list should include all users, servers, print queues, and other Directory tree objects that will be installed. When listing Directory tree objects, establish a naming standard. By using a standard when creating object names, you can make it easier to recognize objects by type and name.Use similar guidelines when naming all objects. The conventions you use should be consistent across the entire Directory.Consult IDREF="FM23526"Appendix C, "Creating a Standards Document for NDS Object Classes and Properties," on page 157 for help in creating this document.Sort the Directory objects by location.You can decrease network traffic by physically locating objects near the users who will access those objects. This keeps data flowing in relatively small segments, rather than travelling across several routers and cable segments where traffic could become congested.If you plan to use bindery services, centralize the objects that bindery services users will use in a common container. This makes managing the context of bindery services objects easier.Sort the objects into a logical hierarchy.When organizing your Directory tree, consider the following possible organizational structures:Organization chart structure. Base the Directory tree on the structure of your organization. When planning the Directory, you can begin with the organization chart, and then modify that chart according to network access requirements and other factors.PAGENUM=97 ID="BP102"Geographic structure. Use geographic locations as Organizational Units. Then you can use the organization chart for each location to organize workgroups or departments at each location.Functional structure. Organize your Directory tree by function if users or groups in your organization perform similar functions. Users with similar functions are likely to share servers and other resources, so it makes sense to group them together.Bindery services structure. Group bindery services users within bindery contexts defined by workgroups, shared resources, and information usage and exchange. By placing similar users in the same container object, you make it easier to give bindery services users access to the resources they need.ID="FM45845"Install the first server and set up the Directory tree.When you install NetWare 4, the INSTALL utility automatically installs NetWare Directory Services and prompts you to name the [Root] with the tree name. Then you can create and name an Organization (O) object and up to three Organizational Unit (OU) objects.You must then set the server context within the Directory tree. If you want to participate in the information superhighway, add a country code when setting the server context and a Country object will be created directly below the tree name or [Root] object.The network hardware supports both file services and Directory Services. If you add large numbers of leaf objects, such as users or print queues, to a single container, you might need to increase the amount of memory on that file server to improve performance.Use the NetWare Administrator utility or the NETADMIN and PCONSOLE utilities to complete the setup.The NetWare Administrator utility is an MS Windows-based utility, and the NETADMIN and PCONSOLE are DOS-based utilities. To run these utilities, you must first install and set up a DOS or MS Windows client workstation. Then you can set up the remaining Directory tree structure, create objects for all network resources you want available in the Directory database, and create Profile objects for maintenance purposes.Leaf objects. Place leaf objects in containers that provide the best access for the resources, groups, and users that use them.PAGENUM=98 ID="BP103"For example, a centralized NetWare 4 file server can be placed in the O container for management purposes. Application servers and print queues can be placed in OU containers with the users or groups that utilize them.Profile objects. Create Profile objects that provide organization or department login scripts in the respective container for groups of users who need similar work environments but who are not located in the same container object.Implementing objects this way allows for easy, centralized control at the top of the tree and local control of the lower levels. At each container level, a User object with supervisory rights has the authority over the objects within that container.Add new servers to appropriate contexts.To add a new server, first create the container you want to install a new server into by using the NetWare Administrator or NETADMIN utility. Then use the INSTALL utility to set the appropriate context within the Directory tree. If you need to relocate a server, you should delete it and then re-create it in its proper context using the INSTALL utility. Set the appropriate container and property rights.NDS incorporates the advanced RSA (Rivest, Shamir, and Adleman, developers of this particular public key encryption system) security features that make encrypted, single-login authentication to network resources possible.NDS security is based on a top-down architecture. All rights to network resources are established through Access Control Lists (ACLs) that allow for sophisticated, but easily managed, administration.The auditing facility also provides a high level of security management.Security and auditing features can be set up in the NetWare Administrator, NETADMIN, or AUDITCON utility.Manage time synchronization by selecting the type of time server each NetWare server is set up as.The number and location of container objects, partitions, and replicas help determine the type of time servers you should create for your network.PAGENUM=99 ID="BP104"Time synchronization is set up and managed in the INSTALL utility and with SET parameters at the server console or in configuration files.Make considerations for, and enable, bindery services by setting the bindery context.For security, performance, and reliability reasons, it is a good idea to group servers at various bindery contexts, depending on department or site. If, for example, your organization is spread over three cities, use site-specific bindery contexts for the following reasons:MARK=BULLETTo provide local control over the servers at each siteThis allows the network supervisors to control local administration---updating local servers, adding or deleting users, installing new equipment, and performing  other tasks that are often best handled on a local basis.To increase securityIf, for example, the network supervisors in three different cities had supervisory rights over the same bindery context container, there would be a great risk of problems due to possible conflicting configurations imposed by the different supervisors.To decrease traffic over WAN linksIf, for example, users in London and Tokyo had their User objects in a bindery context served by a server in New York, every data transmission would take place over WAN links. This would likely result in decreased performance and create the potential for other problems.To enable bindery services for users and objects within one of the container units created with INSTALL, you must set the bindery context. The bindery context is automatically set to the location where you install a server. You must enter this command on each server that will use this bindery context.Optimize and manage Directory trees.Use DSMERGE and PARTMGR (or the Partition Manager option in the NetWare Administrator) to manage the Directory databases on your network.PartitionsPAGENUM=100 ID="BP105". Create most of your partitions at lower levels of the Directory tree. Workgroup boundaries generally determine the number of partitions required in a tree. You should partition your tree in relation to the use and physical locations of network resources. You should create partitions only if they provide better performance or fault tolerance to the network and tree.Create your tree in a triangular pattern with a small number of partitions at the top levels of the tree and greater numbers, if needed, as you progress towards the bottom of the tree. This implementation creates fewer subordinate references at the top of the tree.Before performing any partition operation, ensure that the state of synchronization for all servers affected by the operation is stable. The following table provides recommendations for determining which partitions will be affected by what operation:COLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="12*"COLNAME=2 COLWIDTH="12*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"Partition OperationCOLNAME=2 ROTATE="0" MOREROWS="0"Partitions AffectedVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Create, add, delete a partitionCOLNAME=2 ROTATE="0" MOREROWS="0"Target partitionsCOLNAME=1 ROTATE="0" MOREROWS="0"Change the replica typeCOLNAME=2 ROTATE="0" MOREROWS="0"Target partitionsCOLNAME=1 ROTATE="0" MOREROWS="0"Rebuild any partition replicaCOLNAME=2 ROTATE="0" MOREROWS="0"Target partitionsCOLNAME=1 ROTATE="0" MOREROWS="0"Merge partitionsCOLNAME=2 ROTATE="0" MOREROWS="0"Parent and child partitionsReplicas. Do not create unnecessary replicas of the [Root] partition and other parent partitions. This implementation creates fewer subordinate references at the top of the tree, allowing NDS to keep track of fewer child partition references.If you keep the network user and resources in mind when creating the tree, you will find that the most efficient use of replications---reducing WAN traffic by placing directory services close to users and resources, and fault tolerance---means you should not need many replicas.Merge. Before performing a merge operation, ensure that the state of synchronization for all servers affected by the operation is stable. The following table provides recommendations for preparing source and target trees for merging.COLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="12*"COLNAME=2 COLWIDTH="12*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"Necessary PreconditionCOLNAME=2 ROTATE="0" MOREROWS="0"Required ActionVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"No aliases or leaf objects can exist at the root of the source tree.COLNAME=2 ROTATE="0" MOREROWS="0"Delete any aliases or leaf objects at the root of the source tree.COLNAME=1 ROTATE="0" MOREROWS="0"No identical names can exist between the source and target trees.COLNAME=2 ROTATE="0" MOREROWS="0"Rename objects on the source and target trees if similar names exist.COLNAME=1 ROTATE="0" MOREROWS="0"No login connections can exist on source or target trees.COLNAME=2 ROTATE="0" MOREROWS="0"Close all connections on the source and target trees.COLNAME=1 ROTATE="0" MOREROWS="0"The NDS version must be the same on both source and target trees.COLNAME=2 ROTATE="0" MOREROWS="0"Upgrade all non-4.1 servers that have a replica of the [Root] object.COLNAME=1 ROTATE="0" MOREROWS="0"Any server that contains a replica of the [Root] object on both source and target trees must be up and running.COLNAME=2 ROTATE="0" MOREROWS="0"Ensure that all servers containing a replica of the root partition on both source and target trees are up and running.Ensure that any WAN links affected are stable.COLNAME=1 ROTATE="0" MOREROWS="0"Schema on both source and target trees must be the same.COLNAME=2 ROTATE="0" MOREROWS="0"Ensure that source and target trees are time synchronized within two seconds of each other.PAGENUM=101 ID="BP106"RENDERAS="SECT1"ID="FM19398"Implementing NDS on Various Sizes of NetworksThe following discussions outline the recommended implementation of NDS features and functionality specific for small, medium, and large networks. You must decide which method or combination of methods best suits your organization's particular needs and requirements.If you are implementing NDS in a medium-to-large-sized network, you might benefit from the information provided in IDREF="FM26542"Chapter 5, "Planning NetWare Directory Services Implementation," on page 65 for help in developing an implementation plan for NDS.RENDERAS="SECT2"IDXID="w2819"BOOK="_idx" COLLECTION="nw41" TIDREF="i4175"
Small-Sized IDXID="w2820"BOOK="_idx" COLLECTION="nw41" TIDREF="i2726"IDXID="w2821"BOOK="_idx" COLLECTION="nw41" TIDREF="i2726"
NetworkIn small-sized networks, the primary reason to implement IDXID="w2822"BOOK="_idx" COLLECTION="nw41" TIDREF="i2725"
NDS is the centralized management it provides.PAGENUM=102 ID="BP107"Implementing NDS for centralized management concentrates on two possible NDS models:MARK=BULLETThe physical location of network resourcesThe departmental structure of the organizationThe following figure shows a Directory tree in which ACCT (Accounting), HR (Human Resources), and PAY (Payroll) represent departments, all under the Organization HQ (Headquarters).LABEL="6-1" FLOAT="0"Example of a Small-Sized Directory TreeFILEREF="n41ds66a.tif"RENDERAS="SECT3"Directory IDXID="w2823"BOOK="_idx" COLLECTION="nw41" TIDREF="i1085"
Tree 
StructureSmall-sized networks are commonly site, workgroup, and department oriented in their structure. (PAGENUM=103 ID="BP108"IDREF="FM74321"See "Planning a Departmental Directory Tree (Merge Tree Method)" on page 72.) They maintain a system-wide administrative group with central management at the organizational and departmental levels.The Directory tree begins with a single Organization (O) container object with few or no Organizational Unit (OU) container objects below. If OU containers exist, they are based on functional groups, projects, departments, etc., within a single site.Resources are usually shared by all network users and groups.Network resources are managed by Organization container supervisors. The supervisors are responsible for managing local resources and user and group accounts.RENDERAS="SECT3"Time IDXID="w2824"BOOK="_idx" COLLECTION="nw41" TIDREF="i4487"IDXID="w2825"BOOK="_idx" COLLECTION="nw41" TIDREF="i4487"
ServicesAlthough small-sized business might be restricted to a single- or multiple-segment LAN, time services is still important. A Single Reference time server is usually adequate for LAN-based networks. The Single Reference time server is monitored and periodically adjusted for time by the network supervisors.All other servers in the network are designated as Secondary time servers.RENDERAS="SECT3"IDXID="w2826"BOOK="_idx" COLLECTION="nw41" TIDREF="i3233"IDXID="w2827"BOOK="_idx" COLLECTION="nw41" TIDREF="i3233"
PartitionsIDXID="w2828"BOOK="_idx" COLLECTION="nw41" TIDREF="i1626"Workgroup boundaries generally determine the number of partitions required in a tree. You should partition your tree in relation to the use and physical locations of network resources. You should create partitions only if they provide better performance or fault tolerance to the network and tree. Create your tree in a triangular pattern with a small number of partitions at the top levels of the tree and greater numbers, if needed, as you progress towards the bottom of the tree. This implementation creates fewer subordinate references at the top of the tree.RENDERAS="SECT3"IDXID="w2829"BOOK="_idx" COLLECTION="nw41" TIDREF="i3793"IDXID="w2830"BOOK="_idx" COLLECTION="nw41" TIDREF="i3793"
ReplicasEach server within the network should contain all the resources needed within its location, because users rarely connect to servers in other locations.PAGENUM=104 ID="BP109"If users are connecting to servers in other locations, then make considerations for replicating the Directory partitions based on redundancy for fault tolerance rather than on speed across a WAN.Partition replicas provide fault tolerance. You should copy two to three replicas of each partition somewhere on the network.You should allow for all master replicas on a server to be copied to one or two other servers within the same physical location and to a server located at a different site.RENDERAS="SECT2"IDXID="w2831"BOOK="_idx" COLLECTION="nw41" TIDREF="i2371"
Medium-Sized IDXID="w2832"BOOK="_idx" COLLECTION="nw41" TIDREF="i2726"IDXID="w2833"BOOK="_idx" COLLECTION="nw41" TIDREF="i2726"
NetworkIn medium-sized networks, there are four primary reasons to implement IDXID="w2834"BOOK="_idx" COLLECTION="nw41" TIDREF="i2725"
NDS:MARK=BULLETFlexibility of the centralized management featuresNDS allows for a single network supervisor to administer the entire network of resources from a single location or to share responsibility with local site supervisors within the same administration tool and database.Support for enterprise applicationsNDS supports enterprise applications, such as demographics research tools, database applications, human resources/payroll applications, scheduling systems, statistical services applications, document management, electronic mail, etc.High network performanceNDS allows you to determine how and where network traffic is maintained within the network. Network traffic can remain on a local server by implementing partitioning and replicas.Advanced security featuresNDS incorporates the advanced RSA security features that make encrypted, single-login authentication to network resources possible.NDS security is based on a top-down architecture. All rights to network resources are established through Access Control Lists (ACLs) that allow for sophisticated, but easily managed, administration.The auditing facility also provides a high level of security management.PAGENUM=105 ID="BP110"The following figure shows an example of a common Directory tree for a medium-sized network.LABEL="6-2" FLOAT="0"Example of Medium-Sized Directory TreeFILEREF="n41ds67a.tif"RENDERAS="SECT3"Directory IDXID="w2835"BOOK="_idx" COLLECTION="nw41" TIDREF="i1085"
Tree StructureMedium-sized networks are commonly workgroup and department oriented in their structure. (PAGENUM=106 ID="BP111"IDREF="FM74321"See "Planning a Departmental Directory Tree (Merge Tree Method)" on page 72.) They maintain a system-wide administrative group with central management at the organizational and departmental levels.The Directory tree begins with a general Organization (O) object container with multiple Organizational Unit (OU) container objects below. OU containers are based on functional groups, projects, departments, etc.Within O and OU containers are enterprise resources that are managed centrally. For example:MARK=BULLETServers that function as SAA* or TCP/IP gateways or as a NACSTM systemUser accounts for network supervisorsProfile objects that create an environment for specific users and groupsAs organizations grow, it is necessary to maintain the workgroup and departmental structure of an organization while sufficiently increasing the centralized administration.You should create user accounts for centralized supervisors and Organizational Unit supervisors within their respective containers.The centralized supervisors are responsible for general network management and overall support for the Directory tree. The OU supervisors are responsible for day-to-day tasks, such as user and resource management and local file server backup.Centralized management also helps facilitate the implementation of network-wide standards. You should create and distribute a standards document for the entire network before implementing NDS.RENDERAS="SECT3"Time IDXID="w2836"BOOK="_idx" COLLECTION="nw41" TIDREF="i4487"IDXID="w2837"BOOK="_idx" COLLECTION="nw41" TIDREF="i4487"
ServicesIDXID="w2838"BOOK="_idx" COLLECTION="nw41" TIDREF="i1626"Because many medium-sized networks maintain some level of WAN connectivity, time services support is an important consideration.A Single Reference time server is usually inadequate for networks that have WAN connections. You should use a group of Primary time servers as the basis for network time services.PAGENUM=107 ID="BP112"Determine which servers within your organization provide system-wide services, such as directories or applications accessed by multiple departments or the entire organization. Choose a limited number from the group of servers you identified to be installed as Primary time servers. Limiting the number of Primary time servers to a select few minimizes the network traffic used when the time servers vote on the current time.In addition, choose servers in different locations throughout the network.Set up the remaining servers that you identified as Secondary time servers.RENDERAS="SECT3"IDXID="w2839"BOOK="_idx" COLLECTION="nw41" TIDREF="i3233"IDXID="w2840"BOOK="_idx" COLLECTION="nw41" TIDREF="i3233"
PartitionsPartitioning of medium-sized networks should model the structure of Organizational Unit (OU) containers. Create one partition of each OU within the tree.This allows each partition to contain all of the resource objects that a particular department needs to access. Place the [Root] and Organization (O) containers in the same partition.RENDERAS="SECT3"IDXID="w2841"BOOK="_idx" COLLECTION="nw41" TIDREF="i3793"IDXID="w2842"BOOK="_idx" COLLECTION="nw41" TIDREF="i3793"
ReplicasIDXID="w2843"BOOK="_idx" COLLECTION="nw41" TIDREF="i1626"Create replicas to ensure adequate redundancy of critical partitions. Determine which servers within your organization provide system-wide services, such as directories or applications accessed by multiple departments or the entire organization.Place replicas of those servers' partitions on servers in different locations in the network that access resources in the partitions. This allows all users to authenticate to an enterprise resource without creating high network traffic.For servers that provide local services only, place replicas of those servers' partitions on other local servers.If only one server exists at the location, place one replica of the partition that the server is contained in on a server in a different location. Provide additional replicas if possible.PAGENUM=108 ID="BP113"RENDERAS="SECT2"IDXID="w2844"BOOK="_idx" COLLECTION="nw41" TIDREF="i2070"
Large-Size IDXID="w2845"BOOK="_idx" COLLECTION="nw41" TIDREF="i2726"IDXID="w2846"BOOK="_idx" COLLECTION="nw41" TIDREF="i2726"
NetworksIn large-sized networks, there are six primary reasons to implement IDXID="w2847"BOOK="_idx" COLLECTION="nw41" TIDREF="i2725"
NDS:MARK=BULLETCentralization of resourcesReduced cost of management, equipment, and critical applicationsGlobal network resource management and flexibility of the centralized management featuresNDS allows a single network supervisor to administer the entire network of resources from a single location or to share responsibility with local site supervisors within the same administration tool and database.Support for enterprise applications in a seamless mannerNDS supports enterprise applications, such as demographics research, database applications, human resources/payroll applications, scheduling systems, statistical services applications, document management, electronic mail, etc., regardless of their location on the network.High network performanceNDS allows you to determine how and where network traffic is maintained within the network. Network traffic can remain local by implementing partitioning and replicas.Advanced security featuresNDS incorporates the advanced RSA security features that make encrypted, single-login authentication to network resources possible.NDS security is based on a top-down architecture. All rights to network resources are established through Access Control Lists (ACLs) that allow for sophisticated, but easily managed, administration.The auditing facility also provides a high level of security managementThe following figure shows an example of a common Directory tree for a large-sized network.PAGENUM=109 ID="BP114"LABEL="6-3" FLOAT="0"Example of Large-Sized Directory TreeFILEREF="n41ds68a.tif"RENDERAS="SECT3"DirectoryIDXID="w2848"BOOK="_idx" COLLECTION="nw41" TIDREF="i1085"
 Tree StructureLarge-sized networks are enterprise focused, linking large, organizational networks with many other equal- or smaller-sized networks. They require a high level of flexibility to merge or split networks as needed. These networks consist of multiple Directory trees that are constructed to a hybrid model of both functional and location-based structures. The Directory trees each begin with a general Organization (O) container object with multiple Organizational Unit (OU) container objects below. OU containers are based on functional groups, projects, departments, etc., and also on site locations such as cities or countries.PAGENUM=110 ID="BP115"They maintain both system-wide administrative groups with central management at the organizational and departmental levels and site-based administrative groups that manage local resources and accounts.They maintain a number of high-level divisions within the organization that form the top layer of OU containers. Most of these divisions are divided into sub-departments which form a second layer of OU containers. A third layer of OU containers consists of locations or functional groups.RENDERAS="SECT4"Organizational and Departmental ContainersWithin O and OU containers are enterprise resources that are managed centrally. For example:MARK=BULLETServers that function as SAA* or TCP/IP gateways or as a NACSTM systemUser accounts for network supervisorsProfile objects that create an environment for specific users and groupsRENDERAS="SECT4"Centralized ManagementAs organizations grow, it is necessary to maintain the workgroup and departmental structure of an organization while sufficiently increasing the centralized administration.You should create user accounts for centralized supervisors and Organizational Unit supervisors within their respective containers.The centralized supervisors are responsible for general network management and overall support for the Directory tree. The OU supervisors are responsible for day-to-day tasks, such as user and resource management and local file server backup.Centralized management also helps facilitate the implementation of network-wide standards. You should create and distribute a standards document for the entire network before implementing NDS.RENDERAS="SECT3"Time IDXID="w2849"BOOK="_idx" COLLECTION="nw41" TIDREF="i4487"IDXID="w2850"BOOK="_idx" COLLECTION="nw41" TIDREF="i4487"
ServicesBecause most large-sized networks maintain high levels of WAN connectivity, which span time zones and international datelines, time services support is a very important consideration. PAGENUM=111 ID="BP116"It is critical to have a constant reference of time in order for NDS synchronization to take place. Time is also important to the proper execution of certain events and features, such as network backups and time-based security.You should use a single Reference time server and a group of Primary time servers as the basis for network time services. This ensures that a proper and accurate time reference is available at all times. Determine which servers within your organization provide system-wide services, such as directories or applications accessed by the entire organization. From the servers you identified, choose which ones you will set up as Primary time servers and which one you will set up as the Reference time server.All other NetWare servers in the network should be set up as Secondary time servers.The Reference time server should be adjusted periodically by an outside time source, possibly the U.S. Naval Observatory Clock in Annapolis, MD. In addition, all servers should be adjusted to reduce SAP (Service Advertising Protocol) traffic by making fewer time requests per hour than the default allows.RENDERAS="SECT3"IDXID="w2851"BOOK="_idx" COLLECTION="nw41" TIDREF="i3233"IDXID="w2852"BOOK="_idx" COLLECTION="nw41" TIDREF="i3233"
PartitionsPartitioning of large-sized networks should follow a multi-tiered partition plan. Each division OU container has its own partition representing that container and its objects. Each sublevel OU container is the root for a lower level partition that includes itself and all the other containers and leaf objects lower in that branch of the tree. The [Root] level and the Organization container should form one partition. This partitioning structure ensures that all of the critical access points in the tree are available and can be replicated for redundancy.RENDERAS="SECT3"IDXID="w2853"BOOK="_idx" COLLECTION="nw41" TIDREF="i3793"IDXID="w2854"BOOK="_idx" COLLECTION="nw41" TIDREF="i3793"
ReplicasCreate replicas to ensure adequate redundancy of critical partitions. Determine which servers within your organization provide system-wide services, such as directories or applications accessed by multiple departments or the entire organization.PAGENUM=112 ID="BP117"Place replicas of those servers' partitions on servers in different locations in the network that access resources in the partitions. This allows all users to authenticate to an enterprise resource without creating high network traffic.For servers that provide local services only, place replicas of those servers' partitions on other local servers.If only one server exists at the location, place one replica of the partition that the server is contained in on a server in a different location. Provide additional replicas if possible.For added security and fault tolerance, place a read/write replica of each partition on a master server in the Organization level of Directory trees. This allows the central network supervising staff to maintain a complete Directory database in one location. Also ensure that every partition has up to four replicas available on the network, including replicas on appropriate distant servers. Place a read/write replica on a master file server, to allow for at least one single location in a tree for all replicas. This enables supervisors to more quickly restore a damaged or missing replica. Replicas of every partition should serve as an additional form of redundancy as well as a facilitator of reduced network traffic.Most of the replicas should be located on servers within the main corporate network, except for other locations that have multiple servers. In these cases, replicas of the appropriate partitions are located on all of these servers.RENDERAS="SECT1"Additional InformationCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="10*"COLNAME=2 COLWIDTH="16*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"TopicCOLNAME=2 ROTATE="0" MOREROWS="0"ReferenceVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Container objectsCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Container object" in ConceptsIDREF="FM63488""Container Objects" on page 12COLNAME=1 ROTATE="0" MOREROWS="0"ContextCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Container object" in ConceptsIDREF="FM28349""Context and Names" on page 20COLNAME=1 ROTATE="0" MOREROWS="0"Leaf objectsCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Container object" in ConceptsIDREF="FM72822""Leaf Objects" on page 14COLNAME=1 ROTATE="0" MOREROWS="0"NetWare Administrator utilityCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="superenu" COLLECTION="nw41"Installing an MS Windows Workstation and Starting NetWare Administrator" in Chapter 1 of Supervising the Network"BOOK="superenu" COLLECTION="nw41"Installing an OS/2 Workstation and Starting NetWare Administrator" in Chapter 1 of Supervising the NetworkCOLNAME=1 ROTATE="0" MOREROWS="0"ObjectsCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Container objects" in ConceptsIDREF="FM31768""Directory Objects" on page
8COLNAME=1 ROTATE="0" MOREROWS="0"Partitions and replicasCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Container object" in ConceptsIDREF="FM67604""Directory Partitions" on page 31IDREF="FM76515""Partition Replicas" on page 33COLNAME=1 ROTATE="0" MOREROWS="0"Printing with NetWare AdministratorCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="printenu" COLLECTION="nw41"Managing Print Services with NetWare Administrator" in Chapter 3 of Print  ServicesCOLNAME=1 ROTATE="0" MOREROWS="0"RightsCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Container object" in ConceptsIDREF="FM82583""Object and Property Rights" on page 16LABEL="7"PAGENUM=115 ID="BP118"
ID="FM86103"Managing NetWare Directory ServicesRENDERAS="SECT1"OverviewThis chapter briefly describes the 
management 
utilitiesIDXID="w2855"BOOK="_idx" COLLECTION="nw41" TIDREF="i2318"
 and programs used for setting up and maintaining your implementation of the NetWare® Directory ServicesTM (NDS) technology on your network.The following topics are discussed on the indicated pages:COLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="22*"COLNAME=2 COLWIDTH="4*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"TopicCOLNAME=2 ROTATE="0" MOREROWS="0"PageVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM67116"DSMERGECOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM67116"116COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM47046"DSREPAIRCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM47046"118COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM26615"DSTRACECOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM26615"121COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM47968"INSTALLCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM47968"122COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM59625"NETADMINCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM59625"124COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM98999"NetWare AdministratorCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM98999"126COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM69183"PARTMGRCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM69183"128COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM36681"SET (NDS Parameters)COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM36681"130COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM94371"TIMESYNCCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM94371"131COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM92480"UIMPORTCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM92480"133RENDERAS="SECT1"IntroductionThe NDSTM technology is a distributed name service that provides global access to all network resources regardless of where they are physically located. Users log in to a multiserver network and view the entire network as a PAGENUM=116 ID="BP119"single information system. This single information system is the basis for increased productivity and reduced administrative costs.The management utilities and programs discussed in this chapter can help you build and maintain your Directory Tree hierarchy and objects, as well as helping you maintain the Directory databases within your network.RENDERAS="SECT1"ID="FM67116"DSMERGEIDXID="w2856"BOOK="_idx" COLLECTION="nw41" TIDREF="i1252"Use this utility at the server console toMARK=BULLETMerge the roots of two separate Directory treesRename a treeView name and time synchronization informationCreating one Directory tree from two separate trees allows for communicating and sharing data.The following table shows the IDXID="w2857"BOOK="_idx" COLLECTION="nw41" TIDREF="i1252"
functions available in DSMERGE.COLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="7*"COLNAME=2 COLWIDTH="18*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"OptionCOLNAME=2 ROTATE="0" MOREROWS="0"Use toVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Check Servers in This TreeCOLNAME=2 ROTATE="0" MOREROWS="0"Contact all servers in the local tree to verify that each server has the correct version, status, and tree name.The server you are on must have a replica of the [Root] partition. It does not require the master replica.COLNAME=1 ROTATE="0" MOREROWS="0"Check Time SynchronizationCOLNAME=2 ROTATE="0" MOREROWS="0"Display a list of all servers in this tree, along with information about time sources and time synchronization.The server you are on must have a replica of the [Root] partition. It does not require the master replica.COLNAME=1 ROTATE="0" MOREROWS="0"Merge Two TreesCOLNAME=2 ROTATE="0" MOREROWS="0"Merge the [Root] of the local (source) tree to the [Root] of the target tree.The server you are on must have the master replica of the local tree's [Root] partition.COLNAME=1 ROTATE="0" MOREROWS="0"Rename TreeCOLNAME=2 ROTATE="0" MOREROWS="0"Rename the local tree. Use this option if you are merging two roots with the same name.You can rename only the local tree name. To rename the target tree name, load DSMERGE on a server in the target tree. Then load DSMERGE on the source tree to perform the merge.The server you are on must have the master replica of the root partition.PAGENUM=117 ID="BP120"RENDERAS="SECT2"Using the DSMERGE 
UtilityThe DSMERGE utility requires that the following conditions exist before two Directory trees can be merged:MARK=BULLETNo leaf object or aliases can exist at the root of the source treeNo similar names can exist on source and target treesNo login connections can exist on either source or target treeThe version of NDS must be the same on both source and target treesAny server that contains a replica of the [Root] for both source and target trees must be up and runningSchema on both source and target trees must be the sameAll servers in both source and target trees should be synchronized within two seconds of each other, and all servers should use the same time sourceYou can't merge container or leaf objects with DSMERGE.  To move leaf objects, use NetWare Administrator or NETADMIN. To merge partitions, use PARTMGR or Partition Manager in NetWare Administrator.RENDERAS="SECT2"Completing the Tree MergeFollowing the merging of two trees, it might be necessary to complete the following tasks:PAGENUM=118 ID="BP121"MARK=BULLETIf any servers were not upgraded to NetWare 4.1 before you ran DSMERGE, copy a new replica to those servers.Re-create any leaf objects or aliases at the [Root] that were deleted before you ran DSMERGE.Carefully evaluate and change the partitioning as needed, because merging trees might significantly change replica placement on the source treeUpdate client workstations' PREFERRED TREE statements in their 
NET.CFG files, or rename the target tree so that the final tree name corresponds to the majority of the client workstations' NET.CFG files.RENDERAS="SECT2"Additional InformationCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="10*"COLNAME=2 COLWIDTH="16*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"TopicCOLNAME=2 ROTATE="0" MOREROWS="0"ReferenceVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"DSMERGE utilityCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="superenu" COLLECTION="nw41"Merging NDS Trees" in Chapter 5 of Supervising the Network"BOOK="utlrfenu" COLLECTION="nw41"DSMERGE" in Utilities ReferenceCOLNAME=1 ROTATE="0" MOREROWS="0"Merging partitionsCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="superenu" COLLECTION="nw41"Merging Partitions" in Chapter 5 of Supervising the NetworkCOLNAME=1 ROTATE="0" MOREROWS="0"Moving leaf objectsCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="superenu" COLLECTION="nw41"Moving Objects in the Directory Tree" in Chapter 5 of Supervising the NetworkCOLNAME=1 ROTATE="0" MOREROWS="0"Renaming a Directory treeCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="superenu" COLLECTION="nw41"Renaming the Tree" in Chapter 5 of Supervising the NetworkCOLNAME=1 ROTATE="0" MOREROWS="0"Time synchronizationCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="superenu" COLLECTION="nw41"Managing Network Time Synchronization" in Chapter 7 of Supervising the NetworkRENDERAS="SECT1"ID="FM47046"DSREPAIRIDXID="w2858"BOOK="_idx" COLLECTION="nw41" TIDREF="i1255"Use this utility at the server console to check and r
epair or correct such problems in the IDXID="w2859"BOOK="_idx" COLLECTION="nw41" TIDREF="i1050"
Directory database concerning records, schema, bindery objects, and external references.It is similar to the way VREPAIR fixes volumes on a server.PAGENUM=119 ID="BP122"The following table shows the IDXID="w2860"BOOK="_idx" COLLECTION="nw41" TIDREF="i1255"
functions available in DSREPAIR.COLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="7*"COLNAME=2 COLWIDTH="18*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"OptionCOLNAME=2 ROTATE="0" MOREROWS="0"Use toVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Unattended Full RepairCOLNAME=2 ROTATE="0" MOREROWS="0"Automatically perform all possible repair operations to the Directory database that do not require operator assistance.COLNAME=1 ROTATE="0" MOREROWS="0"Time SynchronizationCOLNAME=2 ROTATE="0" MOREROWS="0"Contact all servers within this server's local database to request information about Directory Services and time synchronization.If a replica of the root partition is contained on this server, then all servers in the Directory tree are contacted.COLNAME=1 ROTATE="0" MOREROWS="0"Replica SynchronizationCOLNAME=2 ROTATE="0" MOREROWS="0"Determine the status of synchronization for every replica in the replica table for the Directory tree.The status of synchronization can inform you of the current condition of the Directory tree.COLNAME=1 ROTATE="0" MOREROWS="0"View/Edit Repair Log FileCOLNAME=2 ROTATE="0" MOREROWS="0"Track all operations of the DSREPAIR utility to a single file. The default log file is SYS:SYSTEM\DSREPAIR.LOG.You can configure options for the log file by accessing "Log File And Login Configuration" in the "Advanced Options" menu.COLNAME=1 ROTATE="0" MOREROWS="0"Advanced Options MenuCOLNAME=2 ROTATE="0" MOREROWS="0"The "Advanced Options" menu allows you to manually perform individual or global repair operations on the Directory tree. You can also access diagnostic information about the Directory tree database to analyze the status of the tree.The "Advanced Options" menu includes the following options:MARK=BULLETRepair local databaseRepair all known network addressesView, verify, and edit remote server ID listRepair replicas, replica lists (rings), and server objectsSynchronize security equivalence attributes for treeUpdate schemaView local partition informationView and edit logCopy compressed NDS database files to diskPAGENUM=120 ID="BP123"RENDERAS="SECT2"Using the DSREPAIR UtilityThe DSREPAIR utility is provided with NetWare 4TM software to repair problems with NetWare Directory Services on an individual-server basis (not from a single, centralized location).You can do any of the following with DSREPAIR:MARK=BULLETCheck Directory information MARK=BULLETLocal Directory tree structureRecords that make up the Directory on the serverDirectory schemaObjects in replicasLocal referencesPAGENUM=121 ID="BP124"Mandatory and optional propertiesInitial statesFile system trustees on mounted volumesMail directoriesStream syntax filesDesignate a new master replica for a partition that has lost this replica due to server failureCheck or perform replica or schema synchronizationRepair all initial statesGuarantee local Database recoveryRemove lost Server objectsConfigure time synchronizationRENDERAS="SECT2"Additional InformationCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="10*"COLNAME=2 COLWIDTH="16*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"TopicCOLNAME=2 ROTATE="0" MOREROWS="0"ReferenceVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"DSREPAIR utilityCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="superenu" COLLECTION="nw41"Repairing the NetWare Directory Database" in Chapter 5 of Supervising the Network."BOOK="utlrfenu" COLLECTION="nw41"DSREPAIR" in Utilities ReferenceRENDERAS="SECT1"ID="FM26615"DSTRACEIDXID="w2861"BOOK="_idx" COLLECTION="nw41" TIDREF="i1257"Use this utility at the server console toMARK=BULLETDetermine whether NDS synchronization processes are completeDiagnose NDS errorsPAGENUM=122 ID="BP125"RENDERAS="SECT2"Using the DSTRACE UtilityDSTRACE is a simple console utility to monitor how NDS is functioning. It is not intended to be used as an end-user tool, but it can often be used to help identify network problems which might be related to NDS.Comparing trace information from server to server can help determine the source of a Directory problem.The NDS TRACE TO FILE parameter is also useful for capturing information that you might want to have when calling your Novell Authorized ResellerCLM or Novell Technical SupportSM representative for assistance.RENDERAS="SECT2"Additional InformationCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="11*"COLNAME=2 COLWIDTH="15*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"TopicCOLNAME=2 ROTATE="0" MOREROWS="0"ReferenceVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"DSTRACE utilityCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="utlrfenu" COLLECTION="nw41"NetWare Directory Services Parameters" under "SET" in Utilities Reference"BOOK="superenu" COLLECTION="nw41"Viewing and Managing NDS Synchronization Status" in Chapter 5 of Supervising the Network.COLNAME=1 ROTATE="0" MOREROWS="0"NDS system messagesCOLNAME=2 ROTATE="0" MOREROWS="0"Messages numbering -601 through -699 and F966 through F9FE)in BOOK="sysmsenu" COLLECTION="nw41"System MessagesRENDERAS="SECT1"ID="FM47968"INSTALLUse this program at the server console toMARK=BULLETInstall or IDXID="w2862"BOOK="_idx" COLLECTION="nw41" TIDREF="i4689"
upgrade the NetWare operating system on your serverIDXID="w2863"BOOK="_idx" COLLECTION="nw41" TIDREF="i4044"
Modify
 your NetWare server IDXID="w2864"BOOK="_idx" COLLECTION="nw41" TIDREF="i759"
configurationPerform some server maintenance operationsRENDERAS="SECT2"Using the IDXID="w2865"BOOK="_idx" COLLECTION="nw41" TIDREF="i1814"
INSTALL ProgramIDXID="w2866"BOOK="_idx" COLLECTION="nw41" TIDREF="i2723"PAGENUM=123 ID="BP126"During the installation process, INSTALL scans the network for any existing Directory trees. If it does not find an existing tree, it prompts you to install the first server in the Directory tree. Installation of the first server in a Directory tree is important because it establishes the initial hierarchy of your tree structure.The INSTALL program assists you in setting up time synchronization.It also assists you in naming the server and in setting up the 
server 
context or name context. This determines the location of the server in the Directory tree.Use the INSTALL program to create partitions for the first server in a tree or to upgrade from a bindery server. Then use INSTALL to install the server into the partition you created.For additional servers, use the PARTMGR utility or Partition Manager in NetWare Administrator to create a new partition before installing a new server into the tree.If you want to install a server into an Organization (O), create the O before you install the server. If you want the O to become a new partition, you can split it off before or after INSTALL is completed.Make sure that you install the server into a context that currently exists. Do not create a new context within INSTALL.RENDERAS="SECT2"IDXID="w2867"BOOK="_idx" COLLECTION="nw41" TIDREF="i2723"
Removing IDXID="w2868"BOOK="_idx" COLLECTION="nw41" TIDREF="i1814"
NDS with the IDXID="w2869"BOOK="_idx" COLLECTION="nw41" TIDREF="i3773"
INSTALL ProgramWhen experiencing problems with NDS, you should not attempt to unload the software and then reload it. Doing this might unsynchronize Directory tree.Rarely is it necessary to remove the NDS software. You should remove NDS only if you are sure that doing so will assist you in recovering your Directory tree.Try correcting any problems first by removing and reinstalling replicas with the partition management utilities. Remove the NDS software only as a last resort.PAGENUM=124 ID="BP127"RENDERAS="SECT2"Additional InformationCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="10*"COLNAME=2 COLWIDTH="16*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"TopicCOLNAME=2 ROTATE="0" MOREROWS="0"ReferenceVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"INSTALL utilityCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="utlrfenu" COLLECTION="nw41"INSTALL" in Utilities ReferenceCOLNAME=1 ROTATE="0" MOREROWS="0"Installing NetWareCOLNAME=2 ROTATE="0" MOREROWS="0""Install Server Software" in Chapter 2 of BOOK="instlenu" COLLECTION="nw41"InstallationCOLNAME=1 ROTATE="0" MOREROWS="0"Partition management utilitiesCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="superenu" COLLECTION="nw41"Creating and Managing Directory Services Partitions" in Chapter 5 of Supervising the Network"BOOK="utlrfenu" COLLECTION="nw41"PARTMGR" in Utilities ReferenceCOLNAME=1 ROTATE="0" MOREROWS="0"Removing NDS softwareCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="superenu" COLLECTION="nw41"Managing the NetWare Directory Tree" of Chapter 5 in Supervising the NetworkCOLNAME=1 ROTATE="0" MOREROWS="0"Upgrading a NetWare serverCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="upmigenu" COLLECTION="nw41"Upgrade
Options" in Chapter 1 of UpgradeRENDERAS="SECT1"ID="FM59625"NETADMINIDXID="w2870"BOOK="_idx" COLLECTION="nw41" TIDREF="i2638"Use this text utility at a client workstation to 
manage NetWare Directory Services (NDS) objects and their 
properties.Users can view, create, move, delete, and assign rights to any NDS object they have appropriate rights to. This utility helps you manage access to these objects.The following figure shows the functions you can select from the "NetAdmin Options" main menu.PAGENUM=125 ID="BP128"LABEL="7-1" FLOAT="0"IDXID="w2871"BOOK="_idx" COLLECTION="nw41" TIDREF="i2638"Functions in NETADMINFILEREF="n41ds09a.tif"RENDERAS="SECT2"Using the NETADMIN UtilityYou can perform the following management tasks with NETADMIN:MARK=BULLETChange object property valuesCreate and name container and leaf objectsCreate searchable container and leaf objectsDelete objects from the Directory treeManage Organizational Role objectsManage trustee assignments to objectsMove objects in the Directory treePAGENUM=126 ID="BP129"Rename leaf and container objectsSearch for objects Manage object and property rightsRENDERAS="SECT2"Additional InformationCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="10*"COLNAME=2 COLWIDTH="16*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"TopicCOLNAME=2 ROTATE="0" MOREROWS="0"ReferenceVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Container objectsCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Container object" in ConceptsCOLNAME=1 ROTATE="0" MOREROWS="0"ContextCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Context" in ConceptsCOLNAME=1 ROTATE="0" MOREROWS="0"Leaf objectsCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Leaf objects" in ConceptsCOLNAME=1 ROTATE="0" MOREROWS="0"NETADMIN utilityCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="utlrfenu" COLLECTION="nw41"NETADMIN" in Utilities ReferenceCOLNAME=1 ROTATE="0" MOREROWS="0"ObjectsCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Objects" in ConceptsIDREF="FM63536"Appendix A, "NDS Object Classes and Properties" on page 137COLNAME=1 ROTATE="0" MOREROWS="0"RightsCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="superenu" COLLECTION="nw41"Default Objects and Rights for NetWare 4.1" in Chapter 1 Supervising the NetworkRENDERAS="SECT1"ID="FM98999"NetWare AdministratorIDXID="w2872"BOOK="_idx" COLLECTION="nw41" TIDREF="i2691"IDXID="w2873"BOOK="_idx" COLLECTION="nw41" TIDREF="i2691"
Use this utility at a client workstation to 
manage NetWare Directory Services (NDS) objects and their properties.Users can view, create, move, delete, and assign rights to any NDS object they have appropriate rights to. This utility helps you manage access to these objects.NetWare Administrator is a graphical user interface utility that runs as a multiple-document interface (MDI) application.Before you use NetWare Administrator for the first time in MS Windows or OS/2, create an "NWADMIN" icon. Thereafter, you can choose the icon to start the utility.PAGENUM=127 ID="BP130"RENDERAS="SECT2"Using the NetWare Administrator UtilityYou can perform the following tasks in MS Windows or OS/2 Windows, or in the NETADMIN, PARTMGR, and PCONSOLE utilities:MARK=BULLETAssign rights in the Directory tree and in the file systemCreate users and groupsCreate and delete Directory objectsMove and rename Directory objectsSet up printing servicesSet up and manage Directory partitions and replicasPAGENUM=128 ID="BP131"RENDERAS="SECT2"Additional InformationCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="10*"COLNAME=2 COLWIDTH="16*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"TopicCOLNAME=2 ROTATE="0" MOREROWS="0"ReferenceVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Container objectsCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Container object" in ConceptsIDREF="FM63488""Container Objects" on page 12COLNAME=1 ROTATE="0" MOREROWS="0"ContextCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Context" in ConceptsIDREF="FM28349""Context and Names" on page 20COLNAME=1 ROTATE="0" MOREROWS="0"Leaf objectsCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Leaf objects" in ConceptsIDREF="FM72822""Leaf Objects" on page 14COLNAME=1 ROTATE="0" MOREROWS="0"NetWare Administrator utilityCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="superenu" COLLECTION="nw41"Installing an MS Windows Workstation and Starting NetWare Administrator" in Chapter 1 of Supervising the Network"BOOK="superenu" COLLECTION="nw41"Installing an OS/2 Workstation and Starting NetWare Administrator" in Chapter 1 of Supervising the NetworkCOLNAME=1 ROTATE="0" MOREROWS="0"ObjectsCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Object" in ConceptsIDREF="FM31768""Directory Objects" on page 8COLNAME=1 ROTATE="0" MOREROWS="0"Partitions and replicasCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Partition (NetWare Directory)" in ConceptsIDREF="FM67604""Directory Partitions" on page 31IDREF="FM76515""Partition Replicas" on page 33COLNAME=1 ROTATE="0" MOREROWS="0"Printing with NetWare AdministratorCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="printenu" COLLECTION="nw41"Managing Print Services with NetWare Administrator" in Chapter 3 of Print ServicesCOLNAME=1 ROTATE="0" MOREROWS="0"RightsCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Rights" in ConceptsIDREF="FM82583""Object and Property Rights" on page 16RENDERAS="SECT1"ID="FM69183"PARTMGRIDXID="w2874"BOOK="_idx" COLLECTION="nw41" TIDREF="i3237"IDXID="w2875"BOOK="_idx" COLLECTION="nw41" TIDREF="i3237"
Use this utility at a client workstation toMARK=BULLETDistribute your IDXID="w2876"BOOK="_idx" COLLECTION="nw41" TIDREF="i1050"
Directory
 databasePAGENUM=129 ID="BP132"IDXID="w2877"BOOK="_idx" COLLECTION="nw41" TIDREF="i2318"
Manage partitions and replicasThe following figure shows the functions available in PARTMGR.LABEL="7-2" FLOAT="0"IDXID="w2878"BOOK="_idx" COLLECTION="nw41" TIDREF="i3237"Functions in PARTMGRFILEREF="n41ds16a.tif"RENDERAS="SECT2"Using the PARTMGR UtilityYou can perform the following tasks by choosing "Manage Partitions" from the "Partition Administration" menu:MARK=BULLETBrowse up the Directory tree to the parent containerBrowse down the Directory tree to see the Server object in containersView a list of the replicas stored on a serverView or modify a partition's replicasView or modify the replicas of the current container object (if that container object is a partition)Create a new partition with a container object as the root of the partitionMerge a partition with its parent partitionAbort a partition operation in progressPAGENUM=130 ID="BP133"RENDERAS="SECT2"Additional InformationCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="10*"COLNAME=2 COLWIDTH="16*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"TopicCOLNAME=2 ROTATE="0" MOREROWS="0"ReferenceVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Partition and replica operationsCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="superenu" COLLECTION="nw41"Managing the NetWare Directory Tree" in Chapter 5 of Supervising the NetworkCOLNAME=1 ROTATE="0" MOREROWS="0"PartitionsCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Partition (NetWare Directory)" in ConceptsCOLNAME=1 ROTATE="0" MOREROWS="0"PARTMGR utilityCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="utlrfenu" COLLECTION="nw41"PARTMGR" in Utilities ReferenceCOLNAME=1 ROTATE="0" MOREROWS="0"ReplicasCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Replica" in ConceptsRENDERAS="SECT1"ID="FM36681"SETIDXID="w2879"BOOK="_idx" COLLECTION="nw41" TIDREF="i3211"
 (NDS Parameters)IDXID="w2880"BOOK="_idx" COLLECTION="nw41" TIDREF="i4101"Use this utility at the server console to view and IDXID="w2881"BOOK="_idx" COLLECTION="nw41" TIDREF="i759"
configure NDS parameters. The default SET parameters give maximum IDXID="w2882"BOOK="_idx" COLLECTION="nw41" TIDREF="i4101"
performance for most systems. Network supervisors should rarely need to modify parameters.RENDERAS="SECT2"Using the SET Utility (NDS Parameters)Although most parameters don't need to be modified, you might increase the IDXID="w2883"BOOK="_idx" COLLECTION="nw41" TIDREF="i4388"
performance of your IDXID="w2884"BOOK="_idx" COLLECTION="nw41" TIDREF="i3294"
system by changing some parameters.NDS SET parameters enable you to perform the following tasks:MARK=BULLETControl the NDS trace fileSet time intervals for maintenance processes that reclaim disk space, remove external references, and check the consistency of backlinksSet NDS synchronization intervals and restrictionsSpecify the number of NetWare Core ProtocolTM (NCP) packet retries before timing outMark the status of other servers in the namebase as UP or DOWNSpecify IDXID="w2885"BOOK="_idx" COLLECTION="nw41" TIDREF="i452"
bindery IDXID="w2886"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"IDXID="w2887"BOOK="_idx" COLLECTION="nw41" TIDREF="i440"
services contextsPAGENUM=131 ID="BP134"You can use SET parameters in two ways: at the system console and in the configuration file.RENDERAS="SECT3"Entering at the System ConsoleWhen a parameter is used at the console prompt, the system is immediately configured to that setting.This overrides any related setting in the AUTOEXEC.NCF file until the server is rebooted. The system then returns to the default setting for the parameter.RENDERAS="SECT3"Saving in the AUTOEXEC.NCF FileWhen a parameter is saved in the AUTOEXEC.NCF file, the server configures itself to the parameter each time the server is booted.You can edit the 
AUTOEXEC.NCF file with INSTALL. If you use SERVMAN to change SET parameters, you are prompted to update .NCF files before exiting the utility.RENDERAS="SECT2"Additional InformationCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="10*"COLNAME=2 COLWIDTH="16*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"TopicCOLNAME=2 ROTATE="0" MOREROWS="0"ReferenceVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Editing AUTOEXEC.NCF fileCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="utlrfenu" COLLECTION="nw41"INSTALL" in Utilities Reference\"BOOK="utlrfenu" COLLECTION="nw41"SERVMAN" in Utilities Reference\COLNAME=1 ROTATE="0" MOREROWS="0"Improving server performanceCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="superenu" COLLECTION="nw41"Monitoring and Optimizing the Server" in Chapter 7 of Supervising the NetworkCOLNAME=1 ROTATE="0" MOREROWS="0"NDS SET parameters and optionsCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="utlrfenu" COLLECTION="nw41"NetWare Directory Services Parameters" under "SET" in Utilities ReferenceRENDERAS="SECT1"ID="FM94371"TIMESYNCUse this utility at the server console to monitor the internal time on a 
server to ensure that the time reported by all servers across the network is consistent 
(synchronized).PAGENUM=132 ID="BP135"TIMESYNC autoloads when the server boots. Rarely will you need to load or unload TIMESYNC. You might, however, want to load TIMESYNC to use an alternate configuration (.CFG) file. RENDERAS="SECT2"Using the TYMESYNC UtilityTime synchronization ensures that all servers in a Directory tree report the same time and order NetWare Directory Services events correctly.NetWare 4.1 uses TIMESYNC, which automatically loads when the server is booted, to control time synchronization.TIMESYNC uses two types of 
SET IDXID="w2888"BOOK="_idx" COLLECTION="nw41" TIDREF="i3211"
parameters:MARK=BULLETThose which control how time synchronization worksThese are set in the TIMESYNC.CFG configuration file.Those which determine how the system handles time synchronizationThese are either entered at the system console or set in the AUTOEXEC.NCF file.RENDERAS="SECT3"Using SET Parameters in the TIMESYNC.CFG FileTime synchronization SET parameters that control how the feature works are stored in their own configuration file, by default named TIMESYNC.CFG, in the SYS:SYSTEM directory.To change the time synchronization configuration on a NetWare server, modify the parameters in the 
TIMESYNC.CFG file, and then reboot the server or set TIMESYNC RESTART FLAG=ON.RENDERAS="SECT3"Using SET Parameters at the System Console or in the AUTOEXEC.NCF FileThe time synchronization parameters that determine how the system handles time synchronization can be entered at the system console. But unless you also add them to the 
AUTOEXEC.NCF file, changes made with SET at the console are lost the next time the server boots.PAGENUM=133 ID="BP136"RENDERAS="SECT2"Additional InformationCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="11*"COLNAME=2 COLWIDTH="15*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"TopicCOLNAME=2 ROTATE="0" MOREROWS="0"ReferenceVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Editing TIMESYNC.NCF fileCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="superenu" COLLECTION="nw41"Editing the TIMESYNC.CFG File" in Chapter 7 of Supervising the NetworkCOLNAME=1 ROTATE="0" MOREROWS="0"Modifying TIMESYNC SET parameters for medium or large networksCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM27092""Choosing a Time Synchronization Method" on page 56COLNAME=1 ROTATE="0" MOREROWS="0"SAPCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Service Advertising Protocol" in ConceptsCOLNAME=1 ROTATE="0" MOREROWS="0"SET parameters and options for TIMESYNCCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="superenu" COLLECTION="nw41"SET Parameters for TIMESYNC" in Chapter 7 of Supervising the NetworkCOLNAME=1 ROTATE="0" MOREROWS="0"Time server typesCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM60956""Time Servers" on page 50COLNAME=1 ROTATE="0" MOREROWS="0"Time synchronizationCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="cncptenu" COLLECTION="nw41"Time synchronization" in ConceptsCOLNAME=1 ROTATE="0" MOREROWS="0"TIMESYNC utilityCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="utlrfenu" COLLECTION="nw41"TIMESYNC" in Utilities ReferenceRENDERAS="SECT1"ID="FM92480"UIMPORTIDXID="w2889"BOOK="_idx" COLLECTION="nw41" TIDREF="i4629"IDXID="w2890"BOOK="_idx" COLLECTION="nw41" TIDREF="i4629"
Use this utility at a client workstation to create, delete, and update User objects and their properties by importing user information from an existing database into the IDXID="w2891"BOOK="_idx" COLLECTION="nw41" TIDREF="i1050"
Directory database.RENDERAS="SECT2"Using the UIMPORT UtilityThis utility is particularly valuable if you have hundreds, or thousands, of user records that you want to record in NetWare Directory Services without having to manually re-create each user.Any application capable of converting records to a comma-separated ASCII file can work with UIMPORT.Use UIMPORT to automate the maintenance of your Directory database when you want toMARK=BULLETCreate User objects in the Directory database using records from another databasePAGENUM=134 ID="BP137"Update User properties in the Directory database when records are changed in your original database programDelete User objects when their accounts on the network are no longer neededRENDERAS="SECT2"Additional InformationCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="10*"COLNAME=2 COLWIDTH="16*"VALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"TopicCOLNAME=2 ROTATE="0" MOREROWS="0"ReferenceCOLNAME=1 ROTATE="0" MOREROWS="0"Using UIMPORTCOLNAME=2 ROTATE="0" MOREROWS="0""BOOK="superenu" COLLECTION="nw41"Importing User Information into the Directory Services Database" in Chapter 5 of Supervising the NetworkLABEL=""PAGENUM=135 ID="BP138"ID="FM95872"AppendixesRENDERAS="SECT1"OverviewThe NetWare® Directory tree supports a large number of object classes and properties available to the NetWare Directory ServicesTM and bindery services technologies.Creating a consistent naming standards document can make present and future implementation of your Directory tree easier and more efficient.Naming standards can also help ensure that the Directory objects you create are intuitive and useful to users and groups on your network.RENDERAS="SECT1"ContentsThis section is divided into three appendixes, with the following information discussed on the indicated pages:COLS=3 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="19*"COLNAME=2 COLWIDTH="12*"COLNAME=3 COLWIDTH="4*"VALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"PurposeCOLNAME=2 ROTATE="0" MOREROWS="0"ChapterCOLNAME=3 ROTATE="0" MOREROWS="0"PageCOLNAME=1 ROTATE="0" MOREROWS="0"To reference lists and explanations of the object classes and properties available in NetWare Directory ServicesCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM63536"Appendix A, "NDS Object Classes and
Properties"COLNAME=3 ROTATE="0" MOREROWS="0"IDREF="FM63536"137COLNAME=1 ROTATE="0" MOREROWS="0"To reference lists of available leaf objects in NetWare Directory ServicesCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM37385"Appendix B, "Referencing and Using Leaf Objects"COLNAME=3 ROTATE="0" MOREROWS="0"IDREF="FM37385"149COLNAME=1 ROTATE="0" MOREROWS="0"To reference guidelines and samples for creating a standards document for objects in a NetWare Directory ServicesCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM23526"Appendix C, "Creating a Standards Document for NDS Object Classes and Properties"COLNAME=3 ROTATE="0" MOREROWS="0"IDREF="FM23526"157LABEL="A"PAGENUM=137 ID="BP139"ID="FM63536"NDS Object Classes and PropertiesRENDERAS="SECT1"OverviewThis appendix lists and explains the available object classes and properties available in the NetWare® Directory ServicesTM architecture.The following topics are discussed on the indicated pages:COLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="22*"COLNAME=2 COLWIDTH="4*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"TopicCOLNAME=2 ROTATE="0" MOREROWS="0"PageVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM71859"NDS Object Classes and Their FunctionsCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM71859"138COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM84329"NDS Object Classes and Their PropertiesCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM84329"140PAGENUM=138 ID="BP140"RENDERAS="SECT1"ID="FM71859"NDS IDXID="w2892"BOOK="_idx" COLLECTION="nw41" TIDREF="i3044"
Object 
Classes and Their FunctionsThis section lists the most common NDS object classes, explains what each is used for, and indicates where that type of object can be contained.  Object Class, Function, and Possible ContainerCOLS=3 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="10*"COLNAME=2 COLWIDTH="16*"COLNAME=3 COLWIDTH="8*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"Object ClassCOLNAME=2 ROTATE="0" MOREROWS="0"FunctionCOLNAME=3 ROTATE="0" MOREROWS="0"Possible ContainerVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"AFP ServerCOLNAME=2 ROTATE="0" MOREROWS="0"Represents an AppleTalk File Protocol- based server that is operating as a node on your NetWare network---and possibly also acting as a NetWare router to, and as the AppleTalk server for, several Apple Macintosh workstations.COLNAME=3 ROTATE="0" MOREROWS="0"Organization  Organizational UnitCOLNAME=1 ROTATE="0" MOREROWS="0"AliasCOLNAME=2 ROTATE="0" MOREROWS="0"Redirects path of Directory tree branch or leaf object to another location for more convenient accessCOLNAME=3 ROTATE="0" MOREROWS="0"Organization  Organizational Unit  Root levelCOLNAME=1 ROTATE="0" MOREROWS="0"Bindery ObjectCOLNAME=2 ROTATE="0" MOREROWS="0"Represents object upgraded from bindery- based server that cannot be mapped to a Directory objectCOLNAME=3 ROTATE="0" MOREROWS="0"Organization  Organizational UnitCOLNAME=1 ROTATE="0" MOREROWS="0"ComputerCOLNAME=2 ROTATE="0" MOREROWS="0"Represents network computers that are not file or print servers (such as gateways, routers, and sometimes workstations)COLNAME=3 ROTATE="0" MOREROWS="0"Organization  Organizational UnitCOLNAME=1 ROTATE="0" MOREROWS="0"CountryCOLNAME=2 ROTATE="0" MOREROWS="0"Additional level of organization in Directory treeCOLNAME=3 ROTATE="0" MOREROWS="0"Root levelCOLNAME=1 ROTATE="0" MOREROWS="0"Directory MapCOLNAME=2 ROTATE="0" MOREROWS="0"Specifies path on volume that points to frequently used application directoryCOLNAME=3 ROTATE="0" MOREROWS="0"Organization  Organizational UnitCOLNAME=1 ROTATE="0" MOREROWS="0"External EntityCOLNAME=2 ROTATE="0" MOREROWS="0"Used by services (such as messaging) to store information about entities (such as E-mail users) outside of DirectoryCOLNAME=3 ROTATE="0" MOREROWS="0"Organization  Organizational UnitCOLNAME=1 ROTATE="0" MOREROWS="0"GroupCOLNAME=2 ROTATE="0" MOREROWS="0"Defines unordered list of users that comprise group for purpose of assigning access rightsCOLNAME=3 ROTATE="0" MOREROWS="0"Organization  Organizational UnitCOLNAME=1 ROTATE="0" MOREROWS="0"ListCOLNAME=2 ROTATE="0" MOREROWS="0"Defines unordered set of names without implying security equivalenceCOLNAME=3 ROTATE="0" MOREROWS="0"Organization  Organizational UnitCOLNAME=1 ROTATE="0" MOREROWS="0"Message Routing GroupCOLNAME=2 ROTATE="0" MOREROWS="0"Represents group of messaging servers with direct connectivity for transferring messages between any two of themCOLNAME=3 ROTATE="0" MOREROWS="0"Organization  Organizational UnitCOLNAME=1 ROTATE="0" MOREROWS="0"Messaging ServerCOLNAME=2 ROTATE="0" MOREROWS="0"Represents server that picks up messages submitted by messaging applications or transferred from other messaging serverCOLNAME=3 ROTATE="0" MOREROWS="0"Organization  Organizational UnitCOLNAME=1 ROTATE="0" MOREROWS="0"NetWare ServerCOLNAME=2 ROTATE="0" MOREROWS="0"Represents server that provides file and other servicesCOLNAME=3 ROTATE="0" MOREROWS="0"Organization  Organizational UnitCOLNAME=1 ROTATE="0" MOREROWS="0"OrganizationCOLNAME=2 ROTATE="0" MOREROWS="0"Defines organization within networkCOLNAME=3 ROTATE="0" MOREROWS="0"Country, Root, or Locality levelCOLNAME=1 ROTATE="0" MOREROWS="0"Organizational RoleCOLNAME=2 ROTATE="0" MOREROWS="0"Defines position or role within organization for purpose of assigning access rightsCOLNAME=3 ROTATE="0" MOREROWS="0"Organization  Organizational Unit COLNAME=1 ROTATE="0" MOREROWS="0"Organizational UnitCOLNAME=2 ROTATE="0" MOREROWS="0"Defines subdivision within organization to contain objectsCOLNAME=3 ROTATE="0" MOREROWS="0"Organization  Organizational UnitCOLNAME=1 ROTATE="0" MOREROWS="0"Print Server COLNAME=2 ROTATE="0" MOREROWS="0"Represents network print serverCOLNAME=3 ROTATE="0" MOREROWS="0"Organization  Organizational UnitCOLNAME=1 ROTATE="0" MOREROWS="0"Printer COLNAME=2 ROTATE="0" MOREROWS="0"Represents physical printing device on networkCOLNAME=3 ROTATE="0" MOREROWS="0"Organization  Organizational UnitCOLNAME=1 ROTATE="0" MOREROWS="0"ProfileCOLNAME=2 ROTATE="0" MOREROWS="0"Specifies login script used by several usersCOLNAME=3 ROTATE="0" MOREROWS="0"Organization  Organizational UnitCOLNAME=1 ROTATE="0" MOREROWS="0"QueueCOLNAME=2 ROTATE="0" MOREROWS="0"Represents batch processing queue for printing on networkCOLNAME=3 ROTATE="0" MOREROWS="0"Organization  Organizational UnitCOLNAME=1 ROTATE="0" MOREROWS="0"UserCOLNAME=2 ROTATE="0" MOREROWS="0"Represents user on networkCOLNAME=3 ROTATE="0" MOREROWS="0"Organization  Organizational UnitCOLNAME=1 ROTATE="0" MOREROWS="0"VolumeCOLNAME=2 ROTATE="0" MOREROWS="0"Represents physical volume within NetWare file serverCOLNAME=3 ROTATE="0" MOREROWS="0"Organization  Organizational UnitPAGENUM=140 ID="BP141"RENDERAS="SECT1"ID="FM84329"NDS 
Object 
Classes and Their PropertiesThis section lists the most common NDS object classes and the properties associated with each.LABEL="A-2" PGWIDE=0 TOCENTRY="1" Object Class and PropertiesCOLS=3 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="9*"COLNAME=2 COLWIDTH="12*"COLNAME=3 COLWIDTH="13*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"Object ClassCOLNAME=2 ROTATE="0" MOREROWS="0"PropertiesCOLNAME=3 ROTATE="0" MOREROWS="0"VALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"AFP ServerCOLNAME=2 ROTATE="0" MOREROWS="0"ACL Account Balance Allow Unlimited Credit Back Link Bindery Property CN Descriptions Full Name Host Device L Minimum Account Balance Network Address OCOLNAME=3 ROTATE="0" MOREROWS="0"Object Class OU Private Key Public Key Resource  See Also Security Equals To Security Flags Serial Number Status Supported Connections User VersionCOLNAME=1 ROTATE="0" MOREROWS="0"AliasCOLNAME=2 ROTATE="0" MOREROWS="0"ACL Aliased Object Name Back LinkCOLNAME=3 ROTATE="0" MOREROWS="0"Bindery Property Object ClassCOLNAME=1 ROTATE="0" MOREROWS="0"Bindery ObjectCOLNAME=2 ROTATE="0" MOREROWS="0"ACL Back LinkBindery Object Restrictions Bindery PropertyCOLNAME=3 ROTATE="0" MOREROWS="0"Bindery Type CNObject ClassCOLNAME=1 ROTATE="0" MOREROWS="0"Bindery QueueCOLNAME=2 ROTATE="0" MOREROWS="0"ACL Back Link Bindery Property Bindery Type CN Description Device Host Resource Name Host Server LCOLNAME=3 ROTATE="0" MOREROWS="0"Network Address O Object Class Operator OU Queue Directory See Also Server User VolumeCOLNAME=1 ROTATE="0" MOREROWS="0"ComputerCOLNAME=2 ROTATE="0" MOREROWS="0"ACLBack Link Bindery Property CN Description L Network Address OCOLNAME=3 ROTATE="0" MOREROWS="0"Object ClassOperatorOUOwnerSee AlsoSerial NumberServerStatusCOLNAME=1 ROTATE="0" MOREROWS="0"CountryCOLNAME=2 ROTATE="0" MOREROWS="0"ACLBack LinkBindery PropertyCOLNAME=3 ROTATE="0" MOREROWS="0"CDescriptionObject ClassCOLNAME=1 ROTATE="0" MOREROWS="0"Directory MapCOLNAME=2 ROTATE="0" MOREROWS="0"ACLBack LinkBindery PropertyCNDescriptionHost ResourceHost ServerCOLNAME=3 ROTATE="0" MOREROWS="0"LNameOObject ClassOUPathSee AlsoCOLNAME=1 ROTATE="0" MOREROWS="0"External EntityCOLNAME=2 ROTATE="0" MOREROWS="0"ACLAuthority RevocationBack LinkBindery PropertyCA Private KeyCA Public KeyCertificate RevocationCertificate Validity IntervalCNCross Certificate PairDescriptionE-Mail AddressExternal NameFacsimile Telephone NumberGroup MembershipCOLNAME=3 ROTATE="0" MOREROWS="0"LLast Referenced TimeObituaryObject ClassOUPhysical Delivery Office NamePostal AddressPostal CodeReferenceRevisionSSASee AlsoTitleCOLNAME=1 ROTATE="0" MOREROWS="0"GroupCOLNAME=2 ROTATE="0" MOREROWS="0"ACLBack LinkBindery PropertyCNDescriptionE-Mail AddressFull NameGIDLLogin ScriptCOLNAME=3 ROTATE="0" MOREROWS="0"Mailbox IDMailbox LocationMemberOObject ClassOUOwnerProfileProfile MembershipSee AlsoCOLNAME=1 ROTATE="0" MOREROWS="0"ListCOLNAME=2 ROTATE="0" MOREROWS="0"ACLAuthority RevocationBack LinkBindery PropertyCA Private KeyCA Public KeyCertificate RevocationCertificate Validity IntervalCNCross Certificate PairDescriptionLCOLNAME=3 ROTATE="0" MOREROWS="0"Last Referenced TimeMailbox IDMemberOObituaryObject ClassOUOwnerReferenceRevisionSee AlsoCOLNAME=1 ROTATE="0" MOREROWS="0"Message Routing GroupCOLNAME=2 ROTATE="0" MOREROWS="0"ACLAuthority RevocationBack LinkBindery PropertyCA Private KeyCA Public KeyCertificate RevocationCertificate Validity IntervalCNCross Certificate PairDescriptionE-Mail AddressFull NameGIDLCOLNAME=3 ROTATE="0" MOREROWS="0"Last Referenced TimeLogin ScriptMailbox IDMailbox LocationMemberOObituaryObject ClassOUOwnerProfileProfile MembershipReferenceRevisionSee AlsoCOLNAME=1 ROTATE="0" MOREROWS="0"Messaging ServerCOLNAME=2 ROTATE="0" MOREROWS="0"Account BalanceACLAllow Unlimited CreditAuthority RevocationBack LinkBindery PropertyCA Private KeyCA Public KeyCertificate RevocationCertificate Validity IntervalCNCross Certificate PairDescriptionFull NameHost DeviceLLast Referenced TimeMessage Routing GroupMessaging Database LocationCOLNAME=3 ROTATE="0" MOREROWS="0"Messaging Server TypeMinimum Account BalanceNetwork AddressOObituaryObject ClassOUPostmasterPrivate KeyPublic KeyReferenceResourceRevisionSecurity Equals ToSecurity FlagsSee AlsoStatusSupported ServicesUser VersionCOLNAME=1 ROTATE="0" MOREROWS="0"NCP ServerCOLNAME=2 ROTATE="0" MOREROWS="0"Account BalanceACLAllow Unlimited CreditBack LinkBindery PropertyCNDS RevisionFull NameHost DeviceLMessaging ServerMinimum Account BalanceNetwork AddressOCOLNAME=3 ROTATE="0" MOREROWS="0"Object ClassOperatorOUPrivate KeyPublic KeyResourceSee AlsoSecurity Equals ToSecurity FlagsStatusSupported ServicesUserVersionCOLNAME=1 ROTATE="0" MOREROWS="0"OrganizationCOLNAME=2 ROTATE="0" MOREROWS="0"ACLBack LinkBindery PropertyDescriptionDetect IntruderE-Mail AddressFacsimile Telephone NumberIntruder Attempt Reset IntervalIntruder Lockout Reset IntervalLLockout After DetectionLogin Intruder LimitLogin ScriptMailbox IDCOLNAME=3 ROTATE="0" MOREROWS="0"Mailbox LocationNNS DomainOObject ClassPhysical Delivery Office NamePostal AddressPostal CodePostal Office BoxPrint Job ConfigurationPrinter ControlSSASee AlsoTelephone NumberCOLNAME=1 ROTATE="0" MOREROWS="0"Organizational RoleCOLNAME=2 ROTATE="0" MOREROWS="0"ACLBack LinkBindery ProperlyCNDescriptionE-Mail AddressFacsimile Telephone NumberLMailbox IDMailbox LocationObject ClassCOLNAME=3 ROTATE="0" MOREROWS="0"OUPhysical Delivery Office NamePostal AddressPostal CodePostal Office BoxRole OccupantSSASee AlsoTelephone NumberCOLNAME=1 ROTATE="0" MOREROWS="0"Organizational UnitCOLNAME=2 ROTATE="0" MOREROWS="0"ACLBack LinkBindery PropertyDescriptionDetect IntruderE-Mail AddressFacsimile Telephone NumberIntruder Attempt Reset IntervalIntruder Lockout OULLockout After DetectionLogin Intruder LimitLogin ScriptMailbox IDCOLNAME=3 ROTATE="0" MOREROWS="0"Mailbox LocationNNS DomainObject ClassPhysical Delivery Office NamePostal AddressPostal CodePostal Office BoxPrint Job ConfigurationPrinter ControlReset IntervalSSASee AlsoTelephone NumberCOLNAME=1 ROTATE="0" MOREROWS="0"Print ServerCOLNAME=2 ROTATE="0" MOREROWS="0"Account BalanceACLAllow Unlimited CreditBack LinkBindery PropertyCNDescriptionFull NameHost DeviceLMinimum Account BalanceNetwork AddressOObject ClassCOLNAME=3 ROTATE="0" MOREROWS="0"OperatorOUPrintPrivate KeyPublic KeyResourceSAP NameSecurity Equals ToSecurity FlagsSee AlsoStatusUserVersionCOLNAME=1 ROTATE="0" MOREROWS="0"PrinterCOLNAME=2 ROTATE="0" MOREROWS="0"ACLBack LinkBindery PropertyCartridgeCNDefault QueueDescriptionHost DeviceLMemoryNetwork AddressNetwork Address RestrictionsNotify COLNAME=3 ROTATE="0" MOREROWS="0"OObject ClassOperatorOUOwnerPage Description LanguagePrint ServerPrinter ConfigurationQueueSee AlsoSerial NumberStatusSupported TypefacesCOLNAME=1 ROTATE="0" MOREROWS="0"ProfileCOLNAME=2 ROTATE="0" MOREROWS="0"ACLBack LinkBindery PropertyCNDescriptionLCOLNAME=3 ROTATE="0" MOREROWS="0"Login ScriptOObject ClassOUSee AlsoCOLNAME=1 ROTATE="0" MOREROWS="0"QueueCOLNAME=2 ROTATE="0" MOREROWS="0"ACLBack LinkBindery PropertyCNDescriptionDeviceHost Resource NameHost ServerLNetwork AddressCOLNAME=3 ROTATE="0" MOREROWS="0"OObject ClassOperatorOUQueue DirectorySee AlsoServerUserVolumeCOLNAME=1 ROTATE="0" MOREROWS="0"UnknownCOLNAME=2 ROTATE="0" MOREROWS="0"ACLBack LinkCOLNAME=3 ROTATE="0" MOREROWS="0"Bindery PropertyObject ClassCOLNAME=1 ROTATE="0" MOREROWS="0"UserCOLNAME=2 ROTATE="0" MOREROWS="0"Account BalanceACLAllow Unlimited CreditBack LinkBindery PropertyCNDescriptionE-Mail AddressFacsimile Telephone NumberFull NameGenerational QualifierGiven NameGroup MembershipHigher PrivilegesHome DirectoryInitialsLLanguageLast Login TimeLocked By IntruderLogin Allowed Time MapLogin DisabledLogin Expiration TimeLogin Grace LimitLogin Grace RemainingLogin Intruder AddressLogin Intruder AttemptsLogin Intruder Reset TimeLogin Maximum SimultaneousLogin ScriptLogin TimeMailbox IDMailbox LocationMessage ServerCOLNAME=3 ROTATE="0" MOREROWS="0"Minimum Account BalanceNetwork AddressNetwork Address RestrictionsObject ClassOUPassword Allow ChangePassword Expiration IntervalPassword Expiration TimePassword Minimum LengthPassword RequiredPassword Unique RequiredPasswords UsedPhysical Delivery Office NamePostal AddressPostal CodePostal Office BoxPrint Job ConfigurationPrinter ControlPrivate KeyProfileProfile MembershipPublic KeySSASecurity Equals ToSecurity FlagsSee AlsoServer HoldsSurnameTelephone NumberTitleType Creator MapUIDCOLNAME=1 ROTATE="0" MOREROWS="0"VolumeCOLNAME=2 ROTATE="0" MOREROWS="0"ACLBack LinkBindery PropertyCNDescriptionHost Resource NameHost ServerCOLNAME=3 ROTATE="0" MOREROWS="0"LOObject ClassOUSee AlsoStatusPAGENUM=148 ID="BP142"LABEL="B"PAGENUM=149 ID="BP143"ID="FM37385"Referencing and Using Leaf ObjectsRENDERAS="SECT1"OverviewThis appendix introduces the leaf objects available in the NetWare® Directory ServicesTM architecture.The following topics are discussed on the indicated pages:COLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="22*"COLNAME=2 COLWIDTH="4*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"TopicCOLNAME=2 ROTATE="0" MOREROWS="0"PageVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM12354"User-Related Leaf ObjectsCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM12354"150COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM61996"Server-Related Leaf ObjectsCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM61996"152COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM58718"Printer-Related Leaf ObjectsCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM58718"153COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM76558"Messaging-Related Leaf ObjectsCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM76558"154COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM19091"Informational Leaf ObjectsCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM19091"155COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM64027"Miscellaneous Leaf ObjectsCOLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM64027"156Directory leaf objects are objects that do not contain any other objects. These represent actual network entities such as users, servers, printers, computers, etc. You create leaf objects within a container object.PAGENUM=150 ID="BP144"RENDERAS="SECT1"ID="FM12354"User-Related 
Leaf 
ObjectsThis section lists the available leaf objects that are related to network users and groups, explains what each is used for, and indicates when to use each.LABEL="B-1" PGWIDE=0 TOCENTRY="1" User-Related Leaf Object Name, Function, and UsageCOLS=3 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="7*"COLNAME=2 COLWIDTH="13*"COLNAME=3 COLWIDTH="13*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"Leaf ObjectCOLNAME=2 ROTATE="0" MOREROWS="0"FunctionCOLNAME=3 ROTATE="0" MOREROWS="0"Usage SituationVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"GroupCOLNAME=2 ROTATE="0" MOREROWS="0"Assigns a name to a list of User objects that can be located anywhere in the Directory tree.COLNAME=3 ROTATE="0" MOREROWS="0"Many User objects need the same trustee assignments. Rather than making many trustee assignments, make just one trustee assignment to all users who belong to the group by making the trustee assignment to the Group object itself.COLNAME=1 ROTATE="0" MOREROWS="0"Message Routing GroupCOLNAME=2 ROTATE="0" MOREROWS="0"Represents a group of messaging servers that can transfer messages directly with each other.COLNAME=3 ROTATE="0" MOREROWS="0"Multiple messaging servers need to communicate with one another.COLNAME=1 ROTATE="0" MOREROWS="0"Organizational RoleCOLNAME=2 ROTATE="0" MOREROWS="0"Defines a position or role within an organization.COLNAME=3 ROTATE="0" MOREROWS="0"You want to assign rights to a particular position rather than to the person who occupies that position. The occupant might change frequently, but the responsibilities of the position do not.You can assign any user to be an occupant of an Organizational Role object because every occupant receives the same rights granted to the Organizational Role object.COLNAME=1 ROTATE="0" MOREROWS="0"ProfileCOLNAME=2 ROTATE="0" MOREROWS="0"Contains a profile login script. When the Profile object is listed as a User object's property, the Profile object's login script is executed when that User object logs in.The profile login script executes after the system login script and before the user login script.COLNAME=3 ROTATE="0" MOREROWS="0"A set of users need to share common login script commands but are not located in the same Directory tree container or are a subset of users in the same container.COLNAME=1 ROTATE="0" MOREROWS="0"UserCOLNAME=2 ROTATE="0" MOREROWS="0"Represents a person who uses the network.In the User object properties, login restrictions, intruder detection limits, password and password restrictions, security equivalences, etc., can be set.COLNAME=3 ROTATE="0" MOREROWS="0"Required for every user who needs to log in to the network.When you create a User object, you can create a home directory for that user who then has default rights to that home directory.When you create User objects, you can also choose to apply a user template to the users that provides default property values.For users who have NetWare 4.1 workstations, you can create the User objects anywhere in the Directory tree, but the users must know their context in order to log in. Create User objects in the container where the users typically log in.For users who have other workstations, create the User objects in the container where the bindery services context is set for the server that they need to log in to.Bindery-based users do not need to know their context because they log in to the server rather than to the Directory tree.PAGENUM=152 ID="BP145"RENDERAS="SECT1"ID="FM61996"Server-Related 
Leaf 
ObjectsThis section lists the available leaf objects that are related to NetWare servers and volumes, explains what each is used for, and indicates when to use each.LABEL="B-2" PGWIDE=0 TOCENTRY="1" Server-Related Leaf Object Name, Function, and UsageCOLS=3 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="6*"COLNAME=2 COLWIDTH="13*"COLNAME=3 COLWIDTH="15*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"Leaf ObjectCOLNAME=2 ROTATE="0" MOREROWS="0"FunctionCOLNAME=3 ROTATE="0" MOREROWS="0"Usage SituationVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Directory MapCOLNAME=2 ROTATE="0" MOREROWS="0"Represents a particular directory in the file system. Directory Map objects can be especially useful in login scripts by pointing to directories that contain applications or other frequently used files.COLNAME=3 ROTATE="0" MOREROWS="0"You want to avoid making changes to many login scripts when the location of applications changes. Instead, you change only the Directory Map object.For example, you have a directory that contains DOS 5.0. You could map a search drive to that directory in any login scripts you create.But if you later upgrade to DOS 6.0 and rename the directory, you would have to change the mapping in every login script where that search mapping appears.By using a Directory Map object instead, you would need to change the information in only that one object.COLNAME=1 ROTATE="0" MOREROWS="0"NCP ServerCOLNAME=2 ROTATE="0" MOREROWS="0"Represents a server running NetWare on your network.In the NetWare Server object's properties, you can store information about the server---such as its physical location and what services it provides.In addition, the NetWare Server object affects the network in that it is referred to by several other objects.COLNAME=3 ROTATE="0" MOREROWS="0"Automatically created during server installation. It must exist for a server's file systems and volumes to be accessible.If you have a bindery-based server, create this object to be able to access that server's volumes. When you create this object for a bindery-based server, that server must be running.COLNAME=1 ROTATE="0" MOREROWS="0"VolumeCOLNAME=2 ROTATE="0" MOREROWS="0"Represents a physical volume on the network.In the Volume object's properties, you can store identification information---such as the Host server, volume location, etc. You can also set restrictions for use of the volume, such as space limits for users.COLNAME=3 ROTATE="0" MOREROWS="0"Optional for every physical volume on the network.Automatically created for every physical volume during NetWare 4.1 server installation.Can be used to display information about the directories and files on that volume.PAGENUM=153 ID="BP146"RENDERAS="SECT1"ID="FM58718"Printer-Related 
Leaf 
ObjectsThis section lists the available leaf objects that are related to NetWare print services, explains what each is used for, and indicates when to use each.These objects are created and controlled using the NetWare print utilities.LABEL="B-3" PGWIDE=0 TOCENTRY="1" Printer-Related Leaf Object Name, Function, and UsageCOLS=3 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="5*"COLNAME=2 COLWIDTH="12*"COLNAME=3 COLWIDTH="16*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"Leaf ObjectCOLNAME=2 ROTATE="0" MOREROWS="0"FunctionCOLNAME=3 ROTATE="0" MOREROWS="0"Usage SituationVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Print QueueCOLNAME=2 ROTATE="0" MOREROWS="0"Represents a print queue on the network.COLNAME=3 ROTATE="0" MOREROWS="0"Required for every print queue on the network.It cannot be created with NETADMIN.See BOOK="printenu" COLLECTION="nw41"Print Services for more information.COLNAME=1 ROTATE="0" MOREROWS="0"Print ServerCOLNAME=2 ROTATE="0" MOREROWS="0"Represents a network print server.COLNAME=3 ROTATE="0" MOREROWS="0"Required for every print server on the network.It cannot be created with NETADMIN.See BOOK="printenu" COLLECTION="nw41"Print Services for more information.COLNAME=1 ROTATE="0" MOREROWS="0"PrinterCOLNAME=2 ROTATE="0" MOREROWS="0"Represents a physical printing device on the network.COLNAME=3 ROTATE="0" MOREROWS="0"Required for every printer on the network.It cannot be created with NETADMIN.See 
BOOK="printenu" COLLECTION="nw41"Print Services for more information.PAGENUM=154 ID="BP147"RENDERAS="SECT1"ID="FM76558"Messaging-Related 
Leaf 
ObjectsThis section lists the available leaf objects that are related to the NetWare Message Handling ServiceTM (MHS) system, explains what each is used for, and indicates when to use each.These objects are created and controlled using the MHS utilities.LABEL="B-4" PGWIDE=0 TOCENTRY="1" Messaging-Related Leaf Object Name, Function, and UsageCOLS=3 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="7*"COLNAME=2 COLWIDTH="12*"COLNAME=3 COLWIDTH="14*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"Leaf ObjectCOLNAME=2 ROTATE="0" MOREROWS="0"FunctionCOLNAME=3 ROTATE="0" MOREROWS="0"Usage SituationVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Distribution ListCOLNAME=2 ROTATE="0" MOREROWS="0"Represents a list of mail recipients.COLNAME=3 ROTATE="0" MOREROWS="0"You want to simplify sending mail.For example, you could create a Distribution List object called "Recreation Committee."Then to send a message to all the members in this committee, simply address the message to "Recreation Committee" rather than to each member individually.COLNAME=1 ROTATE="0" MOREROWS="0"External EntityCOLNAME=2 ROTATE="0" MOREROWS="0"Represents a non-native NDS object that is imported into NDS or registered in NDS.The NetWare MHSTM system uses this object to represent users from bindery-based directories to provide an integrated address book for sending mail.COLNAME=3 ROTATE="0" MOREROWS="0"If your messaging environment contains non-MHS servers (such as SMTP hosts, SNADS nodes, or X.400 MTAs), you could add users and lists from these servers to your NetWare database as External Entities.This would add them to the address books of your messaging applications. Then, when addressing messages, local users can choose non-MHS users and lists from a directory list.COLNAME=1 ROTATE="0" MOREROWS="0"Message Routing GroupCOLNAME=2 ROTATE="0" MOREROWS="0"Represents a group of messaging servers that can transfer messages directly among each other.COLNAME=3 ROTATE="0" MOREROWS="0"You have multiple messaging servers that need to communicate with each other.COLNAME=1 ROTATE="0" MOREROWS="0"Messaging ServerCOLNAME=2 ROTATE="0" MOREROWS="0"Represents a messaging server that resides on a NetWare server.COLNAME=3 ROTATE="0" MOREROWS="0"Automatically created in the Directory tree during NetWare MHS installation on a NetWare server.PAGENUM=155 ID="BP148"RENDERAS="SECT1"ID="FM19091"Informational 
Leaf 
ObjectsThis section lists the available leaf objects that exist only to store information about network resources, explains what each is used for, and indicates when to use each.LABEL="B-5" PGWIDE=0 TOCENTRY="1" Informational Leaf Object Name, Function, and UsageCOLS=3 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="5*"COLNAME=2 COLWIDTH="14*"COLNAME=3 COLWIDTH="14*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"Leaf ObjectCOLNAME=2 ROTATE="0" MOREROWS="0"FunctionCOLNAME=3 ROTATE="0" MOREROWS="0"Usage SituationVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"AFP ServerCOLNAME=2 ROTATE="0" MOREROWS="0"Represents an AppleTalk File Protocol- based server that is operating as a node on your NetWare network---and possibly also acting as a NetWare router to, and as the AppleTalk server for, several Apple Macintosh workstations.COLNAME=3 ROTATE="0" MOREROWS="0"You have an AFP server that you need represented on the network.Use this object to store information about the server---such as its description, location, and network address.This object has no effect on the network operations; it only stores information about the AFP server.COLNAME=1 ROTATE="0" MOREROWS="0"ComputerCOLNAME=2 ROTATE="0" MOREROWS="0"Represents a nonserver network computer, such as a workstation or a router.COLNAME=3 ROTATE="0" MOREROWS="0"Use this object to store information about a nonserver computer, such as its network address, its serial number, or the person it's assigned to.This object has no effect on network operations; it only stores information about the computer.PAGENUM=156 ID="BP149"RENDERAS="SECT1"ID="FM64027"Miscellaneous 
Leaf 
ObjectsThis section lists the remaining available leaf objects, explains what each is used for, and indicates when to use each.LABEL="B-6" PGWIDE=0 TOCENTRY="1" Miscellaneous Leaf Object Name, Function, and UsageCOLS=3 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="6*"COLNAME=2 COLWIDTH="13*"COLNAME=3 COLWIDTH="14*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"Leaf ObjectCOLNAME=2 ROTATE="0" MOREROWS="0"FunctionCOLNAME=3 ROTATE="0" MOREROWS="0"Usage SituationVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"AliasCOLNAME=2 ROTATE="0" MOREROWS="0"Points to another object in the Directory tree and makes it appear as if that object actually exists in the Directory tree where the Alias object is.Although an object appears both where it was actually created and where an Alias referring to it was created, only one copy of the object really exists.If you delete or rename an Alias, the Alias itself (not the object it is pointing to) is deleted or renamed.COLNAME=3 ROTATE="0" MOREROWS="0"You want to allow access to an object that is in another context.For example, you can use an Alias to represent a resource, such as a special printer, that most users in the tree need to access.Also, when you move or rename a container object in a Directory tree, you have the option of creating an Alias in place of the moved or renamed object. If you select this option, NetWare Administrator automatically creates the Alias for you and assigns it the same name as the original object.Creating an alias in place of a moved or renamed container object allows users to continue logging in to the network and to see the container object (and the objects it contains) in its original Directory location.COLNAME=1 ROTATE="0" MOREROWS="0"Bindery ObjectCOLNAME=2 ROTATE="0" MOREROWS="0"Represents an object placed in the Directory tree by an upgrade or migration utility.COLNAME=3 ROTATE="0" MOREROWS="0"It is used by NDS only to provide backward compatibility with bindery- based utilities.COLNAME=1 ROTATE="0" MOREROWS="0"Bindery QueueCOLNAME=2 ROTATE="0" MOREROWS="0"Represents a queue placed in the Directory tree by an upgrade or migration utility.COLNAME=3 ROTATE="0" MOREROWS="0"It is used by NDS only to provide backward compatibility with bindery- based utilities.COLNAME=1 ROTATE="0" MOREROWS="0"UnknownCOLNAME=2 ROTATE="0" MOREROWS="0"Represents an NDS object that has been invalidated and cannot be identified as belonging to any of the other object classes.COLNAME=3 ROTATE="0" MOREROWS="0"Directory Services utilities rename objects that they do not recognize. Delete or re-create the correct object for the resource.LABEL="C"PAGENUM=157 ID="BP150"ID="FM23526"Creating a Standards Document for NDS Object Classes and PropertiesRENDERAS="SECT1"IDXID="w2893"BOOK="_idx" COLLECTION="nw41" TIDREF="i2605"
OverviewIDXID="w2894"BOOK="_idx" COLLECTION="nw41" TIDREF="i1799"This appendix provides you with guidelines and samples for creating a 
standards 
document for objects in a NetWare® Directory ServiceTM database.The following topics are discussed on the indicated pages:COLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="22*"COLNAME=2 COLWIDTH="4*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"TopicCOLNAME=2 ROTATE="0" MOREROWS="0"PageVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM33791"Sample Object Naming Standards COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM33791"158COLNAME=1 ROTATE="0" MOREROWS="0"IDREF="FM10172"Sample Object Property Standards COLNAME=2 ROTATE="0" MOREROWS="0"IDREF="FM10172"159Using a consistent naming 
standard makes current and future implementation of NDS easier and more efficient. A naming standard helps ensure that the Directory objects you create are intuitive and useful to users and groups on your network.An effective naming standard document includes a list of objects to be implemented, the format of each property value, and the intended use of each property.There is no preset naming standard. Different organizations can adopt different naming standards based on both their requirements and their existing configurations.The naming standard in this appendix is offered as an example that works well for any organization, regardless of size, but that can be modified and adjusted to better meet the requirements of individual organizations.PAGENUM=158 ID="BP151"RENDERAS="SECT1"ID="FM33791"Sample 
Object Naming IDXID="w2895"BOOK="_idx" COLLECTION="nw41" TIDREF="i2605"
StandardsIn our examples, we have tried to create relatively short names. This helps keep the context short and reduces data traffic as NDS searches for specific objects.If you have already chosen a different format to name users or servers in an existing NetWare 3TM network, you might want to use those names as a starting point as you implement your NetWare 4TM network.LABEL="C-1" PGWIDE=0 TOCENTRY="1" Object Name and Suggested StandardsCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="10*"COLNAME=2 COLWIDTH="25*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"Object COLNAME=2 ROTATE="0" MOREROWS="0"Suggested StandardsVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Directory MapCOLNAME=2 ROTATE="0" MOREROWS="0"IDXID="w2896"BOOK="_idx" COLLECTION="nw41" TIDREF="i2605"
Name Directory Map objects after the application or process being mapped. For example, WordPerfect® application files would be mapped with a Directory Map named DM-WP. COLNAME=1 ROTATE="0" MOREROWS="0"GroupCOLNAME=2 ROTATE="0" MOREROWS="0"Base group names on the function performed by the group. For example, a word processing group could be named GP-WP.COLNAME=1 ROTATE="0" MOREROWS="0"Organization and 
Organizational UnitCOLNAME=2 ROTATE="0" MOREROWS="0"Choose your Organization and Organizational Unit names based on your organization's abbreviations of unit names.For example, an organization with the name WIDGET, with a business unit called ASG, and a division called NCS would set a context in the Directory tree as OU=NCS.OU=ASG.O=WIDGET.COLNAME=1 ROTATE="0" MOREROWS="0"Organizational RoleCOLNAME=2 ROTATE="0" MOREROWS="0"For security purposes, always use the Organizational Role object to grant administrative rights. The Organizational Role object can be used in any situation where changes in personnel might be frequent or when an error in controlling rights would pose a grave security risk to the organization.For example, a container administrative organizational role could be named OR-NCSADMIN.COLNAME=1 ROTATE="0" MOREROWS="0"PrinterCOLNAME=2 ROTATE="0" MOREROWS="0"Use a three-character location code (such as the airline city code) followed by the mail stop and the printer type for a printrer name.For example, a LaserJet 4 Si would be named PRV-E232-LJ4SI. A duplex LaserJet 4 Si in the same location would be named PRV-E232- LJ4SID.COLNAME=1 ROTATE="0" MOREROWS="0"Print Queue and  
Print ServerCOLNAME=2 ROTATE="0" MOREROWS="0"A print queue and print server name should start with the characters PS and PQ. The rest of the name should contain the department server name and a number for each print server or print queue.For example, a print server could be named PS-NCS001-1 and service print queues named PQ-NCS001-1 and PQ-NCS001-2.COLNAME=1 ROTATE="0" MOREROWS="0"ProfileCOLNAME=2 ROTATE="0" MOREROWS="0"Base profile names on the function supplied by the profile. For example, the profile in a container providing all the required mappings for the departmental users could be named PF-NCSMAP.COLNAME=1 ROTATE="0" MOREROWS="0"ServerCOLNAME=2 ROTATE="0" MOREROWS="0"Use a set of three-character codes (for the location, division, and server) for a server name. Use the airline city code as the three-character location code. This code is widely recognized because all commercial airports in the world have one. Therefore, a server located in Provo and used by NCS would be named PRV-NCS-001.Server names must be unique. So if you have one server named ACCTG, you cannot have another server with that same name anywhere on the network. (This is a restriction of SAP rather than NDS.)COLNAME=1 ROTATE="0" MOREROWS="0"UserCOLNAME=2 ROTATE="0" MOREROWS="0"Restrict usernames to eight characters to match the E-mail name length. The E-mail name consists of the first letter of the first name, followed by the last name. For example, Bill Smith becomes BSMITH.If more than one person with the same first initial and last name exists, add the middle initial as the second character of the name. For example, Bill Smith could be BSMITH and Beverly Lynn Smith could be BLSMITH.PAGENUM=159 ID="BP152"RENDERAS="SECT1"ID="FM10172"Sample 
Object 
Property StandardsFollowing is a sample format that you might use to allow all network supervisors in your organization to enter object names and property information in a consistent manner.The following examples describe possible standards used for User objects and Organization objects. You should ultimately define standards for all objects.PAGENUM=160 ID="BP153"RENDERAS="SECT2"User Object IDXID="w2897"BOOK="_idx" COLLECTION="nw41" TIDREF="i1799"
Property 
StandardsUse the following information standards in the User object properties.RENDERAS="SECT3"Account 
Restrictions PropertiesCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="10*"COLNAME=2 COLWIDTH="15*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"PropertyCOLNAME=2 ROTATE="0" MOREROWS="0"Suggested StandardsVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Login RestrictionsCOLNAME=2 ROTATE="0" MOREROWS="0"Determined by the security policy of your organization.COLNAME=1 ROTATE="0" MOREROWS="0"Login Time RestrictionsCOLNAME=2 ROTATE="0" MOREROWS="0"No standard necessary.COLNAME=1 ROTATE="0" MOREROWS="0"Password RestrictionsCOLNAME=2 ROTATE="0" MOREROWS="0"Determined by the security policy of your organization.RENDERAS="SECT3"Environment IDXID="w2898"BOOK="_idx" COLLECTION="nw41" TIDREF="i1331"
PropertiesCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="9*"COLNAME=2 COLWIDTH="16*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"PropertyCOLNAME=2 ROTATE="0" MOREROWS="0"Suggested StandardsVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Default ServerCOLNAME=2 ROTATE="0" MOREROWS="0"Use the server that the user gets SEND messages from.COLNAME=1 ROTATE="0" MOREROWS="0"Home Directory COLNAME=2 ROTATE="0" MOREROWS="0"Enter both the Volume object name and the pathname.COLNAME=1 ROTATE="0" MOREROWS="0"LanguageCOLNAME=2 ROTATE="0" MOREROWS="0"Use the user's language.RENDERAS="SECT3"Identification IDXID="w2899"BOOK="_idx" COLLECTION="nw41" TIDREF="i1754"
Page PropertiesCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="10*"COLNAME=2 COLWIDTH="16*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"PropertyCOLNAME=2 ROTATE="0" MOREROWS="0"Suggested StandardsVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"DepartmentCOLNAME=2 ROTATE="0" MOREROWS="0"Use the department codes found in the company's telephone directory.COLNAME=1 ROTATE="0" MOREROWS="0"DescriptionCOLNAME=2 ROTATE="0" MOREROWS="0"No standard necessary.COLNAME=1 ROTATE="0" MOREROWS="0"E-Mail AddressCOLNAME=2 ROTATE="0" MOREROWS="0"Use the E-mail format found in the company's telephone directory.COLNAME=1 ROTATE="0" MOREROWS="0"FAX NumberCOLNAME=2 ROTATE="0" MOREROWS="0"Use the full FAX format found in the company's telephone directory.COLNAME=1 ROTATE="0" MOREROWS="0"Last NameCOLNAME=2 ROTATE="0" MOREROWS="0"Enter the last name, followed by a comma, followed by the first name and middle initial.Capitalize only the first letter or initial in each name.Example: Smith, John ACOLNAME=1 ROTATE="0" MOREROWS="0"LocationCOLNAME=2 ROTATE="0" MOREROWS="0"Use the building codes and other geographic information found in the company's telephone directory.COLNAME=1 ROTATE="0" MOREROWS="0"Login NameCOLNAME=2 ROTATE="0" MOREROWS="0"Use the first initial and last name of the user. In some cases, the user might have a name where the first initial and last name conflict with another user's. In this case, add a middle initial to distinguish the user. The company's E-mail format uses the appropriate names.COLNAME=1 ROTATE="0" MOREROWS="0"Other NameCOLNAME=2 ROTATE="0" MOREROWS="0"No standard necessary.COLNAME=1 ROTATE="0" MOREROWS="0"Telephone NumberCOLNAME=2 ROTATE="0" MOREROWS="0"Use the full telephone format found in the company's telephone directory.A telephone number can consist of the following information, separated by hyphens: 1. Outside code (for outside line)2. Access code (for long distance)3. Country code4. City code5. Area code6. Prefix number7. Main number 8. Extension    Note: If an extension is required, insert a space, rather than a hyphen, between the main number and the extension number. For example:    1-801-555-1234 7698COLNAME=1 ROTATE="0" MOREROWS="0"TitleCOLNAME=2 ROTATE="0" MOREROWS="0"Enter the user's current job title. If this person is an administrator for part of the tree, add ADMIN to the title.PAGENUM=162 ID="BP154"RENDERAS="SECT3"Postal IDXID="w2900"BOOK="_idx" COLLECTION="nw41" TIDREF="i3344"
Address PropertiesCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="10*"COLNAME=2 COLWIDTH="15*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"PropertyCOLNAME=2 ROTATE="0" MOREROWS="0"Suggested StandardsVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"Postal AddressCOLNAME=2 ROTATE="0" MOREROWS="0"Enter the user's default corporate postal address. Place the mail stop information in the "Post Office Box" field.Use the "Copy to label" to set the mailing label.Use the full name on the mailing label.PAGENUM=163 ID="BP155"RENDERAS="SECT2"Organization 
Object IDXID="w2901"BOOK="_idx" COLLECTION="nw41" TIDREF="i1799"
Property StandardsUse the following information standards in the Organization object properties.RENDERAS="SECT3"Identification IDXID="w2902"BOOK="_idx" COLLECTION="nw41" TIDREF="i1754"
Page PropertiesCOLS=2 CHAROFF="50" CHAR="" ALIGN="LEFT"COLNAME=1 COLWIDTH="8*"COLNAME=2 COLWIDTH="17*"VALIGN="BOTTOM"COLNAME=1 ROTATE="0" MOREROWS="0"PropertyCOLNAME=2 ROTATE="0" MOREROWS="0"Suggested StandardsVALIGN="TOP"COLNAME=1 ROTATE="0" MOREROWS="0"DescriptionCOLNAME=2 ROTATE="0" MOREROWS="0"Enter a brief description of the Organization's job functionality.COLNAME=1 ROTATE="0" MOREROWS="0"E-Mail AddressCOLNAME=2 ROTATE="0" MOREROWS="0"Use the E-mail address of the company or organization (such as an Internet address).COLNAME=1 ROTATE="0" MOREROWS="0"FAX NumberCOLNAME=2 ROTATE="0" MOREROWS="0"Use the full FAX format found in the company's telephone directory.COLNAME=1 ROTATE="0" MOREROWS="0"LocationCOLNAME=2 ROTATE="0" MOREROWS="0"Use the current location names found in the company's telephone directory. If the organization is located in different geographical areas, put all locations in the field.COLNAME=1 ROTATE="0" MOREROWS="0"NameCOLNAME=2 ROTATE="0" MOREROWS="0"Enter the full name of the Organization that is associated with this container.For example, instead of SED, enter "Systems Engineering Division".COLNAME=1 ROTATE="0" MOREROWS="0"Other NameCOLNAME=2 ROTATE="0" MOREROWS="0"No standard necessary.COLNAME=1 ROTATE="0" MOREROWS="0"Telephone NumberCOLNAME=2 ROTATE="0" MOREROWS="0"Use the full telephone format found in the company's telephone directory.A telephone number can consist of the following information, separated by hyphens: 1. Outside code (for outside line)2. Access code (for long distance)3. Country code4. City code5. Area code6. Prefix number7. Main number Extension    Note: If an extension is required, insert a space, rather than a hyphen, between the main number and the extension number. For example:    1-801-555-1234 7698PAGENUM=165 ID="BP156"GlossaryIDXID="w2903"BOOK="_idx" COLLECTION="nw41" TIDREF="i1607"
Access Control List (ACL)A list that contains information about an object describing which other objects can access it. It is a property of every object in the NetWare® Directory ServicesTM database. Trustees and the Inherited Rights Filter are contained in the ACL.Across-the-Wire migrationA method of upgrading using the NetWare Migration Utility. In an across-the-wire migration, data files are migrated across the network to the destination server. Add Self property right (A)Grants a trustee the right to add or remove itself as a value of the property. This right is used only for properties that contain object names as values, such as lists of group members or mailing lists.ADMIN User objectA User object that is created at installation. It has the Supervisor object right to all objects so that it can be used to create the Directory tree.AFP Server objectAn object that represents an AppleTalk Filing Protocol (AFP) server that allows workstations to share files and programs.Alias objectAn object that points to another object at a different location in the Directory tree. Use it to see an object that you need to use regularly but that is not located in the context that you normally work in.All Properties optionAn option you can choose in order to give a trustee specific property rights to all properties at once instead of assigning rights individually to each property. While property rights assigned individually to a property cannot be inherited, rights granted with the All Properties option flow down the Directory tree to objects below.authenticationA means of verifying that a user is authorized to use the network. Authentication works in combination with Access Control to provide network security.base schemaA set of defined object classes.IDREF="FM84514"See also object classes.binderyA network database in NetWare versions earlier than NetWare 4TM. The bindery contains definitions for entities such as users, groups, and workgroups.bindery contextThe container objects where bindery services is set.IDREF="FM24986"See also context.bindery services A feature of NetWare 4 that allows bindery-based utilities and clients to coexist with NetWare Directory Services on the network.Bindery objectAn object that was upgraded from a bindery-based server, but that cannot be identified. Bindery-based clients must use older NetWare utilities to access these objects through bindery emulation.branchA container object and all the objects it holds, which can include other container objects.Browse object right (B)Grants the right to see the object in the Directory tree. The name of the object is returned when a search is made that matches the object.child partitionA partition that has a Directory tree boundary immediately below another partition.common name (CN)The name of a leaf object, as displayed in the Directory tree.Compare property right (C) Allows a trustee to compare the value of a property with another value to see if they are equal. With the Compare right, an operation can return True or False, but you cannot see the value of the property.complete nameIDREF="FM74632"See Distinguished Name.Computer objectAn object that represents a computer on the network.container objectAn object that holds, or contains, other objects. Container objects are used to logically organize all other objects in the Directory tree. The three types of container objects are Country, Organization, and Organizational Unit.ID="FM24986"contextThe location of an object within its container in the Directory tree.Country object (C)An object that designates a country where your network resides and organizes other objects within the country.Create object right (C)Grants the right to create a new object below the designated object in the Directory tree. This right is available only for container objects.current contextYour current location in the Directory tree.CXA text workstation utility that allows you to change your current context in the Directory tree.Delete object right (D)Grants the right to delete the object from the Directory tree. To delete a container object, all subordinate objects must first be deleted.Directory databaseA database that maintains, stores, and manages directory objects that consist of categories of information, known as properties, and the data included in those properties.ID="FM19770"Directory schemaThe rules that define how the Directory tree is constructed. The schema define specific types of information that dictate the way information is stored in the Directory database.ID="FM13969"directory servicesDatabases of information with powerful facilities for storing, accessing, managing, and using diverse kinds of information about users and resources in computing environments.IDREF="FM76278"See also NetWare Directory Services (NDS).ID="FM64620"Directory treeA hierarchical structure of objects in the NetWare Directory Services database. The Directory tree includes container objects that are used to organize the network and leaf objects that represent resources.ID="FM51944"Directory tree nameA name of 1 to 32 characters assigned during installation to each Directory tree. It can contain upper- and lowercase letters, numbers, hyphens, and underscores, but no spaces or trailing underscores.ID="FM74632"Distinguished NameThe complete name, or path, from an object to the [Root] of the Directory tree.IDREF="FM35851"See also Relative Distinguished Name (RDN).distributed databaseDatabases that provide services to all network applications and users across disparate platforms including hosts, minicomputers, and network systems.DSREPAIRAn NLM program that repairs and corrects problems in the NetWare Directory Services database.effective rightsThe rights that an object can actually exercise to see or modify a particular directory, file, or object. An object's effective rights to a directory, file, or object are calculated by NetWare each time that object attempts an action.fault toleranceA means of protecting data by providing safeguards against hazardous events such as power outages or hard disk crashes.global loginAllows users to log in to the network rather than to individual servers, and to gain access to all network resources.graphical utilitiesAllow network supervisors to manage the network through MS Windows 3.x or OS/2 Presentation Manager*.Group objectA leaf object listing several User objects, used to allow collective (rather than individual) network administration.High Capacity Storage System (HCSS)Extends the storage capacity of a NetWare server by integrating an optical disk library, or jukebox, into the NetWare file system.HCSS moves files between faster low-capacity storage devices (the server's hard disk) and slower high-capacity devices (optical disks in a jukebox).inheritanceThe rights granted to a trustee by a trustee assignment. These rights apply to everything below the point where the trustee assignment is made, unless another explicit trustee assignment is made or the rights are blocked by an Inherited Rights Filter.ID="FM22221"Inherited Rights Filter (IRF)A filter that is part of every directory, file, and object, controlling which rights a trustee can inherit from parent directories and container objects.INSTALLAn NLM program used to initiate the installation of NetWare 4 software.internationalizationAllows adaptation of a network for use with multiple languages.IRFIDREF="FM22221"See Inherited Rights Filter (IRF).LANSee IDREF="FM34249"Local Area Network (LAN).LAN driverAn NLM program that understands and controls the network board. A LAN driver serves as a link between a station's operating system and the physical network parts.leaf objectAn object that doesn't contain any other objects. Leaf objects are located at the end of a branch in the Directory tree.ID="FM34249"local area network (LAN)A network located within a small area or common environment, such as in a building or a building complex.IDREF="FM38716"See also wide area network (WAN).login scriptA list of commands that are executed when a user logs in to the network. These commands organize the network environment.Three different login scripts can be executed when a user logs in: one from the user's immediate container object, one from a Profile object (if specified for the user), and one from the User object itself.master replicaThe replica that contains the first instance of partition information used to change the structure of the Directory in relation to that partition.name typeDistinguishes the type of object name of an object (such as O, OU, or CN).NCF fileA NetWare command file that can be used by the network supervisor to automate server commands.Two special NCF files (STARTUP.NCF and AUTOEXEC.NCF) can be used to add commands to a server's boot process. NCF files are comparable to DOS batch files.NDSIDREF="FM76278"See NetWare Directory Services (NDS).NETADMINA text utility that allows you to create objects and assign rights and properties.NetWare AdministratorA graphical utility that provides much of the same functionality as the text menu and command line utilities. However, with NetWare Administrator, you can perform most of the tasks in one utility.ID="FM76278"NetWare Directory Services (NDS)An object-oriented implementation of directory services that allows you to build sophisticated naming schemes and databases across network-wide resources. IDREF="FM13969"See also directory services.ID="FM22222"NetWare Loadable ModuleTM (NLM)A program you can load and unload from server memory while the server is running. NLMTM software are disk drivers, LAN drivers, name spaces, and other NetWare server management and enhancement utilities used by the operating system.NetWare serverA computer running the NetWare operating system software, regulating communications among the personal computers attached to it, and managing shared resources such as printers and volumes.networkA group of computers that can communicate with each other, share peripherals (such as hard disks and printers), and access remote hosts or other networks.NLMIDREF="FM22222"See NetWare Loadable Module (NLM).ID="FM37864"object Logical representations of network resources including users, groups, printers, volumes, computers, etc., that make up the Directory tree.Some objects represent physical entities while others represent logical entities such as groups and print queues.It is important to note that an object is a structure where information is stored. It is not the entity that it represents.IDREF="FM29084"See also property.ID="FM84514"object classesA defined list of objects such as servers, users, and print queues used by NDS.object rightsAccess rights to an object that are assigned to another object (which becomes a trustee of the object). Object rights don't affect properties or property rights, with the exception of the Supervisor object right, which also allows access to all property values.Organization object (O)A container object that helps organize other objects in the Directory tree.Organizational Role objectA leaf object that defines a position or role within an organization. It is used to specify a position that can be filled by different people, such as a Team Leader or Vice President.ID="FM76873"Organizational Unit object (OU)A container object, a level below the Organization object, that helps to further organize other objects in the Directory tree.parent partitionThe original partition. A partition that has a boundary in the Directory tree above another partition.partial nameIDREF="FM35851"See Relative Distinguished Name (RDN).partitionA logical division of the NetWare Directory Services database. A partition forms a distinct unit of data in the Directory tree that is used to store and replicate Directory information.Each partition consists of a container object, all objects contained in it, and data about those objects. Partitions do not include any information about the file system or the directories and files contained there.PARTMGRThe text workstation utility that can create, modify, and delete partitions and replicas.ID="FM40146"Primary time serverA time source server that synchronizes the time with at least one other Primary or Reference time server and provides the time to Secondary time servers and to clients.IDREF="FM72959"See also time synchronization.Print Queue objectA leaf object that represents the print queue and contains its properties.Print Server objectA leaf object that represents a network print server.Printer objectA leaf object that represents a physical printing device on the network.Profile objectA leaf object that represents a login script that is used by a special group of users who need to share common login script commands.It can be used for users who are not located under the same container in the Directory tree or who are a subset of users in the same container.ID="FM29084"propertyA characteristic of a NetWare Directory Services object such as name, volume, login name, password restrictions, group membership, etc.Some properties can contain multiple values, such as multiple telephone numbers.IDREF="FM37864"See also object.ID="FM28599"property rightsRights that apply to the properties of a NetWare Directory Services object.protocolConvention or rule used by a program or operating system to communicate between multiple endpoints.[PUBLIC] directory A directory on volume SYS: where NetWare utilities and their related files are copied to during installation.[PUBLIC] trusteeA special trustee that can be added to any object, directory, or file. Rights granted to [PUBLIC] are effective for any object in NDS that does not have other effective rights.Read property right (R)A right that grants the right to read and compare the values of a property.read-only replicaA type of replica that can be used only to read NetWare Directory Services database information.read/write replicaA type of replica that can be used to read or update NetWare Directory Services database information. It cannot be used to create a new partition.ID="FM53080"Reference time serverA time source server that provides a time to which all other time servers and clients synchronize.IDREF="FM72959"See also time synchronization.ID="FM35851"Relative Distinguished Name (RDN)The context, or path, from an object to another object of the Directory tree.IDREF="FM74632"See also Distinguished Name.Rename object right (R)Allows you to change the name of the object. This changes the value of the naming property. Only the last part of the complete name can be changed with this right. Changing other parts of the name implies a move operation.For example, if you have the Rename object right on a Printer object, you can rename that Printer object so that its complete name changes from CN=HR_Printer.OU=Personnel.O=Novell to CN=Personnel_Printer.OU=Personnel.O=Novell.ID="FM73126"replicaA copy of a NetWare Directory Services database partition's information. An unlimited number of replicas can be created for each partition, and they can be stored on any server in the network.There are four types of replica: master, read-only, read/write, and secondary.ID="FM89605"replica listThe collection of replica properties of a partition.ID="FM31853"replica ringIDREF="FM89605"See replica list.root directoryThe highest directory level in the NetWare file system hierarchical directory structure. With NetWare, the root directory is at the volume level and all other directories are subdirectories of the volume.ID="FM14641"[Root] objectAn object in the Directory tree whose purpose is to provide a highest point to access different Country and Organization objects, and to allow trustee assignments granting rights to the entire Directory tree.root partitionThe first partition that is created (at the top of the tree) which includes the [Root] object.SAPIDREF="FM44586"See Service Advertising Protocol (SAP).schemaIDREF="FM19770"See Directory schema.ID="FM29271"Secondary time serverA time server that obtains the time from a Single Reference, Primary, or Reference time server and provides the time to clients.IDREF="FM72959"See also time synchronization.Server objectA leaf object that represents a server. Information about its location can be stored in its properties.ID="FM44586"Service Advertising Protocol (SAP)A protocol that provides a way for services to advertise on a NetWare internetwork.ID="FM61339"Single Reference time serverA time source server that provides time to Secondary time servers and to clients. It is the sole source of time on the network.IDREF="FM72959"See also time synchronization.PAGENUM=176 ID="BP157"subordinate reference replicaA 
type of replica that is automatically placed on a server if the parent Directory 
partition has a master, read/write, or read-only replica and the child Directory 
partition does not. Subordinate replicas cannot be modified.subtreeA branch of a Directory partition.Supervisor object right (S) Grants all access privileges. A trustee who has the Supervisor right automatically has access to all properties.The Supervisor right can be blocked by the Inherited Rights Filter, both for objects below the object where Supervisor is assigned and for individual properties of an object.Supervisor property right (S)Grants all access privileges. A trustee who has the Supervisor right automatically has all other rights to the property.The Supervisor right can be blocked by the Inherited Rights Filter, both for objects below the object where Supervisor is assigned and for individual properties of an object.synchronizationA means of ensuring that replicas of a Directory partition contain the same information as other replicas of that partition. Replica synchronization updates the replicas and runs periodically at a cycle controlled by the network supervisor.IDREF="FM73126"See also replica.text utilitiesOne of the two main types of utilities available in the NetWare 4 software, the other being graphical utilities. There are two categories of text utilities: command line utilities and menu utilities.time serverA server which provides time to the system. There are four types of time server: Primary, Reference, Secondary, and Single Reference.IDREF="FM72959"See also time synchronization.PAGENUM=177 ID="BP158"time source serverThe server 
that provides time to the network. These are four types of time source servers: 
Single Reference, Primary, and Reference. time stampA unique code that identifies an event and includes the time is occurred. It is reported by the Directory tree at the time of the event, such as a password change or an object renaming.NetWare Directory Services uses this to establish event order, record real-world times, and set expiration dates.ID="FM72959"time synchronizationA method of ensuring that all servers in a Directory tree report the same time.In systems with a Single Reference time server or a Reference time server, all other servers synchronize to them.Primary and Secondary time servers synchronize with other Primary or Reference time servers and provide time to Secondary time servers.TIMESYNCAn NLM program that controls time synchronization on servers running NetWare Directory Services.IDREF="FM72959"See also time synchronization.treeIDREF="FM64620"See Directory tree.tree nameIDREF="FM51944"See Directory tree name; IDREF="FM21287"true name.trusteeA user or group that has been granted rights to work with a directory, file, or object. IDREF="FM56762"See also trustee assignments.ID="FM56762"trustee assignmentsGrants rights to an object to perform actions on another object or its properties, on a file, or on a directory.Trustee assignments granting rights to an object can be viewed by selecting the object and choosing "Trustees" from the "Object menu." Trustee assignments are stored in the Access Control List (ACL) property of every object.ID="FM21287"true nameThe default name of the [Root] object when it is automatically placed at the top of the tree by the NetWare 4 installation program.typeful nameThe object name that includes the name type (OU, O, etc.) of each object when identifying the Distinguished Name of that object.typeless nameThe object name that excludes the name type (OU, O, etc.) of each object when identifying the Distinguished Name of that object.UIMPORTA text utility that allows the network supervisor to create many User objects at the same time, using a database.User objectA leaf object that represents a person who uses the network. Its properties can store information such as a telephone number, address, group membership, etc.valueThe contents of an object property. Many properties can have multiple values, such as a telephone number property containing three different telephone numbers. Each Telephone Number is a value of the property.Access rights control access to a property, but not to individual values of a property.Volume objectA leaf object that represents a physical volume on the network. Its properties can store information about its location, owner, space use restrictions, etc.WANIDREF="FM38716"See wide area network (WAN).ID="FM38716"wide area network (WAN)A network that communicates over a long distance, such as across a city or around the world. It can comprise of or incorporate one or more local area networks.IDREF="FM34249"See also local area network (LAN).Write property right (W)Allows a trustee to add, change, or remove any value of a property. If the Write right is given, Add Self is disabled because Write includes its functionality.