Active Directory users could learn from NDS

By JOHN FONTANA
Network World, 06/07/99

Network administrators moving to Microsoft's Active Directory should find some tips and comfort in the annals of technology.

Roughly six years ago, Novell sprang its Novell Directory Services (NDS) on legions of faithful NetWare users. What followed was sometimes chaotic and frustrating, but ultimately rewarding.

Early adopters of Windows 2000 and Active Directory could learn a few things from the NDS users who went before them. Active Directory is supposed to ship by year-end.

NT users will face challenges similar to those that NetWare users encountered in 1993 when upgrading their network operating systems to include directory services. Directories are designed to simplify management of users, groups and devices on a net or across an enterprise.

"I see a lot of my NT clients going through the same thing my NetWare folks went through six years ago," says John Kretz, president of Enlightened Point Consulting Group in Phoenix. Kretz remembers some rough times, including culture clashes, training issues and technology snafus.

One major similarity between NDS and Active Directory is users must move from a relatively flat file system, with few interconnecting points, to a hierarchical "tree" structure made up of interwoven organizational units and user groups.

"The big confusion at first was . . . we were using organizational units where groups were a better choice," says early NDS user Harold Valenzula, net administrator of Children's Home Society of California. Valenzula says his biggest lesson was that the tree design affected his whole IT organization. "Organizing the directory tree in NDS was difficult, and we only refined it through trial and error." He thinks Active Directory users will need to do the same.

While there are comparisons to be made, differences exist. Novell jarred users by making a wholesale technology change with NDS in NetWare 4.0, while Microsoft built Active Directory from NT 4.0's domain system. Microsoft users will have more third-party tools at their disposal. But Microsoft also faces higher expectations, and Active Directory will have to mature faster than NDS did while having less margin for errors.

"The big and ugly was understanding how the directory worked," says Peter Cruishank, network architect for the U.S. Navy and an early NDS adopter. "We had issues, including how to set up partitions, how sites fit in, how synchronization was happening and how to configure NDS to fit our operation."

Cruishank says another task was untraining administrators on NetWare 3 and binderies (NetWare files used for security and accounting) and re-training them on NetWare 4 and NDS. The issue forced Novell to release a transitional utility called Bindery Emulation Mode to make the directory look like a bindery.

Cruishank criticized Novell for the complexity of NDS and predicts users will find similar faults with Active Directory. "You have to think differently. If we pulled a server, we found it was still in the directory, and then we had to go back and painfully extract it. With the directory, it became a 3-D world," he says.

The change in thinking was hard on NDS adopters.

"If you had 500 servers, it was essentially taking 500 databases and consolidating them into one thing," acknowledges Brian Faustyn, director of product marketing for NetWare. "It was a radical shift and Microsoft is doing the same thing."

Now at NDS 8.0, which was released in April, Novell has ironed out the early problems.

Microsoft says it is savvy to the bumps that lie ahead.

"The real challenge will be for customers with multiple domains and consolidating those domains," says Peter Houston, lead product manager for Active Directory marketing. "Now you'll have to reconsider all those things that made you create multiple domains in the first place, like political issues and WAN links."

Houston says Active Directory also answers the two biggest complaints about NT 4.0: the need for multiple domains and limits in domain sizes.

Houston, however, believes comparing NDS growing pains with Active Directory challenges is apples to oranges.

"Novell made you migrate in a wholesale fashion,"he says. "In Windows 2000, you can move incrementally and we'll give you the tools to do that."

Third-party vendors, including Entevo and Fast Lane, also will help manage the move.

To support development of directory-enabled applications, Microsoft last week released Active Directory Service Interfaces 2.5.

Some say Microsoft users will have other advantages.

"Active Directory will have it better than NDS in two ways: The lessons learned from history and NT 4.0 domains go half way toward top-down thinking," says Dan Blum, senior vice president of the Burton Group.

Blum says directories have to be built from the top of the organization down. Although NT domains are closer to that model than Novell was with its bindery, major work still has to be done. Enterprises will have to do a high degree of enterprise planning that will raise political and cultural issues, Blum says.

Regardless, Microsoft has little room for mistakes.

"If they don't get Active Directory dead right out the door, they will have big user issues," says Kretz of Enlightened Point Consulting. "They don't have the flexibility for errors Novell had when NDS shipped."