Some interesting facts/news:
NDS Advantage
Novell's NDS Support for NT, Active Directory and Windows 2000
The more things change, the more they stay the same?
October 1999
Overview
Today Novell, with NDS, solves several business issues in a Microsoft environment including: single sign on, single point of administration, and desktop management. Regardless
of the specific technical implementation, Novell will continue to solve these business issues after Windows 2000 and Active Directory ship.
Windows 2000 and Microsoft FUD
As was the case with Windows NT Server and NT Workstation, Microsoft wants the industry to believe that you must use the server and desktop products together. In reality,
companies that have implemented Windows NT workstation with Novell's NDS, Workstation Manager, and now ZENworks, have demonstrated more efficient management, higher end user productivity, and superior ROI than with a pure Microsoft environment.
Microsoft is attempting to use this same tactic with Windows 2000. They do not want to let their customers draw a distinction between the Windows 2000 Professional (workstation), Windows 2000 Server, and Active Directory. Again they want consumers to believe these technologies are dependent on one another and can not be deployed independently. The reality is?Windows 2000 Professional does not require Windows 2000 Server or Active Directory.
The Novell Client for Windows 2000 will ship in the release of Windows 2000 Professional. With this client and Novell's ZENworks for Desktops, Novell will manage Windows 2000
workstations better than Microsoft. This client will also support NetWare and BorderManager connectivity making enterprise management easy.
Solutions for Today
Adoption of NDS for NT (which is redirection of NT Domains into NDS) has been a solution for single point of administration and to provide a single sign-on service - one
password for the end-user, for companies that utilized application servers that were dependent on Microsoft Domains. This has been so successful that GartnerGroup estimates NDS saves 40% of the cost of managing NT application servers.
Building on Today's Solutions
In July Novell announced a technology called DirXML that leverages the Internet standards of XML and LDAP to further coordinate and relieve the burden of directory integration.
When used with Active Directory this solution from Novell will seamlessly provide the identical functionality of NDS for NT. It will allow any application that requires access to Active Directory either for authentication or management to be managed from within NDS.
Administrators and end users will not be able to distinguish functionality from the previous "redirection" product.
However, single point of administration and single sign-on into Active Directory is just the beginning. Research shows that there may already be over 100 application-specific directories within companies today. NDS can provide significant relief to this situation by integrating
operating systems such as NT and Windows 2000, Solaris, and the application specific directories that run on them. DirXML will give corporations an opportunity to manage their
disparate heterogeneous directories from a single point, NDS. DirXML allows directories such as Lotus Notes, PeopleSoft, Exchange and others to become managed components of NDS.
Novell is also evaluating a redirection strategy for Active Directory. Redirecting Active Directory into NDS solves additional Active Directory domain related issues, such as Active Directory replication and global catalog limitations. These architectural deficiencies may severely impact customer deployments.
Summary
Novell customers who have deployed NDS for NT can be assured that Novell will support integrated NDS management of Active Directory and its underlying domains. Novell is committed to providing the best possible directory management solutions for all operating systems and applications, including Windows 2000 and Active Directory.
The scalability, reliability and cross-platform nature of NDS makes it the right choice for such a mission critical function. Novell has already done extensive testing to ensure that our products run with Windows 2000 and assist customers in obtaining the greatest benefits from this new operating system.
Detailing Novell Solutions
Novell has a long history of supporting Microsoft's operating systems and applications. Novell has always provided integration tools for all Microsoft operating system releases, from the original MS-DOS systems through the newest Windows 2000 betas. Novell understands
the importance of a heterogeneous network, one that will eventually include Windows 2000 and Active Directory. Novell already supports future Windows 2000 deployments and
technologies through software available today:
Novell Client for Windows 2000- Novell has developed a Novell Client for Windows 2000. This is a fully-featured client that provides capabilities such as NDS and ZENworks to the Windows 2000 platform. To obtain the latest Novell Client for Windows 2000, please see support.novell.com and search for "Novell Client for Windows 2000"
ADSI Support - Microsoft's Active Directory Service Interface (ADSI) is a Microsoft proprietary set of APIs for developing directory-aware applications. Novell was the first vendor to ship a directory ADSI provider, ADSI documentation, and sample source code at developer.novell.com.
ADSI Client Support - Novell's latest clients provide ADSI support as part of the client software package. Installing ADSI support on Windows 95/98 and Windows NT 4.0 clients is as simple as checking a box during install.
The biggest value proposition for Active Directory will be managing NT Domains. Novell's NDS for NT does just that today and that will not change with the release of Windows 2000.
Customers still have NT Domains that place a large strain on IT staffs. NDS for NT greatly simplifies the task of managing those domains and their complicated trust relationships.
Furthermore, Novell will soon release NDS 8 for NT which provides many directory capabilities natively on the Windows NT platform, including:
Novell's NDS 8 Technology - a directory platform that scales to tens of millions of objects per server and billions systems-wide. NDS 8 technology also seamlessly integrates with other NDS 8 platforms, including NetWare 5, Sun Solaris, and Linux, providing a true, cross-platform directory solution.
Full NDS 8 Maagement - a complete set of GUI utilities for day-to-day administration of NDS, management of the NT file, print, and server systems, and graphical diagnostic and repair utilities. NDS 8 for NT even includes a LDIF bulk-load utility for quickly importing directory objects based on the IETF LDIF standard.
Full LDAP v3 Support - any LDAP v3-enabled application can easily access the NDS directory through native LDAP calls. NDS 8 for NT provides a fully functional LDAP-capable directory for Windows NT Server.
As a Microsoft developer, Novell used standard SDKs and APIs for the development of NDS 8 for NT. This ensures that Novell's applications will run on a variety of Win32
platforms, including Windows NT 3.51, Windows NT 4.0, and Windows 2000. Novell consulting, engineering, sales and testing groups have been trained on Windows 2000 and
have been working with the alpha and beta versions since the beginning. Most of the NDS 8 for NT product already supports Windows 2000.
Microsoft Exchange Mailbox Manager - provides a single point of administration for both NDS and the Exchange mailbox management. Novell's Mailbox Manager ensures that NDS user management operations, such as creating, deleting, or modifying directory user accounts, are synchronized to Windows Exchange.
ZENworks/NDS will manage Windows 2000 desktops - and provides remote installation, upgrade, diagnostics and repair of desktop software.
Office 2000 Deployment - can be done with ZENworks. NDS allows custom distribution and management in the deployment and ongoing support of Office 2000.
NDS for NT - provides a single point of administration between NDS and the NT domain systems. NT domain redirection greatly simplifies NT administration by providing a single user account/password and single point of administration for both NT and NDS systems. Redirection is fully backward compatible with all legacy domain applications, including all shipping Microsoft BackOffice applications.
Providing Customers with Options
Novell is addressing NDS integration with Active Directory with three customer options:
#Allow customers to deploy Windows 2000 without Active Directory - Because Active Directory is a collection of NT domains, it's possible to integrate NDS for NT servers with new Windows 2000 servers through Windows 2000 trust relationships. For example, a Windows NT 4.0 server running NDS for NT can create a bi-directional trust relationship with a new Windows 2000 Active Directory server. Users created in NDS can be granted rights to Windows 2000 files and directories, and can be added to Active Directory groups. All of this is possible because Microsoft provides backward compatibility with Windows NT 4.0. This solution allows customers to deploy Windows 2000 servers independent of Active Directory, giving customers greater choice and flexibility as to when and how Active Directory will be deployed within their environment.
#Use NDS to better manage Active Directory - DirXML
(www.novell.com/products/nds/dirxml) will synchronize NDS objects with Active Directory objects providing a single point of administration. Novell expects to ship this product at or very near the market introduction of Windows 2000. We also expect to develop future Single Sign-on and DirXML solutions for new AD and Windows 2000 applications.
#Redirect Active Directory into NDS - While synchronization solves many of the NDS and Active Directory integration issues, customers have requested that Novell provide redirection of Active Directory into NDS. Redirecting Active Directory into NDS solves additional Active Directory domain related issues, such as Active Directory replication and global catalog limitations. However, since the Windows 2000 domain implementation is much different than previous versions of Windows NT Server, the same implementation for redirection of the Windows NT domain is not possible with Novell's current shipping redirection technology. Novell is evaluating a redirection strategy for Active Directory.
What Analysts Are Saying ?
"?there is not reason to believe that Windows 2000 will emerge stable, or stabilize any sooner than other complex products Microsoft has produced. Many of the nastier problems will have to be found in real-world deployment. When examining deployment requirements, enterprises should factor in that Windows 2000 will be less reliable than NT v4.0 until the first half of 2001 (0.8 probability) or possibly year-end 2001 (0.6 probability)."
Bet on It: Windows 2000 Will Be Less Reliable, GartnerGroup, T. Bittman, March 24, 1999
"The decision to upgrade to Windows 2000 r.1 should not be automatic, due to software, hardware, and labor costs of upgrading, and the risks of an unproven OS. Enterprise-wide
upgrades to Windows 2000 r.1 will not be cost-effective. Many user will be better-served by delaying production use of Windows 2000 until 2001, or waiting for the second release (expected in late 2001, 0.7 probability)"
For Servers, Windows 2000 Release 1 Is Worth Skipping, GartnerGroup, T. Bittman, May 19, 1999
"..Michael Gartenberg, a vice president at Stamford, Connecticut-based Gartner, said the costs of changing to Windows 2000 is so high that a company won't realize lower costs for three years. 'By then, you would have to do a migration to another operating system.'"
"We're reminding people that they're looking at a one side of the equation because the cost of getting to TCO (total cost of ownership) is greater than the costs they are going to save ? It's a money-losing proposition," said Gartenberg.
news.cnet.com
/0-1008-200-114579.html?tag=st.ne.1002.tgif?st.ne.fd.gif.f
"Unless higher-level management mandates an immediate migration to Windows 2000 Server or there is a compelling technical reason to migrate immediately (such as deploying Exchange Platinum), defer Windows 2000 deployment at least until the first and possibly the second Service Pack ships. Users that are satisfied with their current Unix, Linux and NetWare and NDS installations should stick with these platforms. If your enterprise business can no longer
live with the limited domain directory structure of NT 4.0, consider adopting a third-party directory services product. Tops of Giga's list is Novell NDS for NT ? You won't be
sorry."
Forecast: as Windows 2000 Server Ship Date Nears: Compatibility, Confidence Issues Cloud Picture, Giga Information Group, Laura DiDio, September 22, 1999
Clearing Up The Confusion
#Listening to Microsoft: A 'no-win' situation:
When Novell released NDS for NT 2.0, Microsoft clearly stated in their marketing that synchronization was preferred over redirection:
"If Novell wanted to deliver an interoperability solution that works with what customers already have deployed, Novell could have built a directory synchronization tool using the published Active Directory Service Interfaces (ADSI). ADSI, the industry standard for accessing directory services from any vendor, allows third-party developers such as Novell to integrate their solutions into the Windows NT Directory Service. This, too, would have allowed Novell to synchronize the two directory services without replacing Windows NT Server code and then manage both directories from NDS." (Microsoft's original response to NDS for NT)
DirXML is exactly the solution described by Microsoft. DirXML uses Internet Standards such as LDAP and XML and Microsoft's proprietary ADSI technology for bi-directionally synchronizing NDS and Active Directory.
#Solution vs. Implementation - "We Choose to Go to the Moon"
When President Kennedy asked America's scientists to place a man on the moon and return him safely to earth, Kennedy defined the task, not the implementation. In other words, Kennedy didn't say, "Build a three stage rocket with 2 million pounds of thrust fueled by liquid hydrogen and liquid oxygen". Our customers are asking for a solution, not an implementation. Let's not confuse a solution co-management of NDS and Active Directory) with an implementation (redirection verses synchronization).
Customers desire a solution that enables a single point of management, from either Active Directory or NDS utilities. Customers also desire a solution for maintaining password synchronization between the two directories. Both of these solutions are possible by either redirection or synchronization. However, redirection for NT Server 4.0 was chosen because it solved other NT domain problems beyond just single point of administration and single password; namely, NT 4.0 domains also suffered from PDC-BDC replication inefficiencies, trust relationship management, PDC-BDC fault tolerance, delegation of administrative rights, and so forth. Since Active Directory addresses many of these domain limitations, Novell doesn't need to 'fix' Active Directory, as was the case with NT Server 4.0
#Active Directory Bloat: Use synchronization to protect NDS
NDS customers have clearly stated that they do not want the inefficiencies of Active Directory causing problems with their mission-critical NDS deployments. For example, the default Active Directory installation creates an Active Directory of 45 MEGABYTES (without any users!). Simple Active Directory operations, such as granting administrative rights, increase the Active Directory database by hundreds of megabytes. In contrast, NDS rarely exceeds 1-2 megabytes per server in real-world NDS deployments.
Until the deficiencies in Active Directory are solved, maintaining a synchronization approach between Active Directory and NDS limits the problems to the Active Directory servers. Redirecting Active Directory to NDS would contaminate functioning NDS deployments with Active Directory inefficiencies - such as increasing NDS databases from 1-2 megabytes to hundreds of megabytes.
Clearly, customers do not want Active Directory limitations (such as replication, database size, and management issues) impacting their NDS deployments. Redirecting Active Directory to NDS would significantly and unnecessarily impact NDS. Synchronization allows Active Directory's inefficiencies and problems to remain within Active Directory and not affect NDS.
#Active Directory Instability: Synchronization provides a clear delimiter between NDS and AD
It is accepted in the industry that Active Directory will have significant stability and deployment problems in its early releases. By redirecting Active Directory to NDS, problems and deficiencies in Active Directory could wrongly be blamed on NDS, both by customers and Microsoft.
Synchronization defines a clear line between NDS and Active Directory so that the problems in Active Directory are not perceived as NDS issues.
NDS Has Unique Advantages Over Active Directory
When selecting their directory foundation many organizations already know the advantages of NDS in supporting their business directions. The advantages over Active Directory
include:
NDS is cross-platform and Active Directory is not. NDS is shipping, or will soon ship, on NetWare, NT (3.x, 4.x and Windows2000), Solaris, Linux, Compaq Tru64 and OS390. Active Directory is a NOS-only directory, which is still not in production.
NDS manages more devices, types of devices, and applications, providing the greatest savings of time and resources. A few examples are: Single Sign-on for virtually any application, Lucent switches, PBX, QIP, Nortel Optivity, Cisco devices (with a product we'll ship in 1H 2000, plus URT from Cisco), DNS/DHCP, RADIUS dial-in, Firewalls, Proxy Servers, Windows Desktops (3.x, 95, 98, NT 3.51/4, W2K), Software distribution, Help Request System, GroupWare (Exchange, Notes, GroupWise), Instant Messaging (AOL), XML-based integration of any app/data, Oracle 8I, Websphere, PKI (Novell, Entrust, Netscape), Citrix (NT Terminal Server, Metaframe, Winframe), metadirectory products (Isocor, NetVision), Smart Cards (Security Dynamics, ActivCard), Peoplesoft, PLUS >500 applications from other ISVs.
NDS complies and integrates with more open standards such as LDAP v3, XML, DSML, JNDI, PKI, PKCS10, RADIUS, CORBA, SSLv3, etc.,NDS is proven technology with an installed base of almost 70 million users. AD has yet to ship, much less win the loyalty of an installed base. NDS has proven reliability, availability, serviceability, scalability, and security in real-world implementations.
NDS is integrated with over 90% of all office equipment (fax, fax gateway, printers, etc.,) and has 16 million devices integrated today. NDS has unlimited scalability, including the proven ability to manage over 1 billion objects.
NDS allows the administrator to partition the directory to suit their environment, while maintaining a single logical directory. AD makes network administration more complex and less efficient by only allowing for division to occur along domain boundaries, and breaking the directory into management fragments.
Global administration of Active Directory is not possible because access control rights do not flow past domain boundaries. Because NDS is a single logical directory rights can be given and managed globally.
NDS supports multiple client OS platforms such as. Windows 9.x, Windows NT, Windows 2000, Windows 3.x, MacOS, and OS/2. Microsoft will only fully support Windows 2000 Professional (workstation) from Active Directory. Windows 9.x will have limited support, and there is no planned AD support for OS/2, Windows 3.x, Windows NT, or MacOS.
A more thorough summary of these points can be found at:
novell.com
Summary
Novell customers who have deployed NDS for NT or who are considering NDS for management of Windows 2000, Internet LDAP-based applications, or any other network integration, can be assured that Novell will support integrated management of Active Directory and NDS. Novell fully intends to support all NDS for NT functionality through the
DirXML synchronization approach. When considering a directory strategy, it is important to assess not only the current needs of your NOS environment, but also the consolidation of the myriad directories that already exist and the new applications that will require directories in
the future. NDS is the most mature, feature-rich and supported directory that has ever existed. When you bet your business on your technology, your technology better be rock
solid. You can count on NDS, today.
Frequently Asked Questions
Q. Will Microsoft support NDS for NT?
A. Yes. Please see microsoft.com
deployment/planguide/NDS.asp for more information.
Q. Will NDS for NT 2.1 install on a Windows 2000 Server?
A. No. Changes have been made to the Windows 2000 domain system architecture. Novell currently provides integration with Windows 2000 though NT trust relationships. Novell will
also provide other integration solutions that deliver NDS for NT functionality for the Windows 2000 platform.
Q. Will NDS 8 for NT install on a Windows 2000 Server?
A. Yes, NDS 8 for NT will install on Windows 2000, but will not redirect native Active Directory.
Q. Can a Windows 2000 server integrate with a Windows NT 4.0 server running NDS for NT?
A. Yes, a bi-directional trust relationship can be created between the NT 4.0 server and the Windows 2000 server. This trust relationship will allow users defined in NDS for NT to be granted rights to Windows 2000 resources, such as files and directories.
Q. If I install NDS for NT on a Windows NT Server, can I migrate that server to Window 2000?
A. Yes, it is simple to run the SAMMIG.EXE utility and reverse migrate the NT domain information back into the NT domain systems. When the Windows 2000 upgrade is
performed the directory data will be correctly migrated.
Q. Does NDS for NT prevent a migration to Active Directory?
A. Absolutely not. With NDS for NT, you can enjoy the benefits of a scalable, fault-tolerant, proven directory before (or after) Active Directory ships. NDS for NT allows a customer to deploy Windows 2000 (the platform) with minimal Active Directory planning. Because Microsoft provides NDS to Active Directory migration utilities, any effort or time spent on implementing NDS for NT today will not be wasted with Windows 2000.
Q. Does Windows 2000 / Active Directory force customers to choose between Novell or Microsoft directories in order to avoid extra costs and complexity?
A. Customers use many directories today and the introduction of AD will not change this need. NDS reduces costs and complexity by integrating application directories, Internet
directories, and even NOS-specific directories like Active Directory. The use of NDS eliminates many redundant tasks that result from multiple directories.
Q. Why won't Novell immediately provide redirection in NDS for Active Directory?
A. Microsoft has changed the storage mechanism in Active Directory. Further, they have published a set of APIs (Active Directory Service Interface) for accessing information in Active Directory that was not available under the Domain model. Novell will provide functionality similar to redirection without the downsides that will result with redirection techniques.
Q. Are the many advantages of NDS over AD negated by the lack of a redirection capability in NDS for Active Directory? A. No. Novell is investigating a possible redirection solution, and will continue to offer redirection for NT 4.0. Customers require a full-service directory to manage and integrate diverse platforms and resources across the enterprise and the Internet. This will require a variety of technical solutions.
¸ 1999 Novell, Inc. All rights reserved. NetWare and Novell Directory Services are registered trademarks and NDS is a trademark of Novell Corporation in the U.S. and other countries. Windows, Windows NT, Windows 2000, Windows 95 and Windows 98 are registered trademarks and Active Directory, Exchange, Windows NT Server, and Windows NT Workstation are trademarks of Microsoft Corporation. UNIX is a registered
trademark of X/Open Company, Ltd. in the U.S. and other countries. All other brand and product names are trademarks or registered trademarks of their respective companies. |
