Water Resources Division ITAC Home Page

ITAC and Kevin,

Here is a DRAFT memo the DIS Office has developed with input from the Regional Computer Specialists and the NT TAC. Please review the memo prior to the ITAC discussion and recommendation decision next Wednesday (February 12, 2003).

Thanks, Tom (Wood)

The purpose of the memo is to provide guidance and current support plans for implementing Windows 2000 Active Directory (AD) Service within the Water Resources Discipline. Two different AD deployment strategies have been discussed within USGS over the past couple of years, 1) centralized/bureau managed, and 2) local/site managed. The Distributed Information System (DIS) Program Office recommends WRD deployment of Windows 2000 Active Directory (AD) in a local/site managed model, with some caveats described later in this message. This recommendation has been reviewed and approved by the WRD Information Technology Advisory Committee (ITAC) and the Geographic Information Office (GIO).

What is Active Directory?

Active Directory is Microsoft's initial offering in the area of directory services. Microsoft's AD Services are integrated into the Windows 2000 Server operating system and are repositories for environment information, such as applications, files, printers, and people. In addition, AD Services provide consistency to names, descriptions, locations, accesses, management, and security within our Windows based systems.

Issue

To date, the Bureau and DOI have put forth efforts for deploying AD throughout the Bureau and DOI, respectively. These efforts have focused on the deployments being "centralized" rather than "localized". There are several issues with centralized deployments of AD, most notably, the placement of domain controllers (DCs). The DC servers authenticate users, allowing access to the domain services, including file and printer access. The log-on request is sent over the wide area network (WAN) to the nearest DC in a centralized deployment model. This unto itself is not an issue, but the problem arises when the WAN is unavailable. In this case, the user will not be able to access files or peripherals that are not directly connected to the workstation. This problem would compound itself during the occurrence of a "hydrologic event" when access to all local computing resources is even more time-critical. The hydrologic event itself could potentially cause extended WAN outages. In addition to the connectivity issue, there are concerns about centralized AD security compromises, overall cost, and support required to implement an enterprise wide AD system.

Guidance and Current Support Plans

At this time, one WRD Office is connected in production mode to the centralized Bureau AD model and will continue to be supported by the GIO and DIS Program Office. Other offices in WRD are advised not to participate in the Bureau or DOI centralized deployments until the issues described above are resolved. Additional details of the DIS Program Office guidance on AD deployments follow.

Local/Site Managed AD Deployments

The DIS Program Office will support existing and future local Active Directory (AD) deployments within WRD:

• WRD offices are advised to follow NT Technical Advisory Committee (NT TAC) WEB instructions for Active Directory implementation and maintenance found at:   http://nttac.usgs.gov/index.asp?url=os/win2000/AD/index.html.
• NT TAC provides interactive support to WRD employees. Send email questions and concerns to GS-W NT TAC.
• NT TAC SWAT visits focused on AD deployment are available as additional on-site support. The goals of the NT TAC SWAT Program are to ensure that new equipment and software are configured properly and to provide consistency with other WRD offices. DIS will accept requests and organize members of the DIS sponsored NT TAC to participate in the SWAT - normally two members will visit your office. Due to budget restraints at HQ, the requesting office will need to fund salary cost for non-HQ NT TAC personnel and travel costs for both participants. To request an NT TAC SWAT for your office, please notify your Regional Computer Specialist, then send email to GS-W NT TAC with your request.
• Offices deploying local AD must be aware that in the future they may be required to join a more centralized deployment which will likely result in significant work. The NT TAC has strived to minimize the potential re-work as much as possible through their recommended local AD configuration. Please note that joining the centralized model at this time will also require significant re-work.

Centralized/Bureau Managed AD Deployments

The DIS Program Office does not advise, and will not support, additional centralized AD deployments until further notice:

• Networking, security, and support issues must be resolved before additional centralized production deployments are supported.
• DIS staff, NT TAC members, and other WRD IT support staff will continue to fully participate in centralized AD planning activities at Bureau and Department levels.

Questions?

Questions about the information contained in this message should be directed to Garry Neverdon, the DIS Systems Support Unit Chief and NT TAC Chair, at 703-648-7068, or gneverdon.