Windows 2000 Active Directory Case Study

(1)

2 November, 2000 Windows 2000 Active Directory: An ETAC Recommendation presented by Ben Berry, CTO & Gary Walter, Dir. IT Communications Chart 1

A caring difference you can feel

Windows 2000

Active

Directory Case Study

presented to

Office of the CIO

Mark Gargett

Rick Skinner

Dan Robins

Janet Smith

prepared by

Enterprise

Technology

Advisory Council

Scott Denton

(Alaska)(Alaska)

Jeff Springer

(Washington)(Washington)

Gary Russell

(California)(California)

Ben Berry

(Oregon)(Oregon)

Kirby Lott

(Health Plans)(Health Plans)

This document provides a “Solutions Framework” for the phased implement-ation of Windows 2000 and Active Directory throughout Providence.

hp

ak

ca

or

wa

ds

wa wa.providence.org.providence.org ca

ca.providence.org.providence.org _or_{or.providence.org}_{.providence.org}

hp hp.providence.org.providence.org ak ak.providence.org.providence.org

xyz

Xyz.org Xyz.org phsmsg phsmsg phsmsg phsmsg.providence.org.providence.org

(2)

A caring difference you can feel

Vision Statement

Corporate Network

Infrastr

uctu

re

Network

Standards

Integ

Voice-Data

rati

o

n

Security

Network

M

a

nagem

ent

Information / Databases

Windows 2000 Based

Applications

Windows 2000 Based

Applications

Access/Desktop

Enabling Tools

Exchange 2000

Enterprise

Infrastructure

PHS will achieve standardization of its Enterprise

network operating system through a

migration to Windows 2000, including

Active Directory as an enabling technology.

The successful implementation will

establish a reliable, supportable,

Internet standards

-

based foundation

for supporting the delivery of rich

IT services and future growth.

The migration is designed for

phased enterprise

-

wide

implementation to include

all regions on their own

schedule throughout

2001

–

2002.

Business

Goals

(3)

(4)

A caring difference you can feel

Envisioned Goals

Desktop Services.

Reliable, stable, sustainable,

manage-able and cost efficient desktop services and the underlying

supporting infrastructure.

Leverage.

Leverage centralized enterprise class IT services

and minimize duplicate efforts and mistakes where technical

feasible and meeting the business needs of each region.

Strategic Services.

Establish strategic

level of IT Services, Standards and

Gover-nance across the Providence Health System

Organization to optimize services to our

(5)

A caring difference you can feel

Domain Name Space (DNS) &

Domain Naming Scheme

PROVIDENCE.ORG

PHSOR

in-place upgrade

or.providence.org

CA

upgraded with and then

split off from phsor

ca.providence.org

PHSWA

in-place upgrade

wa.providence.org

HP

migration from provhealth

hp.providence.org

AK

migration from phsant

ak.providence.org

AD

(6)

A caring difference you can feel

PHSOR

Phsornt54

PROVHEALTH

Phpordc01

PHSWA

Phswa01

PHSANT

Phsacsecure

OR1

Phsornt10

OR2

Phsornt29

PHSSQL

Phsornt40

PHSWEB

Phsornt31

PHPNT

Phpntdc01

OR99

Phsornt99

PHSMSG

Phsmsgdc01

PHSCA

Pcasj1s01

Current NT4 Domains

(7)

A caring difference you can feel

Active Directory Domains

(8)

A caring difference you can feel

Collapsing NT4 Domains to AD

OR1

Phsornt10

PHSWEB

Phsornt32

PHSSQL

Phsornt40

OR2

Phsornt29

OR99

Phsornt99

PHSOR Windows 2000 AD domain

OU = WEB Servers

Domain

OU = SQL Servers

OU = File & Print Servers

OU = Imnet Servers OU = Testing Servers

1 NT4 PDC

4 NT4 BDCs

4 NT4 Servers

15 Win2K Servers

PHSOR

Phsordc03

or.providence.org

1 NT4 PDC

11 NT4 BDCs

6 NT4 Servers

10 Win2K Servers

1 NT4 PDC

4 NT4 BDCs

9 NT4 Servers

6 Win2K Servers

1 NT4 PDC

11 NT4 BDCs

101 NT4 Servers

18 Win2K Servers

1 NT4 PDC

20 NT4 BDCs

1 NT4 Servers

1 NT4 PDC

1 NT4 BDCs

5 NT4 Servers

OU = Application Servers OU = Terminal Servers

+

PHSMSG

Phsmsgdc01

This domain will be

upgraded in-place to a

separate AD domain.

1 NT4 PDC

15 NT4 BDCs

7 NT4 Servers

1 Win2K Servers

(9)

A caring difference you can feel

DNS: Domain Name Services

Current vs. Proposed

Region

Internal

DNS name

Platform

External

DNS name

Platform

SWSA

Swsa.providence.org

BIND Linux

Providence.org

BIND Linux

CWSA

Cwsa.providence.org

BIND Linux

Providence.org

BIND Linux

PHP

Provhealth.com NT

DNS*

Provhealth.org Gantlet

Solaris

PWSC

Pwsc.org NT

DNS NA

Alaska

Provak.org NT

DNS

Provak.org PIX

California

Phsca.org NT

DNS*

Phsca.org

BIND

UNIX

Oregon

Phsor.org

NT DNS

Phsor.org

BIND 8.2.1

Solaris

Everett

Provnw.org NT

DNS NA

Olympia

Providence.org BIND

Linux

Region

AD Domain

DNS domain, LDAP location

Oregon

OR Or.providence.org

California

CA Ca.providence.org

Alaska

AK Ak.providence.org

Health Plans

HP or PHP

Hp.providence.org

Washington

PHSWA Phswa.providence.org

Exchange

PHSMSG

Phsmsg.providence.org

Current

Proposed

Current DNS namespace and services across all Providence Health Systems regions:

Proposed DNS namespace in alignment with approved standard. All secondary child domains

to providence.org registered domain. This is in line with the Enterprise Network Architecture

Recommendation.

(10)

A caring difference you can feel

Active Directory Design

Recommendation

hp

ak

ca

or

wa

ds

wa wa.providence.org.providence.org ca

ca.providence.org.providence.org _or_{or.providence.org}_{.providence.org}

hp hp.providence.org.providence.org ak ak.providence.org.providence.org

xyz

Xyz.org

phsmsg

phsmsg phsmsg.providence.org.providence.org

wa. providence.org

or. providence.org

ca. providence.org

ak. providence.org

hp. providence.org

phsmsg. providence

Contiguous Namespace

and Sites

(11)

A caring difference you can feel

Domain

Tree

Domain

Tree

Forest

Domain

OU

Trees and Forests

_{Trees and Forests}

Domains

_Domains

Organizational Units

_{Organizational Units}

Active Directory &

Organizational Units

(12)

A caring difference you can feel

Arrange OUs According to:

_{Arrange OUs According to:}

Delegate Administrative Control at OU

_{Delegate Administrative Control at OU}

Level

OUs Enable Single Domain Model

_{OUs Enable Single Domain Model}

Organizational Structure

Recruiting

Human Resources

Benefits

Users

Recruiting

Computers

Network Administrative Model

Organizational Units Expanded

(13)

A caring difference you can feel

Risk Management

_{Interruption of email}

services

_{Interruption of prod}

systems

Availability of skilled

_{Availability of skilled}

resources

Funding

_Funding

Executive sponsorship

_{Executive sponsorship}

_Cross

_-

_regional

coordination

Splinter groups moving

_{Splinter groups moving}

ahead with no clear

direction

Timing to deploy

_{Timing to deploy}

DNS integration

_{DNS integration}

_{Inadequate planning on}

enterprise

implementation

Microsoft and DOJ

_{Microsoft and DOJ}

Cross

_Cross

-

region buy

-

in

Key staff moving on

_{Key staff moving on}

_{Scope creep}

Competing priorities

_{Competing priorities}

and other projects

Incompatible

_Incompatible

applications

(14)

A caring difference you can feel

Enterprise Support Model

Help Desk

Agency AD Engineer

Enterprise AD Coordinator

Region Support

Administrative Support

(account mgmt, etc.)

User Support

Escalation Path

Change Mgmt

Enterprise Issues

ETAC

OCIO

(15)

A caring difference you can feel

Regional Support Roles

Help Desk

Process

Policy

Design

Planning

ETAC

Enterprise AD

Coordinator

Regional

AD Engineer

Implementation

Training

Support

Oversight

Approval

(16)

A caring difference you can feel

Help Desk

First point of contact for

_{First point of contact for}

operational issues

Operational Administration

_{Operational Administration}

¾

Accounts

_Accounts

¾

(17)

A caring difference you can feel

Enterprise AD

Coordinator

Maintains full access to the root of the

_{Maintains full access to the root of the}

forest.

Responsible for enterprise DNS services

_{Responsible for enterprise DNS services}

Responsible for planning implementation

_{Responsible for planning implementation}

of service packs and patches.

Performs consistency checks

_{Performs consistency checks}

Responsible for testing schema changes

_{Responsible for testing schema changes}

(18)

A caring difference you can feel

Agency AD Engineer

Responsible for daily operation of the

_{Responsible for daily operation of the}

AD forest.

Responsibility and administrative

_{Responsibility and administrative}

control of a specific Active Directory

domain.

Supports DNS services in collaboration

_{Supports DNS services in collaboration}

with Enterprise AD Coordinator.

Advanced support for operational

_{Advanced support for operational}

issues.

(19)

A caring difference you can feel

Change Management

Process is applicable for all changes to

include architectural and schema

changes.

Enterprise Review Members

¾

Enterprise AD Coordinator

_{Enterprise AD Coordinator}

¾

Primary Agency AD Engineers

AD Review Committee Members

¾

Enterprise Review Members

¾

Secondary Agency AD Engineers

_{Secondary Agency AD Engineers}

¾

Selected Members which may include CIOs, technical

_{Selected Members which may include CIOs, technical}

experts, etc.

¾

Appointed Chair responsible for agendas, scheduling,

_{Appointed Chair responsible for agendas, scheduling,}

coordinating responses, etc.

(20)

A caring difference you can feel

Change Management Process

Change Request

Submit in Writing to

Enterprise AD Coordinator

Enterprise Review

Draft response submitted to

AD Review Committee

Review Committee determination

Send Assessment response

and close

Implementation Not Recommended

Short Term Break-Fix

Implement Requested Change

Submit to ETAC Group for review

Significant Enterprise Impact

High Risk

Target: 5 days

Implementation Recommended

Implement Requested Change

(21)

A caring difference you can feel

Project Milestones

Windows 2000

AD Planning

Summit

10/00

Master

Project Plan

11/00

Functional

Specification

11/00

Team

Formation

OCIO Charters

ETAC

2/00

_{Vision /}

Scope

9/00

Project

Schedule

11/00

Engineering

Environment Set-up

(Test Lab, equip.

etc.)

_12/00

Proof-of-Concept

1/01

Testing &

Pilot(s)

6/01

_Deployment

7/01