Domains and workgroups

One of the key considerations for anyone installing or working with Windows NT 4 is whether to use a workgroup or domain model. Domains and workgroups are logical groups of computers that are created for the purposes of administration and resource access. A Windows NT 4 system can be configured as either a member of a workgroup or a member of a domain.

Workgroups are used in small networks of usually no more than 10 computers. In a workgroup scenario, a dedicated, or centralized, network server is nonexistent, and each system in the workgroup can offer services to and use services from other systems in the workgroup. Security in a workgroup model is handled by each system; that is, each computer has its own list of users who can access the system. There is no centralized database of user accounts, which results in a situation that can lead to a variety of administrative headaches. For example, changing user passwords and making sure that they are changed on each system in the workgroup can be an administrative nightmare. Also, when a new user joins the company, an account must be created on every system to which the user needs access.

Domains are very different from workgroups. In a Windows environment, a domain model is a network model that uses a centralized approach to resource management, meaning that computers within the domain can access data and network services from a central location. A Windows NT server that is configured in the domain model can be set up to perform three roles on the network:

• Primary domain controller (PDC)-The PDC is the main server and is responsible for the majority of server-related tasks on the network, including authentication and managing the network user account information. A Windows NT domain can have only a single PDC, and every effort should be made to ensure that it is running at all times. Without a PDC, certain administrative tasks, such as adding users, cannot be completed. If the PDC is the only Windows NT server system on the network, its role is even more important because without it, users are unable to log on.
• Backup domain controller (BDC)-As a company grows, its reliance on a single server can create a problem. A single server represents a single point of failure and in many cases, cannot handle the workload for an entire network. That is where a BDC comes in. The BDC holds a second copy of the information that is stored on the PDC, including the database of user accounts and other important network information. Having duplicate information provides a level of fault tolerance for the network and a second server to help with the network load. If the PDC goes offline for any reason, the BDC holds the information necessary to authenticate users and keeps the network functioning. Depending on the size of the network, there might be several BDCs on a single network. If the PDC on a network fails, a BDC can be promoted to a PDC through a simple process. After the problem with the PDC has been corrected and the PDC has been brought back online, the BDC's role can be reversed again. Whereas a domain can have only a single PDC, many BDCs can be used.
• Member server-The member server does not take part in domain authentication and does not hold a copy of the user account database. Member servers provide file, print, and application services.