Copyright: Thursday, October 07, 1999 10:40:33


A phone number that subscribers can dial to reach online services.


Permissions set by Macintosh users that allow them to view and make changes to folders on a server.

By setting access privileges (called permissions when set on a computer running Windows 2000 Server), you control which Macintosh computers can use folders on a volume. AppleTalk network integration (formerly Services for Macintosh) translates access privileges set by Macintosh users to the equivalent Windows 2000 permissions.


A message transmitted to indicate that data has been received correctly.

The Transmission Control Protocol (TCP) requires that the recipient acknowledge successful receipt of data. Such acknowledgments (ACKs) generate additional network traffic, decreasing the rate at which data passes but increasing reliability. To reduce the impact on performance, most hosts send an acknowledgment for every other segment or when a specified time interval has passed.


A model derived from the LDAP data model. The directory holds objects that represent entities of various sorts, described by attributes. The objects and classes of objects that can be stored in the directory are defined in the schema. For each class of objects, the schema defines the attributes an instance of the class must have, the additional attributes it may have, and the class that can be its parent.

See also attribute; LDAP; schema.


A directory service model and a set of COM interfaces. Active Directory Service Interfaces enables Windows 95, Windows 98, Windows NT, and Windows 2000 applications to access several network directory services, including Active Directory. It is supplied as a Software Development Kit (SDK).


A reusable software component that can be used to incorporate ActiveX technology.


A resource record used to map a DNS domain name to a host IP address on the network.

See also resource record.


Predefined groupings of Internet addresses with each class defining networks of a certain size. The range of numbers that can be assigned for the first octet in the IP address is based on the address class. Class A networks (values 1 to 126) are the largest, with more than 16 million hosts per network. Class B networks (128 to 191) have up to 65,534 hosts per network, and Class C networks (192 to 223) can have up to 254 hosts per network.


The addresses within a DHCP scope range of addresses that are available for leased distribution to clients.


A relationship formed between selected neighboring routers for the purpose of exchanging routing information. When the link state databases of two neighboring routers are synchronized, the routers are said to be adjacent. Not every pair of neighboring routers becomes adjacent.

See also link state database.


Client software that is shipped with all Macintosh computers and with Apple Computer server software. Macintosh computers can use their AppleShare client software to connect to computers running Windows 2000 Server and AppleTalk network integration (formerly Services for Macintosh).

See also AppleTalk network integration.


The presentation-layer protocol that manages access to remote files in an AppleTalk network.

See also AppleTalk.


The extended AppleTalk Internet model designed by Apple Computer that supports multiple zones within a network and extended addressing capacity.

See also AppleTalk.


The set of network protocols on which AppleTalk network architecture is based. You must install the AppleTalk Protocol stack on a computer running Windows 2000 Server so that Macintosh clients can connect to it.

See also AppleTalk.


A process that uses Software Installation (an extension of Group Policy) to assign programs to groups of users. The programs appear to be installed and available on the users' desktop when they log on.

You assign programs to a particular Group Policy object (GPO), which in turn is associated with a selected directory object (site, domain, or organizational unit). When you assign programs, the program is advertised to every user managed by the GPO. Advertising the program installs only enough information about the program to make program shortcuts appear on the Start menu and the necessary file associations appear in the registry. When users managed by the GPO log on to a computer running Windows 2000, the program appears on their Start menu. When users select the program from the Start menu for the first time, the program is installed.

You can also install advertised programs by clicking a document managed by the program (either by file extension or by COM-based activation).


A router that is attached to multiple areas. Area border routers (ABRs) maintain separate topological databases for each area.

See also topological database.


The layer of the ATM protocol stack that parses data into the payload portion of the ATM cell for transport across an ATM network. There are four AAL types that correspond to different ATM service types:

AAL1. Supports connection-oriented constant-bit-rate traffic.

AAL2. Supports time-dependent variable-bit-rate traffic.

AAL3/4. Supports connectionless and connection-oriented variable-bit-rate traffic.

AAL5. Supports connection-oriented variable-bit-rate traffic.

AAL is also called ATM adaptation layer.

See also ATM.


A value assigned to an object that describes the object. For example, a file can be described by the attributes of file type (for example, application, text, or HTML file), location, name, size, whether it is a read-only, archive, hidden, or system file, and so on. Attribute is also called property.


Enhanced logging capabilities that monitor and manage the growth and size of log files used by DHCP on an ongoing daily basis.


For DNS, the use of zones by DNS servers to register and resolve a DNS domain name.

When a DNS server is configured to host a zone, it is said to be authoritative for names within that zone. DNS servers are granted authority based on information stored in the zone. When a server is listed in the authority records for a zone (the SOA and NS records), it is allowed to respond to queries about domain names that are stored within the zone.

See also zone.


A group of routers exchanging routing information by using a common routing protocol. AS is also called autonomous system.


A router that exchanges routing information with routers that belong to other autonomous systems. The ASBR then advertises external routes throughout the autonomous system. ASBRs can be internal or area border routers, and might or might not be connected to the backbone. ASBR is also called autonomous system boundary router.

See also autonomous system.


The process of adding static routes to the routing table automatically.

When you configure an interface to use auto-static update mode, the router sends a request to other routers and inherits routes. The routes are saved in the routing table as auto-static routes and are kept even if the router is restarted or the interface goes down. Auto-static updates are supported in RIP for IP and RIP for IPX, but are not available for use with OSPF.

See also OSPF; RIPX.


An ATM service type that supports available-bit-rate traffic, minimum guaranteed transmission rate, and peak data rates. ABR also allows bandwidth allocation depending on availability, and it uses flow control to communicate bandwidth availability to the end node. ABR is also called available bit rate.


In OSPF, a router that is connected to the backbone area. This includes routers that are connected to more than one area (area border routers). However, backbone routers do not have to be area border routers. Routers that have all networks connected to the backbone are internal routers.

See also area border router; OSPF.


In Windows NT Server 4.0 or earlier, a computer running Windows NT Server that receives a copy of the domain's directory database (which contains all account and security policy information for the domain).

The copy is synchronized periodically and automatically with the master copy on the primary domain controller (PDC). BDCs also authenticate user logon information and can be promoted to function as PDCs as needed. Multiple BDCs can exist in a domain. Windows NT 3.51 and 4.0 BDCs can participate in a Windows 2000 domain when the domain is configured in mixed mode. BDC is also called backup domain controller.

See also mixed mode; PDC.


A storage method in MS-DOS, Windows, Windows NT, and Windows 2000 for primary partitions, extended partitions, and logical drives.

See also dynamic storage.


A logical volume (spanned, mirrored, striped, or RAID-5) that was created using Windows NT 4.0 or earlier, or a primary or extended partition or logical drive created with Disk Management. You can create basic volumes only on basic disks.

See also basic disk; volume.


An implementation of DNS written and ported to most available versions of the UNIX operating system. The Internet Software Consortium maintains the BIND software. Berkeley Internet Name Domain is also called BIND.

See also BIND boot file; DNS.


A configuration file used by DNS servers running under versions of the Berkeley Internet Name Domain (BIND) software implementation.

The BIND boot file is a text file, Named.boot, where individual lines in the file list boot directives used to initialize service when the DNS server is started. By default, Windows 2000 DNS servers use DNS parameters stored in the Windows 2000 registry, but they allow the use of a BIND boot file as an alternative for reading boot configuration settings.

See also BIND; registry boot.


The information used by client computers to connect, or bind, to services that are available on a network. There is a wide range of information that could be used as bindings, but one example is a service's port number.


A service that runs on the Windows 2000 Server that acts on client boot requests. Boot Information Negotiation Layer is also called BINL.


A set of optional information types defined originally in RFC 1497 for use with BOOTP service and later supported by DHCP. In DHCP, these extensions form the legacy core set of client parameters available and supported by most standard DHCP and BOOTP servers.

See also BOOTP; DHCP.


The agent program or component responsible for relaying BOOTP broadcast messages between a BOOTP server and a client across an IP router.

A BOOTP relay agent supports BOOTP/DHCP message relay as defined in RFCs 1541 and 2131. BOOTP relay agents are provided through configurable software or firmware on some third-party routers or on computers running Windows 2000 by installing the DHCP Relay Agent service.

See also BOOTP; DHCP client.


A protocol used primarily on TCP/IP networks to configure diskless workstations. RFCs 951 and 1542 define this protocol. DHCP is a later boot configuration protocol that uses this protocol. The Microsoft DHCP service provides limited support for BOOTP service. BOOTP is also called Bootstrap Protocol.


A routing protocol designed for use between autonomous systems. BGP is especially useful for detecting routing loops. (See the BGP version 3 specification in RFC 1163, "A Border Gateway Protocol (BGP).") BGP is also called Border Gateway Protocol.

See also autonomous system.


An ITU-T communication standard for high-speed networking that provides new services, including voice, video, and data on the same network. B-ISDN is also called broadband integrated services digital network.

See also ITU-T.


A multicast service on an ELAN that forwards broadcast, multicast, and initial unicast data traffic sent by a LAN emulation client. BUS is also called broadcast and unknown server.

See also ELAN.


A network message sent from a single computer that is distributed to all other devices on the same segment of the network as the sending computer.


A network that supports more than two attached routers and has the ability to address a single physical message to all of the attached routers (broadcast). Ethernet is an example of a broadcast network.


For DNS and WINS, a local information store of resource records for recently resolved names of remote hosts. Typically, the cache is built dynamically as the computer queries and resolves names. It also helps optimize the time required to resolve queried names.

See also cache file; naming service; resource record.


A file used by DNS to preload its names cache when service is started.

A cache file is also known as the "root hints" file because DNS uses resource records stored in this file to help locate root servers that provide referral to authoritative servers for remote names. For Windows DNS servers, the cache file is named Cache.dns and is located in the %Systemroot%\System32\Dns folder.

See also authoritative; cache; systemroot.


For DNS, typically the server-side ability of DNS servers to store information learned about the domain namespace during the processing and resolution of name queries. With Windows 2000, caching is also available through the DNS Client service as a way for DNS clients to keep a cache of names information learned during recent queries.

See also caching resolver.


For Windows 2000, a client-side DNS name resolution service that performs caching of recently learned DNS domain name information.

The caching resolver service provides system-wide access to DNS-aware programs for resource records obtained from DNS servers during processing of name queries. Cached data is used for a limited period of time and aged according to the active Time-To-Live (TTL) value. You can set the TTL individually for each resource record (RR). Otherwise, it defaults to the minimum TTL set in the SOA RR for the zone.

See also cache; caching; expire interval; minimum TTL; resolver; resource record; SOA (start-of-authority) resource record; TTL.


A protocol that negotiates callback information with a remote client. Callback Control Protocol is also called CBCP.


A resource record used to map an alternate alias name to a primary canonical DNS domain name used in the zone.

See also resource record.


An object's distinguished name presented with the root first and without the LDAP attribute tags (such as: CN=, DC=). The segments of the name are delimited with forward slashes (/). For example,

CN=MyDocuments,OU=MyOU,DC=Microsoft,DC=Com

is presented as

microsoft.com/MyOU/MyDocuments

in canonical form.

See also distinguished name; LDAP.


A password that allows the user to capture statistics from the network and to display captured data.

See also display password.


A set of conditions that, when met, stop the capture or execute a program or command file to perform another type of action related to the capture.


For DNS, domains located in the namespace tree directly beneath another domain name (the parent domain). For example, "example.microsoft.com" would be a child domain of the parent domain, "microsoft.com". Child domain is also called subdomain.

See also parent domain.


A collection of files, some of which contain PostScript information. When a Macintosh computer sends a print job to a PostScript printer, the printer uses a Chooser Pack to interpret PostScript commands in the print job.

See also PostScript; PostScript printer.


The Macintosh desk accessory with which users select the network server and printers they want to use.


An IP address that ranges from 1.0.0.0 through 126.0.0.0. large networks such as the ARPANET use class A addresses.

See also Class B IP address; Class C IP address; IP address.


An IP address that ranges from 128.1.0.0 through 191.254.0.0. The first three octets indicate the network, and the last octet indicates hosts on the network.

See also Class A IP address; Class C IP address; IP address.


An IP address that ranges from 192.1.1.0 through 223.254.254.0. The first three octets indicate the network, and the last octet indicates hosts on the network. Network Load Balancing provides optional session support for class C IP addresses (in addition to support for single IP addresses) to accommodate clients that make use of multiple proxy servers at the client site.

See also Class A IP address; Class B IP address; IP address.


A proposed Internet standard, described in RFC 2225, that allows IP communication directly on the ATM layer, bypassing an additional protocol (such as Ethernet or Token Ring) in the protocol stack. CLIP is also called classical IP over ATM.

See also ATM; IP.


Passwords that are not scrambled, thus making them more susceptible to network sniffers.


For DHCP, an optional server-side mechanism for detecting if a scope IP address is in use on the network. When enabled, the DHCP server will ping an address first before offering that address to clients, and then it will briefly await a response. If the pinged address responds, a conflict is registered and that address is not offered to clients obtaining a lease from the server.


A user who has access to a computer or a resource across the network.


A network protocol in which a sender broadcasts traffic on the network to an intended receiver without first establishing a connection to the receiver.


A network protocol that requires an end-to-end virtual connection between the sender and receiver before communicating across the network.


An ATM service type that supports constant bandwidth allocation. CBR ensures that all cells in a transmission are maintained from end to end. This service type is used for voice and video transmission that require little or no cell loss and rigorous timing controls during transmission. CBR is also called constant bit rate. See also ATM.


The process of stabilizing after changes occur in the network. If a route becomes unavailable, routers send update messages throughout the networks, reestablishing information about preferred routes. Slow routing convergences can cause loops.

For Network Load Balancing, convergence is a process by which Network Load Balancing hosts exchange messages to determine a new, consistent state of the cluster and to elect the host with the highest host priority, known as the default host. During convergence, a new load distribution is determined for hosts that share the handling of network traffic for specific TCP or UDP ports.

See also cluster; default host; host; UDP.


A loop that happens when a link in a network goes down and routers on the network update their routing tables with incorrect hop counts.

For example, a loop can develop if the link to Router C goes down. Router B then advertises that the link is down and that it has no route to C. Because Router A has a route to C with a metric of 2, it responds to Router B and sends its link to C. Router B then updates its table to include a link with metric 3, and the routers continue to announce and update their links to C until they reach the number 16. This is a count to infinity.


Objects in which Active Directory stores information about directory partitions and external directory services. An example of an external directory service is another LDAP-compliant directory.

See also directory partition; LDAP.


One of two forks (resource fork and data fork) that make up each Macintosh file. The data fork holds most of the file's information and is shared between Macintosh and personal computer clients.

See also resource fork.


The zone to which all Macintosh clients on the network are assigned by default.


The ability to assign responsibility for management and administration of a portion of the namespace to another user, group, or organization.

See also inheritance; parenting.


A connection that initiates a link to a remote site when data or routing information must be sent to that site, and closes the connection when a specified amount of time has passed without data being sent over the link.


Routing that makes switched connections to connect networks across WANs based on need. For example, connecting branch offices with a modem that dials and establishes a connection only when there is network traffic from one office to another. This feature helps save long-distance connection costs.


The zone in which AppleTalk network integration (formerly Services for Macintosh) appears on the network.

See also default zone.


A message sent by the DHCP server to a client to acknowledge and complete a client's request for leased configuration. This message will contain a committed IP address for the client to use for a stated period of time along with other optional client parameters. The DHCP acknowledgment message name is DHCPACK.


A special reserved option type used by DHCP clients to optionally identify membership in a specific DHCP option class, either a vendor or user class.

For vendor class identification, hardware vendors can choose to predefine specific identifier values; for example, to identify a client's hardware configuration. For user class identification, values can be defined administratively to identify a logical group of DHCP clients, such as all clients in a particular building and floor location.


Any network-enabled device that supports the ability to communicate with a DHCP server for the purpose of obtaining dynamic leased IP configuration and related optional parameters information.

See also DHCP server; lease.


A message sent by a DHCP client to the DHCP server to decline the offer of an IP address on the network. This message is used when the client detects a potential conflict because the IP address is found to be already in use on the network. The DHCP decline message name is DHCPDECLINE.


A reserved DHCP message type used by computers on the network to request and obtain information from a DHCP server for use in their local configuration. When this message type is used, the sender is already externally configured for its IP address on the network, which may or may not have been obtained using DHCP. The DHCP information message name is DHCPINFORM.


A message sent by a DHCP server to a client to indicate that the IP address that the client requested is not correct for the local IP network served by the DHCP server. This message is most often used when the client computer was moved to a new location, but it could also indicate that the client's lease with the server has expired. The DHCP negative acknowledgment message name is DHCPNAK.


A message used by DHCP servers to offer the lease of an IP address to a DHCP client when it starts on the network. When this message is used, a client can receive more than one offer if multiple DHCP servers are contacted during the DHCP discovery phase, but the client will typically select the first address it is offered. The DHCP offer message name is DHCPOFFER.


The agent program or component responsible for relaying DHCP and BOOTP broadcast messages between a DHCP server and a client across an IP router. A DHCP relay agent supports BOOTP/DHCP message relay as defined in RFCs 1541 and 2131. For Windows 2000 Server, the DHCP Relay Agent service is managed using the Routing and Remote Access service.

See also DHCP client; DHCP server.


A message sent by clients to the DHCP server to indicate release of its leased IP address. The client uses this message to cancel its currently active lease. You can perform address release manually using the ipconfig /release command at a command prompt. The DHCP release message name is DHCPRELEASE.


A message sent by clients to the DHCP server to request or renew lease of its IP address. The client uses this message under the following conditions:

To select and request a lease from a specific DHCP server when lease offers were made simultaneously from several different servers.

To confirm a previously leased IP address after the client system is restarted.

To extend the current IP address lease for the client.

The DHCP request message name is DHCPREQUEST.


In Windows 2000 Server, a computer running the Microsoft DHCP service that offers dynamic configuration of IP addresses and related information to DHCP-enabled clients.


A standard dial-up connection such as telephone and ISDN lines.


A special communication line that uses modulation technology to maximize the amount of data that can be sent over copper wires. DSL is used for connections from telephone switching stations to a subscriber rather than between switching stations. DSL is also called digital subscriber line.


An information source (for example, a telephone directory) that contains information about people, computer files, or other objects. In a file system, a directory stores information about files. In a distributed computing environment (such as a Windows 2000 domain), the directory stores information about objects such as printers, fax servers, applications, databases, and other users.


The physical storage for each replica of Active Directory. Directory database is also called the store.


The copying of a master set of directories from a server (called an export server) to specified servers or workstations (called import computers) in the same or other domains. Replication simplifies the task of maintaining identical sets of directories and files on multiple computers because only a single master copy of the data must be maintained. Files are replicated when they are added to an exported directory and every time a change is saved to the file.


A process by which the Windows 2000 Net Logon service attempts to locate a domain controller running Windows 2000 Server in the trusted domain. Once a domain controller has been discovered, it is used for subsequent user account authentication.


A password that allows the user to open only previously saved capture (.cap) files.

See also capture password.


A name that uniquely identifies an object by using the relative distinguished name for the object, plus the names of container objects and domains that contain the object. The distinguished name identifies the object as well as its location in a tree. Every object in Active Directory has a distinguished name. A typical distinguished name might be

CN=MyName,CN=Users,DC=Microsoft,DC=Com

This identifies the "MyName" user object in the microsoft.com domain.


In Windows 2000 and Active Directory, a collection of computers defined by the administrator of a Windows 2000 Server network that share a common directory database.

A domain has a unique name and provides access to the centralized user accounts and group accounts maintained by the domain administrator. Each domain has its own security policies and security relationships with other domains and represents a single security boundary of a Windows 2000 computer network. Active Directory is made up of one or more domains, each of which can span more than one physical location.

For DNS, a domain is any tree or subtree within the DNS namespace. Although the names for DNS domains often correspond to Active Directory domains, DNS domains should not be confused with Windows 2000 and Active Directory networking domains.

See also directory partition.


A security or distribution group that can contain universal groups, global groups, and accounts from any domain in the domain tree or forest. A domain local group can also contain other domain local groups from its own domain. Rights and permissions can be assigned only at the domain containing the group.

See also distribution group; domain tree; forest; global group; security group; universal group.


A grouping of one or more domains with administration and communication links between them that are arranged for the purpose of user and resource management.


In Windows 2000 and Active Directory, the name given by an administrator to a collection of networked computers that share a common directory.

For DNS, domain names are specific node names in the DNS namespace tree. DNS domain names use singular node names, known as "labels," joined together by periods (.) that indicate each node level in the namespace.

See also DNS; label; namespace.


The parent DNS domain name that is used to root either a zone or a resource record within a zone. This name is joined to the end of unqualified or relative domain names to form a fully qualified domain name (FQDN) within the zone. In DNS Manager, the domain of origin will correspond to Zone name as it appears in the Add Zone wizard or the name that appears in the Parent domain name field for any resource records created within the zone.

See also FQDN; relative name.


For DNS, an optional parent domain name that can be appended to the end of a relative domain name used in a name query or host lookup. The domain suffix can be used to complete an alternate fully qualified DNS domain name to be searched when the first attempt to query a name fails.

See also parent domain.


In DNS, the inverted hierarchical tree structure that is used to index domain names.

Domain trees are similar in purpose and concept to the directory trees used by computer filing systems for disk storage.

For example, when numerous files are stored on disk, directories can be used to organize the files into logical collections. When a domain tree has one or more branches, each branch can organize domain names used in the namespace into logical collections.

In Active Directory, one or more Windows 2000 domains connected by transitive, bidirectional trust, sharing a common schema, configuration, and global catalog. The hierarchical structure of domains within a tree forms a contiguous namespace. Multiple trees can be connected to form a forest.

See also domain name; forest; global catalog; namespace; schema.


For Windows 2000 Server, the way in which DNS performs case-insensitive handling of DNS domain names. Windows DNS servers use downcasing to convert any uppercase letters used in domain names to equivalent lowercase letters. For example, the name "HOST.example.Microsoft.com" would be downcased to "host.example.microsoft.com".

See also upcasing.


An updated specification to the DNS standard that permits hosts that store name information in DNS to dynamically register and update their records in zones maintained by DNS servers that can accept and process dynamic update messages.


The process of real-time routing changes in response to network changes. Dynamic routing software adjusts routes based on the routing update messages it receives and then distributes update messages about its new routes.


A storage method in Windows 2000 that allows disk and volume management without requiring operating system restart.

See also basic storage.


A logical ATM network that emulates the services of an Ethernet or Token Ring LAN. ELAN is also called emulated local area network.


The method used to pass data from one protocol over a network within a different protocol. Data from one protocol is wrapped with the header of a different protocol. Encapsulation is described in RFC 1483.


A small range of one or more IP addresses within a DHCP scope excluded from the DHCP service. Exclusion ranges ensure that these scope addresses will never be offered to clients by the DHCP server.


For DNS, the number of seconds that DNS servers operating as secondary masters for a zone will use to determine if zone data should be expired when the zone is not refreshed and renewed.

See also secondary master; zone.


The association of an MS-DOS file name extension with a Macintosh file type and file creator. Extension-type associations allow users of the personal computer and Macintosh versions of the same program to share the same data files on the server. AppleTalk network integration (formerly Services for Macintosh) has many predefined extension-type associations.


A four-character sequence that tells the Macintosh Finder the name of the program that created a file. With AppleTalk network integration (formerly Services for Macintosh), you can create extension-type associations that map personal computer file name extensions to Macintosh file creators and file types. These associations allow both personal computer and Macintosh users to share the same data files on the server.

See also extension-type association.


One of two subfiles of a Macintosh file. When Macintosh files are stored on a computer running Windows 2000 Server, each fork is stored as a separate file. Each fork can be independently opened by Macintosh users.


The Microsoft File Replication service (FRS) provides multi-master file replication for designated directory trees between designated Windows 2000 servers. The designated directory trees must be on disk partitions formatted with the version of NTFS used with Windows 2000. FRS is used by the Microsoft Distributed file system (Dfs) to automatically synchronize content between assigned replicas, and by Active Directory to automatically synchronize content of the system volume information across domain controllers.


A combination of hardware and software that provides a security system, usually to prevent unauthorized access from outside to an internal network or intranet.

A firewall prevents direct communication between network and external computers by routing communication through a proxy server outside of the network. The proxy server determines whether it is safe to let a file pass through to the network. A firewall is also called a security-edge gateway.


A collection of one or more Windows 2000 domains that share a common schema, configuration, and global catalog and are linked with two-way transitive trusts.

See also domain tree; global catalog; schema; transitive trust; two-way trust.


In DNS, a query process in which the friendly DNS domain name of a host computer is searched to find its IP address. In DNS Manager, forward lookup zones are based on DNS domain names and typically hold host (A) address resource records.


A DNS server designated by other internal DNS servers to be used to forward queries for resolving external or offsite DNS domain names.


The standard query type supported by all DNS servers to update and synchronize zone data when the zone has been changed. When a DNS query is made using AXFR as the specified query type, the entire zone is transferred as the response. AXFR is also called full zone transfer.

See also IXFR; secondary master; zone; zone transfer.


A DNS domain name that has been stated unambiguously so as to indicate with absolute certainty its location in the domain namespace tree. Fully qualified domain names differ from relative names in that they are typically stated with a trailing period (.), for example, "host.example.microsoft.com", to qualify their position to the root of the namespace. Fully qualified domain name is also called FQDN.


A NetWare user account that belongs to the NTGATEWAY group. The account is used to create an authenticated connection from a computer running Windows 2000 Server to a NetWare server.

Gateway accounts can be granted maximum permissions on NetWare servers.


For Windows 2000 Server, a normal user account in a user's domain. Most user accounts are global accounts. If there are multiple domains in the network, it is best if each user in the network has only one user account in only one domain, and each user's access to other domains is accomplished through the establishment of domain trust relationships.

See also local account.


A domain controller that contains a partial replica of every domain in Active Directory. In other words, a global catalog holds a replica of every object in Active Directory, but with a limited number of each object's attributes. The global catalog stores those attributes most frequently used in search operations (such as a user's first and last names) and those attributes required to locate a full replica of the object.

The Active Directory replication system builds the global catalog automatically. The attributes replicated into the global catalog include a base set defined by Microsoft. Administrators can specify additional properties to meet the needs of their installation.

See also replication.


The follow-up queries or successive lookups that are made to resolve glue records in a zone to other remote DNS servers that are authoritative for a derivative zone.

When glue chasing is performed, name server (NS) resource records for delegated DNS servers are "chased" or followed by using successive queries to resolve the servers named in NS records to their host address (A) resource records and to obtain server IP addresses.

See also delegation; glue records.


Resource records for out-of-zone information used to provide helpful pointer information for locating DNS servers that have been delegated authority for specific subdomains derived from a zone's domain of origin. These records are used to "glue" zones together and provide an effective delegation and referral path for other DNS servers to follow when performing a recursive lookup to fully resolve a name.

See also delegation; domain of origin; glue chasing; recursion.


An Address Resolution Protocol (ARP) request broadcast by a TCP/IP-based client to a network to check for a conflict with its configured IP address.

A gratuitous ARP resolves the client's configured IP address to its hardware or media access control address prior to initializing and using that IP address on the network. Gratuitous ARP requests ensure that the client's IP address is not already in use elsewhere on the network. If the client receives a reply to the gratuitous ARP request from another host or computer, it detects a conflict for its configured IP address and will not use it.


The fifth byte in the ATM cell header used to detect and correct errors in the ATM header. HEC is also called header error control.


An internetwork with servers and workstations running different operating systems, such as Windows 2000, Macintosh, or Novell NetWare, using a mix of different transport protocols.


The portion of the IP address that identifies a computer within a particular network ID.


The name of a device on a network. For a device on a Windows NT or Windows 2000 network, this can be the same as the computer name, but it may not be. The host name must be in the Hosts file, or it must be known by a DNS server, for that host to be found by another computer attempting to communicate with it.

See also Hosts file.


A local text file in the same format as the 4.3 Berkeley Software Distribution (BSD) UNIX /etc/hosts file. This file maps host names to IP addresses. In Windows 2000, this file is stored in the \%Systemroot%\System32\Drivers\Etc folder.

See also systemroot.


A network-enabled device joining communication lines at a central location, providing a common connection to all devices on the network.


A protocol used by IP hosts to report their multicast group memberships to any immediately neighboring multicast routers. IGMP is also called Internet Group Membership Protocol.

See also multicasting; protocol.


A circumstance that occurs when Windows 2000 Server allows one process to take on the security attributes of another.


A name known by a DNS service that includes a list of the specific addresses of systems that have registered the name.

See also DNS.


An alternate query type that can be used by some DNS servers to update and synchronize zone data when a zone is changed. When incremental zone transfer is supported between DNS servers, servers can keep track of and transfer only those incremental resource record changes between each version of the zone. Incremental zone transfer is also called IXFR.

See also AXFR; secondary master; zone; zone transfer.


A mechanism that allows a given access control entry (ACE) to be copied from the container where it was applied to all children of the container. Inheritance can be combined with delegation to grant administrative rights to a whole subtree of the directory in a single update operation.

See also ACE; delegation.


A limited set of SNMP functions included in the ATM specification for the ATM user-to-network interface (UNI). ILMI is also called integrated local management interface.

See also UNI.


A router for which all the networks that it is connected to belong in the same area.


A large open community of network designers, operators, vendors, and researchers concerned with the evolution of Internet architecture and the smooth operation of the Internet.

Technical work is performed by working groups organized by topic areas (such as routing, transport, and security) and through mailing lists. Internet standards are developed in IETF Requests for Comments (RFCs), which are a series of notes that discuss many aspects of computing and computer communication, focusing on networking protocols, programs, and concepts. The IETF is also called the Internet Engineering Task Force.


A service that supports transports for asynchronous, site-to-site messaging. Each transport serves two major roles: send/receive and topology queries (such as, what are the various sites connected by this transport, and at what cost?). The intersite messaging services shipped in Windows 2000 are RPC and SMTP (mail). Intersite messaging service is also called ISM.

See also RPC; SMTP.


One of the two process types (iteration and recursion) for DNS name resolution.

In this process, a client will request a DNS server to answer a query. In the request, the client is given the best answer to the query that the server can provide based on current information without seeking assistance from other DNS servers to help answer the query. If the DNS server is authoritative for the requested name, it will answer the query with a complete and definitive answer. If not, the server will return referral information that will direct the client to other DNS servers that are more likely to have an answer.

See also iterative query; recursion; referral.


A query made to a DNS server in which the requester instructs the server that it expects the best answer the server can provide without seeking further help from other DNS servers. Iterative queries are also sometimes called nonrecursive queries.

See also iteration; recursion; referral.


Each part of a full DNS domain name that represents a node in the domain namespace tree. Domain names are made up of a sequence of labels, such as the three labels ("example", "microsoft", and "com") that make up the DNS domain name "example.microsoft.com". Each label used in a DNS name must be 63 bytes or less in character length.


A set of protocols that allow existing Ethernet and Token Ring LAN services to overlie an ATM network. LANE allows connectivity among LAN- and ATM-attached stations. LANE is also called LAN emulation.

See also ATM.


The client on an ELAN that performs data forwarding, address resolution, and other control functions. The LEC resides on end stations in an ELAN. LEC is also called LAN emulation client.

See also ATM; ELAN; LANE.


The central control point for an ELAN. The LAN emulation server enables LANE clients to join the ELAN and resolves LAN addresses to ATM addresses. LAN emulation server is also called LES.

See also ATM; ELAN; LANE.


The service that assigns individual LANE clients to particular ELANs by directing them to the LAN emulation service (LES). LECS is also called LANE emulation configuration server.

See also ELAN; LANE; LES.


In Active Directory replication, the delay between the time an update is applied to a given replica and the time it is applied to some other replica. Latency is sometimes referred to as propagation delay.

See also replication.


Files that contain LDAP instructions that manipulate directory information. Before the LDAP commands in an LDIF file are carried out, they can be read or modified, providing an opportunity for fine-tuning. LDIF is also called LDAP Data Interchange Format.

See also LDAP.


The length of time for which a DHCP client can use a dynamically assigned IP address configuration. Before the lease time expires, the client must either renew or obtain a new lease with DHCP.


The primary access protocol for Active Directory. Lightweight Directory Access Protocol (LDAP) version 3 is defined by a set of Proposed Standard documents in Internet Engineering Task Force (IETF) RFC 2251.


A map of the network maintained by OSPF routers. It is updated after any change in the network topology. The link state database is used to compute the network routes, which must be computed again after any change in the topology.

See also OSPF.


For Windows 2000 Server, a user account provided in a domain for a user whose global account is not in a trusted domain. A local account is not required where trust relationships exist between domains.

See also global account.


A service that performs a specific operating system function for other local processes on the computer.


For Windows 2000 Server, NTFS file system disk volumes used as primary data storage. Such disk volumes can be managed by Remote Storage by copying infrequently accessed files to remote (secondary) storage.

See also remote storage.


The Apple networking hardware built into every Macintosh computer. LocalTalk includes the cables and connector boxes that connect components and network devices that are part of the AppleTalk network system. LocalTalk was formerly known as the AppleTalk Personal Network.


A group of IP hosts that belong to the same IP subnet. LIS is also called logical IP subnet.


In Windows 2000 Server, the computers from which a user is allowed to log on.


A form of domain name checking DNS uses that examines characters in DNS names for valid ANSI character compliance. However, loose name checking does not check for compliance with DNS naming requirements and valid character usage for Internet host names, as specified in RFC 1123, "Requirements for Internet Hosts -- Applications and Support."

For RFC compliance, DNS domain names will use name labels made up only of valid uppercase and lowercase letters, number characters, and hyphens (A through Z, a through z, 0 through 9, and –) separated by periods.

See also domain name; label; strict RFC checking.


A service model that requires specific computers and services be used to complete a task. If a user must connect to a specific computer to access a service, then that service is considered machine-centric.

See also service-centric.


Storage space on the server used for folders and files of Macintosh users.

A Macintosh-accessible volume is equivalent to a shared folder for personal computer users. Each Macintosh-accessible volume on a computer running Windows 2000 Server will correspond to a folder. Both personal computer users and Macintosh users can be given access to files located in a folder that is designated as both a shared folder and a Macintosh-accessible volume.


Folder and volume permissions that are similar to the access privileges used on a Macintosh.


For Windows 2000 Server, a local NTFS file system 5.0 volume whose disk space is managed by Remote Storage. Remote Storage frees up disk space by automatically moving infrequently accessed files to a remote storage device.

See also local storage; remote storage.


An authoritative DNS server for a zone. Master servers can vary and will be one of two types (either primary or secondary masters), depending on how the server obtains its zone data.

See also primary master; secondary master; zone; zone transfer.


The period of time a password can be used before the system requires the user to change it.


The API for which Active Directory provides support for backward compatibility with Microsoft Exchange applications. New applications should use Active Directory Service Interfaces for accessing Active Directory. Messaging API is also called MAPI.

See also Active Directory Service Interfaces.


The distance in number of hops to the destination; its "cost" to the router.


The fewest characters a password can contain.


A default Time-To-Live (TTL) value set in seconds for use with all resource records in a zone.

This value is set in the start-of-authority (SOA) resource record for each zone. By default, the DNS server includes this value in query answers to inform recipients how long it may cache and use resource records provided in the query answer before they must expire the cached records data. When TTL values are set for individual resource records, those values will override the minimum TTL.

See also SOA (start-of-authority) resource record; TTL.


The default domain mode setting on Windows 2000 domain controllers. Mixed mode allows Windows NT and Windows 2000 backup domain controllers to co-exist in a domain. Mixed mode does not support the universal and nested group enhancements of Windows 2000. The domain mode setting can be changed to Windows 2000 native mode when all Windows NT domain controllers are removed from a domain.

See also native mode.


In DNS, extended characters supported in some Unicode character sets that use more than a single byte for encoding individual characters. Windows 2000 DNS servers use the Unicode Transformation Format 8 (UTF-8) encoding scheme described in RFC 2044 to interpret and transform multibyte characters into single-byte characters of 8-bit length.

See also UTF-8.


An IP datagram sent to a select multicast group of hosts. Each datagram is sent from a single host source for transmission and delivery to multiple host destinations using the Class D IP address reserved for a specified multicast group.


An extension to DHCP that provides for automating distribution of multicast address configurations for network clients.

The MDHCP extensions use the DHCP client/server model to provide address distribution and dynamic configuration of Class D-range multicast IP addresses using the standard DHCP lease process for clients that communicate with an MDHCP-capable server. Windows 2000 Server provides server-side support by providing MDHCP capabilities as part of DHCP. For clients to support MDHCP configuration, they must use programs written using the new multicast DHCP API calls available for Windows 2000. MDHCP is also called multicast DHCP.


A range of multicast group IP addresses in the Class D address range that are available to be leased or assigned to multicast DHCP clients by DHCP.

See also address classes; lease; multicast DHCP.


A protocol that enables routing over IP and IPX networks by connecting LANs or by connecting LANs to WANs. Multiprotocol Routing is also called MPR.


A special top-level DNS domain reserved for reverse mapping of IP addresses to DNS host names.

See also reverse lookup; top-level domains.


A Windows 2000 feature that enables file system access by MS-DOS and Windows 3.x users to NTFS file system and FAT volumes, and that enables user account assignments for Kerberos protocol users from non-Windows 2000 Kerberos realms or for external (nonenterprise) users with X.509 certificates.

For file system access, Windows 2000 allows share names of up to 255 characters, as opposed to MS-DOS and Windows 3.x, which are restricted to eight characters followed by a period and an extension of up to three characters. Each file or folder with a name that does not conform to the MS-DOS 8.3 standard is automatically given a second name that does. MS-DOS and Windows 3.x users connecting to the file or directory over the network see the name in the 8.3 format; Windows 2000 users see the long name.


A resource record used in a zone to designate the DNS domain names for authoritative DNS servers for the zone. Name server resource record is also called NS resource record.

See also resource record.


In Active Directory, any contiguous branch, or a subtree within a tree.

Naming context is a term used in X.500 and carried over into the LDAP standards. The preferred term in Active Directory is "directory partition." Active Directory is made up of one or more naming contexts containing data about an organization's specific implementation of Active Directory. Windows 2000 Server domain controllers replicate data by using naming contexts as the unit of replication. The directory always has at least these naming contexts:

The schema, which defines the object classes and attributes contained in Active Directory.

The configuration context, which identifies the domain controllers, replication topology, and other related information about the domain controllers within a specific implementation of Active Directory.

One or more domains that contain the actual directory object data.

A domain controller always stores the naming contexts for the schema, configuration, and (only) its domain.

See also directory partition; domain tree; schema.


A service such as that provided by WINS or DNS that allows friendly names to be resolved to address or other specially defined resource data used to locate network resources of various types and purposes.


The condition in which all domain controllers in the domain have been upgraded to Windows 2000 and an administrator has enabled native mode operation (through Active Directory Users and Computers).

See also mixed mode.


A situation in which computers that use and query DNS cache negative responses to a query for a limited period of time. A negative response is obtained when a DNS server directly answers a name query, indicating that no records of the requested DNS domain name were found to exist. The use of this kind of caching can help speed the response for successive queries from other computers for the same name.


A method DNS uses to give ordering and preference to IP addresses on the same network when a requesting client queries for a host name that has multiple host address (A) type resource records. This is designed so that the client program will attempt to connect to a host using the closest (and fastest) IP address available.


The device that accepts PPP connections and places clients on the network that the NAS serves. NAS is also called network access server.


A Microsoft/3Com specification establishing a common shared interface for Windows 2000 and other Microsoft operating systems to support protocol-independent transport of multiple network transport protocols (such as TCP/IP, NetBEUI, IPX/SPX, and AppleTalk). NDIS allows more than one transport protocol to be bound and to operate simultaneously over a single network adapter. NDIS is also called network driver interface specification.


A service for distributed computing systems that provides a distributed file system, eliminating the need for keeping multiple copies of files on separate computers. NFS is also called network file system.


The portion of the IP address that identifies a group of computers and devices located on the same logical network.


A service for distributed computing systems that provides a distributed database system for common configuration files. NIS is also called Network Information Service.


The type of physical wiring and lower-layer protocols used for transmitting and receiving packets. For example, Ethernet, FDDI, and Token Ring.


An IP address that includes a subnet bit-mask. Active Directory uses the subnet bit-mask to recognize sites and establish how replication of directory information will occur.


An interface that defines how switches in a network communicate with each other. NNI is also called network-to-network interface.


A list maintained by the primary master for a zone of other DNS servers that should be notified when zone changes occur. The notify list is made up of IP addresses for DNS servers configured as secondary masters for the zone. When the listed servers are notified of a change to the zone, they will initiate a zone transfer with another DNS server and update the zone.

See also primary master; secondary master; zone; zone transfer.


A command-line utility that allows you to make DNS queries for testing and troubleshooting your DNS installation. Nslookup was originally released with the BIND implementation of DNS. For Windows 2000, a version of Nslookup is available for use with DNS.

See also BIND.


A label that uniquely identifies an object class or attribute.

An object identifier is represented as a dotted decimal string (for example, 1.2.3.4). Object identifiers form a hierarchy with the root object identifier being issued by a national registration authority responsible for issuing object identifiers.

In the United States, this is the American National Standards Institute (ANSI). Organizations or individuals obtain a root object identifier from an issuing authority and use it to allocate additional object identifiers as they develop new classes and attributes.

For example, Microsoft has been issued the root object identifier of 1.2.840.113556. Microsoft uses one of the branches from this root object identifier to allocate object identifiers for Active Directory classes and another branch for Active Directory attributes.


A routing protocol used in medium-sized and large networks. This protocol is more complex than RIP but allows better control and is more efficient in propagation of routing information. OSPF is also called Open Shortest Path First.


The client-side wizard that walks a user through the installation of an operating system or provides access to maintenance and troubleshooting utilities.


A four-layered conceptual model (consisting of Application, Transport, Internet, and Network Interface layers) to which TCP/IP protocols map. Each layer in this TCP/IP model corresponds to one or more layers of the International Standards Organization (ISO) seven-layer OSI model consisting of Application, Presentation, Session, Transport, Network, Data-link, and Physical. OSI is also called the Open Systems Interconnection model.


For DNS, domains that are located in the namespace tree directly above other derivative domain names (child domains). For example, "microsoft.com" would be the parent domain for "example.microsoft.com", a child domain.

See also child domain.


The concept of managing the growth and delegation of a parent domain into further child domains, which are derived and delegated from the parent name.

See also child domain; parent domain.


A virtual circuit assigned to a preconfigured static route. PVC is also called permanent virtual circuit.


A utility that verifies connections to one or more remote hosts. The ping command uses the ICMP echo request and echo reply packets to determine whether a particular IP system on a network is functional. Ping is useful for diagnosing IP network or router failures.

See also ICMP.


A NetBIOS implementation that uses point-to-point communication with a name server to resolve names as IP addresses.


The local access point for a network provider. Each POP provides a telephone number that allows users to make a local call for access to online services. POP is also called point of presence.


A resource record used in a reverse lookup zone created within the in-addr.arpa domain to designate a reverse mapping of a host IP address to a host DNS domain name.

See also in-addr.arpa domain; resource record.


A process that, used with split horizon, improves RIP convergence over simple split horizon by advertising all network IDs. However, the network IDs learned in a given direction are advertised with a hop count of 16, indicating that the network is unavailable.

See also split horizon.


The method TCP and UDP use to specify which program running on the system is sending or receiving the data.


In a Windows NT Server 4.0 or earlier domain, the computer running Windows NT Server that authenticates domain logons and maintains the directory database for a domain. The PDC tracks changes made to accounts of all computers on a domain. It is the only computer to receive these changes directly. A domain has only one PDC.

In Windows 2000, one of the domain controllers in each domain is identified as the PDC for compatibility with Windows NT 4.0 and earlier versions of Windows NT. PDC is also called primary domain controller.

See also BDC; mixed mode.


The group with which a Macintosh user usually shares documents stored on a server. You specify a user's primary group in the user's account. When a user creates a folder on the server, the user's primary group is set by default as the folder's associated group.


An authoritative DNS server for a zone that can be used as a point of update for the zone. Only primary masters have the ability to be updated directly to process zone updates, which include adding, removing, or modifying resource records that are stored as zone data. Primary masters are also used as the first sources for replicating the zone to other DNS servers.

See also secondary master.


The ATM Forum standard that defines the interface between ATM switches in a private network or a public network. PNNI is also called Private or Public Network-to-Network Interface.


A Macintosh-accessible volume that is accessible by only one Macintosh user.

For a volume to be a private volume, the permissions on its root directory must give the volume's owner all three permissions (Make Changes, See Files, and See Folders), while giving the "primary group" and "everyone" categories no permissions at all. When a private volume's owner uses the Chooser to view the volumes available on the server, the private volume is listed; however, no other users can see the private volume when viewing the volumes available on the server.


A dynamic-link library (DLL) that identifies the protocols used to send a frame onto the network.


A WINS service that pulls in replicas from its push partner by requesting them and then accepting the pushed replicas.

See also push partner.


A WINS service that sends replicas to its pull partner upon receiving a request from it.

See also pull partner.


A set of quality-assurance standards and mechanisms for data transmission, implemented in Windows 2000. QoS is also called quality of service.


An Internet protocol for transporting real-time traffic over multicast and unicast network services. RTP is also called real-time transport protocol.

See also unicast.


A state used by DHCP clients to extend and renew their address lease when the current lease is close to expiring. In this state, the client broadcasts to the network to locate any DHCP server that can either renew or replace its currently leased configuration. The rebinding state begins when 87.5 percent of the client's lease time has elapsed.

See also lease.


The process of making the client lease information stored in the DHCP server database consistent with a duplicate copy of this same information stored in the Windows 2000 registry. Using DHCP Server Management, reconciliation helps restore or recover the contents of the DHCP server database file, Dhcp.mdb, located in the %Systemroot%\System32\Dhcp folder.

See also systemroot.


One of the two process types (iteration and recursion) for DNS name resolution.

In this process, a resolver (a DNS client) will request that a DNS server provide a complete answer to a query that does not include pointers to other DNS servers. When a client makes a query and requests that the server use recursion to answer, it effectively shifts the workload of resolving the query from the client to the DNS server. If the DNS server supports and uses recursion, it will contact other DNS servers as necessary (using iterative queries on behalf of the client) until it obtains a definitive answer to the query. This type of resolution allows the client resolver to be small and simple.

See also iteration; iterative query; recursive query.


A query made to a DNS server in which the requester asks the server to assume the full workload and responsibility for providing a complete answer to the query. The DNS server will then use separate iterative queries to other DNS servers on behalf of the requester to assist in completing an answer for the recursive query.

See also iteration; iterative query; recursion.


Pointer information sent in by a DNS server in answer to an iterative or nonrecursive query that refers the client to other DNS servers that are more likely to have an answer.

See also iteration; iterative query.


A server that responds to requests for service from remote installation clients. It refers clients to other remote installation servers where they can install Windows 2000 Professional. The referral server does not directly host client computers for installing the operating system.

See also host server.


An interval of time used by secondary masters of a zone to determine how often to check if their zone data needs to be refreshed.

When the refresh interval expires, the secondary master checks with its source for the zone to see if its zone data is still current or if it needs to be updated using a zone transfer. This interval is set in the SOA (start-of-authority) resource record for each zone.

See also resource record; secondary master; SOA; zone; zone transfer.


The default boot option used by most Windows 2000 DNS servers. When registry boot is used, DNS is started and initialized using DNS parameters and their values as they are stored in the Windows 2000 registry. You can use a Berkeley Internet Name Domain (BIND) boot file as an alternative to this method of boot configuration for DNS.

See also BIND boot file.


The part of an object's distinguished name that is an attribute of the object itself. For most objects this is the Common Name attribute. For security principals, the default common name is the security principal name, also referred to as the SAM account name.

For the distinguished name

CN=MyName,CN=Users,DC=Microsoft,DC=Com

the relative distinguished name of the "MyName" user object is "CN= MyName". The relative distinguished name of the parent object is "CN=Users".

See also distinguished name.


The partial DNS domain name configured in individual resource records to locate and qualify the record within a zone.

The relative name is joined to the front of the parent domain (domain of origin) for each resource record to form a fully qualified domain name (FQDN) within the zone. In DNS Manager, the relative name will correspond to fields that use record-specific name properties, such as the Host computer name field used in an address (A) resource record.

See also domain of origin; FQDN.


For Windows 2000 Server, a data-management service that extends disk space on the server computer.

Remote Storage copies infrequently accessed files from local (primary) storage to remote (secondary) storage. When local disk space falls below a threshold, data that is cached locally is removed, freeing up disk space. Remote Storage uses Removable Storage to access tapes in a library that are used for secondary storage of data.

See also remote storage; Removable Storage.


For Windows 2000 Server, removable tapes in a library used for secondary data storage. Specified tapes used for secondary data storage are managed by Remote Storage and contain data that is either cached on, or has been removed from, local storage to free up disk space.

See also local storage; Remote Storage.


Client service referral behavior performed using a DNS query to resolve domain names to locate host computers that are service providers for well-known TCP/IP-based network services. Rendezvous for clients uses queries for resource record types such as mail exchanger (MX) or service (SRV) records.


The process of copying data from a data store or file system to multiple computers to synchronize the data.

Active Directory provides multimaster replication of the directory between domain controllers within a given domain The replicas of the directory on each domain controller are writeable. This allows updates to be applied to any replica of a given domain. The replication service automatically copies the changes from a given replica to all other replicas.

See also directory partition.


DNS client programs used to look up DNS name information. Resolvers can be either a small "stub" (a limited set of programming routines that provide basic query functionality) or larger programs that provide additional lookup DNS client functions, such as caching.

See also caching; caching resolver.


One of two forks (resource fork and data fork) that make up each Macintosh file. The resource fork holds Macintosh operating system resources, such as code, menu, font, and icon definitions. Resource forks have no relevance to personal computers, so the resource forks of files on the server are never accessed by personal computer clients.

See also data fork.


Standard database record types used in zones to associate DNS domain names to related data for a given type of network resource, such as a host IP address. Most of the basic resource record types are defined in RFC 1035, but additional RR types have been defined in other RFCs and approved for use with DNS. RR is also called resource record.


A collection of more than one resource record returned in a query response by a DNS server. Resource record sets (RRsets) are used in responses where more than one record is part of the answer.

See also resource record.


A signaling protocol that allows the sender and receiver in a communication to set up a reserved highway for data transmission with a specified quality of service. Resource Reservation Protocol is also called RSVP.


The time, in seconds after the refresh interval expires, used by secondary masters of a zone to determine how often to try and retry contacting its source for zone data to see if its replicated zone data needs to be refreshed.

This interval is set in the SOA (start-of-authority) resource record for each zone.

See also resource record; secondary master; SOA; zone; zone transfer.


In DNS, a query process by which the IP address of a host computer is searched to find its friendly DNS domain name. In DNS Manager, reverse lookup zones are based on the in-addr.arpa domain name and typically hold pointer (PTR) resource records.

See also in-addr.arpa domain; PTR (pointer) resource record.


The highest or uppermost level in a hierarchically organized set of information. The root is the point from which further subsets are branched in a logical sequence that moves from a broad or general focus to narrower perspectives.


Local information stored on a DNS server that provides helping resource records to direct the server to its root servers. For DNS, the root hints are stored in the file Cache.dns, located in the \%Systemroot%\System32\Dns folder. Root hints is also called cache hints.

See also authoritative; namespace; root; root servers; systemroot.


DNS servers that are authoritative for the root of the namespace.

See also authoritative; namespace; root; root hints.


A simple mechanism used by DNS servers to share and distribute loads for network resources. Round robin is used to rotate the order of resource record (RR) data returned in a query answer when multiple RRs exist of the same RR type for a queried DNS domain name.

For example, if a query is made for a multihomed computer ("hostname") that uses three IP addresses, with each address specified in its own A-type resource record, as follows:

hostname	IN  A	10.0.0.1

hostname	IN  A	10.0.0.2

hostname	IN  A	10.0.0.3

the DNS server will round robin the order of the IP addresses when answering client requests.

In this example, the first client request will be answered with the addresses ordered 10.0.0.1, 10.0.0.2, and 10.0.0.3. The next client request for the same information will be answered with the order rotated to 10.0.0.2, 10.0.0.3, followed by 10.0.0.1. The rotation process continues until data from all of the same-type resource records associated with a name have been rotated to the top of the list returned in answering client queries.

See also RR.


A scripting utility for the Routing and Remote Access service that is a command-line alternative to the router administration user interface available through Routing and Remote Access.


A series of messages exchanged between routers to propagate network address and connection information.


A domain-unique security principal name in Windows NT 4.0 and earlier.

See also SAM; security principal name.


The process of cleaning and removing extinct or outdated names data from the WINS database.


A description of the object classes and attributes stored in Active Directory. For each object class, the schema defines the attributes an object class must have, the additional attributes it may have, and the object class that can be its parent.

The Active Directory schema can be updated dynamically. For example, an application can extend the schema with new attributes and classes and use the extensions immediately. Schema updates are accomplished by creating or modifying the schema objects stored in Active Directory. Like every object in Active Directory, schema objects have an access control list, so only authorized users may alter the schema.


An authoritative DNS server for a zone that is used as a source for replication of the zone to other servers. Secondary masters update their zone data only by transferring zone data from other DNS servers. They do not have the ability to perform zone updates.

See also master server; primary master; zone transfer.


Domain names that are rooted hierarchically at the second tier of the domain namespace directly beneath the top-level domain names such as ".com" and ".org."

When DNS is used on the Internet, second-level domains are names such as "microsoft.com" that are registered and delegated to individual organizations and businesses according to their top-level classification. The organization then assumes further responsibility for parenting management and growth of its name into additional subdomains.

See also parent domain; parenting; top-level domains.


A Windows 2000 service used during the logon process. SAM maintains user account information, including groups to which a user belongs. SAM is also called security account manager.


A Windows 2000 entity that is automatically assigned a security identifier for access to resources. A security principal can be a user, group, or computer. Windows 2000 uses Active Directory for account management of user and security principals.

See also security principal name.


A name that uniquely identifies a user, group, or computer within a single domain. This name is not guaranteed to be unique across domains.

See also security principal.


The Macintosh-style permission that gives users the right to open a folder and see the files in the folder. When AppleTalk network integration (formerly Services for Macintosh) translates access privileges into Windows 2000 Server permissions, a user who has the See Files and See Folders privileges is given Read permission.

See also See Folders.


The Macintosh-style permission that gives users the right to open a folder and see the files contained in that folder. When AppleTalk network integration (formerly Services for Macintosh) translates access privileges into Windows 2000 Server permissions, a user who has See Files and See Folders privileges is given Read permission.


In the Macintosh environment, initializes and broadcasts routing information about one or more physical networks. This information tells routers where to send each packet of data. On an AppleTalk network, a seed router initially defines the network numbers and zones for a network. AppleTalk network integration (formerly Services for Macintosh) servers can function as seed routers, and you can also use third-party hardware routers as seed routers.


The AppleTalk zone on which a server appears. On a Phase 2 network, a server appears in the default zone of the server's default network.

See also default network; default zone; desired zone; zone.


A resource record used in a zone to register and locate well-known TCP/IP services. The SRV resource record is specified in RFC 2052 and is used in Windows 2000 or later to locate domain controllers for Active Directory Service.

See also resource record.


A service model that does not require that a specific computer be used to complete a task. In a service-centric environment, users need to know only what service they want to use. They do not need to know what computer that service resides on to use it successfully.

See also machine-centric.


A software component of Windows 2000 Server that allows Macintosh users to access a computer running Windows 2000 Server. The services provided with this component allow personal computer and Macintosh users to share files and resources, such as printers on the AppleTalk network or printers attached to the Windows 2000 Server.

See also File Server for Macintosh; Print Server for Macintosh.


A valid MS-DOS or OS/2 8.3 file name (with up to 8 characters followed by a period and an extension of up to 3 characters) that a computer running Windows 2000 Server creates for every Macintosh folder name or file name on the server. Personal computer users refer to files on the server by their short names; Macintosh users refer to them by their long names.

See also name mapping.


A protocol that uses signaling to request, route, accept, and tear down virtual circuits.


A component that saves disk space on the server by maintaining a single physical copy of all identical files found. If SIS finds a duplicate file on the server, it copies the original file into the SIS store and leaves a link where the original resided. This technology is used only with Remote Installation Services. SIS is also called Single Instance Store.

See also Remote Installation Services.


One or more well connected (highly reliable and fast ) TCP/IP subnets. A site allows administrators to configure Active Directory access and replication topology quickly and easily to take advantage of the physical network. When users log on, Active Directory clients locate Active Directory servers in the same site as the user.


Part of the Windows 2000 BackOffice suite. SMS includes desktop management and software distribution features that significantly automate the task of upgrading software on client computers.


A member of the TCP/IP suite of protocols that governs the exchange of electronic mail between message transfer agents. Simple Mail Transfer Protocol is also called SMTP.


A route-advertising algorithm that prevents the advertising of routes in the same direction in which they were learned. Split horizon helps prevent routing loops.

See also poison reverse.


A protocol that advertises IP multicast conferences for the purpose of session announcement, invitation, and initiation. SDP descriptors are stored in Windows 2000 Active Directory (specifically, on the server running Site Server ILS Service). SDP is described in RFC 2327 of the IETF. SDP is also called Standard Description Protocol.

See also IETF; Site Server ILS Service.


A record that indicates the starting point or original point of authority for information stored in a zone. The SOA resource record (RR) is the first RR created when adding a new zone. It also contains several parameters used by other computers that use DNS to determine how long they will use information for the zone and how often updates are required. SOA resource record is also called start-of-authority resource record.

See also authoritative; resource record; secondary master; zone.


Routes in the routing table that are permanent.

Static routes are manually configured by a network administrator. They change only if the network administrator changes them. If the routing protocol is configured to support auto-static routes (automatically added static routes), then the router can issue a request to a protocol to get an update of routing information on a specific interface. The results of such an update are then converted and kept as static routes.

See also protocol; router.


A form of domain name checking used by Windows 2000 DNS that examines characters used in DNS names for compliance with DNS naming requirements and valid character usage as specified in RFC 1123, "Requirements for Internet Hosts -- Applications and Support."

For strict RFC compliance, DNS domain names will use name labels made up only of valid uppercase and lowercase letters, number characters, and hyphens (A through Z, a through z, 0 through 9, -) separated by periods.

See also domain name; label; loose name checking.


A DNS domain located directly beneath another domain name (the parent domain) in the namespace tree. For example, "example.microsoft.com" would be a subdomain of the domain "microsoft.com". Subdomain is also called child domain.

See also child domain; parent domain.


An IETF standard that enables administrative control at the subnet level. SBM is also called subnet bandwidth management.

See also IETF.


In Windows 2000 Server, an administrative grouping feature that supports a DHCP server's ability to use more than scope for each physical interface and subnet. Superscopes are useful under the following conditions: If more DHCP clients must be added to a network than were originally planned, if an IP network is renumbered, or if two or more DHCP servers are configured to provide scope redundancy and fault-tolerant design DHCP service for a single subnet. Each superscope can contain one or more member scopes (also known as child scopes).


A connection established dynamically between devices on an ATM network through the use of signaling. SVC is also called switched virtual circuit.


In Windows 2000 Server, the user profile that is loaded when Windows 2000 is running and no user is logged on. When the Begin Logon dialog box is visible, the system default profile is loaded.


Storage locations for data that are defined by Windows 2000 Server and are the same regardless of who is logged on at the computer. (Users who are also members of the Administrators group can also add new variables or change the values.)


A timer value included in packets sent over TCP/IP-based networks that tells the recipients how long to hold or use the packet or any of its included data before expiring and discarding the packet or data.

For DNS, TTL values are used in resource records within a zone to determine how long requesting clients should cache and use this information when it appears in a query response answered by a DNS server for the zone. TTL is also called Time-To-Live.


Domain names that are rooted hierarchically at the first tier of the domain namespace directly beneath the root (.) of the DNS namespace. On the Internet, top-level domain names such as ".com" and ".org" are used to classify and assign second-level domain names (such as "microsoft.com") to individual organizations and businesses according to their organizational purpose.

See also second-level domains.


An overview of networks and how they relate to routers. Routers in the same area have the same topological database.


A route-advertising algorithm that advertises changes in the network topology as they occur, rather than waiting for the next scheduled periodic advertisement.


A protocol used to download the initial files needed to begin the installation process. Trivial File Transfer Protocol is also called TFTP.


An address that identifies a specific, globally unique host.


A standard encoding scheme used for computer text-based data. Unicode uses 2 bytes (16 bits) to represent each character, which allows 65,536 possible unique characters to be assigned. This number of possible character values enables almost all of the written languages of the world to be represented using a single character set.

See also ASCII; UCS.


An international standard character set reference that is part of the Unicode standard. The most widely held existing version of the UCS standard is UCS-2, which specifies 16-bit character values currently accepted and recognized for use to encode most of the world's languages. UCS is also called Unicode Character System.

See also ASCII; Unicode; UTF-8.


A protocol used to transform extended multibyte Unicode characters to variable-length sequences of single-byte values to provide compatibility with legacy file systems, parsers, and other software that rely on single-byte ASCII values but are transparent to other values. For Windows 2000, DNS servers and clients use the UTF-8 protocol. UTF-8 is also called Unicode Transformation Format 8.

See also ASCII; Unicode; UCS.


A security or distribution group that can be used anywhere in the domain tree or forest.

A universal group can have members from any Windows 2000 domain in the domain tree or forest. It can also include other universal groups, global groups, and accounts from any domain in the domain tree or forest. Rights and permissions must be assigned on a per-domain basis, but can be assigned at any domain in the domain tree or forest.

Universal groups can be members of domain local groups and other universal groups but cannot be members of global groups. Universal groups appear in the global catalog and should contain primarily global groups.

See also distribution group; domain local group; domain tree; forest; global catalog; global group; security group.


An ATM service type that does not include any service guarantees. UBR is also called unspecified bit rate.


For Windows 2000, the method of case-insensitive handling for NetBIOS names. Upcasing is used by Windows 2000 to convert any lowercase letters entered in NetBIOS names to equivalent uppercase letters. For example, the name "host1" would be case converted to "HOST1."

See also downcasing.


The UPN suffix is the part of the user principal name to the right of the "@" character. The default UPN suffix for a user account is the DNS domain name of the domain that contains the user account. Alternative UPN suffixes may be added to simplify administration and user logon  processes  by providing a single UPN suffix for all users. The UPN suffix is only used within the Windows 2000 domain and is not required to be a valid DNS domain name.

See also UPN; DNS.


A software component that prompts clients for their user names and passwords.

See also clear-text passwords.


An administrative feature that allows DHCP clients to be grouped logically according to a shared or common need. For example, a user class can be defined and used to allow similar DHCP leased configuration for all client computers in a specific building or site location.


A TCP complement that offers a connectionless datagram service that guarantees neither delivery nor correct sequencing of delivered packets (much like IP). User Datagram Protocol is also called UDP.


The interface between ATM users or end stations and an ATM switch or network. The UNI interface is defined in the ATM Forum UNI documents. UNI is also called user network interface.


The user principal name. This consists of a user account name (sometimes referred to as the user logon name) and a domain name identifying the domain in which the user account is located. This is the standard usage for logging on to a Windows 2000 domain. The format is: user@domain.com (as for an e-mail address).

See also distinguished name; UPN suffix.


Security settings that manage the assignment of rights to groups and user accounts.


Asymmetric high-speed data transmission standard published by the ITU-T for 56 kilobits-per-second (Kbps) modems. The transmission speed from the client-side modem is the same as V.34. The reception speed from the host-side modem, such as an Internet service provider or corporate network, is up to 56 Kbps, with a typical speed of 40 to 50 Kbps. When the host-side modem does not support this standard, the backup is V.34.

See also V.34.


For Windows 2000 Server, the process of comparing files on local volumes with their associated data in secondary storage by Remote Storage. Volumes that are validated ensure that the correct data is recalled from remote storage when a user attempts to open the file from a local volume.

See also Remote Storage.


An ATM service type that guarantees service based on average and peak traffic rates. VBR is used for traffic that requires little or no cell loss. It transmits data in spurts, or bursts, rather than in a continuous stream. VBR is also called variable bit rate.


An administrative feature that allows DHCP clients to be identified and leased according to their vendor and hardware configuration type. For example, assigning a vendor class of "HP" to a printer vendor such as Hewlett-Packard would allow all Hewlett-Packard printers to be managed as a single unit so they could all obtain a similar DHCP leased configuration.


A section of the ATM cell header that contains the virtual channel address over which the cell is to be routed. VCI is also called virtual channel identifier.


A container that allows any LDAP-compliant directory to be accessed through Active Directory.

See also LDAP.


In Windows 2000, a protected environment subsystem that emulates MS-DOS and 16-bit Windows within Windows 2000. A virtual DOS machine (VDM) is created whenever a user starts an MS-DOS program in Windows 2000.


A connection between two virtual interfaces.


A section of the ATM cell header that contains the virtual path address over which the cell is to be routed. VPI is also called virtual path identifier.


An optional, case-sensitive password you can assign to a Macintosh-accessible volume when you configure the volume. To access the volume, a user must type the volume password.


Services that are so pervasive in the computer industry that standard bindings are universally recognized. These services often maintain a machine-centric status and are frequently legacy services such as those developed for use in TCP/IP networks; for example, Telnet and FTP. Well-known services could be published in Active Directory, but because their bindings are widely known, the information would be superfluous.


In DNS, the supported use of wildcard characters such as the asterisk (*) in domain names for DNS queries that resolve to multiple names. When wildcarding is used, DNS servers must support resolving name queries that use wildcard characters, and resolvers must be able to parse multiple records from any resource record sets (RRsets) issued in wildcard query responses.

See also resource record set.


A set of standards defining a distributed directory service, developed by the International Standards Organization (ISO).


In the Macintosh environment, a logical grouping that simplifies browsing the network for resources, such as servers and printers. It is similar to a domain in Windows 2000 Server networking.

In a DNS database, a zone is a subtree of the DNS database that is administered as a single separate entity, a DNS server. This administrative unit can consist of a single domain or a domain with subdomains. A DNS zone administrator sets up one or more name servers for the zone.

See also DNS; domain.


In the Macintosh environment, a list that includes all of the zones associated with a particular network. Zone list is not to be confused with Windows 2000 DNS zones.

See also zone.


The process by which DNS servers interact to maintain and synchronize authoritative name data.

When a DNS server is configured as a secondary master for a zone, it periodically queries another DNS server configured as its source for the zone. If the version of the zone kept by the source is different, the secondary master server will pull zone data from its source DNS server to synchronize zone data.

See also AXFR; IXFR; secondary master; zone.


The process of sending a message simultaneously to more than one destination on a network.


A computer or electromechanical device that controls the routing and operation of a signal path.


The practice of using a computer to control one or more telephone and communications functions. CTI is also called computer-telephony integration.


The extension of local area network multicasting technology to a TCP/IP network. Hosts send and receive multicast datagrams, the destination fields of which specify IP host group addresses rather than individual IP addresses. A host indicates that it is a member of a group by means of the Internet Group Management Protocol (IGMP). IP multicasting is also called Internet Protocol multicasting.

See also IGMP; TCP/IP.


A method for sending voice over a LAN, a WAN, or the Internet using TCP/IP packets. VoIP is also called Voice over Internet Protocol.

See also LAN; TCP/IP; WAN


A device that connects networks using the same communications protocols so that information can be passed from one to the other. Also, a device that connects two local area networks, whether or not they use the same protocols. A network bridge operates at the ISO/OSI data-link layer.


A device that connects networks using different communications protocols so that information can be passed from one to the other. A network gateway both transfers information and converts it to a form compatible with the protocols being used by the receiving network.


Playing audio and video immediately as it is downloaded from a network, rather than storing it in a file first.


A protocol that Windows 2000 remote access can use to negotiate a connection. PAP is not the most secure protocol because the password is sent from the user's computer to the server in plain text. PAP is also called Password Authentication Protocol.

See also remote access.


A replication model in which any domain controller accepts and replicates directory changes to any other domain controller. This differs from other replication models in which one computer stores the single modifiable copy of the directory and other computers store backup copies.

See also domain controller; replication.


Sufficient connectivity to make your network and Active Directory useful to clients on your network. The precise meaning of well-connected is determined by your particular needs.

See also Active Directory.


In Windows, the relationships among a set of network components.

In the context of Active Directory replication, topology refers to the set of connections that domain controllers use to replicate information among themselves.

See also domain controller; replication.


The ITU-T standard for multipoint data conferencing. T.120 provides the protocols for establishing and managing data flow, connections, and conferences. Support for T.120 enables data transfer from conferencing applications, such as file transfer and application sharing, to operate in conjunction with H.323 connections.

See also H.323.


The ITU-T standard for multimedia communications over networks that do not provide a guaranteed quality of service (QoS). This standard provides specifications for workstations, devices, and services to carry real-time video, audio, and data or any combination of these elements.

See also QoS.


A system connected to multiple physical TCP/IP networks capable of routing or delivering IP packets between them. A gateway translates between different transport protocols or data formats (for example, IPX and IP) and is generally added to a network primarily for its translation ability.

In the context of interoperating with Novell NetWare networks, a gateway acts as a bridge between the server message block (SMB) protocol used by Windows 2000 networks and the NetWare core protocol (NCP) used by NetWare networks A gateway is also called an IP router.

See also Gateway Service for NetWare; IP address.


A group of NetWare servers. Accounts used to create a gateway must belong to this group.

See also gateway; Gateway Service for NetWare.


For Network Load Balancing, the method used to associate client requests to cluster hosts. When no affinity is specified, all network requests are load balanced across the cluster without respect to their source. Affinity is implemented by directing all client requests from the same IP address to the same cluster host.

See also client request; IP address.


A measure of the fault tolerance of a computer and its programs. A highly available computer runs 24 hours a day, 7 days a week.

See also fault tolerance.


A service request from a client computer to a server computer or, for Network Load Balancing, a cluster of computers. Network Load Balancing forwards each client request to a specific host within the cluster according to the system administrator's load-balancing policy.

See also client; cluster; host; load balancing; server.


A set of computers that work together to provide a service. The use of a cluster enhances both the availability of the service and the scalability of the operating system that provides the service. Network Load Balancing provides a software solution for clustering multiple computers running Windows 2000 Advanced Server that provide networked services over the Internet and private intranets.

See also availability; scalability.


The adapter that, when using multiple network adapters in each host of a Network Load Balancing cluster, handles the network traffic for cluster operations (the traffic for all hosts in the cluster). This adapter is programmed with the host's cluster IP address.

See also dedicated adapter; IP address.


The network adapter that, when using multiple network adapters in each host of a Network Load Balancing cluster, handles network traffic not related to cluster operations (the traffic for individual hosts on the network). This adapter is programmed with the host's dedicated IP address.

See also cluster adapter; IP address.


The host with the highest host priority for which a drainstop command is not in progress. After convergence, the default host handles all of the network traffic for TCP and UDP ports that are not otherwise covered by port rules.

See also convergence; drainstop; host priority; port rule; UDP.


For Network Load Balancing, a command that disables new traffic handling for the rule whose port range contains the specified port.

All ports specified by the port rule are affected. If all is specified for the port, this command is applied to the ports covered by all port rules. New connections to the specified host or hosts are not allowed, but all active connections are maintained.

To disable active connections, use the disable command instead. This command has no effect if the specified hosts have not started cluster operations.

See also drainstop; port rule.


For Network Load Balancing, a command that disables all new traffic handling on the specified hosts.

The hosts then enter draining mode to complete existing connections. While draining, hosts remain in the cluster and stop their cluster operations when there are no more active connections. To terminate draining mode, explicitly stop cluster mode with the stop command, or restart new traffic handling with the start command.

To drain connections from a specific port, use the drain command.

See also drain.


For Network Load Balancing, the method by which network traffic inbound to a cluster is handled by the hosts within the cluster. Traffic can either be handled by a single server, load balanced among the hosts within the cluster, or disabled completely.

See also load balancing; server.


A Windows 2000 computer that runs a server program or service used by network or remote clients. For Network Load Balancing, a cluster consists of multiple hosts connected over a local area network.


For Network Load Balancing, a host's precedence for handling default network traffic for TCP and UDP ports. It is used in case a host within the cluster goes offline, and it determines which host within the cluster will assume responsibility for the traffic previously handled by the offline host.

See also UDP.


A technique used by Windows Clustering to scale the performance of a server-based program (such as a Web server) by distributing its client requests across multiple servers within the cluster.

Each host can specify the load percentage that it will handle, or the load can be equally distributed across all the hosts. If a host fails, Windows Clustering dynamically redistributes the load among the remaining hosts.

See also client request; cluster; host; scalability; server.


An address that is used to communicate with other network adapters on the same subnet. Each network adapter has an associated media access control address.

See also multicast media access control address.


A type of media access control address used by multiple, networked computers to receive the same incoming network frames concurrently. Network Load Balancing uses multicast MAC addresses to efficiently distribute incoming network traffic to cluster hosts.

See also MAC address.


A plug-in board that connects a computer to a local area network (LAN). For Network Load Balancing, a cluster communicates over the LAN connecting the cluster's hosts.

See also cluster; host; LAN.


For Network Load Balancing, a set of configuration parameters that determine the filtering mode to be applied to a range of ports.

See also filtering mode.


In the context of load balancing TCP/IP traffic, a set of client requests directed to a server. These requests can be invoked with multiple, possibly concurrent, TCP connections. The server program sometimes maintains state information between requests. To preserve access to the server state, Network Load Balancing needs to direct all requests within a session to the same cluster host when load balancing.

See also client request; server; TCP/IP.


An IP address that is shared among the hosts of a Network Load Balancing cluster. A Network Load Balancing cluster might also use multiple virtual IP addresses, for example, in a cluster of multihomed Web servers.

See also host; multihomed computer.


A domain controller that has been assigned one or more special roles in an Active Directory domain.

The domain controllers assigned these roles perform operations that are single-master (not permitted to occur at different places on the network at the same time). Examples of these operations include resource identifier allocation, schema modification, PDC election, and certain infrastructure changes.

The domain controller that controls the particular operation owns the operations master role for that operation. The ownership of these operations master roles can be transferred to other domain controllers.

See also Active Directory; domain naming master; infrastructure master; multimaster replication; PDC emulator master; relative ID master; replication; schema master.


The domain controller assigned to control all updates to the schema within a forest. At any time, there can be only one schema master in the forest.

See also Active Directory; domain controller; forest; multimaster replication; operations master; replication; schema.


The domain controller assigned to control the addition or removal of domains in the forest. At any time, there can be only one domain naming master in the forest.

See also Active Directory; domain controller; forest; multimaster replication; operations master; replication.


The domain controller assigned to allocate sequences of relative IDs to each domain controller in its domain.

Whenever a domain controller creates a security principal (user, group, or computer object), the domain controller assigns the object a unique security ID. The security ID consists of a domain security ID that is the same for all security IDs created in a particular domain, and a relative ID that is unique for each security ID created in the domain. At any time, there can be only one relative ID master in a particular domain.

See also Active Directory; domain controller; multimaster replication; operations master; replication.


The domain controller assigned to act as a Windows NT 4.0 primary domain controller (PDC) to service network clients that do not have Active Directory client software installed, and to replicate directory changes to any Windows NT backup domain controllers (BDCs) in the domain.

For a Windows 2000 domain operating in native mode, the PDC emulator master receives preferential replication of password changes performed by other domain controllers in the domain and handles any password authentication requests that fail at the local domain controller. At any time, there can be only one PDC emulator in a particular domain.

See also Active Directory; BDC; domain controller; multimaster replication; operations master; PDC; replication.


The domain controller assigned to update group-to-user references whenever group memberships are changed, and to replicate these changes to any other domain controllers in the domain. At any time, there can be only one infrastructure master in a particular domain.

See also Active Directory; domain controller; multimaster replication; operations master; replication.


An identifier assigned by domain controllers to security principals (user, group, or computer objects) created by that domain controller.

The relative ID is combined with the domain security ID to create a security ID that is unique in the forest. A series of relative IDs is assigned (by the relative ID master) to each domain controller in the forest. When a domain controller uses most of the relative IDs assigned to it, it requests additional relative IDs from the domain controller that is the relative ID master.

See also domain controller; forest; relative ID master; security ID; security principal.


An Active Directory container object used within domains. Organizational units are logical containers into which you can place users, groups, computers, and other organizational units. It can contain objects only from its parent domain. An organizational unit is the smallest scope to which you can apply a Group Policy or delegate authority.


 A 32-bit protected-mode file system that controls access to the contents of CD-ROM drives in Windows 95. Compact Disc File System is also called CDFS.


A software service that dynamically maps IP addresses to computer names (NetBIOS names). This allows users to access resources by name instead of requiring them to use IP addresses that are difficult to recognize and remember. WINS servers support clients running Windows NT 4.0 and earlier versions of Microsoft operating systems.

See also DNS.


 A central network device (multiport hub) that forwards packets to specific ports rather than, as in conventional hubs, broadcasting every packet to every port. In this way, the connections between ports deliver the full bandwidth available.

See also bandwidth; hub; packet.


A technology for breaking data into packets and then sending the packets over a network. Each packet has a header containing its source and destination, a sequence number to reassemble the information, a block of data content, and an error-checking code. The data packets may take different routes to their destination, where the original information is reassembled after the packets arrive. The international standard for packet switching networks is X.25.

See also packet.


A technology in which a connection is established by closing a switch; for example, by dialing a telephone. This creates a circuit in which all the information transmitted over the connection follows the same route to the destination. The circuit is dedicated to the connection until it is closed.


 A computer that uses a 64-bit microprocessor chip that employs reduced instruction set computing (RISC). Alpha computers are, for most operations, faster than the equivalent non-RISC-based computers.

See also RISC.


A process in which a computer that is starting (booting) creates a log file that records the loading of each device and service. In Windows 2000, this log file is called Ntbtlog.txt and is saved in the system root directory.

See also systemroot.


 A set of software processes that maintains a backup copy of a volume at all times. Each mirror of a volume resides on a different disk; ideally, each disk has its own controller. If one mirror becomes unavailable (due to a disk failure, for example), you can use the other mirror to gain access to the volume's data.


Software routines and low-level input/output instructions stored in read-only memory (ROM). Unlike random-access memory (RAM), read-only memory stays intact even in the absence of electrical power.


 A signal sent by a device to get the attention of the processor when the device is ready to accept or send information. Each device sends its interrupt requests over a specific hardware line, numbered from 0 to 15. Each device must be assigned a unique IRQ number. IRQ is also called interrupt request.


 A hardware configuration available by pressing F8 during startup. If the current hardware settings prevent the computer from starting, the last known good configuration can allow you to start the computer and examine the configuration. When the last known good configuration is used, later configuration changes are lost.


The process of having software translate between names that are easy for users to work with and numerical IP addresses, which are difficult for users but necessary for TCP/IP communications. Name resolution can be provided by software components such as DNS or WINS.

See also DNS; TCP/IP; WINS.


 A licensing mode that requires a separate Client Access License for each client computer that accesses Windows 2000 Server, regardless of whether all the clients access the server at the same time.

See also client; Per Server Licensing.


 A licensing mode that requires a separate Client Access License for each concurrent connection to the server, regardless of whether there are other client computers on the network that do not happen to connect concurrently.

See also client; Per Seat Licensing.


 A method of starting Windows 2000 using basic files and drivers only, without networking. Safe mode is available by pressing the F8 key when prompted during startup. This allows you to start your computer when a problem prevents it from starting normally.


 A method of starting Windows 2000 using basic files and drivers only, without networking, and with only a command prompt displayed. This mode is available by pressing the F8 key when prompted during startup. This allows you to start your computer when a problem prevents it from starting normally.


 A method of starting Windows 2000 using only basic files, drivers, and networking. This mode is available by pressing the F8 key when prompted during startup. This allows you to start your computer when a problem prevents it from starting normally


 A file that is handled in a way that requires much less disk space than would otherwise be needed. Sparse support allows an application to create very large files without committing disk space for every byte. For example, you could use sparse support to work with a 42-GB file in which you needed to write data only to the first 64 KB.


 A device connected between a computer and a power source to ensure that electrical flow is not interrupted. UPS devices use batteries to keep the computer running for a period of time after a power failure. UPS devices usually provide protection against power surges and brownouts as well. UPS is also called uninterruptible power supply.


When referring to software, to update existing program files, folders, and registry entries to a more recent version. Upgrading, unlike performing a new installation, leaves existing settings and files in place.


A simple grouping of computers, intended only to help users find such things as printers and shared folders within that group. Workgroups in Windows 2000 do not offer the centralized user accounts and authentication offered by domains.


Software services that provide authentication support, including secure e-mail, Web-based authentication, and smart card authentication. These services contrast with Internet Authentication Services (IAS), which provide authentication for dial-in users.

See also IAS.


Software services that support Web site creation, configuration, and management, along with other Internet functions. Microsoft Internet Information Services include Network News Transfer Protocol (NNTP), File Transfer Protocol (FTP), and Simple Mail Transfer Protocol (SMTP). Internet Information Services is also called IIS.

See also FTP; NNTP; SMTP.


 A member of the TCP/IP suite of protocols used to distribute network news messages to NNTP servers and to NNTP clients (newsreaders) on the Internet. NNTP is designed so that news articles are stored on a server in a central database, thus enabling a user to select specific items to read. NNTP is also called Network News Transfer Protocol.

See also TCP/IP.


 A member of the TCP/IP suite of protocols, used to copy files between two computers on the Internet. Both computers must support their respective FTP roles: one must be an FTP client and the other an FTP server. FTP is also called File Transfer Protocol.

See also TCP/IP.


Software that provides search functions for documents stored on disk, allowing users to search for specific document text or properties.


Software that supports distributed applications that use HTTP to communicate through Internet Information Services (IIS).

See also IIS.


Software services that provide security and authentication for dial-in users. Internet Authentication Service is also called IAS.

See also Certificate Services.


A software service that allows you to control how applications are allotted network bandwidth. Important applications can be given more bandwidth, less important applications less bandwidth.

See also bandwidth.


Software services that support telephony applications that help users access features such as caller ID, conference calls, video conferencing, and faxing. This support depends on Internet Information Services (IIS).

See also IIS; LDAP.


The process of forwarding communications traffic along internetwork pathways. A computer set up to support routing receives transmitted messages and forwards them to their correct destinations over the most efficient available route, even if many routes are possible.

See also router.


Software services that allow an administrator to set up new client computers remotely, without having to visit each client. The target clients must support remote booting.

See also client.


Software services that allow client applications to be run on a server so that client computers can function as terminals rather than independent systems. The server provides a multisession environment and runs the Windows-based programs being used on the clients.

See also client.


Software that provides the ability to register and track licenses for Terminal Services clients.

See also client; Terminal Services.


Software components that include utilities for network management and monitoring, along with services that support client dialing and the updating of client phone books. Also included is the Simple Network Management Protocol (SNMP).

See also Active Directory; client.


Four TCP/IP services: Character Generator, Daytime Discard, Echo, and Quote of the Day.

See also TCP/IP.


Software that provides file and print services for Macintosh, as well as print services for UNIX.

See also File Server for Macintosh; Print Server for Macintosh.


Software that provides multimedia support, allowing you to deliver content using Advanced Streaming Format over an internet or the Internet.

See also internet.


For Microsoft networking, the sending of messages directly over the IPX protocol without the use of NetBIOS. While direct hosting may be more efficient, a direct hosting client can connect only to a direct hosting server. Windows 2000 Professional does not support direct hosting.

See also IPX; NetBIOS; NWLink.


A protocol used by routers to exchange information between routers on an IPX network and by hosts to determine the best router to use when forwarding IPX traffic to a remote IPX network. RIPX is also called Routing Information Protocol over IPX.

See also IPX; NWLink; router.


A service that computers running NetWare client software use to access shared file and printer resources on a computer running Windows 2000 Server.


The standard type of trust relationship between Windows 2000 domains in a domain tree or forest. When a domain joins an existing forest or domain tree, a transitive trust is automatically established.

Transitive trusts are always two-way relationships. This series of trusts, between parent and child domains in a domain tree and between root domains of domain trees in a forest, allows all domains in a forest to trust each other for the purposes of authentication. For example, if domain A trusts domain B and domain B trusts domain C, then domain A trusts domain C.

See also domain tree; forest; non-transitive trust; one-way trust; two-way trust.


A type of trust relationship that is bounded by the two domains in the relationship. For example, if domain A trusts domain B and domain B trusts domain C, there is no trust relationship between domain A and domain C.

Non-transitive trusts can be one-way or two-way relationships. This is the only type of trust that can exist between a Windows 2000 domain and a Windows NT domain or between Windows 2000 domains in different forests.

See also forest; one-way trust; transitive trust; two-way trust.


A type of trust relationship in which only one of the two domains trusts the other domain. For example, domain A trusts domain B and domain B does not trust domain A. All one-way trusts are non-transitive.

See also non-transitive trust; two-way trust.


A type of trust relationship in which both of the domains in the relationship trust each other.

In a two-way trust relationship, each domain has established a one-way trust with the other domain. For example, domain A trusts domain B and domain B trusts domain A. Two-way trusts can be transitive or non-transitive. All two-way trusts between Windows 2000 domains in the same domain tree or forest are transitive.

See also domain tree; forest; non-transitive trust; one-way trust; transitive trust.


A collection of functions that are implemented by the cluster software and used by a cluster-aware client or server application, a cluster management application, or a resource DLL to manage the cluster itself, cluster objects, and the cluster database.

See also cluster-aware application; DLL; node; resource; resource DLL; server cluster.


An application that can run on a cluster node and can be managed as a cluster resource. Cluster-aware applications use the Cluster API to receive status and notification information from the server cluster.

See also Cluster API; cluster-unaware application; node.


An application that can run on a cluster node and be managed as a cluster resource but does not support the Cluster API.

See also cluster-aware application; node.


Storage where one or more attached disks hold data used either by server applications running on the cluster or by applications for managing the cluster. Each disk on the cluster storage is owned by only one node of the cluster. The ownership of disks moves from one node to another when the disk group fails over or moves to the other node.

See also failover; node.


A diagram for visualizing the dependency relationships between resources.

See also dependency; resource.


A resource type that provides DHCP services from a cluster.

See also DHCP.


A resource type that can use Microsoft Distributed Transaction Coordinator (MS DTC) in a cluster.


Parameters that an administrator can set, using Cluster Administrator, that affect failover operations.

See also failover.


The amount of time it takes a resource, either individually or in a group, to complete the failover process.

See also failover; resource.


A file share accessible by a network path that is supported as a cluster resource by a resource DLL.

See also DLL; resource DLL.


An application that is supported as a cluster resource by a resource DLL.

See also resource DLL.


A Windows 2000 service that is supported as a cluster resource by a resource DLL.

See also resource DLL.


A message that is sent regularly by the server cluster on one node to the server cluster on another node to detect communication failure.

See also node.


A server-instance designation used with Internet Information Services (IIS) that supports the WWW and FTP services. IIS server instances are supported as cluster resources by a resource DLL. IIS Server Instance resources may have dependencies on IP Address resources, Network Name resources, and Physical Disk resources. Access information for server instances does not fail over.

See also dependency; failover; resource DLL.


A private network that connects nodes in a cluster.

See also server cluster; node.


A 32-bit number in dotted decimal format that represents an Internet Protocol (IP) address and is supported as a cluster resource by a resource DLL provided with Windows 2000.

See also IP; IP address; resource DLL.


A resource type that can use Message Queuing in a cluster.


The name of a device that exists on a network and is supported as a cluster resource by a resource DLL provided with Windows 2000.

See also resource DLL.


A state in which one or more of the nodes in a cluster cannot communicate with the other cluster nodes.

See also node.


A disk on a cluster storage device. Physical disks are supported as cluster resources by a resource DLL.

See also resource DLL.


The frequency the Resource Monitor checks that the resource is available and operating.

There are two levels of polling: Looks Alive and Is Alive. The server cluster requests a more thorough check of the resource's state at each Is Alive interval than it does at each Looks Alive interval; therefore, the Is Alive polling interval is typically longer than the Looks Alive polling interval. You can specify the two polling intervals and a time-out value for resources.

See also resource.


Printer queues providing access to a network printer connected to the network by an IP address rather than by an individual name. Print spoolers are supported as cluster resources by a resource DLL.

See also IP address; resource DLL.


A cluster network that supports only node-to-node communication.

See also node.


A cluster network that supports client-to-cluster communication (either with or without supporting node-to-node communication).

See also node.


A measure of how well a computer, service, or application can grow to meet increasing performance demands.

For server clusters, scalability is the ability to incrementally add one or more systems to an existing cluster when the overall load of the cluster exceeds its capabilities.


Application software running on a cluster node, regardless of whether it does service registration.

See also node.


The process of manually moving a group between nodes to balance the load across the nodes.


A required dependency for many resource types. Windows 2000 Advanced Server provides one storage-class resource: Physical Disk. However, your vendor or reseller may supply other storage-class resource types.

See also resource types.


A collection of services that appears to clients as a physical Windows 2000 Advanced Server. A virtual server is typically a group containing all of the resources to run a particular application, including a Network Name resource and an IP Address resource.


A group that is used solely for e-mail distribution and that is not security-enabled.

Distribution groups cannot be listed in discretionary access control lists (DACLs) used to define permissions on resources and objects. Distribution groups can be used only with e-mail applications (such as Microsoft Exchange) to send e-mail to collections of users. If you do not need a group for security purposes, create a distribution group instead of a security group.

See also DACL; security group.


A group that can be listed in discretionary access control lists (DACLs) used to define permissions on resources and objects. A security group can also be used as an e-mail entity. Sending an e-mail message to the group sends the message to all the members of the group.

See also DACL.


An identifying prefix or suffix appended to a user name to enable appropriate routing and authentication during a remote logon process.

See also authentication; routing; user name.


An address that uniquely identifies a node on a network.

Every network adapter has a DLC address or DLC identifier (DLCI). Some network protocols, such as Ethernet and Token Ring, use DLC addresses exclusively. Other protocols, such as TCP/IP, use a logical address at the OSI Network layer to identify nodes.

However, all network addresses must eventually be translated to DLC addresses. In TCP/IP networks, this translation is performed by the Address Resolution Protocol (ARP). DLC is also called Data Link Control.

See also ARP; node; OSI.


A feature of the Windows 98 and Windows 2000 TCP/IP protocol that self-configures an IP address and subnet mask in the absence of a static configuration and a DHCP server.

APIPA randomly selects a unique IP address from the range 169.254.0.1 through 169.254.255.254 and sets the subnet mask to 255.255.0.0. APIPA allows home users and small business users to create a functioning, single subnet TCP/IP network without having to manually configure the TCP/IP protocol or set up a DHCP server. APIPA is also called Automatic Private IP Addressing.

See also DHCP server; IP address; TCP/IP.


A resource type that provides WINS from a cluster.

See also WINS.


Parameters that an administrator can set using Cluster Administrator that affect failback operations.

See also failback.


For server clusters, the restarting of a failed application or the dispersion of the work to remaining computers when a computer or application in the server cluster fails.


A container for files and Dfs links.

See also Dfs link.


A link from a Dfs root to one or more shared files, another Dfs root, or a domain-based volume.

See also Dfs root; domain Dfs.


The process of copying data from one folder to another. The data merges into a single data set over time.


One or more shared folders that participates in replication.

See also replication.


A folder within a replica set.

See also replica set.


Rules that define how and when replication is performed.

See also replication.


A description of the physical connections between replicas and sites. In contrast, Dfs topologies describe the logical connections.

See also replica.


The logical structure of a distributed file system, including such items as a Dfs root, Dfs links, and a replica set.

See also Dfs link; Dfs root; replica set.


The combination of a Dfs root and a Dfs link. An example of a Dfs path is \\server\dfs\a\b\c\link, where \\server\dfs is the Dfs root, and \a\b\c\ is the Dfs link.


An implementation of Dfs in which Dfs topological information is stored in Active Directory. Because this information is made available on multiple domain controllers in the domain, domain Dfs provides fault-tolerance for any distributed file system in the domain.

See also Dfs topology; fault-tolerance.


A shared folder whose existing files and folders are replicated to other shared folders when replication is initially configured. After replication is complete, there is no initial master, since any of the replicas can accept changes and propagate them to the other replicas. The initial master then becomes another replica.

See also replica; replication.


A portion of the data storage area on a hard disk. Sectors are the smallest physical storage units on a disk and are of fixed size.

See also cluster size.


A floppy disk that contains key system files. You use a boot disk to start a computer that does not have a bootable CD-ROM drive and is unable to start from the hard disk.

See also boot; boot files; boot volume; system volume.


The hard disk drive that contains the system and boot partitions used to start Windows 2000.

See also boot partition; system partition.


In Disk Management, the process of detecting a disk or volume and assigning it a status (for example, healthy) and a type (for example, dynamic).

See also basic volume; dynamic volume.


Storage media such as a tape or disk that can easily be removed for transport, backup, or offsite storage.


Both the directory and the services making the directory information available to the users. A directory service can:

Enforce security defined by administrators to keep information safe from intruders.

Distribute a directory across many computers in a network.

Replicate a directory to make it available to more users and resistant to failure.

Partition a directory into multiple stores to allow the storage of very large numbers of objects.

Maintain information about all of the objects in the directory.

Allow users to find any object in the directory given one of its attributes.

See also directory.


The process by which Network Monitor copies frames.

See also frame.


In synchronous communication, a package of information transmitted as a single unit from one device to another.

See also capture.


An optionally enabled trace record of Cluster service events on a node. Not synonymous with quorum log. See also quorum log.


Data about data. For example, the title, subject, author, and size of a file constitute the file's metadata. See also schema.


A Windows 2000 security feature that locks a user account if a number of failed logon attempts occur within a specified amount of time, based on security policy lockout settings. Locked accounts cannot log on.


An entry in an object's discretionary access control list (DACL) that grants permissions to a user or group. An ACE is also an entry in an object's system access control list (SACL) that specifies the security events to be audited for a user or group. Access control entry is also called ACE.

See also DACL; object; permission; SACL.


An open industry specification that defines power management on a wide range of mobile, desktop, and server computers and peripherals. ACPI is the foundation for the OnNow industry initiative that allows system manufacturers to deliver computers that will start at the touch of a keyboard. ACPI design is essential to take full advantage of power management and Plug and Play in Windows 2000. If you are not sure if your computer is ACPI-compliant, check your manufacturer's documentation. Advanced Configuration and Power Interface is also called ACPI.

See also Plug and Play.


The window or icon that you are currently using or that is currently selected. Windows 2000 always applies the next keystroke or command you choose to the active window. Windows or icons on the desktop that are not selected are inactive.


The directory service included with Windows 2000 Server. It stores information about objects on a network and makes this information available to users and network administrators. Active Directory gives network users access to permitted resources anywhere on the network using a single logon process. It provides network administrators with an intuitive hierarchical view of the network and a single point of administration for all network objects.

See also directory partition; service.


The partition from which the computer starts up. The active partition must be a primary partition on a basic disk. If you use Windows 2000 exclusively, the active partition can be the same as the system volume. If you use Windows 2000 and either Windows 98 or earlier or MS-DOS, the active partition must contain the startup files for both operating systems.

See also basic disk; primary partition; system partition.


The volume from which the computer starts up. The active volume must be a simple volume on a dynamic disk. You cannot mark an existing dynamic volume as the active volume, but you can upgrade a basic disk containing the active partition to a dynamic disk. Once the disk is upgraded to dynamic, the partition becomes a simple volume that is active.

See also active partition; basic disk; dynamic disk; dynamic volume; simple volume.


A printed circuit board that allows a computer to use a peripheral device for which it does not already have the connections or circuit boards. For example, a network adapter provides the physical interface (connector) and the hardware (circuitry) to let a computer access a network. A network adapter is also called an adapter card, a card, or a network adapter.


A person responsible for setting up and managing domain controllers or local computers and their user and group accounts, assigning passwords and permissions, and helping users with networking issues. Administrators are members of the Administrators group and have full control over the domain or computer.


A computer running simple network management protocol (SNMP) agent software. In the Windows implementation of SNMP, agent information includes comments about the user, the physical location of the computer, and the types of service to report, based on the computer's configuration.

See also service; SNMP.


A service used by the server and other services to notify selected users and computers of administrative alerts that occur on a computer. The Alerter service requires the Messenger service.

See also administrative alerts; Messenger service; service.


Information that indicates whether a file is read-only, hidden, ready for archiving (backing up), compressed, or encrypted, and whether the file contents should be indexed for fast file searching.


The process that tracks the activities of users by recording selected types of events in the security log of a server or a workstation.


In Backup, a type of restore operation on a Windows 2000 domain controller in which the objects in the restored directory are treated as authoritative, replacing (through replication) all existing copies of those objects. Authoritative restore is applicable only to replicated System State data such as Active Directory data and File Replication Service data. You must use the Ntdsutil.exe utility to perform an authoritative restore.

See also Active Directory; nonauthoritative restore; System State.


A program that runs while the user is working on another task. The computer's microprocessor assigns fewer resources to background programs than foreground programs.

See also foreground program.


A type of local or global group that contains the user rights you need to back up and restore files and folders. Members of the Backup Operators group can back up and restore files and folders regardless of ownership, permissions, encryption, or auditing settings.

See also auditing; global group; local group; user rights.


A collection of files, folders, and other data that have been backed up and stored in a file or on one or more tapes.


A summary of the files and folders that have been saved in a backup set.

See also backup set; on-disk catalog; on-media catalog.


A type that determines which data is backed up and how it is backed up. There are five backup types: copy, daily, differential, incremental, and normal.

See also copy backup; daily backup; differential backup; incremental backup; normal backup.


In analog communications, the difference between the highest and lowest frequencies in a given range. For example, an analog telephone line accommodates a bandwidth of 3,000 hertz (Hz), the difference between the lowest (300 Hz) and highest (3,300 Hz) frequencies it can carry. In digital communications, bandwidth is expressed in bits per second (bps).

See also bps.


A precedence ranking that determines the order in which the threads of a process are scheduled for the processor. Use Task Manager to view and change base priorities.

For Message Queuing, a property that specifies the queue's priority in a public queue. You can set the base priority from -32,768 to 32,767; the default priority is 0. Private queues do not support base priority. Message Queuing routes and delivers messages first by base priority, then by message priority.

See also Message Queuing; private queue; public queue.


A physical disk that contains primary partitions, extended partitions, or logical drives. Basic disks may also contain spanned, mirrored, striped, and RAID-5 volumes created using Windows NT 4.0 or earlier. Basic disks can be accessed by MS-DOS.

See also basic volume; extended partition; logical drive; mirrored volume; MS-DOS; primary partition; RAID-5 volume; spanned volume; striped volume.


A volume on a basic disk. Basic volumes include primary partitions, extended partitions, and logical drives, as well as spanned, mirrored, striped, or RAID-5 volumes created using Windows NT 4.0 or earlier.

See also basic disk; extended partition; logical drive; mirrored volume; MS-DOS; primary partition; RAID-5 volume; spanned volume; striped volume; volume.


An ASCII (unformatted text) file that contains one or more operating system commands. A batch program's file name has a .cmd or .bat extension. When you type the file name at the command prompt, or when the batch program is run from another program, its commands are processed sequentially. Batch programs are also called batch files.

See also ASCII; logon script.


A base-2 number system in which values are expressed as combinations of two digits, 0 and 1.


On PC-compatible computers, the set of essential software routines that test hardware at startup, start the operating system, and support the transfer of data among hardware devices. The BIOS is stored in read-only memory (ROM) so that it can be executed when the computer is turned on. Although critical to performance, the BIOS is usually invisible to computer users. Basic input/output system is also called BIOS.

See also ROM.


The number of bits transmitted every second, used as a measure of the speed at which a device, such as a modem, can transfer data. A character is made up of 8 bits. In asynchronous communication, each character may be preceded by a start bit and may terminate with a stop bit. So for each character, 10 bits are transmitted. For example, if a modem communicates at 2,400 bits per second (bps), then 240 characters are sent every second.


The process of starting or resetting a computer. When first turned on (cold boot) or reset (warm boot), the computer executes the software that loads and starts the computer's operating system, preparing it for use.


The system files needed to start Windows 2000. The boot files include Ntldr and Ntdetect.com.

See also partition boot sector.


The volume that contains the Windows 2000 operating system and its support files. The boot volume can be, but does not have to be, the same as the system volume.

See also system volume; volume.


The default groups provided with Windows 2000 Professional and Windows 2000 Server. Built-in groups have been granted useful collections of rights and built-in abilities.

In most cases, built-in groups provide all the capabilities needed by a particular user. For example, if a domain user account belongs to the built-in Administrators group, logging on with that account gives a user administrative capabilities over the domain and the domain servers. To provide a needed set of capabilities to a user account, assign it to the appropriate built-in group.

See also group.


Communication lines used for data transfer among the components of a computer system. Busses essentially allow different parts of the system to share data. For example, a bus connects the disk-drive controller, memory, and input/output ports to the microprocessor.


The number of characters received since a connection was established.


The number of characters transmitted since a connection was established.


The sector of the International Telecommunication Union (ITU) responsible for telecommunication standards. ITU-T replaces the Comité Consultatif Internationale de Télégraphie et Téléphonie (CCITT). Its responsibilities include standardizing modem design and operations, and standardizing protocols for networks and facsimile transmission. ITU is an international organization within which governments and the private sector coordinate global telecom networks and services.

See also service.


A path or link through which noncontrol information passes between two devices. A single Basic Rate Interface (BRI) connection, for example, has one physical connection but two channels for exchanging information between devices. This is often called a bearer channel, implying a channel that carries information.

See also B-channel; D-channel.

A Web site designed to deliver content from the Internet to your computer, similar to subscribing to a favorite Web site.

See also active content.


To turn off an option by removing the X or check mark from a check box. You clear a check box by clicking it or by selecting it and then pressing the SPACEBAR.


A Windows 2000-based application that can display and store linked or embedded objects.

For distributed applications, the application that imitates a request to a server application.


Included with Windows 2000 Professional, a service that allows client computers to make direct connections to resources on computers running NetWare 2.x, 3.x, or 4.x server software.

See also service.


A system service that supports ClipBook Viewer, which allows pages to be seen by remote ClipBooks.


A means of providing support for character sets and keyboard layouts for different countries. A code page is a table that relates the binary character codes used by a program to keys on the keyboard or to characters on the display.


A name used to group SNMP hosts. This name is placed in SNMP messages sent between SNMP-managed devices such as Windows 2000-based server computers and SNMP management stations. Typically, all hosts belong to Public, which is the standard name for a common community of all SNMP hosts.

See also SNMP; trap.


A protocol used in the negotiation process in a PPP connection. Compression Control Protocol is one type of Network Control Protocol (NCP). NCPs are used to establish and configure different network protocol parameters for IP, IPX, and NetBEUI. Compression Control Protocol is also called CCP.

See also IP; IPX; NetBEUI; PPP.


To assign a drive letter, port, or computer name to a shared resource so that you can use it with Windows 2000.


The left pane in a Microsoft Management Console (MMC) that displays the items contained in the console. By default it is the left pane of a console window, but it can be hidden. The items in the console tree and their hierarchical organization determine the capabilities of a console.

See also MMC.


A backup that copies all selected files but does not mark each file as having been backed up (in other words, the archive attribute is not cleared). Copying is useful if you want to back up files between normal and incremental backups because copying does not affect these other backup operations.

See also daily backup; differential backup; incremental backup; normal backup.


In Task Manager, the percentage of time that a process used the CPU since the last update. On the Task Manager Process tab, the column heading is CPU.

See also Windows 2000 Task Manager.


In Task Manager, the total processor time, in seconds, used by a process since it started.

See also Windows 2000 Task Manager.


Typically, files with extensions that have been created for special kinds of files. Custom file types are not tracked by the system registry.


A backup that copies all selected files that have been modified the day the daily backup is performed. The backed-up files are not marked as having been backed up (in other words, the archive attribute is not cleared).

See also copy backup; differential backup; incremental backup; normal backup.


One of two types of hardware connected by an RS-232-C serial connection, the other being a Data Terminal Equipment (DTE) device. A DCE is an intermediary device that often transforms input from a DTE before sending it to a recipient. A modem, for example, is a DCE that modulates data from a microcomputer (DTE) and sends it along a telephone connection. Data Communications Equipment is also called DCE.

See also DTE; RS-232-C standard.


In the RS-232-C hardware standard, any device, such as a remote access server or client, that has the ability to transmit information in digital form over a cable or a communications line. Data Terminal Equipment is also called DTE.

See also DCE; remote access server; RS-232-C standard.


The process of rewriting parts of a file to contiguous sectors on a hard disk to increase the speed of access and retrieval. When files are updated, the computer tends to save these updates on the largest continuous space on the hard disk, which is often on a different sector than the other parts of the file. When files are thus fragmented, the computer must search the hard disk each time the file is opened to find all of the file's parts, which slows down response time.

See also fragmentation.


The on-screen work area on which windows, icons, menus, and dialog boxes appear.


The document into which a package or a linked or embedded object is being inserted. For an embedded object, this is sometimes also called the container document.

See also embedded object.


The pane in the Microsoft Management Console (MMC) that displays the details for the selected item in the console tree. The details can be a list of items or they can be administrative properties, services, and events that are acted on by a snap-in.

See also MMC; service; snap-in.


Any piece of equipment that can be attached to a network or computer, for example, a computer, printer, joystick, adapter or modem card, or any other peripheral equipment. Devices normally require a device driver to function with Windows 2000.

See also device driver.


A conflict that occurs when the same system resources have been allocated to two or more devices. System resources include interrupt request (IRQ) lines, direct memory access (DMA) channels, input/output (I/O) ports, and memory addresses.

See also DMA; interrupt request (IRQ) lines; I/O port; memory address; resource.


A program that allows a specific device, such as a modem, network card, or printer, to communicate with Windows 2000. For example, without serial port drivers, Network Connections cannot use a modem to connect to a network. Although a device may be installed on your system, Windows 2000 cannot use the device until you have installed and configured the appropriate driver. If a device is listed in the Hardware Compatibility List (HCL), a driver is usually included with Windows 2000. Device drivers load automatically (for all enabled devices) when a computer is started, and thereafter run invisibly.

See also HCL.


A unit for housing a portable computer that contains a power connection, expansion slots, and connections to peripherals, such as a monitor, printer, full-sized keyboard, and mouse. The docking station turns the portable computer into a desktop computer.


A TCP/IP service protocol that offers dynamic leased configuration of host IP addresses and distributes other configuration parameters to eligible network clients. DHCP provides safe, reliable, and simple TCP/IP network configuration, prevents address conflicts, and helps conserve the use of client IP addresses on the network. DHCP uses a client/server model where the DHCP server maintains centralized management of IP addresses that are used on the network. DHCP-supporting clients can then request and obtain lease of an IP address from a DHCP server as part of their network boot process. Dynamic Host Configuration Protocol is also called DHCP.

See also IP address; lease; service; TCP/IP.


Address configuration parameters that a DHCP service assigns to clients. Most DHCP options are pre-defined, based on optional parameters defined in Request For Comment (RFC) 1542, although extended options can be added by vendors or users.

See also DHCP; RFC; service.


A backup that copies files created or changed since the last normal or incremental backup. It does not mark files as having been backed up (in other words, the archive attribute is not cleared). If you are performing a combination of normal and differential backups, restoring files and folders requires that you have the last normal as well as the last differential backup.

See also copy backup; daily backup; incremental backup; normal backup.


Memory access that does not involve the microprocessor. DMA is frequently used for data transfer directly between memory and a peripheral device such as a disk drive. Direct memory access is also called DMA.


A contiguous subtree of the directory that forms a unit of replication. A given replica is always a replica of some directory partition. The directory always has at least three directory partitions:

The schema, which defines the object classes and attributes contained in Active Directory.

The configuration, which identifies the domain controllers, replication topology and other related information about the domain controllers within a specific implementation of Active Directory.

One or more domains that contain the actual directory object data.

A domain controller always stores the partitions for the schema, configuration, and its own (and no other) domain. The schema and configuration are replicated to every domain controller in the domain tree or forest. The domain is replicated only to domain controllers for that domain. A subset of the attributes for all domain objects is replicated to the global catalog.

See also Active Directory; attribute; domain controller.


To make a device nonfunctional. For example, if you disable a device in a hardware configuration, you will not be able to use the device when your computer uses that hardware configuration. Disabling a device frees the resources that were allocated to the device.

See also enable; hardware configuration.


A physical data storage device attached to a computer.

See also basic disk; dynamic disk.


An expansion board that plugs into a personal computer to give it display capabilities. A computer's display capabilities depend on both the logical circuitry (provided in the video adapter) and the monitor. Each adapter offers several different video modes. The two basic categories of video modes are text and graphics. Within the text and graphics modes, some monitors also offer a choice of resolutions. At lower resolutions a monitor can display more colors.

Modern adapters contain memory, so that the computer's RAM is not used for storing displays. In addition, most adapters have their own graphics coprocessor for performing graphics calculations. These adapters are often called graphics accelerators.

See also RAM.


A group of computers that are part of a network and share a common directory database. A domain is organized in levels and is administered as a unit with common rules and procedures. Each domain has a unique name.

On the Internet, domains are defined by an IP address. All devices sharing part of the IP address are in the same domain. In an Internet address, the domain is generally the word or number that indicates the type of entity that owns the address, for example, .com or .org.

See also IP address.


In a Windows 2000 Server domain, a computer running Windows 2000 Server that manages user access to a network, which includes logging on, authentication, and access to the directory and shared resources.


A set of characters stored on disk and sent (downloaded) to a printer's memory when needed for printing a document. Downloadable fonts are most commonly used with laser printers and other page printers, although many dot-matrix printers can accept some of them. Downloadable fonts are also called soft fonts.

See also font.


To move an item on the screen by selecting the item and then pressing and holding down the mouse button while moving the mouse. For example, you can move a window to another location on the screen by dragging its title bar.


A data type composed of hexadecimal data with a maximum allotted space of 4 bytes.


A physical disk that is managed by Disk Management. Dynamic disks can contain only dynamic volumes (that is, volumes created with Disk Management). Dynamic disks cannot contain partitions or logical drives, nor can they be accessed by MS-DOS.

See also dynamic volume; partition.


An operating system feature that allows executable routines (generally serving a specific function or set of functions) to be stored separately as files with .dll extensions. These routines are loaded only when needed by the program that calls them.


A logical volume that is created using Disk Management. Dynamic volumes include simple, spanned, striped, mirrored, and RAID-5. You must create dynamic volumes on dynamic disks.

See also dynamic disk; mirrored volume; RAID-5 volume; simple volume; spanned volume; striped volume; volume.


Information created in another application that has been pasted inside your document. When information is embedded, you can edit the information in the new document using toolbars and menus from the original program. To edit the embedded information, double-click it and the toolbars and menus from the program used to create the information appear.

Embedded information is not linked to the original source. If you change information in one place, it is not updated in the other.

See also linked object.


A disk, created by the Backup utility, that contains information about your current Windows system settings. You can use this disk to repair your computer if it will not start or if your system files are damaged or erased. Emergency Repair Disk is also called ERD.


To make a device functional. For example, if you enable a device in your hardware configuration settings you will be able to use the device when your computer uses that hardware configuration.

See also disable; hardware configuration.


Windows 2000 file system that enables users to encrypt files and folders on an NTFS volume disk to keep them safe from access by intruders. Encrypting file system is also called EFS.

See also NTFS file system.


A technique for detecting when data is lost during transmission. This allows the software to recover lost data by notifying the transmitting computer that it needs to retransmit the data.


Any significant occurrence in the system or an application that requires users to be notified or an entry to be added to a log.


The Windows 2000 process of recording an audit entry in the audit trail whenever certain events occur, such as services starting and stopping, or users logging on and off and accessing resources. You can use Event Viewer to review AppleTalk network integration (formerly Services for Macintosh) events as well as Windows 2000 events.

See also service.


A socket in a computer, designed to hold expansion boards and connect them to the system bus.

See also bus.


The ability of a computer or operating system to ensure data integrity when hardware failures occur. In Disk Management, mirrored volumes and RAID-5 volumes are fault tolerant.

See also mirrored volume; RAID-5 volume.

For server clusters, a fault-tolerant system is always available. Fault-tolerant systems are typically implemented by configuring a backup of the primary system that remains idle until a failure occurs.

See also server cluster.


A small block of memory temporarily assigned by a computer's operating system to hold information about a file that has been opened for use. An FCB typically contains such information as the file's identification, its location on disk, and a pointer that marks the user's current (or last) position in the file. File control block is also called FCB.


A table or list maintained by some operating systems to keep track of the status of various segments of disk space used for file storage. File allocation table is also called FAT.

See also FAT32; file system; NTFS file system.


In the Windows environment, a designation of the operational or structural characteristics of a file. The file type identifies the program, such as Microsoft Word, that is used to open the file. File types are associated with the file name extension. For example, files that have the .txt or .log extension are of the Text Document type and can be opened using any text editor.

In the Macintosh environment, a four-character sequence that identifies the type of a Macintosh file. The Macintosh Finder uses the file type and file creator to determine the appropriate desktop icon for that file.


A graphic design applied to a collection of numbers, symbols, and characters. A font describes a certain typeface, along with other qualities such as size, spacing, and pitch.


The specification of physical characteristics such as paper size (such as letter or legal) and printer area margins of paper or other print media. For example, by default, the Letter form has a paper size of 8.5-by-11 inches and does not reserve space for margins.


The scattering of parts of the same disk file over different areas of the disk. Fragmentation occurs as files on a disk are deleted and new files are added. It slows disk access and degrades the overall performance of disk operations, although usually not severely.

See also defragmentation.


Available space that you use to create logical drives within an extended partition.

See also extended partition; logical drive; unallocated space.


For Windows 2000 Server, a group that can be granted rights and permissions and can become a member of local groups in its own domain, the member servers and workstations thereof, and trusting domains. However, a global group can contain user accounts only from its own domain. Global groups provide a way to create sets of users from inside the domain, available for use both in and out of the domain.

Global groups cannot be created or maintained on computers running Windows 2000 Professional. However, for Windows 2000 Professional computers that participate in a domain, domain global groups can be granted rights and permissions at those workstations and can become members of local groups at those workstations.

See also group; local group; permission; user account.


A collection of users, computers, contacts, and other groups. Groups can be used as security or as e-mail distribution collections. Distribution groups are used only for e-mail. Security groups are used both to grant access to resources and as e-mail distribution lists.

See also domain; local group; global group.

For server clusters, a collection of resources managed as a single object. Typically, a group contains all of the resources needed to run a specific application or service. A group is owned by a single node at any point in time. Failover and failback always act on groups.

See also failback; failover; node; resource; server cluster; service.


A collection of user accounts. By making a user account a member of a group, you give the related user all the rights and permissions granted to the group.

See also user account.


The groups to which a user account belongs. Permissions and rights granted to a group are also provided to its members. In most cases, the actions a user can perform in Windows 2000 are determined by the group memberships of the user account that has been logged on to.

See also group.


A unique name identifying a local group or a global group to Windows 2000. A group's name cannot be identical to any other group name or user name in its own domain or computer.

See also global group; local group.


An AppleTalk network integration (formerly Services for Macintosh) user who does not have a user account or who does not provide a password. When a Macintosh user assigns permissions to everyone, those permissions are given to the group's guests and users.

See also AppleTalk; permission.


In Task Manager, the number of object handles in a process's object table.

See also Windows 2000 Task Manager.


Resource settings that have been allocated for a specific device. Each device on your computer has a hardware configuration, which may consist of IRQ lines, DMA, an I/O port, or memory address settings.

See also device; DMA; I/O port; interrupt request (IRQ) lines; memory address.


A list of the devices supported by Windows 2000. The latest version of the HCL can be downloaded from the Hardware Compatibility List Web page at http://www.microsoft.com/hwtest/hcl/.


A feature available on some tape devices that automatically compresses the data that is being stored on the device. This is usually an option that is turned on or off in a backup program.

See also device.


A classification for similar devices. For example, Imaging Device is a hardware type for digital cameras and scanners.

See also device.


A base-16 number system represented by the digits 0 through 9 and the uppercase or lowercase letters A (equivalent to decimal 10) through F (equivalent to decimal 15).


A chart consisting of horizontal or vertical bars, the widths or heights of which represent the values of certain data.


A section of the registry that appears as a file on your hard disk.

The registry subtree is divided into hives (named for their resemblance to the cellular structure of a beehive). A hive is a discrete body of keys, subkeys, and values that is rooted at the top of the registry hierarchy. A hive is backed by a single file and a .log file, which are in the systemroot\System32\Config or the systemroot\Profiles\username folders.

By default, most hive files (Default, SAM, Security, and System) are stored in the systemroot\System32\Config folder. The systemroot\Profiles folder contains the user profile for each user of the computer. Because a hive is a file, it can be moved from one system to another, but it can be edited only by using Registry Editor.

See also registry; systemroot.


Specified in Active Directory Users and Computers or Local Users and Groups, the home directory is a folder that is accessible to the user and can contain files and programs for that user. A home directory can be assigned to an individual user or can be shared by many users. Some programs use the home directory as the default folder for the Open and Save As dialog boxes. Other programs use My Documents.

See also Active Directory Users and Computers; My Documents.


A simple markup language used to create hypertext documents that are portable from one platform to another. HTML files are simple ASCII text files with codes embedded (indicated by markup tags) to denote formatting and hypertext links. Hypertext Markup Language is also called HTML.

See also ASCII.


A mode in which the ARP/MARS provides ATM addresses to requesting clients in the form of a multicast server (MCS) list value. In this mode, the ARP/MARS acts as a multicast server, providing active forwarding of all multicast and broadcast traffic destined for IP addresses contained within the ranges specified in the list.

See also ARP; ATM; IP address; MARS; MCS; nonhubbed mode.


A common connection point for devices in a network. Typically used to connect segments of a local area network (LAN), a hub contains multiple ports. When a packet arrives at one port, it is copied to the other ports so that all segments of the LAN can see all packets.

See also LAN.


A request for attention from the processor. When the processor receives an interrupt, it suspends its current operations, saves the status of its work, and transfers control to a special routine known as an interrupt handler, which contains the instructions for dealing with the particular situation that caused the interrupt. Interrupts can be generated by various hardware devices to request service or report problems, or by the processor itself in response to program errors or requests for operating-system services. Interrupts are the processor's way of communicating with the other elements that make up a computer system. A hierarchy of interrupt priorities determines which interrupt request will be handled first if more than one request is made. A program can temporarily disable some interrupts if it needs the full attention of the processor to complete a particular task.


A type of disk-drive interface in which the controller electronics reside on the drive itself, eliminating the need for a separate adapter card. Integrated device electronics is also called IDE.


A standard for high-speed serial devices such as digital video and digital audio editing equipment.

See also device.


The name of a process as displayed in Task Manager.

See also Windows 2000 Task Manager.


A backup that copies only those files created or changed since the last normal or incremental backup. It marks files as having been backed up (in other words, the archive attribute is cleared). If you use a combination of normal and incremental backups, to restore your data you will need to have the last normal backup and all incremental backup sets.

See also copy backup; daily backup; differential backup; normal backup.


A channel through which data is transferred between a device and the microprocessor. The port appears to the microprocessor as one or more memory addresses that it can use to send or receive data. Input/output port is also called I/O port.

See also device; memory address.


A digital phone line used to provide higher bandwidth. ISDN in North America is typically available in two forms: Basic Rate Interface (BRI) consists of 2 B-channels at 64 kilobits per second (Kbps) and a D-channel at 16 Kbps; Primary Rate Interface (PRI) consists of 23 B-channels at 64 Kbps and a D-channel at 64 Kbps. An ISDN line must be installed by the phone company at both the calling site and the called site. Integrated Services Digital Network is also called ISDN.

See also B-channel; D-channel; WAN.


Digits dialed before the country code to access the international phone service. The actual digits depend on the country or region in which you are dialing an international number. For example, in the United States of America, the prefix for international dialing is 011. To dial from the United States of America to Honduras, which has the country code 504, you would dial:

011 +504 (000) 000-0000

The actual digits depend on the country or region.


A maintenance protocol in the TCP/IP suite, required in every TCP/IP implementation, that allows two nodes on an IP network to share IP status and error information. ICMP is used by the ping utility to determine the reachability of a remote system. Internet Control Message Protocol is also called ICMP.

See also IP; protocol; TCP/IP.


A company that provides individuals or companies access to the Internet and the World Wide Web. When you sign a contract with an ISP, you are given a telephone number, a user name, a password, and other connection information so you can connect your computer to the ISP's computers. An ISP typically charges a monthly and/or hourly connection fees. Internet service provider is also called ISP.


Hardware lines over which devices can send signals to get the attention of the processor when the device is ready to accept or send information. Interrupt request (IRQ) lines are numbered from 0 to 15. Each device must have a unique IRQ line.

See also device.


A 32-bit address used to identify a node on an IP internetwork. Each node on the IP internetwork must be assigned a unique IP address, which is made up of a network identifier and a host identifier. This address is typically represented in dotted-decimal notation, with the decimal value of each octet separated by a period, for example, 192.168.7.27.

In Windows 2000, you can configure the IP address statically or dynamically through DHCP.

See also DHCP; IP address; node.


A network protocol native to NetWare that controls addressing and routing of packets within and between LANs. IPX does not guarantee that a message will be complete (no lost packets). Internetwork Packet Exchange is also called IPX.

See also IPX/SPX; LAN.


A physical location on a hard disk that points to data located at another location on your hard disk or another storage device. Junction points are created when you create a mounted drive. You can also create a junction point using the linkd command.

See also mounted drive.


In Registry Editor, a folder that appears in the left pane of the Registry Editor window. A key can contain subkeys and value entries. For example, Environment is a key of HKEY_CURRENT_USER.

See also registry; subkey.

In IP security (IPSec), a value used in combination with an algorithm to encrypt or decrypt data. Key settings for IP security are configurable to provide greater security.


The arrangement that accommodates the special characters and symbols used in different languages. Keyboard layouts affect which characters appear when you press the keys on your keyboard. After you change your keyboard layout, the characters that appear on your screen may no longer correspond to the characters that are printed on your keyboard keys.


The length of time for which a dynamically assigned IP address configuration can be used by a DHCP client. Before the lease time expires, the client must either renew or obtain a new lease with the DHCP service.

See also DHCP; IP address.


A data-storage system, usually managed by Removable Storage. A library consists of removable media (such as tapes or discs) and a hardware device that can read from or write to the media. There are two major types of libraries: robotic libraries (automated multiple-media, multidrive devices) and stand-alone drive libraries (manually operated, single-drive devices).

See also Removable Storage.


An object that is inserted into a document but still exists in the source file. When information is linked, the new document is updated automatically if the information in the original document changes. If you want to edit the linked information, double-click it. The toolbars and menus from the original program will appear.

If the original document is on your computer, changes that you make to the linked information will also appear in the original document.

See also embedded object.


A group of computers and other devices dispersed over a relatively limited area and connected by a communications link that allows one device to interact with any other on the network. Local area network is also called LAN.


The computer that you are currently logged on to as a user. More generally, a local computer is a computer that you can access directly without using a communications line or a communications device, such as a network card or a modem. Similarly, running a local program means running the program on your computer, as opposed to running it from a network server.


For computers running Windows 2000 Professional and member servers, a group that can be granted permissions and rights from its own computer and (if the computer participates in a domain) user accounts and global groups both from its own domain and from trusted domains.

See also global group; user account.


A user profile that is created automatically on the computer the first time a user logs on to a computer running Windows 2000 Professional or Windows 2000 Server.


A file that stores messages generated by an application, service, or operating system. These messages are used to track the operations performed. For example, Web servers maintain log files listing every request made to the server. Log files are usually plain text (ASCII) files and often have a .log extension.

In Backup, a file that contains a record of the date the tapes were created and the names of files and directories successfully backed up and restored. The Performance Logs and Alerts service also creates log files.

See also ASCII; service.


A volume you create within an extended partition on a basic disk. A logical drive can be formatted and assigned a drive letter. Only basic disks can contain logical drives, and a logical drive cannot span multiple disks.

See also basic disk; basic volume; extended partition.


Files that can be assigned to user accounts. Typically a batch file, a logon script runs automatically every time the user logs on. It can be used to configure a user's working environment at every logon, and it allows an administrator to influence a user's environment without managing all aspects of it. A logon script can be assigned to one or more user accounts.

See also batch program; logon script path; user account.


A sequence of directory names that specifies the location of the logon script. When a user logs on, the authenticating computer the logon locates the specified logon script (if one has been assigned to that user account) by following that computer's local logon script path (usually systemroot\System32\Repl\Import\Scripts).

See also logon script; user account.


Digits dialed before the area or city code to access a long distance phone service. For example, in the United States of America, you dial a 1 before the area or city code:

1 (206) 000-0000

The actual digits depend on the country, region, or phone service. Area codes and long distance operators are not used in all countries.


An account that is created by a domain administrator and uniquely identifies the computer on the domain. The Windows 2000 computer account matches the name of the computer joining the domain.


A set of objects that represent various types of information about a device, used by Simple Network Management Protocol (SNMP) to manage the device. Because different network management services are used for different types of devices and protocols, each service has its own set of objects. Management Information Base is also called MIB.

See also service; SNMP.


A network-enabled host running Simple Network Management Protocol (SNMP) management software. This software requests information from SNMP agents. Management system is also called a management console.

See also SNMP.


A user profile that is not updated when the user logs off. It is downloaded to the user's desktop each time the user logs on, and is created by an administrator and assigned to one or more users to create consistent or job-specific user profiles. Only members of the Administrators group can change profiles.

See also roaming user profile; user profile.


To enlarge a window to its largest size by clicking the Maximize button (at the right of the title bar) or by pressing ALT+SPACEBAR, and then pressing x.

See also minimize.


Any fixed or removable object that stores computer data. Examples include hard disks, floppy disks, tapes, and compact discs.


A logical collection of removable media that have the same management policies. Media pools are used by applications to control access to specific tapes or discs within libraries managed by Removable Storage. There are four media pools: Unrecognized, Import, Free, and application-specific. Each media pool can only hold either media or other media pools.

See also backup media pool; free media pool; import media pool; Removable Storage.


In Task Manager, the current working set of a process, in kilobytes. The current working set is the number of pages currently resident in memory. On the Task Manager Processes tab, the column heading is Mem Usage.

See also Windows 2000 Task Manager.


In Task Manager, the change in memory, in kilobytes, used since the last update.

See also Windows 2000 Task Manager.


A portion of computer memory that can be allocated to a device or used by a program or the operating system. Devices are usually allocated a range of memory addresses.


A service that sends and receives messages sent by administrators or by the Alerter service.

See also Alerter service; service.


An industry-standard communication protocol that allows modems to automatically retransmit corrupted data, assuring that only error-free data passes through the modem. MNP2 and MNP3 standards are included in MNP4. Microcom Networking Protocol Four is also called MNP4.


A data-compression standard that allows modems to increase throughput by compressing data before transmission. Data can be compressed with a ratio of up to 2:1.

MNP5 sometimes expands data that has already been compressed, resulting in poorer performance in those cases. If you have an MNP5 modem, do not turn on modem compression and software compression at the same time.

To turn on MNP5 compression, you must also turn on MNP4 error control. Microcom Networking Protocol Five is also called MNP5.

See also MNP4.


A system service that provides fax services to local and remote network clients. Fax services include receiving faxes and faxing documents, fax wizard messages, and e-mail messages.

See also service.


A framework for hosting administrative tools, called consoles.

A console may contain tools, folders or other containers, World Wide Web pages, and other administrative items. These items are displayed in the left pane of the console, called a console tree. A console has one or more windows that can provide views of the console tree.

The main MMC window provides commands and tools for authoring consoles. The authoring features of MMC and the console tree itself may be hidden when a console is in User Mode. Microsoft Management Console is also called MMC.

See also console tree; service; snap-in.


The setup that specifies the type of MIDI device you are using, the channel and patch settings needed to play MIDI files, and the port your device is using.

See also MIDI.


To reduce a window to a button on the taskbar by clicking the Minimize button (at the right of the title bar) or by pressing ALT+SPACEBAR, and then pressing n.

See also maximize.


A serial interface standard that allows for the connection of music synthesizers, musical instruments, and computers. The MIDI standard is based partly on hardware and partly on a description of the way in which music and sound are encoded and communicated between MIDI devices. The information transmitted between MIDI devices is in a form called a MIDI message, which encodes aspects of sound, such as pitch and volume, as 8-bit bytes of digital information.

MIDI devices can be used for creating, recording, and playing back music. Using MIDI, computers, synthesizers, and sequencers can communicate with each other, either keeping time or actually controlling the music created by other connected equipment. Musical Instrument Digital Interface is also called MIDI.

See also MIDI setup.


A copy of a volume. Each mirror of a volume resides on a different disk. If one mirror becomes unavailable (due to a disk failure, for example), you can use the other mirror to gain access to the volume's data.

See also fault tolerance; mirrored volume.


A fault-tolerant volume that duplicates data on two physical disks. It provides data redundancy by using a copy (mirror) of the volume to duplicate the information contained on the volume. The mirror is always located on a different disk. If one of the physical disks fails, the data on the failed disk becomes unavailable, but the system continues to operate using the unaffected disk.

A mirrored volume is slower than a RAID-5 volume in read operations but faster in write operations. You can create mirrored volumes only on dynamic disks. In Windows NT 4.0, a mirrored volume was known as a mirror set.

See also dynamic disk; dynamic volume; fault tolerance; RAID-5 volume; volume.


Short for modulator/demodulator, a device that allows computer information to be transmitted and received over a telephone line. The transmitting modem translates digital computer data into analog signals that can be carried over a phone line. The receiving modem translates the analog signals back to digital form.


A program that is designed to run with MS-DOS and therefore may not be able to take full advantage of all Windows 2000 features.

See also MS-DOS; program.


A computer that has multiple network cards or that has been configured with multiple IP addresses for a single network card.

See also IP address.


The identifier of your computer on the network.


A portion of memory that can be used by one process to pass information to another, so that the output of one process is the input of the other process. The second process can be local (on the same computer as the first) or remote (on a networked computer).


A set of unique names for resources or items used in a shared computing environment.

For Microsoft Management Console (MMC), the namespace is represented by the console tree, which displays all of the snap-ins and resources that are accessible to a console.

See also console tree; MMC; resource; snap-in.

For Domain Name System (DNS), namespace is the vertical or hierarchical structure of the domain name tree. For example, each domain label, such as "host1" or "example," used in a fully qualified domain name, such as "host1.example.microsoft.com," indicates a branch in the domain namespace tree.

See also directory; DNS; label.


An application programming interface (API) that can be used by programs on a local area network (LAN). NetBIOS provides programs with a uniform set of commands for requesting the lower-level services required to manage names, conduct sessions, and send datagrams between nodes on a network. Network basic input/output system is also called NetBIOS.

See also BIOS; LAN; node; service.


A service that provides network transport and security for DDE conversations.

See also DDE; service.


For tree structures, a location on the tree that can have links to one or more items below it.

For local area networks (LANs), a device that is connected to the network and is capable of communicating with other network devices.

See also LAN.

For server clusters, a computer system running Windows 2000 Advanced Server that is an active or inactive member of a cluster.

See also server cluster.


A restore of a backup copy of a Windows 2000 domain controller in which the objects in the restored directory are not treated as authoritative. The restored objects are updated with changes held in other replicas of the restored domain.

See also authoritative restore.


A mode in which the ATM ARP/MARS does not forward multicast and broadcast traffic for multicast group clients. In this mode, the service returns a dynamic listing of ATM hosts currently registered for the multicast group address to requesting clients. Clients then use this list to initiate and establish their own point-to-multipoint virtual connections with each of the members in the multicast list.

See also ARP; ATM; hubbed mode; MARS; MCS; service.


A backup that copies all selected files and marks each file as having been backed up (in other words, the archive attribute is cleared). With normal backups, you need only the most recent copy of the backup file or tape to restore all of the files. You usually perform a normal backup the first time you create a backup set.

See also copy backup; daily backup; differential backup; incremental backup.


An advanced file system designed for use specifically within the Windows 2000 operating system. It supports file system recovery, extremely large storage media, long file names, and various features for the POSIX subsystem. It also supports object-oriented applications by treating all files as objects with user-defined and system-defined attributes.

See also FAT; FAT32; file system; POSIX.


An entity such as a file, folder, shared folder, printer, or Active Directory object described by a distinct, named set of attributes. For example, the attributes of a File object include its name, location, and size; the attributes of an Active Directory User object might include the user's first name, last name, and e-mail address.

For OLE and ActiveX, an object can also be any piece of information that can be linked to, or embedded into, another object.

See also ActiveX; attribute; child object; container object; noncontainer object; OLE; parent object.


Information stored on a local disk drive. The on-disk catalog contains a list of files and folders that have been backed up in a backup set.

See also backup set; on-media catalog.


Information stored on backup storage media. The on-media catalog contains a list of files and folders that have been backed up in a backup set.

See also backup set; on-disk catalog.


A member of a mirrored volume or a RAID-5 volume that has failed due to a severe cause, such as a loss of power or a complete hard-disk head failure. When this happens, the fault-tolerant driver determines that it can no longer use the orphaned member and directs all new reads and writes to the remaining members of the fault-tolerant volume.

See also fault tolerance; mirrored volume; RAID-5 volume.


In Windows 2000, the person who controls how permissions are set on objects and can grant permissions to others.

In the Macintosh environment, an owner is the user responsible for setting permissions for a folder on a server. A Macintosh user who creates a folder on the server automatically becomes the owner of the folder, and can then transfer ownership to someone else. Each Macintosh-accessible volume on the server also has an owner.


An icon that represents embedded or linked information. That information may consist of a complete file, such as a Paint bitmap, or part of a file, such as a spreadsheet cell. When you choose the package, the application used to create the object either plays the object (for example, a sound file) or opens and displays the object. If you change the original information, linked information is automatically updated. However, you must manually update embedded information.

See also embedded object; linked object; OLE.


The interrupt that occurs when software attempts to read from or write to a virtual memory location that is marked "not present."

See also virtual memory.

In Task Manager, page fault is the number of times data has to be retrieved from disk for a process because it was not found in memory. The page fault value accumulates from the time the process started.

See also Page Fault Delta; Windows 2000 Task Manager.


In Task Manager, the change in the number of page faults since the last update.

See also page fault; Windows 2000 Task Manager.


The system-allocated virtual memory that has been charged to a process and that can be paged. Paging is the moving of infrequently-used parts of a program's working memory from RAM to another storage medium, usually the hard disk.

See also RAM.

In Task Manager, the amount of system allocated virtual memory, in kilobytes, used by a process.

See also virtual memory; Windows 2000 Task Manager.


A hidden file on the hard disk that Windows 2000 uses to hold parts of programs and data files that do not fit in memory. The paging file and physical memory, or RAM, comprise virtual memory. Windows 2000 moves data from the paging file to memory as needed and moves data from memory to the paging file to make room for new data. Paging file is also called a swap file.

See also RAM; virtual memory.


The location (such as Upper Paper Tray or Envelope Feeder) of the paper at the printer.


The object in which another object resides. A parent object implies relation. For example, a folder is a parent object in which a file, or child object, resides. An object can be both a parent and a child object. For example, a subfolder that contains files is both the child of the parent folder and the parent folder of the files.

See also child object; object.


Redundant information that is associated with a block of information. In Windows 2000 Server, parity is a calculated value used to reconstruct data after a failure.

RAID-5 volumes (also called stripe sets with parity) stripe data and parity intermittently across a set of disks. Within each stripe, the data on one disk is parity data and the data on the other disks is normal data. RAID-5 volumes therefore require at least three disks to allow for this extra parity information. The parity portion of each stripe contains the XOR (the Boolean operation called exclusive OR) of the data in that stripe. When a disk fails, Windows 2000 Server uses the parity information in conjunction with the data on good disks to recreate the data on the failed disk.

See also fault tolerance; RAID-5 volume; striped volume; XOR.


A portion of a physical disk that functions as though it were a physically separate disk. Partitions can be created only on basic disks.

See also basic disk; extended partition; primary partition; system partition.


An automatic telephone switching system that enables users within an organization to place calls to each other without going through the public telephone network. Users can also place calls to outside numbers. Private Branch Exchange is also called PBX.


The page-description language (PDL) developed by Hewlett Packard for their laser and inkjet printers. Because of the widespread use of laser printers, this command language has become a standard in many printers. Printer Control Language is also called PCL.

See also PDL; PostScript.


A computer language that describes the arrangement of text and graphics on a printed page. Page-description language is also called PDL.

See also PCL; PostScript.


In System Monitor, a data item associated with a performance object. For each counter selected, System Monitor presents a value corresponding to a particular aspect of the performance defined for the performance object.

See also performance object.


In System Monitor, a logical collection of counters that is associated with a resource or service that can be monitored.

See also performance counter; service.


In System Monitor, a term used to distinguish between multiple performance objects of the same type on a computer.

See also performance object.


A rule associated with an object to regulate which users can gain access to the object and in what manner.

See also object.

AppleTalk network integration (formerly Services for Macintosh) automatically translates between permissions and Macintosh access privileges. This means that permissions set on a folder (volume) are enforced for Macintosh users and access privileges set by Macintosh users are enforced for personal computer users connected to the computer running Windows 2000 Server.


A numerical identifier that uniquely distinguishes a process while it runs. Use Task Manager to view PIDs. Process identifier is also called PID.


A set of specifications developed by Intel that allows a computer to automatically detect and configure a device and install the appropriate device drivers.


Generally, a connection point on your computer where you can connect devices that pass data into and out of a computer. For example, a printer is typically connected to a parallel port (also called an LPT port), and a modem is typically connected to a serial port (also called a COM port).

See also modem; serial port.


A page-description language (PDL), developed by Adobe Systems for printing on laser printers, that offers flexible font capability and high-quality graphics. PostScript is the standard for desktop publishing because it is supported by imagesetters, the high-resolution printers used by printing services for commercial typesetting.

See also PCL; PDL; service.


A key that represents one of the main divisions of the registry. Each predefined key is displayed in a separate Registry Editor window, with the key’s name appearing in the window's title bar. For example, HKEY_CLASSES_ROOT is a predefined key.

See also key; registry.


The NetWare server that you connect to by default when you log on to your computer. The preferred server validates your user credentials and is queried when you request information about resources available on the NetWare network.


A volume you create using unallocated space on a basic disk. Windows 2000 and other operating systems can start from a primary partition. You can create up to four primary partitions on a basic disk, or three primary partitions and an extended partition. Primary partitions can be created only on basic disks and cannot be subpartitioned.

See also basic disk; dynamic volume; extended partition; partition.


A computer that is dedicated to managing the printers on a network. The print server can be any computer on the network.


Computer software that accepts a document sent to a printer by the user and then stores it on disk or in memory until the printer is ready for it. This collection of dynamic-link libraries (DLLs) receives, processes, schedules, and distributes documents for printing. The term spooler is an acronym created from "simultaneous print operations on line."

See also DLL; spooling.


A device that puts text or images on paper or other print media. Examples include laser printers or dot-matrix printers.

See also logical printer; Printers; print spooler.


The folder in Control Panel that contains the Add Printer wizard and icons for all the printers installed on your computer.

See also printer.


A complete, self-contained set of computer instructions that you use to perform a specific task, such as word processing, accounting, or data management. Program is also called application.


A file that provides information to Windows 2000 about how best to run MS-DOS-based program. When you start an MS-DOS-based program, Windows 2000 looks for a PIF to use with it. PIFs contain such items as the name of the file, a start-up directory, and multitasking options. Program information file is also called PIF.

See also MS-DOS-based program.


A set of rules and conventions for sending information over a network. These rules govern the content, format, timing, sequencing, and error control of messages exchanged among network devices.


A computer that listens to name query broadcasts and responds for those names not on the local subnet. The proxy communicates with the name server to resolve names and then caches them for a specific time period.


A method used to standardize and categorize fault-tolerant disk systems. Six levels gauge various mixes of performance, reliability, and cost. Windows 2000 provides three of the RAID levels: Level 0 (striping), Level 1 (mirroring), and Level 5 (RAID-5). Redundant Array of Independent Disks is also called RAID.

See also fault tolerance; mirrored volume; RAID-5 volume; striped volume.


A fault-tolerant volume with data and parity striped intermittently across three or more physical disks. Parity is a calculated value that is used to reconstruct data after a failure. If a portion of a physical disk fails, you can recreate the data that was on the failed portion from the remaining data and parity. You can create RAID-5 volumes only on dynamic disks, and you cannot mirror or extend RAID-5 volumes. In Windows NT 4.0, a RAID-5 volume was known as a striped set with parity.

See also dynamic disk; dynamic volume; fault tolerance; parity; RAID-5 volume; volume.


Memory that can be read from or written to by a computer or other devices. Information stored in RAM is lost when you turn off the computer. Random-access memory is also called RAM.

See also virtual memory.


Fonts that are stored as bitmaps. Raster fonts are designed with a specific size and resolution for a specific printer and cannot be scaled or rotated. If a printer does not support raster fonts, it will not print them. The five raster fonts are Courier, MS Sans Serif, MS Serif, Small, and Symbol. Raster fonts are also called bit-mapped fonts.

See also font; printer.


The folder that stores deleted files. You can retrieve files you deleted in error, or you can empty the Recycle Bin to create more disk space.


To update displayed information with current data.

See also refresh rate.


File types that are tracked by the system registry and are recognized by the programs you have installed on your computer.

See also file type.


Contiguous chunks of storage on a disk.


In Windows 2000, a database repository for information about a computer's configuration. The registry contains information that Windows 2000 continually references during operation, such as:

Profiles for each user.

The programs installed on the computer and the types of documents each can create.

Property settings for folders and program icons.

What hardware exists on the system.

Which ports are being used.

The registry is organized hierarchically as a tree and is made up of keys and their subkeys, hives, and value entries.

See also hive; key; subkey; value entry.


Part of the integrated Routing and Remote Access service that provides remote networking for telecommuters, mobile workers, and system administrators who monitor and manage servers at multiple branch offices. Users with a computer running Windows 2000 and Network and Dial-up Connections can dial in to remotely access their networks for services such as file and printer sharing, electronic mail, scheduling, and SQL database access.

See also remote access server; service.


A computer that you can access only by using a communications line or a communications device, such as a network card or a modem.


A service used for managing removable media (such as tapes and discs) and storage devices (libraries). Removable Storage allows applications to access and share the same media resources.

See also library; service.


For Windows 2000 Server, an application used to automatically move infrequently accessed files from local storage to remote storage. Remote files are recalled automatically upon user request when the file is opened.


In color management, the approach used to map the colors specified in an image file to the color gamut of your monitor or printer. The color gamut is the range of color that a device can produce.

See also color gamut.


The official documents of the Internet Engineering Task Force (IETF) that specify the details for protocols included in the TCP/IP family. Requests for Comments is also called RFC.

See also TCP/IP.


A specific IP address within a scope permanently reserved for leased use to a specific DHCP client. Client reservations are made in the DHCP database using DHCP Manager and based on a unique client device identifier for each reserved entry.

See also DCHP; IP address.

In Admission Control Service/Quality of Service (ACS/QoS), an allocation of network resources, contained in a Resource Reservation Protocol (RSVP) reservation request administered by the ACS.


Generally, any part of a computer system or network, such as a disk drive, printer, or memory, that can be allotted to a running program or a process.

For Device Manager, any of four system components that control how the devices on a computer work. These four system resources are: interrupt request (IRQ) lines, direct memory access (DMA) channels, input/output (I/O) ports, and memory addresses.

See also DMA; I/O port; interrupt request (IRQ) lines; memory address.

For server clusters, a physical or logical entity that is capable of being managed by a cluster, brought online and taken offline, and moved between nodes. A resource can be owned only by a single node at any point in time.

See also node; offline; online; resource; server cluster.


A server-based user profile that is downloaded to the local computer when a user logs on and is updated both locally and on the server when the user logs off. A roaming user profile is available from the server when logging on to any computer running Windows 2000 Professional or Windows 2000 Server. When logging on, the user can use the local user profile if it is more current than the copy on the server.

See also local user profile; mandatory user profile; user profile.


An accepted industry standard for serial communication connections. Adopted by the Electric Industries Association, this Recommended Standard (RS) defines the specific lines and signal characteristics used by serial communications controllers to standardize the transmission of serial data between devices. The letter C signifies the third in a series.


A range of IP addresses that are available to be leased or assigned to DHCP clients by the DHCP service.

See also DHCP; IP address; lease.


In a domain environment, a site, domain, or organizational unit; in a workgroup environment, the local disk.

See also domain.


A typeface designed for display on a computer monitor screen. Screen fonts often have accompanying PostScript fonts for printing to PostScript-compatible printers.

See also font; PostScript.


The setting that determines the amount of information that appears on your screen, measured in pixels. Low resolution, such as 640 x 480, makes items on the screen appear large, although the screen area is small. High resolution, such as 1024 x 768, makes the overall screen area large, although individual items appear small.

See also pixel.


A standard high-speed parallel interface defined by the American National Standards Institute (ANSI). A SCSI interface is used for connecting microcomputers to peripheral devices such as hard disks and printers, and to other computers and local area networks (LANs). Small computer system interface is also called SCSI.

See also LAN.


On a network, protection of a computer system and its data from harm or loss, implemented especially so that only authorized users can gain access to shared files.


A computer port that allows asynchronous transmission of data characters one bit at a time. Also called a communication or COM port.

See also communication port; port.


In general, a computer that provides shared resources to network users.


Permissions that restrict a shared resource's availability over the network to only certain users.

See also permission.


A folder on another computer that has been made available for others to use on the network.


Any device, data, or program that is used by more than one other device or program. For Windows 2000, shared resources refer to any resource that is made available to network users, such as folders, files, printers, and named pipes. A shared resource can also refer to a resource on a server that is available to network users.

See also resource; server.


To make resources, such as folders and printers, available to others.

See also resource.


A link to any item accessible on your computer or on a network, such as a program, file, folder, disk drive, Web page, printer, or another computer. You can put shortcuts in various areas, such as on the desktop, on the Start menu, or in specific folders.


A network protocol used to manage TCP/IP networks. In Windows, the SNMP service is used to provide status information about a host on a TCP/IP network. Simple Network Management Protocol is also called SNMP.

See also service; TCP/IP.


A volume made up of disk space from a single disk. It can consist of a single region on a disk or multiple regions of the same disk that are linked together. You can extend a simple volume within the same disk or onto additional disks. If you extend a simple volume across multiple disks, it becomes a spanned volume. You can create simple volumes only on dynamic disks. Simple volumes are not fault tolerant, but can be mirrored.

See also dynamic disk; dynamic volume; fault tolerance; mirrored volume; spanned volume; volume.


A type of tool you can add to a console supported by Microsoft Management Console (MMC). A stand-alone snap-in can be added by itself; an extension snap-in can only be added to extend the function of another snap-in.

See also MMC.


The document where a linked or embedded object was originally created.

See also embedded object; linked object.


A volume consisting of disk space on more than one physical disk. You can add more space to a spanned volume by extending it at any time. You can create spanned volumes only on dynamic disks. Spanned volumes are not fault tolerant and cannot be mirrored. In Windows NT 4.0, a spanned volume was known as a volume set.

See also dynamic disk; dynamic volume; fault tolerance; mirrored volume; simple volume; volume.


A process on a server in which print documents are stored on a disk until a printer is ready to process them. A spooler accepts each document from each client, stores it, then sends it to a printer when the printer is ready.

See also print spooler.


A line of information related to the current program. The status bar is usually located at the bottom of a window. Not all windows have a status bar.


A group of characters or character bytes handled as a single entity. Computer programs use strings to store and transmit data and commands. Most programming languages consider strings (such as "2674:gstmn") as distinct from numeric values (such as "470924").


A volume that stores data in stripes on two or more physical disks. Data in a striped volume is allocated alternately and evenly (in stripes) to these disks. Striped volumes offer the best performance of all volumes available in Windows 2000, but they do not provide fault tolerance. If a disk in a striped volume fails, the data in the entire volume is lost. You can create striped volumes only on dynamic disks. Striped volumes cannot be mirrored or extended. In Windows NT 4.0, a striped volume was known as a stripe set.

See also dynamic disk; dynamic volume; fault tolerance; volume.


A menu that contains commands you can use to manipulate a window or close a program. You click the program icon at the left of the title bar to open the System menu.


Files used by Windows to load, configure, and run the operating system. Generally, system files must never be deleted or moved.


In Backup, a collection of system-specific data that can be backed up and restored. For all Windows 2000 operating systems, the System State data includes the registry, the COM+ Class Registration database, and the system boot files. For Windows 2000 Server, the System State data also includes the Certificate Services database (if the server is operating as a certificate server). If the server is a domain controller, the System State data also includes Active Directory directory services database and the SYSVOL directory.

See also Active Directory; domain controller; registry; SYSVOL.


A shared directory that stores the server copy of the domain's public files, which are replicated among all domain controllers in the domain.

See also domain; domain controller.


The volume that contains the hardware-specific files needed to load Windows 2000. The system volume can be, but does not have to be, the same volume as the boot volume.

See also boot volume; volume.


A program running under MS-DOS that remains loaded in memory even when it is not running, so that it can be quickly invoked for a specific task performed while any other application is operating. Terminate-and-stay-resident is also called TSR.

See also MS-DOS.


In a dialog box, a box in which you type information needed to carry out a command. The text box may be blank or may contain text when the dialog box opens.


In Task Manager, the number of threads running in a process.

See also Windows 2000 Task Manager.


The horizontal bar at the top of a window that contains the name of the window. On many windows, the title bar also contains the program icon, the Maximize, Minimize, and Close buttons, and the optional ? button for context-sensitive Help. To display a menu with commands such as Restore and Move, right-click the title bar.

See also maximize; minimize.


A set of networking protocols used on the Internet that provides communications across interconnected networks made up of computers with diverse hardware architectures and various operating systems. TCP/IP includes standards for how computers communicate and conventions for connecting networks and routing traffic. Transmission Control Protocol/Internet Protocol is also called TCP/IP.

See also IP; protocol.


In Simple Network Management Protocol (SNMP), a message sent by an agent to a management system indicating that an event has occurred on the host running the agent. For example, the SNMP service can be configured to send a trap when it receives a request for information that does not contain the correct community name and does not match an accepted host name for the service.

See also agent; authentication; IP; SNMP.


The position of a User object in the file system of a Novell Directory Services (NDS) tree on a Novell NetWare network. The default tree and context is the location in an NDS tree that a computer running Windows 2000 and either Gateway Service for NetWare or Client Service for NetWare is automatically logged onto.

See also Client Service for NetWare; Gateway Service for NetWare; NDS; object.


A hierarchical representation of the folders, files, disk drives, and other resources connected to a computer or network. For example, Windows Explorer uses a tree view to display the resources that are attached to a computer or a network.


A program that masquerades as another common program in an attempt to receive information. An example of a Trojan horse is a program that behaves like a system logon to retrieve user names and password information that the writers of the Trojan horse can later use to break into the system.


Fonts that are scalable and sometimes generated as bitmaps or soft fonts, depending on the capabilities of your printer. TrueType fonts are device-independent fonts that are stored as outlines. They can be sized to any height, and they can be printed exactly as they appear on the screen.

See also font.


A logical relationship established between domains to allow pass-through authentication, in which a trusting domain honors the logon authentications of a trusted domain.

User accounts and global groups defined in a trusted domain can be given rights and permissions in a trusting domain, even though the user accounts or groups don't exist in the trusting domain's directory.

See also authentication; domain; global group; permission; user account.


Scalable fonts designed to work with PostScript devices.

See also font; PostScript.


Available disk space that is not allocated to any partition, logical drive, or volume. The type of object you can create on unallocated space depends on the disk type (basic or dynamic):

For basic disks, you can use unallocated space outside partitions to create primary or extended partitions. You can use free space inside an extended partition to create a logical drive.

For dynamic disks, you can use unallocated space to create dynamic volumes. Unlike basic disks, you do not select the exact disk region used to create the volume.

See also basic disk; dynamic disk; extended partition; logical drive; object; partition; primary partition; volume.


A 16-bit character encoding standard developed by the Unicode Consortium between 1988 and 1991. By using two bytes to represent each character, Unicode enables almost all of the written languages of the world to be represented using a single character set. By contrast, 8-bit ASCII is not capable of representing all of the combinations of letters and diacritical marks that are used just with the Roman alphabet.

Approximately 39,000 of the 65,536 possible Unicode character codes have been assigned to date, 21,000 of them being used for Chinese ideographs. The remaining combinations are open for expansion.

See also ASCII.


When referring to software, the act of removing program files and folders from your hard disk and removing related data from your registry so the software is no longer available.

When referring to a device, the act of removing the corresponding device drivers from your hard disk and physically removing the device from your computer.

See also device driver; install.


A service that manages an uninterruptible power supply (UPS) connected to a computer.

See also service.


A record that consists of all the information that defines a user to Windows 2000. This includes the user name and password required for the user to log on, the groups in which the user account has membership, and the rights and permissions the user has for using the computer and network and accessing their resources. For Windows 2000 Professional and member servers, user accounts are managed with Local Users and Groups. For Windows 2000 Server domain controllers, user accounts are managed with Microsoft Active Directory Users and Computers.

See also Active Directory Users and Computers; domain controller; group; permissions; user name.


A unique name identifying a user account to Windows 2000. An account's user name must be unique among the other group names and user names within its own domain or workgroup.

See also user account.


A profile that defines the Windows 2000 environment that is loaded by the system when a user logs on. It includes all the user-specific settings of a user's Windows 2000 environment, such as program items, screen colors, network connections, printer connections, mouse settings, and window size and position.


Tasks a user is permitted to perform on a computer system or domain, such as backing up files and folders, adding or deleting users in a workstation or domain, and shutting down a computer system. Rights can be granted to groups or to user accounts, but are best reserved for use by groups.

See also group.


Data transmission standard that provides for up to 33,600 bits per second (bps) communications over telephone lines. It defines a full-duplex (two-way) modulation technique and includes error-correcting and negotiation.

See also bps; full-duplex; modulation standards.


Data transmission standard that provides for up to 56,000 bits per second (bps) communications over telephone lines. The transmission speed from the client-side modem is 33,600 bps. The transmission speed from the host-side modem, such as an Internet service provider or corporate network, is up to 56,000 bps, with an average speed of 40,000 to 50,000 bps. When the host-side modem does not support this standard, the alternative is V.34.

See also bps; modulation standards; V.34.


Protocols that determine how modems convert digital data into analog signals that can be transmitted over telephone lines.

Initially, Bell created modulation standards used in the United States, and the CCITT created international standards. The ITU-T (formerly called the CCITT) now sets standards generally adopted by modem manufacturers both internationally and in the United States. The ITU-T V series standards (such as V.34 and V.90) define data communication over the telephone network. The suffixes "-bis" and "-ter" (for example, V.32bis) indicate later versions of a standard.

See also ITU-T; modem; V.34; V.90.


The string of data that appears in the right pane of a registry window and that defines the value of the currently selected key. A value entry has three parts: name, data type, and the value itself.

See also key; registry.


Temporary storage used by a computer to run programs that need more memory than it has. For example, programs could have access to 4 gigabytes of virtual memory on a computer's hard drive, even if the computer has only 32 megabytes of RAM. The program data that does not currently fit in the computer's memory is saved into paging files.

See also paging file; RAM.


A portion of a physical disk that functions as though it were a physically separate disk. In My Computer and Windows Explorer, volumes appear as local disks such as C: or D:.


The extension of a private network that encompasses encapsulated, encrypted, and authenticated links across shared or public networks. VPN connections can provide remote access and routed connections to private networks over the Internet. Virtual private network is also called VPN.

See also LAN; protocol; remote access; tunnel.


The background pattern used on a graphical user interface such as Windows. Any pattern or picture that can be stored as a bitmap (.bmp) file can be set as a screen background.


The extension of a data network that uses telecommunication links to connect to geographically separated areas. Wide area network is also called WAN.

See also LAN.


A Boolean operation that yields true if and only if one of its operands is true and the other is false. For Windows 2000 Server, the exclusive OR is a Boolean operation in which the Windows 2000 Server RAID-5 volume form of fault tolerance maintains an XOR of the total data to provide data redundancy. This is used to reconstruct missing data on a failed disk or sector from the remaining disks in the RAID-5 volume. Exclusive OR is also called XOR.

See also fault tolerance; RAID-5 volume.


To remove a removable tape or disc from a drive.

See also library; mount.


To place a removable tape or disc into a drive.

See also dismount; library.


An area of storage on a hard disk. A drive is formatted using a file system (such as FAT or NTFS) and has a drive letter assigned to it. You can view the contents of a drive by clicking its icon in Windows Explorer or My Computer. There can be multiple drives on a single hard disk.

See also FAT; NTFS file system.


The area on the taskbar to the right of the taskbar buttons. The status area displays the time and can also contain icons that provide quick access to programs, such as Volume Control and Power Options. Other icons can appear temporarily, providing information about the status of activities. For example, the printer icon appears after a document has been sent to the printer and disappears when printing is complete.

See also taskbar; taskbar button.


The software interface between the operating system and the printer in Windows 2000. While a printer is the device that does the actual printing, a logical printer determines how a print job is processed and how it is routed to its destination (to a local or network port, to a file, or to a remote print share). When you print a document, it is spooled (or stored) on the logical printer before it is sent to the printer itself.

See also printer; spooling.


A plug-in unit available for some printers that contains fonts in several styles and sizes. As with downloadable fonts, printers using font cartridges can produce characters in sizes and styles other than those created by the fonts built into it.

See also downloadable fonts; font.


A printer that receives input from more than one computer. For example, a printer attached to another computer on the network can be shared so that it is available for you to use. Shared printer is also called a network printer.


A profile that contains the data needed for translating the values of a color gamut. This data includes information about color, hue, saturation, and brightness.

See also color gamut; saturation; hue.


Multidimensional color space consisting of the red, green, and blue intensities that make up a given color. This system is typically used in scanners, digital cameras, computer monitors, and computer printers.

See also color management; color space.


Multidimensional color space consisting of the cyan, magenta, yellow, and black intensities that make up a given color. Commercial color printing devices generally use this system of four-color process inks.

See also color management; color space.


A set of three values that defines how a color can be represented on computer devices such as monitors, scanners, and printers. For example, in the LAB color space, the terms luminance or whiteness (L), redness-greenness (A), and yellowness-blueness (B) are used; in the HVC system, the terms are hue (H), value (V), and chroma (C). Color space refers to the three-dimensional space that is defined by the respective values, such as L, A, and B.

See also CMYK color space; color space; RGB color space.


Particular range of colors that a device is able to produce. Devices such as scanners, monitors, and printers can produce a unique range of colors, which is determined by the characteristics of the device itself.

See also color profile; saturation; hue.


Process of producing accurate, consistent color among a variety of input and output devices. A color management system (CMS) maps colors between devices such as scanners, monitors, and printers; transforms colors from one color space to another (for example, RGB to CMYK); and provides accurate on-screen or print previews.

See also CMYK color space; RGB color space.


Data that describes the configuration and characteristics of specific computer equipment. This information can be used to configure computers for using peripheral devices.


How often the video screen is retraced in order to prevent the image from flickering. The entire image area of most monitors is refreshed approximately 60 times per second.

See also refresh.


A drive attached to an empty folder on an NTFS volume. Mounted drives function the same as any other drive, but are assigned a label or name instead of a drive letter. The mounted drive's name is resolved to a full file system path instead of just a drive letter. Members of the Administrators group can use Disk Management to create mounted drives or reassign drive letters.

See also drive; mount; NTFS file system.


A miniature version of an image that is often used for quick browsing through multiple images.


The path and folder name where the Windows 2000 system files are located. Typically, this is C:\Winnt, although you can designate a different drive or folder when you install Windows 2000. You can use the value %systemroot% to replace the actual location of the folder that contains the Window 2000 system files. To identify your systemroot folder, click Start, click Run, and then type %systemroot%.


An external bus that supports Plug and Play installation. Using USB, you can connect and disconnect devices without shutting down or restarting your computer. You can use a single USB port to connect up to 127 peripheral devices, including speakers, telephones, CD-ROM drives, joysticks, tape drives, keyboards, scanners, and cameras. A USB port is usually located on the back of your computer near the serial port or parallel port. Universal serial bus is also called USB.

See also bus; Plug and Play; port.


When referring to software, to add program files and folders to your hard disk and related data to your registry so that the software runs properly. Installing contrasts with upgrading, where existing program files, folders, and registry entries are updated to a more recent version.

When referring to hardware, to physically connect the device to your computer, to load device drivers onto your computer, and to configure device properties and settings.

See also device driver; registry; uninstall.


A removable device, approximately the size of a credit card, that can be plugged into a Personal Computer Memory Card International Association (PCMCIA) slot in a portable computer. PCMCIA devices can include modems, network cards, and hard disk drives.

See also modem.


The process of distributing a computer system's facilities to different components of a job in order to perform the job.


The printer command language developed by Hewlett Packard that provides printer control at the print-job level. Using PJL commands, you can change default printer settings such as number of copies to print. PJL commands also permit switching printer languages between print jobs without action by the user. If bi-directional communication is supported, a PJL-compatible printer can send information such as printer model and job status to the print server. Printer Job Language is also called PJL.

See also PCL; PDL; PostScript.


Objects from the Graphics Device Interface (GDI) library of application programming interfaces (APIs) for graphics output devices.

In Task Manager, the number of GDI objects currently used by a process.

See also Windows 2000 Task Manager.


In Task Manager, the peak amount of physical memory resident in a process since it started.

See also paging file; RAM; Windows 2000 Task Manager.


The amount of disk space available to a user.

See also warning level.


An object from Window Manager, which includes windows, menus, cursors, icons, hooks, accelerators, monitors, keyboard layouts, and other internal objects.

In Task Manager, the number of USER objects currently being used by a process.

See also Windows 2000 Task Manager.


In Task Manager, the amount of virtual memory, or address space, committed to a process.

See also virtual memory; Windows 2000 Task Manager.


The point at which users are nearing their quota limit.

See also quota limit.


A program designed to aid in detecting, locating, and correcting errors in another program by allowing the programmer to step through the program, examine the data, and monitor conditions such as the values of variables.


The specification of the language you want to type in. Some programs that are designed for Windows 2000 recognize this setting. When you add a new input locale, a keyboard layout for that language is also added.

See also keyboard layout.


Wireless file transfer between a computer and another computer or device using infrared light.

See also infrared.


A direct or incoming network connection to a remote access server using an infrared port.

See also infrared port.


A computer, or a computer peripheral such as a printer, that can communicate using infrared light.

See also infrared; infrared port.


An optical port on a computer that communicates with other computers or devices using infrared light. Communication is achieved without cables. Infrared ports can be found on portable computers, printers, cameras, and other devices. An infrared port may also be assigned to an external infrared device that is connected to a serial or a parallel port, or connected directly to the motherboard.

See also infrared device.


Light that is beyond red in the color spectrum. While the light is not visible to the human eye, infrared transmitters and receivers can send and receive infrared signals. Infrared is also called IR.

See also infrared device; infrared port; IrDA.


Communication between a computer and another computer or device without wires. The form of wireless communication provided as part of the Windows 2000 operating system uses infrared light to transmit files. Radio frequencies, as used by cellular and cordless telephones, are another form of wireless communication.

See also infrared; infrared device; infrared port.


The industry organization of computer, component, and telecommunications vendors who establish the standards for infrared communication between computers and peripheral devices, such as printers. Infrared Data Association is also called IrDA.

See also infrared; infrared device; infrared port.


The bar that contains the Start button and appears by default at the bottom of the desktop. You can click the taskbar buttons to switch between running programs. You can also hide the taskbar, move it to the sides or top of the desktop, and customize it in other ways.

See also desktop; taskbar button; status area.


A button that appears on the taskbar and corresponds to a running application.

See also taskbar.


A semiconductor circuit that contains information that cannot be modified. Read-only memory is also called ROM.


A service that provides recommendations for technology that can help people with disabilities.


A file that is stored inside Briefcase and not linked to any file outside Briefcase. When you update files, the orphan files are not synchronized with any other file.


A Briefcase command that separates the copy of the file inside Briefcase from the copy outside Briefcase.


In asynchronous communications, an extra bit used in checking for errors in groups of data bits transferred within or between computer systems. In modem-to-modem communications, a parity bit is often used to check the accuracy with which each character is transmitted.

See also asynchronous communication; bit; parity.


A type of optical disc storage technology. A digital video disc (DVD) looks like a CD-ROM disc, but it can store greater amounts of data. DVDs are often used to store full-length movies and other multimedia content that requires large amounts of storage space.

See also DVD decoder; DVD drive.


A hardware or software component that allows a digital video disc (DVD) drive to display movies on your computer screen.

See also DVD; DVD drive.


A type of digital video disc (DVD) decoder that allows a DVD drive to display movies on your computer screen. A software decoder uses only software to display movies.

See also DVD decoder; DVD drive; hardware decoder.


A type of digital video disc (DVD) decoder that allows a DVD drive to display movies on your computer screen. A hardware decoder uses both software and hardware to display movies.

See also DVD decoder; DVD drive; software decoder.


A disk storage device that uses digital video disc (DVD) technology. A DVD drive reads both CD-ROM and DVDs; however, you must have a DVD decoder to display DVD movies on your computer screen.

See also DVD; DVD decoder.


A derivative of the file allocation table file system. FAT32 supports smaller cluster sizes than FAT, which results in more efficient space allocation on FAT32 drives.

See also allocation unit size; FAT; NTFS file system.


Hardware that can convert audio or video signals between analog and digital forms (coder/decoder); hardware or software that can compress and uncompress audio or video data (compression/decompression); or the combination of coder/decoder and compression/decompression. Generally, a codec compresses uncompressed digital data so that the data uses less memory.


The type of interface to which your ISDN device is being attached. Switch type is also called switch.

See also B-channel; D-channel; ISDN.


A separate channel of an ISDN line that is used for ISDN signaling. For ISDN Basic Rate Interface (BRI), the D-channel is 16 kilobits per second (Kbps). For ISDN Primary Rate Interface (PRI), the D-channel is 64 Kbps. D-channel is also called data channel.

See also ISDN.


A single channel of an ISDN line that is used to carry either voice or data information. ISDN Basic Rate Interface (BRI) has 2 B-channels. ISDN Primary Rate Interface (PRI) in North America has 23 B-channels. ISDN Primary Rate Interface (PRI) in Europe has 23 B-channels. B-channel is also called bearer channel.

See also ISDN.


An 8- to 14-digit number that identifies the services that you ordered for each B-channel. For example, when you order Primary Rate ISDN, you obtain two phone numbers and two SPIDs from your ISDN provider. Typical ISDN adapters cannot operate without configuring SPIDs. Service Profile Identifier is also called SPID.

See also B-channel; ISDN; service.


A link between the I/O ports of two computers created with a single cable rather than a modem or other interfacing devices. In most cases, a direct cable connection is made with a null modem cable.

See also I/O port; null modem cable.


An administrative tool that you can use to manage the devices on your computer. Using Device Manager, you can view and change device properties, update device drivers, configure device settings, and uninstall devices.

See also device; uninstall.


A font contained in a plug-in cartridge and used to add fonts to laser, ink-jet, or high-end dot-matrix printers. Cartridge fonts are distinguished both from internal fonts, which are contained in ROM in the printer and are always available, and from downloadable (soft) fonts, which reside on disk and which can be sent to the printer as needed.

See also downloadable fonts; font; font cartridge; ROM.


A string that specifies the called subscriber ID transmitted by the receiving fax machine when receiving an inbound fax. This string is usually a combination of the fax or telephone number and the name of the business. It is often the same as the transmitter subscriber ID. Called subscriber ID is also called CSID.

See also string; TSID string.


A string that specifies the transmitter subscriber ID sent by the fax machine when sending a fax to a receiving machine. This string is usually a combination of the fax or telephone number and the name of the business. It is often the same as the called subscriber ID. Transmitter subscriber ID is also called TSID.

See also CSID string; string.


A system capable of transmitting information in only one direction at a time over a communications channel.

See also duplex; full-duplex.


A system capable of transmitting information in both directions over a communications channel.

See also full-duplex; half-duplex.


A system capable of simultaneously transmitting information in both directions over a communications channel.

See also duplex; half-duplex.


An application programming interface (API) standard for software that provides a TCP/IP interface under Windows. Winsock is also called Windows Sockets.

See also TCP/IP.


Operating system memory that is never paged to disk. Paging is the moving of infrequently used parts of a program's working memory from RAM to another storage medium, usually the hard disk.

In Task Manager, the amount of memory used by a process, in kilobytes.

See also paging file; RAM; Windows 2000 Task Manager.


A Windows 2000 utility that provides information about programs and processes running on the computer. Using Task Manager, you can end or run programs and end processes, and display a dynamic overview of your computer's performance.


The process by which the system validates the user's logon information. A user's name and password are compared against an authorized list. If the system detects a match, access is granted to the extent specified in the permissions list for that user. When a user logs on to an account on a computer running Windows 2000 Professional, the authentication is performed by the workstation. When a user logs on to an account on a Windows 2000 Server domain, authentication may be performed by any server of that domain.

See also server; trust relationship.


A program, routine, or process that performs a specific system function to support other programs, particularly at a low (close to the hardware) level. When services are provided over a network, they can be published in Active Directory, facilitating service-centric administration and usage. Some examples of Windows 2000 services are Security Accounts Manager service, File Replication Service, and Routing and Remote Access Service.

See also Active Directory.


The layer of AppleTalk Phase 2 protocols that deliver data to its destination on the network.

See also AppleTalk.


A user's status when a telephone connection has been established and the user has entered a correct user name and password. If the user has callback permission and has requested callback, the connection is followed by the calling-back phase.

If the calling-back phase is followed by a waiting-for-call phase, then the server was unable to reach the user at the specified number. The user may have supplied an inaccurate callback number (in the case of set-by-caller callback), or an unauthorized attempt to access the network may be under way (in the case of preset-to callback).

See also preset-to callback; set-by-caller callback.


A user's status when a telephone connection has been established but authentication has not yet taken place. The user may be trying to prove security clearance, or the system may be idle. If this condition occurs, followed by the Waiting for Call phase, then the user was unable to provide a correct user name or password. If this phase is repeated, followed by the Waiting for Call phase, an unauthorized attempt to access the network may be under way.

See also Waiting for Call.


Errors caused by the failure of a cyclic redundancy check. A CRC error indicates that one or more characters in the data packet received were found garbled on arrival.


A state in which the sending computer is transmitting characters faster than the receiving computer can accommodate them. If this problem persists, reduce the bits-per-second (bps) rate.

See bps.


In the Macintosh environment, a folder for which you have the Make Changes permission but not the See Files or See Folders permission. You can copy files into a drop folder, but you cannot see what files and subfolders the drop folder contains.

See also Make Changes.


In the Macintosh environment, one of the user categories to which you assign permissions for a folder. Permissions given to everyone apply to all users who use the server, including guests.

See also permission.


A device driver that works directly with the network card, acting as an intermediary between the card and the protocol driver. With AppleTalk network integration (formerly Services for Macintosh), the AppleTalk Protocol stack on the server is implemented as a protocol driver and is bound to one or more network card drivers.

See also AppleTalk; device driver.


In the Macintosh environment, the user category to which you assign permissions for the owner of a folder or a Macintosh volume.


A form of security in which a remote access server verifies users by calling them back at numbers supplied by the network administrator at the time user privileges are granted. Only a network administrator can change a preset callback number. This ensures that no one can borrow a user's password and connect to the server from a location other than the user's normal one.

See also callback number; remote access server.


A telephone-answering protocol in which incoming calls are answered with silence instead of a tone signal. Some telephone-switching systems use quiet answering. These switching systems expect the caller to provide another phone number, code, or extension after the quiet answer.


In Network and Dial-up Connections, a form of callback in which the user supplies the telephone number that the remote access server uses for callback. This setting spares the user any long-distance telephone charges.

See also callback number; remote access server.


A scripted dialog box between the client computer and an intermediary device. This kind of dialog box requires no response from the user.

See also client.


A condition where an expected character is not received in time. When this condition occurs, the software assumes that the data has been lost and requests that it be resent.


A tunnel which is initiated by the client. It tunnels PPP over IP from the client to the tunnel server, then the data is forwarded to the target host by the tunnel server.

See also IP; PPP; tunnel; tunnel server.


A telephony signal that Network and Dial-up Connections has put the modem in Listen mode and is waiting for incoming calls.

See also modem.


A software component of Windows 2000 Server that allows Macintosh users access to a computer running Windows 2000 Server. The services provided with this component allow personal computer and Macintosh users to share files and resources, such as printers on the AppleTalk network or printers attached to the Windows 2000 Server.

See also File Server for Macintosh; Print Server for Macintosh; service.


Apple Computer network architecture and network protocols. A network that has Macintosh clients and a computer running Windows 2000 Server with AppleTalk network integration (formerly Services for Macintosh) functions as an AppleTalk network.


A protocol that dynamically controls the use of multilinked lines. Bandwidth Allocation Protocol (BAP) eliminates excess bandwidth by allocating lines only as they are required. The conditions under which BAP dials extra lines when needed, and hangs up underused lines, are configured through Network and Dial-up Connections.


The speed at which a modem communicates. Baud rate refers to the number of times the condition of the line changes. This is equal to bits per second only if each signal corresponds to one bit of transmitted data.

Modems must operate at the same baud rate in order to communicate with each other. If the baud rate of one modem is set higher than that of the other, the faster modem usually alters its baud rate to match that of the slower modem.

See also bps; modem.


The number that a remote access server uses to call back a user. This number can be preset by the administrator or specified by the user at the time of each call, depending on how the administrator configured the user's callback options. The callback number should be the number of the phone line to which the user's modem is connected.

See also remote access server.


A form of network security in which a remote access server calls a user back at a preset number after the user has made an initial connection and has been authenticated.

See also preset-to callback; remote access server.


An authentication protocol used by Microsoft remote access and Network and Dial-up Connections. Using CHAP, a remote access client can send its authentication credentials to a remote access server in a secure form. Microsoft has created a Windows-specific variant of CHAP called MS-CHAP. Challenge Handshake Authentication Protocol is also called CHAP.

See also remote access; remote access server.


A port on a computer that allows asynchronous communication of one byte at a time. Communication port is also called a serial port.

See also asynchronous communication; serial port.


Operating parameters, such as bits per second (bps) and modem type, that apply to serial ports on a computer.

See also bps; modem.


A technique used to reduce the number of characters transmitted without losing data content. The transmitting modem compresses the data and the receiving computer or modem decompresses the data back to its original state.

See also modem.


In the Macintosh environment, the physical network on which the processes of a server reside as nodes and on which the server appears to users. The default network of a server must be one to which that server is attached. Only servers on AppleTalk Phase 2 internets have default networks. Note that the concept of an AppleTalk internet differs from that of the Transport Control Protocol/Internet Protocol (TCP/IP) Internet. Most large AppleTalk networks are not single physical networks. Instead they are internets, which are multiple smaller physical networks connected by routers.

See also AppleTalk; internet; node; router; TCP/IP.


The connection to your network if you are using a device that uses the telephone network. This includes modems with a standard phone line, ISDN cards with high speed ISDN lines, or X.25 networks.

If you are a typical user, you may have one or two dial-up connections, perhaps to the Internet and to your corporate network. In a more complex server situation, multiple network modem connections might be used to implement advanced routing.

See also ISDN.


An extension of the Point-to-Point Protocol (PPP) that provides remote access user authentication by means of other security devices. Support for a number of authentication schemes may be added. These schemes include token cards; dial-up; the Kerberos V5 protocol; one-time passwords; and public key authentication using smart cards, certificates, and others. EAP works with dial-up, PPTP, and L2TP clients. EAP is a critical technology component for secure VPNs because it offers more security against brute force or dictionary attacks (where all possible combinations of characters are attempted), and password guessing than other authentication methods, such as CHAP. Extensible Authentication Protocol is also called EAP.

See also CHAP; Kerberos V5; L2TP; PPP; PPTP; VPN.


A password that is scrambled. Encrypted passwords are more secure than plaintext passwords, which are susceptible to network sniffers.

See also encryption.


In communications, a computer that is located between communications lines and a main (host) computer and used to relieve the host of tasks related to communications; sometimes considered synonymous with communications controller. A front-end processor is dedicated entirely to handling transmitted information, including error detection and control; receipt, transmission, and possibly encoding of messages; and management of the lines running to and from other devices. Front-end processor is also called FEP.


An AppleTalk network integration (formerly Services for Macintosh) service that allows Macintosh clients and personal computer clients to share files. File Server for Macintosh is also called MacFile.

See also AppleTalk; service.


A series of signals acknowledging that communication can take place between computers or other devices. A hardware handshake is an exchange of signals over specific wires (other than the data wires), in which each device indicates its readiness to send or receive data. A software handshake consists of signals transmitted over the same wires used to transfer data, as in modem-to-modem communications over telephone lines.


A device other than a modem or X.25 PAD, located between a network connection and the remote access server. This device is typically a modem-pool switch or security host and requires either a static or interactive dialog box between the client and itself.

See also interactive dialog box; PAD; remote access server; static dialog box.


A dialog box that requires a response from the user. Intermediary devices such as a security host require such a dialog box as an added layer of security between the client and the remote access server. In such dialog boxes, the user types an access code or a user name and password on the remote access terminal screen.

See also intermediary device; remote access server; static dialog box.


A network logon from a computer keyboard, when the user types information in the Logon Information dialog box displayed by the computer's operating system.


Two or more physical networks, connected by routers, that maintain a map of the physical networks on the internet and forward data received from one physical network to other physical networks. Network users in an internet can share information and network devices.

See also router.

With AppleTalk network integration (formerly Services for Macintosh), you can create an internet by connecting two or more AppleTalk networks to a computer running Windows 2000 Server.

See also AppleTalk.

With Microsoft TCP/IP, you can create an internet by connecting two or more IP networks to a multihomed computer running either Windows 2000 Server or Windows 2000 Professional. To effectively route between internets that use TCP/IP, you must either add IP routes or enable IP forwarding.

See also TCP/IP.


Transport protocols used in Novell NetWare networks, which together correspond to the combination of TCP and IP in the TCP/IP protocol suite. Windows 2000 implements IPX through NWLink.

See also IPX; NWLink; TCP/IP.


An industry-standard Internet tunneling protocol. Unlike Point-to-Point Tunneling Protocol (PPTP), L2TP does not require IP connectivity between the client workstation and the server. L2TP requires only that the tunnel medium provide packet-oriented point-to-point connectivity. The protocol can be used over media such as ATM, Frame Relay, and X.25. L2TP provides the same functionality as PPTP. Based on Layer 2 Forwarding (L2F) and PPTP specifications, L2TP allows clients to set up tunnels across intervening networks. Layer 2 Tunneling Protocol is also called L2TP.

See also ATM; IP; PPTP; tunnel.


A local text file that maps IP addresses to the computer names of Windows 2000 networking computers outside the local subnet. In Windows 2000, this file is stored in the systemroot \System32\Drivers\Etc folder.

See also IP address.


A printer that is directly connected to one of the ports on your computer.

See also printer.


The Macintosh-style permission that gives users the right to make changes to a folder's contents; for example, modifying, renaming, moving, creating, and deleting files. When AppleTalk network integration (formerly Services for Macintosh) translates access privileges into Windows 2000 Server permissions, a user who has the Make Changes privilege is given Write and Delete permissions.

See also AppleTalk; permission.


A 128-bit key or 40-bit key encryption algorithm using RSA RC4. MPPE provides for packet confidentiality between the remote access client and the remote access or tunnel server and is useful where IP security (IPSec) is not available. MPPE 40-bit keys are used to satisfy current North American export restrictions. MPPE is compatible with Network Address Translation. Microsoft Point-to-Point Encryption is also called MPPE.

See also remote access server; tunnel server.


The combination two or more physical communications links’ bandwidth into a single logical link increase your remote access bandwidth and throughput by using remote access Multilink. Based on the Internet Engineering Task Force (IETF) standard RFC 1990, you can use Multilink to combine analog modem paths, ISDN B-channels, and mixed analog and digital communications links on both your client and server computers. This increases your Internet and intranet access speed and decreases the amount of time you are connected to a remote computer.

See also B-channel; bandwidth; ISDN; remote access; RFC.


A network protocol native to Microsoft Networking. It is usually used in small, department-size local area networks (LANs) of 1 to 200 clients. It can use Token Ring source routing as its only method of routing. NetBIOS Enhanced User Interface is also called NetBEUI. It is the Microsoft implementation of the NetBIOS standard.

See also LAN; NetBIOS; router.


In the Macintosh environment, the routing address or range of addresses assigned to the physical network that AppleTalk Phase 2 routers use to direct information to the appropriate network. Network number is also called network range and cable range.

See also AppleTalk.


Special cabling that eliminates the modem's need for asynchronous communications between two computers over short distances. A null modem cable emulates modem communication.

See also asynchronous communication; modem.


An implementation of the Internetwork Packet Exchange (IPX), sequenced packet exchange (SPX), and NetBIOS protocols used in Novell networks. NWLink is a standard network protocol that supports routing and can support NetWare client-server applications, where NetWare-aware Sockets-based applications communicate with IPX/SPX Sockets-based applications.

See also IPX/SPX; NetBIOS.


A device that connects a non-X.25 device such as a modem to an X.25 packet switching network. Packet assembler/disassembler is also called PAD.


A security measure used to restrict logon names to user accounts and access to computer systems and resources. A password is a unique string of characters that must be provided before a logon name or an access is authorized. For Windows 2000, a password for a user account can be up to 14 characters and is case-sensitive.

See also user account.

With AppleTalk network integration (formerly Services for Macintosh), each Macintosh user has a user password to access the Windows 2000 Server. You can also assign each Macintosh-accessible volume a volume password that all users must type to gain access to the volume.

See also AppleTalk; volume.


A portion of a hard disk partition that contains information about the disk's file system and a short machine language program that loads the Windows operating system.

See also partition; system volume.


A set of industry-standard framing and authentication protocols that is part of Windows 2000 remote access to ensure interoperability with other remote access software. PPP negotiates configuration parameters for networking protocols such as TCP/IP, IPX, and AppleTalk. Point-to-Point Protocol is also called PPP.

See also AppleTalk; IPX; remote access; TCP/IP.


Networking technology that supports multiprotocol virtual private networks (VPNs), enabling remote users to access corporate networks securely across the Internet or other networks by dialing into an Internet service provider (ISP) or by connecting directly to the Internet. The Point-to-Point Tunneling Protocol (PPTP) tunnels, or encapsulates, IP, IPX, or NetBEUI traffic inside of IP packets. This means that users can remotely run applications that are dependent upon particular network protocols.

See also IP; IPX; ISP; NetBEUI; packet; service; tunnel; VPN.


Basic dial telephone connections to the public switched network, without any added features or functions. Plain old telephone service and point of termination station is also called POTS.


The source code that contains both the data to be printed and the commands for print. Print jobs are classified into data types based on what modifications, if any, the spooler must make to the job for it to print correctly.

See also print spooler.


Standard analog telephone lines, available worldwide. Public Switched Telephone Network is also called PSTN.


A form of dialing that enters a phone number by means of pulse frequencies. The user typically hears a series of clicking sounds when dialing. Old-fashioned rotary dial phones use pulse dialing.

See also touch-tone dialing.


A security authentication protocol based on clients and servers and widely used by Internet service providers (ISPs) on non-Microsoft remote servers. RADIUS is the most popular means of authenticating and authorizing dial-up and tunneled network users today. Remote Authentication Dial-In User Service is also called RADIUS.

See also authentication; ISP; tunnel.


Any Windows 2000-based computer configured to accept remote access connections.

See also remote access.


In Windows 2000 remote access, strings expected from the device, which can contain macros.

See also remote access; string.


In a Windows 2000 environment, helps LANs and WANs achieve interoperability and connectivity, and can link LANs that have different network topologies (such as Ethernet and Token Ring). Routers match packet headers to a LAN segment and choose the best path for the packet, optimizing network performance.

See also LAN; packet header; WAN.

In the Macintosh environment, routers are necessary for computers on different physical networks to communicate with each other. Routers maintain a map of the physical networks on a Macintosh internet (network) and forward data received from one physical network to other physical networks. Computers running Windows 2000 Server with Services for Macintosh can act as routers, and you can also use other routing hardware on a network with Services for Macintosh.

See also internet.


A other authentication device that verifies whether a caller from a remote client is authorized to connect to the remote access server. This verification supplements security already supplied by remote access and by Windows 2000 Server.

See also authentication; remote access; remote access server.


An older industry standard that is part of Windows 2000 remote access client to ensure interoperability with other remote access software. Serial Line Internet Protocol is also called SLIP.

See also remote access.


In dual-boot or multiple-boot systems, the configuration settings that specify which system to start and how each system should be started.

See also dual boot; multiple boot.


A form of dialing that uses multiple-tone signaling. The user hears a series of tones (beeps) when dialing. Push-button telephones usually use touch-tone dialing.

See also pulse dialing.


A logical connection over which data is encapsulated. Typically, both encapsulation and encryption are performed and the tunnel is a private, secure link between a remote user or host and a private network.

See also dial-up connection; tunnel server.


A server or router that terminates tunnels and forwards traffic to the hosts on the target network.

See also tunnel.


A special group that contains all users who have user permissions on the server. When a Macintosh user assigns permissions to everyone, those permissions are given to the group’s users and guests.

See also everyone category; guest; permission.


A group of users who work on a common project and share information on computers that are interconnected, often over a local area network (LAN).

See also LAN.


In the Macintosh environment, a logical grouping that simplifies browsing the network for resources, such as servers and printers. It is similar to a domain in Windows 2000 Server networking.

In a DNS (Domain Name System) database, a zone is a subtree of the DNS database that is administered as a single separate entity, a DNS server. This administrative unit can consist of a single domain or a domain with subdomains. A DNS zone administrator sets up one or more name servers for the zone.

See also DNS; DNS server; domain.


A logical collection of data-storage media that has been reserved for use by Windows 2000 Backup. Backup uses Removable Storage to control access to specific media within a library.

See also library; media pools; Removable Storage.


A logical collection of data-storage media that has not been cataloged by Removable Storage. Media in an import media pool should be cataloged as soon as possible so that they can be used by an application.

See also media pools; Removable Storage.


A logical collection of unused data-storage media that can be used by applications or other media pools. When media are no longer needed by an application, they are returned to a free media pool so that they can be used again.

See also media pools; Removable Storage.


Groups that appear in the program list on the Start menu for all users who log on to the computer. Only administrators can create or change common groups.

See also group.


The profile that serves as a basis for all user profiles. Every user profile begins as a copy of the default user profile, which is stored on each computer running Windows 2000 Professional or Windows 2000 Server.


Fonts that reside in your printer. They can be built into the printer itself or provided by a font cartridge or font card.

See also font; font cartridge; printer fonts.


A list that represents part of an object's security descriptor that allows or denies permissions to specific users and groups. Discretionary access control list is also called DACL.

See also ACE; group; object; permission; SACL; security descriptor.


A computer configuration that can start two different operating systems.

See also multiple boot.


A standard that can be used with high-capacity hard disks, floppy disk drives, and tape drives to allow these devices to communicate with a computer at high speeds. Enhanced small device interface is also called ESDI.


A service that records events in the system, security, and application logs. The Event Log service is located in Event Viewer.

See also service.


The program that runs in the active window; the topmost window whose title bar is highlighted. The foreground program responds to commands issued by the user.

See also background program; title bar.


A folder name or file name longer than the 8.3 file name standard (up to eight characters followed by a period and an extension of up to three characters) of the FAT file system. Windows 2000 supports long file names up to the file-name limit of 255 characters.

See also FAT.

In a Macintosh environment, users can assign long names to files and folders on the server and, using AppleTalk network integration (formerly Services for Macintosh), you can assign long names to Macintosh-accessible volumes when you create them. Windows 2000 automatically translates long names of files and folders to 8.3 names for MS-DOS and Windows 3.x users.

See also AppleTalk;  MS-DOS.


A feature of an uninterruptible power supply (UPS) that removes spikes, surges, sags, and noise from the power supply.

See also UPS service.


The component that, working in conjunction with the printer driver, receives and alters print jobs, as necessary, according to their data type to ensure that the jobs print correctly.

See also print job; printer driver.


A program designed to allow other programs to work with a particular printer without concerning themselves with the specifics of the printer's hardware and internal language. By using printer drivers that handle the subtleties of each printer, programs can communicate properly with a variety of printers.

See also device driver; PCL; PostScript.


Also called the queue view, the Printer window shows information about any pending print jobs for the printer. For each printer you have installed or to which you are connected, you can such information as see how many documents are waiting to be printed, who owns them, and how large they are.

See also print job.


Two or more identical printers that are connected to one print server and act as a single printer. In this case, when you print a document, the print job will be sent to the first available printer in the pool.

See also print job; printer.


The management of one computer by an administrator working at another computer connected to the first computer across a network.

See also administrator.


A unique number that identifies user, group, and computer accounts. Every account on your network is issued a unique SID when the account is first created. Internal processes in Windows 2000 refer to an account's SID rather than the account's user or group name. If you create an account, delete it, and then create an account with the same user name, the new account will not have the rights or permissions previously granted to the old account because the accounts have different SID numbers. Security identifier is also called security ID or SID.

See also group account; group name; user account; user name.


On NTFS volumes, a custom set of permissions. You can customize permissions on files and directories by selecting the individual components of the standard sets of permissions.

See also NTFS file system; permission; volume.


The password stored in each user's account. Each user generally has a unique user password and must type that password when logging on or accessing a server.

See also password; user account.


An object that cannot logically contain other objects. For example, a file is a noncontainer object.

See also container object; object.


A list that represents part of an object's security descriptor that specifies which events are to be audited per user or group. Examples of auditing events are file access, logon attempts, and system shutdowns. System access control list is also called SACL.

See also ACE; auditing; DACL; object; security descriptor.


An object that resides in another object. A child object implies relation. For example, a file is a child object that resides in a folder, which is the parent object.

See also object; parent object.


A service that maintains an up-to-date list of computers and provides the list to applications when requested. The Computer Browser service provides the computer lists displayed in the Network Neighborhood, Select Computer, and Select Domain dialog boxes and (for Windows 2000 Server only) in the Server Manager window.

See also service.


An object that can logically contain other objects. For example, a folder is a container object.

See also noncontainer object; object.


Information in the Windows 2000 registry on assigned drive letters, simple volumes, striped volumes, mirrored volumes, spanned volumes, and RAID-5 volumes. You can change the disk configuration by using Disk Management.

See also mirrored volume; RAID-5 volume; registry; simple volume; spanned volume; striped volume.


A portion of a basic disk that can contain logical drives. Use an extended partition if you want to have more than four volumes on your basic disk. Only one of the four partitions allowed per physical disk can be an extended partition, and no primary partition needs to be present to create an extended partition. Extended partitions can be created only on basic disks.

See also basic disk; logical drive; partition; primary partition; unallocated space.


In an operating system, the overall structure in which files are named, stored, and organized. NTFS, FAT, and FAT32 are types of file systems.

See also FAT; FAT32; NTFS file system.


A user's complete name, usually consisting of the last name, first name, and middle initial. The full name is information that Local Users and Groups or Active Directory Users and Computers can maintain as part of the information identifying and defining a user account.

See also Active Directory Users and Computers; user account.


A built-in account used to log on to a computer running Windows 2000 when a user does not have an account on the computer or domain, or in any of the domains trusted by the computer's domain.


A desktop folder that provides you with a convenient place to store documents, graphics, or other files you want to access quickly. When you save a file in a program such as WordPad or Paint, the file is automatically saved in My Documents, unless you choose a different folder.

See also home directory.


An Institute of Electrical and Electronics Engineers (IEEE) standard that defines a set of operating-system services. Programs that adhere to the POSIX standard can be easily ported from one system to another. POSIX was based on UNIX system services, but it was created in a way that allows it to be implemented by other operating systems. Portable Operating System Interface for UNIX is also called POSIX.

See also service.


A disk that contains the MS-DOS system files necessary to start MS-DOS.

See also MS-DOS.


A program that attempts to spread from computer to computer and either cause damage (by erasing or corrupting data) or annoy users (by printing messages or altering what is displayed on the screen).


All the subkeys that appear when a key in the registry is expanded. A descendent key is the same as a subkey.

See also key; subkey.


An Open Systems Interconnection (OSI) network layer transmission unit that consists of binary information representing both data and a header containing an identification number, source and destination addresses, and error-control data.

See also binary; packet header.


In network protocol communications, a specially reserved field of a defined bit length that is attached to the front of a packet for carry and transfer of control information. When the packet arrives at its destination, the field is then detached and discarded as the packet is processed and disassembled in a corresponding reverse order for each protocol layer.

See also packet; protocol.


An administrative tool designed to perform day-to-day Active Directory administration tasks. These tasks include creating, deleting, modifying, moving, and setting permissions on objects stored in the directory. These objects include organizational units, users, contacts, groups, computers, printers, and shared file objects.

See also Active Directory; object; permission.


A service on the print server that receives documents (print jobs) from Line Printer Remote (LPR) utilities running on client systems. Line Printer Daemon is also called LPD.

See also LPR; print jobs; print server; service.


A connectivity utility that runs on client systems and is used to print files to a computer running an LPD server. Line Printer Remote is also called LPR.

See also LPD.


A font created by a series of dots connected by lines. Plotter fonts can be scaled to any size and are most often printed on plotters. Some dot-matrix printers also support plotter fonts.

See also font.


In a PostScript printer, a part of memory that stores font information. The memory in PostScript printers is divided into two areas: banded memory and virtual memory. The banded memory contains graphics and page-layout information needed to print your documents. The virtual memory contains any font information that is sent to your printer either when you print a document or when you download fonts.

See also PostScript printer; virtual memory.


Any computer or program connecting to, or requesting the services of, another computer or program. For example, Windows 2000 Professional is an Active Directory client. Client can also refer to the software that enables the computer or program to establish the connection. For example, to connect a Windows 95-based computer to Windows 2000 Active Directory, you must install the Windows 95 Active Directory client on the computer running Windows 95.

See also Active Directory; server.


The printer to which a computer sends documents if you select the Print command without first specifying which printer you want to use with a program. You can have only one default printer; it should be the printer you use most often.

See also printer.


The standard used to measure screen and printer resolution, expressed as the number of dots that a device can display or print per linear inch. The greater the number of dots per inch, the better the resolution. Dots per inch is also called DPI.


Fonts that are defined in terms of the PostScript page-description language (PDL) rules and are intended to be printed on a PostScript-compatible printer.

When a document displayed in a screen font is sent to a PostScript printer, the printer uses the PostScript version if the font exists. If the font doesn't exist but a version is installed on the computer, that font is downloaded to the printer. If there is no PostScript font installed in either the printer or the computer, the bit-mapped (raster) font is translated into PostScript and the printer produces text using the bit-mapped font. PostScript fonts are distinguished from bit-mapped fonts by their smoothness, detail, and faithfulness to standards of quality established in the typographic industry.

See also downloadable fonts; fonts; PDL; PostScript; printer; raster fonts.


A printer that uses the PostScript page-description language (PDL) to create text and graphics on the output medium, such as paper or overhead transparency. Examples of PostScript printers include the Apple LaserWriter, the NEC LC-890, and the QMS PS-810.

See also PDL; PostScript.


Fonts residing in or intended for a printer. A printer font, usually located in the printer's read-only memory (ROM), can be internal, downloaded, or on a font cartridge.

See also device fonts; downloadable fonts; font; font cartridge; ROM.


The type of access a user or group has to use the printer. The printer permissions are Print, Manage Printers, and Manage Documents.

See also permission.


A list of programs or tasks waiting for execution. In Windows 2000 printing terminology, a queue refers to a group of documents waiting to be printed.

In NetWare and OS/2 environments, queues are the primary software interface between the application and print device; users submit documents to a queue. With Windows 2000, however, the printer is that interface [image] the document is sent to a printer, not a queue.

See also printer.


A design that appears across your desktop. You can create your own pattern or select a pattern provided by Windows 2000.

See also desktop.


The brightness of a color based on a scale from black to white on your monitor.


A computer configuration that runs two or more operating systems. For example, Windows 98, MS-DOS, and Windows 2000 operating systems can be installed on the same computer. When the computer is started, any one of the operating systems can be selected.

See also dual boot; MS-DOS.


Alerts that relate to server and resource use. They notify users about problems in areas such as security and access, user sessions, server shutdown due to power loss (when a uninterruptible power supply is available), directory replication, and printing. When a computer generates an administrative alert, a message is sent to a predefined list of users and computers.

See also Alerter service.


In some dialog boxes, the command button that is selected or highlighted when the dialog box is initially displayed. The default button has a bold border, indicating that it will be chosen automatically if you press ENTER. You can override a default button by clicking Cancel or another command button.


In the DNS client-server model, the server containing information about a portion of the DNS database that makes computer names available to client resolvers querying for name resolution across the Internet.

See also DNS.


The name by which a domain is known to the network. Part of the Domain Name System (DNS) naming structure, domain names consist of a sequence of name labels separated by periods.

See also DNS; domain.


The database structure used by the Domain Name System (DNS).

See also DNS.


A static, hierarchical name service for TCP/IP hosts. The network administrator configures the DNS with a list of host names and IP addresses, allowing users of workstations configured to query the DNS to specify remote systems by host names rather than IP addresses.

For example, a workstation configured to use DNS name resolution could use the command ping remotehost rather than ping 1.2.3.4 if the mapping for the system named remotehost was contained in the DNS database. DNS domains should not be confused with Windows 2000 networking domains.

See also DNS name; domain; IP address; service; TCP/IP.


A form of interprocess communication (IPC) implemented in the Microsoft Windows family of operating systems. Two or more programs that support dynamic data exchange (DDE) can exchange information and commands.


A string consisting of environment information, such as a drive, path, or file name, associated with a symbolic name that can be used by Windows 2000. You use System in Control Panel or the Set command from the Windows 2000 command prompt to define environment variables.

See also string; variable.


Type of memory that can be added to IBM personal computers. The use of expanded memory is defined by the Expanded Memory Specification (EMS), which supports memory boards containing RAM that can be enabled or disabled by software.

See also extended memory; RAM.


Memory beyond one megabyte in 80286, 80386, 80486, and Pentium computers. Windows 2000 requires an 80486 or higher computer.

See also expanded memory.


A serious error that affects the operating system and that could place data at risk. The operating system generates an obvious message, a screen with the STOP error, rather than continuing on and possibly corrupting data. STOP error is also called a fatal system error.


The position of a color along the color spectrum. For example, green is between yellow and blue. This attribute can be set using Display in Control Panel.

See also saturation.


A person responsible for planning, configuring, and managing the day-to-day operation of the network. Network administrator is also called a system administrator.


A way to transfer and share information between applications by pasting information created in one application into a document created in another application, such as a spreadsheet or word processing file.

See also embedded object; linked object.


Short for picture element, one spot in a rectilinear grid of thousands of such spots that form an image produced on the screen by a computer or on paper by a printer. A pixel is the smallest element that display or print hardware and software can manipulate to create letters, numbers, or graphics. A pixel is also called a pel.


A type of microprocessor design that focuses on rapid and efficient processing of a relatively small set of instructions. RISC architecture limits the number of instructions that are built into the microprocessor, but optimizes each so it can be carried out very rapidly [image] usually within a single clock cycle. Reduced instruction set computing is also called RISC.


In color management, the purity of a color's hue, moving from gray to the pure color.

See also hue.


A moving picture or pattern that appears on your screen when you have not used the mouse or keyboard for a specified period of time. Double-click Display in Control Panel, or right-click the desktop and click Properties to select a screen saver.


In programming, a named storage location capable of containing a certain type of data that can be modified during program execution.

System environment variables are defined by Windows 2000 Server and are the same no matter who is logged on to the computer. Administrator group members can add new variables or change the values, however.

User environment variables can be different for each user of a particular computer. They include any environment variables you want to define or variables defined by your applications, such as the path where application files are located.

See also environment variables.


Memory that cannot be paged to disk. Paging is the moving of infrequently used parts of a program's working memory from RAM to another storage medium, usually the hard disk.

See also paging file.


A universal maximum for registry space that prevents an application from filling the paged pool with registry data. The total amount of space that can be consumed by registry data (hives) is restricted by the registry size limit. Registry size limit is also called RSL.

See also hive; paged pool; paging file; registry.


A brief period of time during which a particular task is given control of the microprocessor in a time-sharing multitasking environment. A computer's processor is allocated to an application, usually measured in milliseconds. Time slice is also called quantum.


A file that prints at the highest possible resolution for your printer. An EPS file may print faster than other graphical representations. Some Windows 2000 and non-Windows 2000 graphical applications can import EPS files. Encapsulated PostScript is also called EPS.

See also PostScript.


Outline fonts that are rendered from line and curve commands, and can be scaled and rotated. OpenType fonts look good in all sizes and on all output devices supported by Windows 2000. OpenType is an extension of TrueType font technology. The OpenType fonts include Arial, Courier New, Lucida Console, Times New Roman, Symbol, and Wingdings.

See also font; TrueType fonts.


A method of cryptography in which two different keys are used: a public key for encrypting data and a private key for decrypting data. Public key cryptography is also called asymmetric cryptography.


Programs used to enter the thousands of different characters in written Asian languages with a standard 101-key keyboard. An IME consists of both an engine that converts keystrokes into phonetic and ideographic characters and a dictionary of commonly used ideographic words. As the user enters keystrokes, the IME engine attempts to identify which character or characters the keystrokes should be converted into. Input method editor is also called IME.


The country code, area code, and specific dialing requirements for the place you are dialing from. Once you have created a dial location, you can select it to apply the dialing requirements to all your calls. To change dialing locations, select or create a different one.


A font that is useful for devices such as pen plotters that cannot reproduce bitmaps. Characters are drawn in arrangements of line segments rather than patterns of dots and can be scaled to any size or aspect ratio. The three vector fonts are Modern, Roman, and Script.

See also font; plotter font.


The smallest amount of disk space that can be allocated to hold a file. All file systems used by Windows 2000 organize hard disks based on allocation unit size. The smaller the cluster size, the more efficiently a disk stores information. If no cluster size is specified during formatting, Windows 2000 picks defaults based on the size of the volume. These defaults are selected to reduce the amount of space lost and the amount of fragmentation on the volume. Allocation unit size is also called cluster size.

See also file system.


For Windows 2000, the DNS name of a device on a network. These names are used to locate computers on the network. To find another computer, its host name must either appear in the Hosts file or be known by a DNS server. For most Windows-based computers the host name and the computer name will be the same.

See also DNS; DNS server.


A form of data transmission in which information is sent and received at irregular intervals, one character at a time. Because data is received at irregular intervals, the receiving modem must be signaled to let it know when the data bits of a character begin and end. This is done by means of start and stop bits.

See also modem.


A set of information attached to an object that specifies the permissions granted to users and groups, as well as the security events to be audited.

See also DACL; group; object; permission; SACL.


An application programming interface (API) used by communications programs to work with telephony and network services. Communications programs like HyperTerminal and Phone Dialer use TAPI to dial, answer, and route telephone calls on conventional telephony devices, including PBXs, modems, and fax machines. TAPI 3.0 also provides Internet Protocol (IP) telephony support, which Phone Dialer and other programs use to transmit, route, and control real-time audio and video signals over IP-based networks such as the Internet. Telephony application programming interface (API) is also called TAPI.

See also IP; modem; service.


The messenger protocol of TCP/IP that is responsible for addressing and sending IP packets over the network. IP provides a best-effort, connectionless delivery system that does not guarantee that packets arrive at their destination or in the sequence in which they were sent. Internet Protocol is also called IP.

See also packet; TCP/IP.


The smallest unit of information handled by a computer. One bit expresses a 1 or a 0 in a binary numeral, or a true or false logical condition. A group of 8 bits makes up a byte, which can represent many types of information, such as a letter of the alphabet, a decimal digit, or other character. Bit is also called binary digit.

See also binary.


A computer that runs Windows 2000 Server but is not a domain controller of a Windows 2000 domain. Member servers participate in a domain, but do not store a copy of the directory database. For a mermber server, permissions can be set on resources that allow users to connect to the server and use its resources. Resource permissions can be granted for domain global groups and users as well as for local groups and users.

See also domain controller; global group; local group; permission.


A computer that runs Windows 2000 Server but does not participate in a domain. A stand-alone server has only its own database of users, and it processes logon requests by itself. It does not share account information with any other computer and cannot provide access to domain accounts.

See also domain; member server.


A message-passing facility that allows a distributed application to call services available on various computers on a network. Used during remote administration of computers. Remote procedure call is also called RPC.

See also service.


For Message Queuing, a message class that indicates that a message arrived or was retrieved by the target application (a positive acknowledgment), or that an error occurred before the original message could be retrieved (a negative acknowledgment). These messages are sent to administrative queues on the source computer.

See also administration queue; message class.


For Message Queuing, a queue that stores acknowledgment messages.

See also acknowledgment message.


For Message Queuing, the storage size limit for messages on a computer, based on the total size of the messages. When a computer quota is reached, Message Queuing can no longer send messages to that computer until one or more messages are removed from queues. Message Queuing enforces the computer quota before it enforces the queue quota on a computer.

See also queue quota.


For Message Queuing, a queue created on servers running a connector application. You can use the connector application to exchange messages with computers that are running other message-queuing products.

See also connector application; foreign computer.


For Message Queuing, a queue that stores nontransactional messages that are undeliverable or expired. These queues store failed messages on the computer on which the message expired. Messages in these queues are written to disk and are therefore recoverable.

See also transactional message; transaction dead-letter queue.


For Message Queuing, a message that uses fewer resources and is faster than a recoverable message. However, because express messages are mapped to memory, they are lost if the computer storing them fails.

See also recoverable message.


A computer that uses a other message queuing system but, through a connector application, can exchange messages with computers that run Message Queuing.

See also connector application; Message Queuing.


For Message Queuing, a queue where journal messages are stored.

See also journaling.


For Message Queuing, a property that specifies the cumulative limit for journal messages in a journal queue. The limit is based on cumulative journal message size. When a journal queue's quota is reached, messages are no longer stored.

See also journal queue; journaling; source journaling; target journaling.


For Message Queuing, a unit of information sent between computers running Message Queuing. The message can contain text or binary data as defined by the sending application. All messages, including status messages, are stored in queues on Message Queuing computers.

See also message class; message label; Message Queuing.


A transaction manager that coordinates transactions that span multiple resource managers, such as Message Queuing and Microsoft SQL Server. MS DTC is automatically installed when Message Queuing is installed.

See also Message Queuing; transaction.


A message queuing and routing system for Windows 2000 that enables distributed applications running at different times to communicate across heterogeneous networks and with computers that may be offline. Message Queuing provides guaranteed message delivery, efficient routing, security, and priority-based messaging. Message Queuing was formerly known as MSMQ.

See also MSMQ.


For Message Queuing, a computer that requires synchronous access to a Message Queuing server to perform all standard message queuing operations, such as sending and receiving messages and creating queues.

See also independent client; Message Queuing server.


For Message Queuing, an application that enables Message Queuing computers to communicate with computers that use other messaging systems.

See also foreign computer.


For Message Queuing, a service on a Message Queuing server that provides message routing services. If so configured, this feature can be used on a Message Queuing server to:

Enable computers that use different network protocols to communicate.

Reduce the number of sessions by acting as a gateway for all incoming or outgoing messages for independent clients.

Route messages between sites over a routing link.

See also independent client; Message Queuing server; routing link; service.


For Message Queuing, a computer running Windows 2000 Professional that can create queues and store messages locally without synchronous access to a Message Queuing server. Independent clients can also use Message Queuing servers to provide efficient message routing.

See also dependent client; Message Queuing server; routing services.


For Message Queuing, a queue that is not published in Active Directory and can be accessed only by applications that have access to the full format name of the queue.

See also Active Directory; format name; public queue.


For Message Queuing, a queue that is published in Active Directory and replicated throughout a Windows 2000 enterprise. Public queues can, therefore, be located by any computer running Message Queuing within the enterprise.

See also Active Directory; private queue.


For Message Queuing, the storage size limit for messages in public queues. When a queue quota is reached, Message Queuing can no longer send messages to that queue until one or more messages are removed from the queue. Message Queuing enforces the computer quota before it enforces the queue quota on a computer.

See also computer quota.


For Message Queuing, a globally unique identifier (GUID) specified by the application that created the queue.


For Message Queuing, a message that can be recovered no matter which computer fails, but that uses more resources and is slower than an express message.

See also express message.


For Message Queuing, a queue on the source computer that contains report messages Report queues can be used when sending test messages and tracking message routes.

See also report message.


For Message Queuing, a queue that is created by the sending application and used by the receiving application to reply to messages. For example, an application might send a response message to a response queue every time the application receives a message.

See also response message.


For Message Queuing, a feature that typically reduces network bandwidth within a site, and the number of sessions between sites. Specially configured Message Queuing servers with routing services provide session concentration.

See also Message Queuing server; routing services.


For Message Queuing, a communications link established between Windows 2000 sites for routing messages. Specially configured Message Queuing servers with routing services enabled are used to create a routing link between sites.

See also Message Queuing; routing services; routing-link cost.


For Message Queuing, a number used to determine the route messages can take between two sites. This number represents the relative monetary cost of communication over a link. A routing link has a default routing-link cost of 1 and should not be changed unless you have multiple routing links between two sites and you want to enforce message routing over a specific routing link.

See also intersite routing; routing link.


For Message Queuing, the process of storing a copy of an outgoing message. Source journaling is configured on a message basis and is set by the sending application. When source journaling is enabled, a copy of the message is put in the source journal queue of the source computer when the message arrives at the destination (target) queue.

See also journal queue; target journaling.


For Message Queuing, a computer that can provide message queuing, routing, and directory services to client computers. Message Queuing servers can be used to:

Provide message routing and session concentration for independent clients.

Provide message routing between sites over routing links.

Create queues and store messages for dependent clients.

Access information in Active Directory (if installed on a Windows 2000 domain controller).

See also Active Directory; dependent client; independent client; routing link; routing services; session concentration.


For Message Queuing, the process of storing a copy of incoming messages. Target journaling is configured on a queue basis. When target journaling is enabled, a copy of each incoming message is placed in the target journal queue when the message is retrieved (read) from the destination queue.

See also journal queue; source journaling.


For Message Queuing, the pairing of two or more actions that are performed together as a single action; the action succeeds or fails as a whole. Using Microsoft Distributed Transaction Coordinator (MS DTC) ensures that either both actions succeed or neither is executed.

See also MS DTC.


For Message Queuing, a queue that stores transactional messages that cannot reach their destination queue. Transaction dead-letter queues store failed messages on the computer on which the message expired. Messages in these queues are written to disk and are therefore recoverable.

See also dead-letter queue; transaction.


The message queuing and routing system for Windows NT version 4.0, Windows 95, and Windows 98. For Windows 2000, called Message Queuing.

See also Message Queuing.


For Message Queuing, a message that contains status information and is sent to report queues on the source computer. Examples include test messages and route tracking messages.

See also report queue.


For Message Queuing, a queue that stores various types of administrative messages. Message Queuing uses up to five system queues, all of which are private queues. System queues cannot be deleted.

See also private queue.


For Message Queuing, a queue that stores sent test messages.


For Message Queuing, a message that can be sent and received only from within a transaction. This type of message returns to its prior state when a transaction is terminated abruptly. A transactional message is removed from a queue only when the transaction is committed; otherwise, it remains in the queue and can be subsequently read during another transaction.

See also queue; transaction.


For Message Queuing, a message sent by a receiving application to the response queue specified by a sending application. Any available queue can be specified as a response queue.

See also response queue.


A database in Novell NetWare 3.x that contains organizational and security information about users and groups.


The file-sharing protocol that governs communications about resource (such as disk and printer), bindery, and NDS operations between server and client computers on a Novell NetWare network. Requests from client computers are transmitted by the IPX protocol. Servers respond according to NCP guidelines. NetWare Core Protocol is also called NCP.

See also bindery; IPX; NDS.


A 4-byte hexadecimal number used for addressing and routing purposes. The external network number is associated with physical network adapters and networks, compared to the internal network number, which is associated with a virtual network. To communicate with each other, all computers on the same network that use a given frame type must have the same external network number. All external network numbers must be unique to the IPX internetwork.

See also frame type; internal network number; IPX.


A logical network that exists inside Novell NetWare and NetWare-compatible servers and routers but is not associated with a physical adapter. The virtual network appears to a user as a separate network. On a computer running Windows 2000 Server, programs advertise their location on a virtual network, not a physical network. The internal network number identifies a virtual network inside a computer.

See also external network number; internal network number.


A 4-byte hexadecimal number used for addressing and routing purposes. The internal network number identifies a virtual network inside a computer. On a computer running Windows 2000 Server, programs advertise their location on the internal network number of the virtual network, not a physical network. When you assign internal network numbers, you gain more efficient routing to the programs in computers with multiple network adapters that are connected to multiple, interconnected networks. Like the external network number, the internal network number must be unique to the IPX internetwork. Internal network number is also called virtual network number.

See also external network number; IPX.


The way in which a network type, such as Ethernet, formats data to be sent over a network. When multiple frame types are allowed for a particular network type, the packets are structured differently and are, therefore, incompatible. All computers on a network must use the same frame type to communicate. Frame type is also called frame format.

See also packet.


For Indexing Service, a collection of all index information and stored properties for a particular group of file system directories. By default, Indexing Service indexes the System and Web catalogs on your hard drive.

See also property.


Any self-contained piece of work created with an application program and, if saved on disk, given a unique file name by which it can be retrieved.


For Indexing Service, software that extracts content and property values from a document in order to index them.

See also document; property value.


For Indexing Service, a word or character that specifies a relationship in a query.

See also query.


A characteristic or parameter of a class of objects or devices. For example, properties of Microsoft Word files include Size, Created, and Characters.

See also property value.


For Indexing Service, a file that stores values for document properties.

See also document; property.


A specific characteristic or parameter that defines a property. For example, property values of a specific Microsoft Word document could include Size = 10,000 bytes, Created = Jan 2, 1999, and Characters = 5,250.


For Indexing Service, a structured statement that specifies the documents you want to find. The simplest query is a single word.


For Indexing Service, one or more terms that identify an element in a query, such as weight, phrase, property, or regular expression. For example, the tag {prop name=created} specifies the Created property in a query.

See also property; query.


For Indexing Service, an ordered series of words or numbers used in a query. For example, a single document can have (Scott Cooper; Don Hall; Amy Egert) as a vector of coauthors.

See also query.


A keyboard character that can be used to represent one or many characters when conducting a query. The question mark (?) represents a single character, and the asterisk (*) represents one or more characters.

See also query.


A set of technologies that allows software components to interact with one another in a networked environment, regardless of the language in which the components were created.


A command-line interface that provides a limited set of administrative commands that are useful for repairing a computer. For example, you can use the Recovery Console to start and stop services, read and write data on a local drive (including drives formatted to use the NTFS file system), repair a master boot record (MBR), and format drives. You can start the Recovery Console from the Windows 2000 Setup disks or by using the Winnt32.exe command with the /cmdcons switch.

See also MBR; NTFS file system; service.


The first sector on every hard disk. The MBR contains a small amount of executable code and the partition table, which stores information about the disk's primary and extended partitions. Master boot record is also called MBR.

See also Recovery Console; partition boot sector.


A logical grouping of hosts on one or more LANs that allows communication to occur between hosts as if they were on the same physical LAN. Virtual local area network is also called VLAN.

See also LAN.


A key within a key. In the registry structure, subkeys are subordinate to subtrees and keys. Keys and subkeys are similar to the section header in .ini files; however, subkeys can carry out functions.

See also descendent key; key; registry; subtree.


Any node within a tree, along with any selection of connected descendant nodes. In the registry structure, subtrees are the primary node and contain keys, subkeys, and value entries.

See also key; registry; subkey; value entry.


A standard single-byte character-encoding scheme used for computer text-based data. ASCII uses designated 7-bit or 8-bit number combinations to allow either 128 or 256 possible characters to be represented. Standard ASCII uses 7 bits to represent all uppercase and lowercase letters, the numbers 0 through 9, punctuation marks, and special control characters used in U.S. English. Most current Intel-based systems support the use of extended (or "high") ASCII. Extended ASCII allows the eighth bit of each character to be used to identify an additional 128 special symbol characters, foreign-language letters, and graphic symbols. American Standard Code for Information Interchange is also called ASCII.

See also Unicode.


Files with an .inf extension contain device information or scripts to control hardware operations.


On networks running Novell NetWare 4.0, a distributed database that maintains information about every resource on the network and provides access to these resources. Novell Directory Services is also called NDS.


Included with Windows 2000 Server, a service that allows a computer running Windows 2000 Server to connect to NetWare servers. Creating a gateway also allows client computers running only Microsoft client software to access NetWare resources through the gateway.

See also service.


The full Windows 2000 name of a resource on a network. It conforms to the \\servername\sharename syntax, where servername is the name of the server and sharename is the name of the shared resource. UNC names of directories or files can also include the directory path under the share name, with the following syntax:

\\servername\sharename\directory\filename.

Universal Naming Convention is also called UNC.


Dynamic content, such as a stock ticker, a weather map, or news, that is usually updated from the World Wide Web or a channel.

See also channel.


The naming convention for disk drives on IBM and compatible computers. Drives are named by letter, beginning with A, followed by a colon.


An address for a resource on the Internet that is used by Web browsers to locate Internet resources. An Internet address typically starts with a protocol name, followed by the name of the organization that maintains the site; the suffix identifies the kind of organization it is. For example, the address http://www.yale.edu/ provides the following information:

http	This Web server uses the Hypertext Transfer Protocol.
www	This site is on the World Wide Web.
yale	The Web server is at Yale University.
edu	This is an educational institution.
Internet address is also called Uniform Resource Locator (URL).

See also protocol; Web server.


A folder on a Web server. You can view files and folders on Web servers just as you would view files and folders on network servers. However, when you save a file to a Web folder, the file is saved on a Web server, not on your computer's hard disk. You can create Web folders by using the Add Network Place wizard, which is located in My Network Places.

Web folders are available only on Web servers that support Web Extender Client (WEC), FrontPage extensions, and Distributed Authoring and Versioning (DAV) protocols.

See also Web server.


A computer that is maintained by a system administrator or Internet service provider (ISP) and that responds to requests from a user's browser.

See also Internet address; ISP.


An application programming interface (API) that is provided as part of Microsoft Windows. CryptoAPI provides a set of functions that allow applications to encrypt or digitally sign data in a flexible manner while providing protection for the user's sensitive private key data. Actual cryptographic operations are performed by independent modules known as cryptographic service providers (CSPs). CryptoAPI is also called CAPI.

See also CSP; private key.


A model of trust in which certification paths are created through the establishment of parent-child relationships between certification authorities.

See also certification authority; certification path.


A collection of data used for authentication and secure exchange of information on nonsecured networks, such as the Internet. A certificate securely binds a public encryption key to the entity that holds the corresponding private encryption key. Certificates are digitally signed by the issuing certification authority and can be managed for a user, a computer, or a service. The most widely accepted format for certificates is defined by the ITU-T X.509 international standard.

See also certification authority; ITU-T; private key; public key; service.


An unbroken chain of trust from a public key in which a verifier has trust to a public key in which a verifier wishes to establish trust.

See also public key.


A document maintained and published by a certification authority that lists certificates that have been revoked. Certificate revocation list is also called CRL.

See also certificate; certification authority.


Typically, a permanent storage where certificates, certificate revocation lists, and certificate trust lists are stored. It is possible, however, to create and open a certificate store solely in memory when working with certificates that do not need to be put in permanent storage. The certificate store is central to much of the certificate functionality in Windows 2000.

See also certificate; certificate revocation list; certificate trust list.


 A Windows 2000 construct that pre-specifies the format and content of certificates based on their intended usage. When requesting a certificate from a Windows 2000 certification authority (CA), certificate requestors will, depending on their access rights, be able to select from a variety of certificate types that are based on certificate templates, such as "User," and "Code Signing."

See also certificate; certification authority.


A signed list of root certification authority certificates that an administrator considers reputable for designated purposes, such as client authentication or secure e-mail. Certificate trust list is also called CTL.

See also certificate; certification authority; root certificate; root authority.


An entity responsible for establishing and vouching for the authenticity of public keys belonging to users (end entities) or other certification authorities. Activities of a certification authority may include binding public keys to distinguished names through signed certificates, managing certificate serial numbers and certificate revocation. Certification authority is also called CA.

See also certificate; public key.


An optional extension in an X.509v3 certificate that identifies how information is obtained. Also, a directory entry or other distribution source for certificate revocation lists. CRL Distribution Point is also called CDP.

See also certificate; certificate revocation list; X.509v3 certificate.


The processes, art, and science of keeping messages and data secure. Cryptography is used to enable and ensure confidentiality, data integrity, authentication (entity and data origin), and nonrepudiation.


The code that performs authentication, encoding, and encryption services that Windows-based applications access through the CryptoAPI.

A CSP is responsible for creating keys, destroying them, and using them to perform a variety of cryptographic operations. Each CSP provides a different implementation of the CryptoAPI. Some provide stronger cryptographic algorithms, while others contain hardware components, such as smart cards. Cryptographic service provider is also called CSP.

See also CryptoAPI; service; smart card.


A means for originators of a message, file, or other digitally encoded information to bind their identity to the information. The process of signing information entails transforming the information, as well as some secret information held by the sender, into a tag called a signature. Digital signatures are used in public key environments. and they provide nonrepudiation and integrity services.

See also public key cryptography; service.


A standard that uses the Digital Signature Algorithm (DSA) for its signature algorithm and SHA-1 as its message hash algorithm. DSA is a public-key cipher that is used only to generate digital signatures and cannot be used for data encryption. Digital Signature Standard is also called DSS. See also digital signature; SHA-1.


The process of disguising a message or data in such a way as to hide its substance.


A standard entitled "Security Requirements for Cryptographic Modules." FIPS 140-1 describes government requirements that hardware and software cryptomodules should meet for Sensitive, but Unclassified (SBU) use. Federal Information Processing Standard 140-1 is also called FIPS 140-1.


A family of security products, including PCMCIA-based cards, compatible serial port devices, combination cards (such as FORTEZZA/Modem and FORTEZZA/Ethernet), server boards, and others. FORTEZZA is a registered trademark held by the National Security Agency.


An algorithm used to produce a hash value of some piece of data, such as a message or session key. A good hash algorithm has a quality where changes in the input data can change every bit in the resulting hash value; for this reason, hashes are useful in detecting any modification in a large data object, such as a message. Furthermore, a good hash algorithm makes it computationally infeasible to construct two independent inputs that have the same hash. Typical hash algorithms include MD2, MD4, MD5, and SHA-1. Hash algorithm is also called a hash function.

See also MD2; MD4; MD5; message digest; SHA-1.


A mechanism for message authentication using cryptographic hash functions. HMAC can be used with any iterative cryptographic hash function, for example, MD5, SHA-1, in combination with a secret shared key. The cryptographic strength of HMAC depends on the properties of the underlying hash function. Hash-based Message Authentication Code algorithm is also called HMAC.

See also hash algorithm; MD5; SHA-1.


An algorithm that insures the quality of a block of data. Message Authentication Code is also called MAC.


A hash algorithm that creates a 128-bit hash value and was developed by RSA Data Security, Inc.

See also hash algorithm.


A hash algorithm that creates a 128-bit hash value and was developed by RSA Data Security, Inc.

See also hash algorithm.


An industry-standard one-way, 128-bit hashing scheme, developed by RSA Data Security, Inc., and used by various Point-to-Point Protocol (PPP) vendors for encrypted authentication. A hashing scheme is a method for transforming data (for example, a password) in such a way that the result is unique and cannot be changed back to its original form. The CHAP authentication protocol uses challenge-response with one-way MD5 hashing on the response. In this way, you can prove to the server that you know your password without actually sending the password over the network.

See also CHAP; hash algorithm; PPP.


A fixed-size result obtained by applying a one-way mathematical function (sometimes called a hash algorithm) to an arbitrary amount of data. Given a change in the input data, the resulting value of the message digest will change. Message digest is also called a hash.

See also hash algorithm.


The Cryptographic Message Syntax Standard. It is a general syntax, developed and maintained by RSA Data Security, Inc., for data to which cryptography may be applied, such as digital signatures and/or encryption. It also provides a syntax for disseminating certificates or certificate revocation lists.

See also certificate; certificate revocation list; encryption; PKCS.


The Certification Request Syntax Standard, developed and maintained by RSA Data Security, Inc. A syntax for certificate requests.

See also certificate; PKCS.


The Personal Information Exchange Syntax Standard, developed and maintained by RSA Data Security, Inc. This syntax standard specifies a portable format for storing or transporting a user's private keys, certificates, and miscellaneous secrets.

See also certificate; PKCS.


The secret half of a cryptographic key pair that is used with a public key algorithm. Private keys are typically used to decrypt a symmetric session key, digitally sign data, or decrypt data that has been encrypted with the corresponding public key.

See also public key.


The nonsecret half of a cryptographic key pair that is used with a public key algorithm. Public keys are typically used when encrypting a session key, verifying a digital signature, or encrypting data that can be decrypted with the corresponding private key.

See also private key.


A family of standards for public key cryptography that includes RSA encryption, Diffie-Hellman key agreement, password-based encryption, extended-syntax, cryptographic message syntax, private key information syntax, and certificate request syntax, as well as selected attributes. Developed, owned and maintained by RSA Data Security, Inc. Public Key Cryptography Standards is also called PKCS.

See also certificate; public key.


A method of encryption that uses two encryption keys that are mathematically related. One key is called the private key and is kept confidential. The other is called the public key and is freely given out to all potential correspondents. In a typical scenario, a sender uses the receiver's public key to encrypt a message. Only the receiver has the related private key to decrypt the message. The complexity of the relationship between the public key and the private key means that, provided the keys are long enough, it is computationally infeasible to determine one from the other. Public key encryption is also called asymmetric encryption.

See also encryption; private key; public key; symmetric encryption.


The term generally used to describe the laws, policies, standards, and software that regulate or manipulate certificates and public and private keys. In practice, it is a system of digital certificates, certification authorities, and other registration authorities that verify and authenticate the validity of each party involved in an electronic transaction. Standards for PKI are still evolving, even though they are being widely implemented as a necessary element of electronic commerce. Public key infrastructure is also called PKI.

See also certificate; certification authorities; public key.


The certification authority at the top of a certification hierarchy.

See also certification authority; certification hierarchy.


A self-signed certification authority certificate. It is called a root certificate because it is the certificate for the root authority. The root authority must sign its own certificate because by definition there is no higher certifying authority in the certification hierarchy.

See also certificate; certification authority; certification hierarchy; root authority.


A widely used public/private key algorithm. It is the default cryptographic service provider (CSP) for Microsoft Windows. It was patented by RSA Data Security, Inc. in 1977.

See also CSP.


A protocol for secure electronic mail over the Internet. Secure Multipurpose Internet Mail Extensions is also called S/MIME.


A protocol for secure network communications using a combination of public and secret key technology. Secure Sockets Layer is also called SSL.


A message digest hash algorithm that generates a 160-bit hash value. SHA-1 is used with the Digital Signature Algorithm (DSA) in the Digital Signature Standard (DSS), among other places. Secure Hash Algorithm is also called SHA-1.

See also DSS; hash algorithm message digest.


A credit card-sized device used to securely store public and private keys, passwords, and other types of personal information. To use a smart card, you need a smart card reader attached to the computer and a personal PIN number for the smart card.

In Windows 2000, smart cards can be used to enable certificate-based authentication and single sign-on to the enterprise.

See also authentication; certificate; single sign-on; smart card reader.


A standard device within the smart card subsystem. A smart card reader is an interface device (IFD) that supports bidirectional input/output to a smart card.

See also smart card.


An encryption algorithm which requires the same secret key to be used for both encryption and decryption. Because of its speed, symmetric encryption is typically used when a message sender needs to encrypt large amounts of data. Symmetric encryption is also called secret key encryption.

See also public key encryption.


A certification by a trusted third party specifying that a particular message existed at a specific time and date. In a digital context, trusted third parties generate a trusted time stamp for a given message by having a time stamping service append a time value to a message and then digitally signing the result.

See also digital signature; service.


A protocol that provides privacy and security between two applications communicating over a network. Transport Layer Security is also called TLS.


Version 3 of the ITU-T recommendation X.509 for syntax and format. It first appeared in the version of X.509 modified in 1995. This is the standard certificate format used by Windows 2000 certificate-based processes.

An X.509 certificate includes information about the person or entity to whom the certificate is issued, information about the certificate, plus optional information about the certification authority (CA) issuing the certificate. Subject information may include the entity's name, public key, public-key algorithm, and an optional unique subject ID.

See also certificate; certification authority; ITU-T; public key.


A management infrastructure in Windows 2000 that supports monitoring and controlling system resources through a common set of interfaces and provides a logically organized, consistent model of Windows operation, configuration, and status.


A feature that detects when a predefined counter value rises above or falls below the configured threshold and notifies a user by means of the Messenger service.

See also Messenger service.


A type of log generated when the user selects a trace data provider using Performance. Trace logs differ from counter-data logs in that they measure data continuously rather than take periodic samples.


The Windows 2000 Microsoft Management Console (MMC) snap-in used to specify the behavior of users' desktops. A Group Policy object, which an administrator creates using Group Policy, is the mechanism for configuring desktop settings.

See also desktop; Group Policy object; MMC; policy; snap-in.


The mechanism by which desktop settings are configured automatically, as defined by the administrator. Depending on context, this can refer to Windows 2000 Group Policy, Windows NT 4.0 System Policy, or a specific setting in a Group Policy object.

See also Group Policy; Group Policy object; System Policy.


A collection of group policy settings. Group policy objects are essentially the documents created by the Group Policy snap-in, a Windows 2000 utility. Group Policy objects are stored at the domain level, and they affect users and computers contained in sites, domains, and organizational units. In addition, each Windows 2000 computer has exactly one group of settings stored locally, called the local Group Policy object.

See also Group Policy; object; policy.


A Windows NT 4.0-style policy based on registry settings made using Poledit.exe, the System Policy Editor.


An application that is used to configure a cluster and its nodes, groups, and resources. Cluster Administrator can run on any member of the trusted domain regardless of whether the computer is a cluster node.

See also Cluster Administrator extension; Cluster.exe; node; resource; server cluster.


A software component that implements the Cluster Administrator extension application programming interface (API) for allowing Cluster Administrator to configure a new resource type.

See also Cluster Administrator; resource; server cluster.


An alternative to using Cluster Administrator to administer clusters from the Windows 2000 command prompt. You can also call Cluster.exe from command scripts to automate many cluster administration tasks.

See also Cluster Administrator.


The log where the quorum resource stores data. This data is maintained by the clustering software.

See also quorum resource; server cluster.


A group of independent computer systems, known as nodes, working together as a single system to ensure that mission-critical applications and resources remain available to clients. A server cluster is the type of cluster that Cluster service implements.

See also Cluster service; node; resource.


The essential software component that controls all aspects of server cluster operation and manages the cluster database. Each node in a server cluster runs one instance of the Cluster service.

See also node.


A relationship of reliance between two resources that makes it necessary for them to run in the same group on the same node. For example, an application is dependent on the disks that contain its data resources.

See also node; resource.


The process of moving resources, either individually or in a group, back to their preferred node after the node has failed and come back online.

See also node; online; resource.


A state that applies to a resource or a node in a cluster. A resource or a node is placed in the failed state after an unsuccessful attempt has been made to bring it online.

See also node; online; resource.


The process of taking resources, either individually or in a group, offline on one node and bringing them back online on another node. The offline and online transitions occur in a predefined order, with resources that are dependent on other resources taken offline before and brought online after the resources upon which they depend.

See also node; offline; online; resource.


A state that marks a component in a cluster as unavailable. A node in an offline state is either inactive or not running. Resources and groups also have an offline state.

See also group; node; online, paused; resource.


A state that marks a component in a cluster as available. When a node is online, it is an active member of the cluster and can own and run groups as well as honor cluster database updates, contribute votes to the quorum algorithm, and maintain heartbeats. Resources and groups also have an online state.

See also group; node; offline; paused; resource.


A state that applies to a node in a cluster. The node is a fully active member in the cluster but cannot accept new resource groups (for example, a resource group cannot fail over or fail back to a paused node). You can administer and maintain a paused node.

See also failback; failover; node; offline.


A state that refers to a resource in a cluster when the resource is in the process of being brought online or taken offline.

See also offline; online; resource.


A list that specifies which nodes in the cluster are capable of running that resource. By default, both nodes appear as possible owners, so the resource can run on either node. In most cases, it is appropriate to use this default setting. If you want the resource to be able to fail over, both nodes must be designated as possible owners.

See also failover; node; resource.


The node on which you prefer each group to run.

For example, the static load balancing model performs best when groups are appropriately balanced between two nodes. When a node fails, the remaining node takes over the groups from the failed node, but performance is diminished. By setting those groups to fail back to their preferred server (the failed node), you automatically restore maximum performance when failback occurs. A group does not fail back if a preferred owner is not selected.

You will not always choose a preferred owner because it may not matter where the group resides; all that matters is that the group is still running on one of the two nodes. Or, the nodes may be equally capable of handling the load required to use some or all of the resources.

See also failback; group; node; resource.


The quorum-capable resource selected to maintain the configuration data necessary for recovery of the cluster. This data contains details of all of the changes that have been applied to the cluster database. The quorum resource is generally accessible to other cluster resources so that any cluster node has access to the most recent database changes. By default there is only one quorum resource per cluster.

See also node.


A dynamic-link library containing an implementation of the Resource application programming interface (API) for a specific type of resource. The Resource DLL is loaded into the address space of its Resource Monitor.

See also DLL; resource; Resource Monitor.


A cluster software component that facilitates communication between a node's server cluster and one or more of its resources.

See also node; resource; server cluster.


Classes of resources, such as print spooler, physical disk, and file share, organized by the server cluster. Windows 2000 Advanced Server provides Resource DLL files for the most common types of resources. Using the application programming interface (API) provided in the Microsoft Platform Software Development Kit (SDK), other vendors can add support for other resource types.

See also print spooler; Resource DLL; server cluster.


A Services for Macintosh service that enables Macintosh clients to send and spool documents to printers attached to a computer running Windows 2000 Server, and enables clients to send documents to printers anywhere on an AppleTalk network. Print Server for Macintosh is also called MacPrint.

See also AppleTalk; service.


A service that manages zero or more multicast groups and distributes multicast data sent to it by clients of those multicast groups through point-to-multipoint connections. Multicast server is also called MCS.

See also service.


A service for resolving multicast IP addresses to the ATM addresses of the clients that have joined that multicast group. The MARS can work in conjunction with the MCS and clients to distribute multicast data through point-to-multipoint connections. Multicast address resolution service is also called MARS.

See also ATM; IP address; MCS; service.


A high-speed connection-oriented protocol to transport multiple types of traffic across a network. ATM packages data in a 53-byte, fixed-length cell that can be switched quickly between logical connections on a network. Asynchronous transfer mode is also called ATM.

See also protocol.


A protocol in the TCP/IP suite that provides IP address-to-MAC address resolution for IP packets. Address Resolution Protocol is also called ARP.

See also IP; MAC; packet; TCP/IP


The partition that contains the hardware-specific files needed to load Windows 2000 (for example, Ntldr, Osloader, Boot.ini, Ntdetect.com).

The system partition can be, but does not have to be, the same as the boot partition.

See also boot partition; partition.


The partition that contains the Windows 2000 operating system and its support files.

The boot partition can be, but does not have to be, the same as the system partition.

See also partition; system partition.


A partition consisting of disk space on one or more physical disks that was created with Windows NT 4.0 or earlier. You can delete volume sets only with Windows 2000. To create new volumes that span multiple disks, use spanned volumes on dynamic disks.

See also basic disk; dynamic disk; spanned volume.


A partition created with Windows NT 4.0 or earlier that stores data in stripes on two or more physical disks. You can delete stripe sets only with Windows 2000. To create new volumes that are striped, use striped volumes on dynamic disks.

See also basic disk; dynamic disk; striped volume.


A fault-tolerant partition created with Windows NT 4.0 or earlier that duplicates data on two physical disks. You can only repair, resynchronize, break, or delete mirror sets in Windows 2000. To create new volumes that are mirrored, use mirrored volumes on dynamic disks.

See also basic disk; dynamic disk; fault tolerance; mirrored volume.


A fault-tolerant partition created with Windows NT 4.0 or earlier that stripes data intermittently across three or more physical disks. You can only repair or delete stripe sets with parity with Windows 2000. To create new fault-tolerant volumes that are striped, use RAID-5 volumes on dynamic disks.

See also basic disk; dynamic disk; fault tolerance; parity; RAID-5 volume.


A protocol that automates distribution of multicast address configurations for network clients. MADCAP replaces MDHCP in the DHCP protocols. It is built on a client-server model that allows hosts to request multicast address allocation services from multicast address allocation servers. In general, the client unicasts or multicasts a message to one or more servers, which may also respond with messages that are unicast to the client. For clients to support MADCAP configuration, their programs must use the new MADCAP application programming interface (API) calls that are available for Windows 2000. Multicast Address Dynamic Client Allocation Protocol is also called MADCAP.

See also DHCP; service.


An NTFS system file on NTFS-formatted volumes that contains information about each file and folder on the volume. The MFT is the first file on an NTFS volume. Master File Table is also called MFT.

See also FAT; NTFS file system; volume.


A process that verifies that the user has the correct rights or permissions to access a resource in a domain.

See also permission.


The mechanisms for limiting access to certain items of information or to certain controls based on users' identity and their membership in various predefined groups. Access control is typically used by system administrators for controlling user access to network resources such as servers, directories, and files and is typically implemented by granting permissions to users and groups for access to specific objects.

See also group; network administrator; permission.


An event log containing information on security events that are specified in the audit policy.


A process that allows a user with a domain account to log on to a network once, using a password or smart card, and to gain access to any computer in the domain.

See also smart card.


A Windows NT 4.0 domain that is used for managing user and group accounts in a multidomain network.


A Windows NT 4.0 domain that is used for hosting file, print, and other application services.

See also domain; service.


A policy that determines the security events to be reported to the network administrator.


A set of identification data for a security principle, issued by a domain controller for purposes of user authentication. Two forms of tickets in Windows 2000 are ticket-granting tickets (TGTs) and service tickets.

See also authentication; domain controller; service ticket; TGT.


A Kerberos V5 service that runs on a domain controller. It issues ticket-granting tickets (TGTs) and service tickets for obtaining network authentication in a domain. Key Distribution Center is also called KDC.

See also Kerberos V5; TGT.


A ticket issued by the Kerberos V5 Key Distribution Center (KDC) for purposes of obtaining a service ticket from the ticket-granting service (TGS). Ticket-granting ticket is also called TGT.

See also KDC; Kerberos V5; TGS.


A Kerberos V5 service provided by the Kerberos V5 Key Distribution Center (KDC) service that issues service tickets that allow users to authenticate to services in a domain. Ticket-granting service is also called TGS.

See also KDC; Kerberos V5; service ticket.


A ticket issued by the Kerberos V5 ticket-granting service (TGS) that allows a user to authenticate to a specific service in the domain.

See also Kerberos V5; TGS; ticket.


A set of security principles, in a non-Windows networked environment, that are subject to Kerberos authentication.

See also Kerberos V5.


Permissions on an object that are automatically assigned when the object is created, or specifically assigned or changed by the owner of the object.

See also object; permission.


Permissions on an object that are automatically inherited from its parent object. Inherited permissions cannot be modified.

See also object; parent object; permission.


A user right that is assigned to a user and that specifies the ways in which a user can log onto a system. An example of a logon right is the right to log on to a system remotely.


A user right which is assigned to a user and that specifies allowable actions on the network. An example of a privilege is the right to shut down a system.


An administrator who is issued a public key certificate for the purpose of recovering user data encrypted with Encrypting File System (EFS).

See also certificate; EFS; public key.


An Internet standard security protocol for handling authentication of user or system identity. With Kerberos V5, passwords that are sent across network lines are encrypted, not sent as plaintext. Kerberos V5 includes other security features as well.

See also KDC; password; realm; service ticket; TGS; TGT; ticket.


A display mode in which the monitor can display letters, numbers, and other text characters, but no graphical images or character formatting (italics, superscript, and so on).


A display mode in which lines and characters on the screen are drawn pixel by pixel. Graphics mode displays images by grouping individual dots into shapes, such as the arrowhead of a mouse pointer. It can also preview character formatting, such as boldface and italics, as it will appear in print.


An operating system used on all personal computers and compatibles. As with other operating systems, such as OS/2, it translates user keyboard input into operations the computer can perform. MS-DOS can be easily accessed by using the Command Prompt, while MS-DOS-based programs can be accessed through the use of shortcuts on the desktop. Microsoft Disk Operating System is also called MS-DOS.

See also Command Prompt window; MS-DOS-based program; OS/2; shortcut.


A region of RAM reserved for use with data that is temporarily held while waiting to be transferred between two locations, such as between an application’s data area and an input/output device.

See also RAM.


A window displayed on the desktop used to interface with the MS-DOS operating system. MS-DOS commands are typed at an entry point identified by a blinking cursor.


A protected-mode, virtual memory, multitasking operating system for personal computers based on the Intel 80286, 80386, i486, and Pentium processors. OS/2 can run most MS-DOS-based programs and can read all MS-DOS disks.

See also MS-DOS; MS-DOS-based program.