When Microsoft introduced Windows NT in 1993, they offered two products: Windows NT 3.1 and Windows NT Advanced Server 3.1. The problem was that the exact roles of these two products had not been clearly defined in Microsoft’s marketing strategy. This led to confusion about which product should be used in what environments.
With the introduction of 3.5 in late 1994, Microsoft changed the product names, their feature sets, and gave a clear indication of what roles each product was designed for. Windows NT became Windows NT Workstation, and Windows NT Advanced Server became Windows NT Server.
Windows NT Workstation was designed as a robust, 32-bit multithreaded, multitasking operating system that was capable of running high-end engineering or mission-critical client/server applications.
Windows NT Server became the cornerstone of Microsoft’s enterprise-class network operating system. Windows NT Server was designed to provide file, print, and application services to diverse clients.
Windows NT Workstation and Windows NT Server are both built using the same core technologies, resulting in products with more similarities than differences. Some of the features common to both Windows NT products are
The Windows NT platform was designed to provide a powerful operating system platform capable of scaling from the simplest file and print services network, to the largest enterprise network providing file and print services to thousands of users, as well as advanced messaging and application services.
To achieve this, Windows NT was designed with a microkernel capable of preemptively dispatching threads to up to 32 processors. This provides scalability, both for servers and for high-demand workstations. Furthermore, by providing preemptive multitasking, NT can prevent any single process from monopolizing the processor.
Windows NT is a true 32-bit operating system, with no internal 16-bit code, unlike Windows 95, which still has a considerable amount of 16-bit code under the hood for compatibility with older versions of Windows. As a result, Windows NT is capable of taking full advantage of the powerful features of today’s most advanced microprocessors, including Intel’s new Pentium Pro processor.
In order to properly fit the role of a mission-critical operating system, Windows NT provides memory protection for all user-level processes. The NT kernel runs in its own 32-bit, virtualized address space. Additionally, every 32-bit program runs in its own address space. With 16-bit Windows programs, you have the option of running each process in its own memory space, or in a memory space shared by other Windows programs. In any case, programs cannot write to another program’s address space, preventing an errant program from stepping on other programs or on the operating system itself.
On the hardware side, NT supports 4GB of RAM per system and 2GB of virtual memory per application. Additionally, it can address up to 402 million TB of data storage per system. With the capability to take advantage of this kind of hardware, NT is fully capable of meeting the needs of enterprise-level client/server needs.
Additionally, Windows NT, unlike Windows 3.x and Windows 95, is capable of running on many different processor architectures, although Windows 3.x and its descendants are supported only on the Intel x86 platform. Windows NT will also take full advantage of powerful RISC processors such as the DEC Alpha AXP, MIPS R4400, and IBM/Motorola PowerPC processors. This means that no matter how much processing power you need, Windows NT will be able to accommodate you. Although the newest and fastest Pentium and Pentium Pro processors are still around 200 MHz, the latest Alpha and MIPS RISC chips scream at well over 300 MHz!
The core networking components are virtually identical between NT Server and NT Workstation. As mentioned in chapter 1, networking was built into the Windows NT from the beginning; it is one of the fundamental elements of the NT architecture.
For many people coming from an MS-DOS/Windows networking background, file and print services are traditionally based on either a client/server model or a peer-to-peer model. Windows NT is more like a hybrid of the two. Essentially, an NT Server is optimized to act as a server, but you can also use it as a workstation. Likewise, NT Workstation is optimized as a desktop workstation, but it can also be used as a server. This differs greatly from the Novell model, wherein you have dedicated servers and dedicated clients that are built on completely different architectural models.
Windows NT uses the NDIS 3.0 standard to support numerous different transport protocols. Support is built into the product for TCP/IP, NetBEUI, IPX/SPX, DLC, and AppleTalk. Windows NT can provide traditional Microsoft file and print services over TCP/IP, IPX/SPX, and NetBEUI. DLC is supported for printing to network-connected printers and IBM mainframe connectivity. AppleTalk is supported on NT Server for providing Macintosh file and print services and on NT Workstation for administering NT Servers running File and Print Services for Macintosh.
Both NT Server and NT Workstation provide standard TCP/IP utilities, including Telnet and FTP clients. Additionally, an FTP Server service can be installed to provide TCP/IP-based file transfer between NT and UNIX hosts or any other system with an FTP client.
Windows NT includes a full set of powerful GUI tools for administering most parts of the operating system. These tools include
NOTE: An NT domain is a group of workstations and servers that can be administered together. A common user account database resides on the NT domain controllers, which provide user authentication services for other members of the domain. This enables a user to have a single account for logging onto all computers in the domain. Furthermore trust relationships can be set up between domains that enable you to grant access to a local resource to user accounts from a trusted domain. More information on NT domains can be found in Chapter 4, Installing Windows NT Server, and Chapter 15, Administering the Server.
Microsoft has gone to great lengths to ensure that Windows NT integrates well with other desktop operating systems and network operating systems. Making both NT Workstation and NT Server fit seamlessly into a NetWare environment was a high priority. NetWare integration is primarily provided by the following two components:
Microsoft recognizes that TCP/IP is unarguably the most important network protocol in use today. The world is continuing to advance toward a world-wide computer network infrastructure, and the primary protocol for that network is TCP/IP.
Traditionally, Microsoft services were built on NetBEUI, which, although small and fast, is more suited to small networks due to its high level of network broadcasts and its inability to be routed. To make their software more universal, Microsoft has virtualized their entire networking platform so that you can mix and match protocols, requesters and services. This means that you can use the traditional Microsoft networking services over NetBEUI, IPX/SPX or TCP/IP and the result is the same to the user. It is now possible to build your entire Microsoft-based network using TCP/IP—or IPX/SPX. Having a single networking protocol can make network management easier. Additionally, it can improve client performance by not requiring each workstation to load multiple network protocols for communicating with different services.
Recognizing the importance of TCP/IP, Microsoft expended great effort to ensure that the TCP/IP implementation in Windows NT was robust and as fast as possible. The results are a highly optimized, 32-bit stack, the core of which is similar in its Windows for Workgroups 3.11, Windows 95, and Windows NT implementations. In addition to focusing on the speed of the stack, Microsoft has tried to provide TCP/IP-based services to make the stack more functional. The following are some of the features of the TCP/IP stack in Windows NT:
The Remote Access Service (RAS) in Windows NT is a very robust tool for creating WAN connections to support today’s advanced client/server computing environments. RAS enables remote users to gain dialin access to the network using the NetBEUI, IPX, or TCP/IP protocols. RAS uses the point-to-point protocol (PPP) to support network connections over standard modems, ISDN, and X.25 WAN links.
RAS is fully integrated with the NT security database so that users can use their standard NT user account and password for authentication. If a greater degree of security is necessary, RAS can take advantage of third-party security hosts.
RAS is compatible with UNIX systems via PPP, NetWare, Shiva LanRovers, Windows, Windows for Workgroups, Windows NT Server, Windows NT Workstation, and LAN Manager.
One of the exciting new technologies supported in Windows NT 4 is called Point-to-Point Tunneling Protocol (PPTP), which is supported through the RAS service. PPTP enables you to create virtual private networks (VPNs) across any type of network link. One of the VPN is security. You can tell NT to encrypt data using RSA Data Security Incorporated’s RC4 encryption algorithm. This provides data security and enables you to use the Internet as a secure "private" network. A second advantage of the VPN concept is that you can easily and securely use any Internet Service Provider (ISP) to dial into, while still maintaining data security.
For more information on RAS and PPTP, see Chapter 20.
When Microsoft designed Windows NT, they concentrated on making it secure. Because NT was intended for use in enterprise environments, it was vital that NT be able to prevent unauthorized access to business-critical information. Microsoft deemed that designing the system to meet and exceed the U.S. National Security Agency’s criteria for C2-level secure systems would result in a product that would satisfy the needs of the commercial sector as well. Additionally, by going through the lengthy C2 certification procedure, Microsoft would have a certifiable security metric that could be used to demonstrate the security of their system.
As part of the security system, Windows NT requires that the actions of all users, both local and remote, be verified against a built-in security database. So access to any part of the system would only be granted after a user provides a valid user account and password.
Furthermore, NT provides mechanisms to protect its built-in security database. One such mechanism is that, by default, NT does not allow passwords to be sent in clear text over the network. Additionally, no user or process can directly modify the system’s security database. All interactions with this database are done through well-defined messages that are passed between the various software components. Additionally, you can create a password policy that requires users to have passwords of a certain length, or even create a policy that disables accounts after a designated number of failed logon attempts.
To protect the data stored on the system, NTFS, Windows NT’s preferred file system, uses access control lists (ACLs) to provide file and directory protection on a user-by-user basis. Each object also has a owner, who is the ultimate authority when it comes to granting or denying access an object.
For more information on taking advantage of NT Security, see Chapter 25.
Security is important for protecting your data from accidental or intentional mishandling; however, regular backups are important for protecting your data from other kinds of problems. Recognizing this, Microsoft includes a full-featured, graphical tape backup utility with Windows NT. This utility, called NT Backup, was made for Microsoft by Arcada Software and is very similar to Arcada’s commercial software package, Backup Exec.
NOTE: Arcada was recently acquired by Seagate and rolled into a division of Seagate called the Seagate Storage Group.
NT Backup can take advantage of any tape device supported by Windows NT. It can perform typical backup operations, including normal, copy, incremental, differential, and daily. With NT Backup you can have a backup set span multiple tapes, or include multiple backup sets on one tape.
Additionally, NT Backup supports NT’s integrated security model through the use of user rights, and by allowing you to back up and restore files and directories with or without the access control lists (ACLs). NT Backup can also be used to backup NT’s Registry and has full support of long filenames.
If you want to schedule regular backups, you can build batch jobs and use NT’s built-in system scheduler to run the jobs as necessary.
The NT Backup utility is discussed in Chapter 23.
Windows NT supports two major files systems:
These three file systems are discussed in greater depth in Chapter 6.
NOTE: One of the big surprises in Windows NT 4 was the discontinuation of support for the High-Performance File System (HPFS), originally developed for OS/2, and supported on NT 3.1, 3.5, and 3.51.
To build a truly robust operating system, you must make sure that all components of the system are up to the task. So when designing Windows NT, Microsoft’s engineers chose to develop a new file system that fit in line with NT’s goals: performance, stability, scalability, and reliability. The result was NTFS.
NTFS is an advanced file system that uses journaling—a concept similar to logging— to provide recoverability. In face, the transaction-processing concepts used in NTFS combined with its relational database model, make NTFS look more like a high-performance database than a traditional file system. To provide improved speed, NTFS was built on a "lazy-write" model, rather than the "careful-write" model that is used by the traditional FAT file system.
NTFS is the only file system in Windows NT that supports file-level security permissions. This is done through an access control list (ACL), which contains the details of exactly what users are granted permissions to a resource and what level of permissions they have been granted.
In addition, NTFS supports many other advanced features including:
Windows NT supports FAT primarily to provide backward compatibility. However, the FAT implementation in NT differs somewhat from the implementation in DOS. One difference is that Windows NT allows for long filenames—up to 255 characters.
NOTE: Both Windows NT and Windows 95 support FAT in the same way.
There are many disadvantages of using FAT under NT. For example, FAT does not give you the recoverability provided by NTFS. Additionally, FAT does not support ACLs, so you cannot assign security permissions to individual files or directories.
There are times in NT where you must use the FAT file system. For instance FAT is the only file system support on floppy drives. Also, because of their design, the boot partition on RISC computers running NT must be FAT.
There are some things in FAT’s favor though. Because of overhead involved in keeping the journal log under NTFS, there are situations in which FAT might be faster for writing information.
The features discussed above are shared by both the NT Workstation and the NT Server products. There are many features available in the NT Server product that are not available in the Workstation product. Some of the most important features are
Whereas NT Workstation is limited to 10 incoming network connections, Windows NT Server has no such limitation. In fact, there is no software-defined limit to the number of clients that can simultaneously connect to an NT Server. The limit of 10 network connections in NT Workstation is not simply a whimsically chosen number. After careful benchmarking and analysis, Microsoft determined that NT Workstation and NT Server performed similarly up to about 10 simultaneous incoming network connections. After that, NT Server was much more capable of handing the load. This has to do with differences in the internal optimization of the two products, including the pageability of the server code and the difference in the number of system worker threads.
Because NT Server is designed to meet the needs of high-end, mission-critical systems, Microsoft has included a fault-tolerant disk driver, called FTDISK.SYS, with NT Server. This driver uses redundant array of inexpensive disks (RAID) levels 1 and 5 to handle fault-tolerant disk configurations such as disk mirroring, disk duplexing, and disk striping with parity.
NOTE: Both Windows NT Server and NT Workstation can take advantage of hardware-based RAID solutions, which can provide increased performance, compared to NT Server’s software solution.
You can find more information about RAID 1 and 5 in Chapter 23.
There are two major TCP/IP-related enhancements provided by Windows NT Server. These are
These TCP/IP server services are discussed in Chapter 12.
One major difference between Windows NT Server and NT Workstation is very fast Internet server that is at the foundation of Microsoft’s Internet strategy. It supports the hypertext transport protocol (HTTP), which is the fundamental transport protocol of the World Wide Web, as well as support for FTP and gopher services.
NOTE: Microsoft includes a service in NT Workstation, called Peer Web Services, which appears to be virtually identical to the IIS. However, the greatest limitation to Peer Web Services is that it only accepts 10 incoming connections, limiting its use for anything but the smallest application.
Through the use of the Internet Server API (ISAPI) programming interface, the IIS service can be extended to provide other services, such as a full-text search engine, such as the forthcoming product Microsoft product code-named Tripoli.
You can find more information on IIS, and using NT as an Internet server in Chapter 28, Windows NT as an Internet Server.
Although the RAS client in NT Workstation and NT Server are virtually identical, the RAS server service provided in Windows NT Server has two major features that set it apart from its NT Workstation sibling:
You can find more in-depth coverage of the Remote Access Service in Chapter 20.
Microsoft has realized that the most effective way to challenge Novell in the networking world is to make their products integrate as easily as possible with Novell networks. NT Server adds two main utilities that help narrow the once insurmountable chasm between the two products. The following two Novell-related services are provided in NT Server:
The magic of this service is that it allows you to make Novell-based disk and printer resources available to Microsoft clients without the additional overhead required for running the IPX/SPX stack and Novell client software.
NOTE: Microsoft sells an add-on product for NT Server, called File & Print Services for NetWare, which makes an NT Server look exactly like a Novell 3.x server.
These NetWare-related tools are discussed in greater detail in Chapter 22.
One of the foremost features included in NT Server, but not in NT Workstation is the capability for NT Server to act as a domain controller. Without a Windows NT Server on your network to act as the primary domain controller, you would lose all of the functionality provided by a domain structure. Some of these additional features are
Additionally, you can chose to use mandatory profiles, which cannot be changed by the user and can be used to limit the user’s activities. Any changes made to the desktop or other settings by the user during an interactive logon session are not saved when the user logs off.
The Network Client Administrator is a tool that many people just don’t seem to know what to do with. It was introduced in version 3.5 to make a system administrator’s job easier when installing client-end software. This utility generates a boot disk that when booted in a client system can be used to automatically install Microsoft client software over the network from the server. The Network Client Administrator can be used to install the following client software which Microsoft has included on the NT Server CD:
The Network Client Administrator is discussed in-depth in Chapter 21.
The Directory Replication service in Windows NT allows you to maintain identical copies of files and directories on multiple computers. When you make changes to any of these files or directories, the change is replicated to other computers configured to import replication changes.
Both Windows NT Servers and NT Workstations can be configured to import directories. However, only Windows NT Servers can act as a directory replication export servers.
The Directory Replication service is useful for replicating logon scripts among all the Windows NT logon servers in a domain.
Out of the box, Windows NT Server is able to act as a file and print server for Macintosh clients as well as print to AppleTalk-based printers. This makes it easier than ever to support both Macintosh and Windows networking clients from a single server product. There are five major services that are provided by NT’s Services for Macintosh (SFM):
One of the problems commonly encountered with integrating PC and Macintosh systems is the 8.3 limit on filenames imposed by DOS. Because SFM files are hosted on an NTFS partition, which is capable of handling files with 255-character names, NT is easily able to accommodate the Macintosh’s 32-character filenames.
In fact, in many ways NT provides far more robust Macintosh services than any current Macintosh product. To test the scalability of NT Server’s SFM services, Microsoft has performed limits testing with more than 1,000 simultaneous Macintosh connections. This is good evidence of the robustness of NT as a Macintosh file server solution.
In-depth coverage of the Services for Macintosh is provided in Chapter 10.
The Remoteboot service enables you to boot an MS-DOS, Windows 3.1, or Windows 95 workstation over the network from a shared software installation located on your NT Server. The client’s network card must have a remote program load (RPL) chip. Remoteboot can give you increased workstation security, software, and operating system version control and decreased workstation costs.
The Remoteboot service is covered in Chapter 15.
Microsoft offers two methods of client licensing for BackOffice products: per server or per seat. To help system administrators enforce their licensing policy, Microsoft has begun including the Client-Licensing Manager applet with NT Server. This program is the forerunner of a more sophisticated license monitoring software expected later this year.
The Client-Licensing Manager allows you to designate the number of licenses you own for various BackOffice applications and enforces the licensing policy by denying services to users if all available license have been exhausted. You can use this application to manage licenses for all BackOffice products on your network from a single location.
The Client-License Manager also keeps track of license usage statistics, enabling you to view the highest number of current connections. This is extremely valuable for capacity planning.
The Client-License Manager also supports local, domain, or enterprise-based license metering. You can set up central servers that will act as repositories for all licensing information. You can choose how frequently Windows NT replicates information to the master license server.
An additional use for the Client-License Manager is for generating historical reports of when new licenses were purchased and for which products.
Windows NT 4.0 now includes the Microsoft Network Monitor Tool, which enables you to directly view traffic network traffic as it passes across the network wire. This tool was previously only available as part of Microsoft’s Systems Management Server (SMS) package, but is now included with NT Server 4. The Network Monitor Tool is a very important troubleshooting device, because it permits you to actually disassemble the packets that are passed across the network and isolate where problems are occurring. For example, if you are having trouble getting a DHCP client to locate a DHCP server on the network, you could watch to see where the communications are getting held up, and quickly resolve the problem. Without being able to look at the raw network data, problems like this are often based on a tremendous amount of guesswork and can be very time consuming.
Windows NT Server and Workstation have more differences than just their feature sets. The actual code that controls the internals of each system is optimized so NT Workstation performs best as a desktop operating system for client/server and mission critical applications, whereas NT Server provides a robust, fault-tolerant operating system capable of being the foundation of an enterprise-level network by providing application, file, and print system.
The following differences have been made to the two products to make each best fit its intended market:
To better meet their particular roles, Windows NT Server and NT Workstation handle the flushing of dirty cache data differently. This mechanism, known as write throttling, essentially results in NT Server holding dirty information in cache longer than NT Workstation. This allows NT Server to better perform its role as a server. NT Workstation, on the other hand, flushes its cache more frequently, resulting in a smaller memory overhead for the cache.
SRV.SYS is the driver in Windows NT that is responsible for processing high-level file system requests and then passing them to the appropriate low-level device driver. In Windows NT Workstation, SRV.SYS is highly pageable, which translates to a lower memory footprint, but might result in additional paging. In NT Server, this driver is less pageable, meaning a larger dedicated memory footprint. This is part of the reason that NT Server needs more memory than NT Workstation. By not allowing parts of the SRV.SYS code to be paged out, NT Server is better able to respond quickly to requests.
When you interactively log onto a Windows NT Workstation, the system preloads the Windows NT Virtual DOS Machine (NTVDM). Preloading the NTVDM allows NT Workstation to load 16-bit applications faster but results in a slightly longer logon time. Also, preloading the NTVDM consumes more memory if you will not be running 16-bit code. Because NT Server is not intended to be a regular logon workstation, there is no need to preload the NTVDM. If an interactively logged-on user on an NT Server starts a 16-bit application, NT Server will load the NTVDM and then dispose of it when the application is exited.
NT Server creates more worker threads than NT Workstation. These worker threads provide access to key system resources and ensure that access to these resources is handled in an equitable manner. By using more threads, the core services of Windows NT Server are more responsive to incoming user requests and are better able to distribute the system load across processors in an SMP system. Using a smaller number of system threads in NT Workstation results in a smaller system overhead, leaving more resources for user-based applications.
Windows NT Server allows you to choose whether you want to optimize your server for file and print services, or as an application server. This provides you the option of targeting what services you want to receive the highest priority. Because NT Workstation is not designed to be a high-performance server, it does not allow for this optimization.
