In Windows 2000, a different system of registration is used for security principles distributed throughout the enterprisethe Active Directory (AD). A decentralized database of objects is used in order to provide much more scalability to accommodate more modern deployment and management scenarios involving hundreds or thousands of security principles potentially distributed throughout a global-scale enterprise.
In order to provide granular administration of the security principals within such a structure, Windows 2000 improves on the NT domain model by adding smaller and larger aggregate groupings. Within each domain are many organizational units (OUs), which may in turn contain other nested organizational units themselves. Domains may be grouped into parent/child relationships creating trees, and multiple trees may be joined via trusts in order to create the enterprise-level collection known as a forest.
The logical structure of the Windows 2000 Active Directory will be discussed in greater detail later in this chapter in the section called "Logical Structure."