Glossary

An entry in an access control list (ACL). Each access control entry defines the protection or auditing to be applied to a file or other object for a specific user or group.

The part of a security descriptor that restricts and audits access to an object. The owner of an object has discretionary access control of the object and can change the object's ACL to allow or disallow other users access to the object. Access control lists are ordered lists of access control entries (ACEs).

See permission.

A permission that controls the way in which an object may be manipulated by a user or member of a group. Different object types support different access rights; these are stored in an object's access control list (ACL).

See user account.

Controls the way passwords must be used by all user accounts of a domain, or of an individual computer. Specifics include minimum password length, how often a user must change his or her password, and how often users can reuse old passwords. Account policy can be set for all user accounts in a domain when administering a domain.

An administrative resource that enables remote administration on servers. A server's ADMIN$ resource must be shared for the server to be administered remotely. See also IPC$.

Alerts relate to server and resource use, warn about problems relating to security and access, user sessions, directory replication, and printing. When a computer generates an administrative alert, a message is sent to a predefined list of users and computers. See also Alerter service.

A resource used when network users and administrators perform certain tasks on the server, including viewing the resources the server is sharing, administering the server remotely, and running shared applications. Administrative resources include ADMIN$ and IPC$. The way in which these resources are shared determines how users can perform tasks.

Responsible for setting up and managing the network; allowed to configure the network. Compare to system operator.

Notifies selected users and computers of administrative alerts that occur on a computer. It is used by the Server and other services. See also administrative alerts.

A set of routines that an application program uses to request and carry out lower-level services performed by the operating system.

Information that indicates whether a file is a read-only, hidden, system, or compressed file, and whether the file has been changed since a backup copy of it was made.

Defines the type of security events that are logged and determines what Advanced Server will do when the security log becomes full.

Tracking activities of users by recording selected types of events in the security log of a server.

Validation of a user's logon information. When a user logs on to an account on an Advanced Server domain, that authentication can be performed by any domain controller in that domain. See also domain controller, trust relationship.

In an Advanced Server domain, a computer running Advanced Server or Windows NT Server that receives a copy of the domain's directory database, which contains all account and security policy information for the domain. The copy is synchronized periodically and automatically with the master copy on the primary domain controller (PDC). BDCs also authenticate user logons and can be promoted to function as PDCs as needed. Multiple BDCs can exist on a domain. See also primary domain controller.

A text file that contains one or more commands. When you type the file name at the command prompt, the commands contained in the file are processed sequentially.

A segment of the directory tree, representing a directory (or folder) and any subdirectories (or folders within folders) it contains.

To view available network resources by looking through lists of folders, files, user accounts, groups, domains, or computers. Browsing allows users on an Advanced Server network to see what domains and computers are accessible from their local computer. See also Computer Browser service.

The default groups provided with Advanced Server. Built-in groups have been granted useful collections of rights and built-in abilities. In most cases, a built-in group provides all the capabilities needed by a particular user. For example, if a domain user account belongs to the built-in Administrators group, logging on with that account gives a user administrative capabilities over the domain and the servers of the domain. To provide a needed set of capabilities to a user account, assign it to the appropriate built-in group. See also group, User Manager for Domains.

A computer that accesses shared network resources provided by another computer (called a server). See also server; workstation.

Advanced Server's command-oriented administrative interface.

Account created when a computer first is added to a domain during network setup at installation. Used to establish secure communications channels.

Maintains an up-to-date list of computers and provides the list to applications when requested. Provides the computer lists displayed in the Network Neighborhood, Select Computer, and Select Domain dialog boxes and in the Server Manager window.

A unique name of up to 15 uppercase characters that identifies a computer to the network. The name cannot be the same as any other computer or domain name in the network.

A user accessing a computer or a resource across the network.

See primary domain controller, backup domain controller.

A code in a user account that specifies the language in which the server sends messages to the user.

The directory that you are currently working in. Also called current folder.

A networking program that runs in the background.

The permissions assigned to a newly-created file or directory if no permissions were specified explicitly when the file or directory was created. Default permissions are derived from the parent directory of the directory or file to which they are assigned.

The printer that is used if you choose the Print command without first specifying which printer you want to use with an application. You can have only one default printer; it should be the printer you use most often.

A service that requires the support of another service.

All the subkeys that appear when a key in the registry is expanded. A descendent key is the same thing as a subkey. See also key, subkey, Registry.

The directory to which you intend to copy or move one or more files.

A program that enables a specific piece of hardware (device) to communicate with the operating system. Although a device may be installed on your system, the operating system cannot recognize the device until you have installed and configured the appropriate driver.

Part of a structure for organizing your files on a disk, a directory (also called a folder) is represented by the folder icon in Windows NT and Windows 95. A directory can contain files and other directories, called subdirectories or folders within folders.

The access that a group or user is granted to a particular file or directory. See also share permissions, special access permissions.

Stores all of the security and user account information for a domain.

The copying of a master set of directories from a server (called an export server) to specified servers or workstations (called import computers) in the same or other domains. Replication simplifies the task of maintaining identical sets of directories and files on multiple computers, because only a single master copy of the data must be maintained. Files are replicated when they are added to an exported directory and every time a change is saved to an exported file. See also Directory Replicator service.

Replicates directories, and the files in those directories, between computers. See also directory replication.

A graphical display of a disk's directory structure. The directories and folders on the disk are shown as a branching structure. The top-level directory is the root directory.

A user account that does not permit logons. The account appears in the user account list of the User Manager for Domains window and can be restored to enabled status at any time. See also user account.

As set by the administrator or resource owner, allows some users to access a resource or perform an action while preventing other users from doing so.

The administrative resource, C$, that represents a server's disk drives. An administrator performing remote administration can use this resource to access all of the files on the server's disk drives. See also ADMIN$, IPC$.

A shared disk device. Advanced Server can share a directory tree or a single directory as a disk resource.

For Advanced Server, a collection of computers defined by the administrator of an Advanced Server network that share a common directory database and security policy. A domain provides access to the centralized user accounts and group accounts maintained by the domain administrator. Each domain has a unique name. See also workgroup.

In an Advanced Server domain, refers to a computer running Advanced Server or Windows NT Server that manages all aspects of user-domain interactions, and uses information in the directory database to authenticate users logging on to domain accounts. One shared directory database is used to store security and user account information for the entire domain. A domain has one primary domain controller (PDC) and one or more backup domain controllers (BDCs). See also primary domain controller, backup domain controller.

The name by which a domain is known to the network.

See synchronize.

A term that refers to earlier operating systems such as Windows for Workgroups or LAN Manager, that can interoperate with the Advanced Server for UNIX Systems.

Fonts that you send to your printer either before or during the printing of your documents. When you send a font to your printer, it is stored in printer memory until it is needed for printing.

A form of interprocess communications (IPC) in which two or more programs that support dynamic data exchange can exchange information and commands.

A file that prints at the highest possible resolution for your printer. An EPS file may print faster than other graphical representations.

Any significant occurrence in the system or in an application that requires users to be notified, or an entry to be added to a log.

Records events in the system, security, and application logs. EventLog service is located in Event Viewer.

In directory replication, a path from which subdirectories, and the files in those subdirectories, are automatically exported from an export server. See also directory replication.

In directory replication, a server from which a master set of directories is exported to specified servers or workstations (called import computers) in the same or other domains. See also directory replication.

Indicates the type of file or directory or the type of application associated with a file. In MS-DOS, this includes a period and up to three characters at the end of a file name. Advanced Server and Windows NT support long file names up to 255 characters.

A table or list maintained by some operating systems to keep track of the status of various segments of disk space used for file storage. Also referred to as the FAT file system.

The ability of an Advanced Server computer to share parts (or all) of its local file system(s) with remote computers. An administrator creates share points by using either Server Manager or the net share command from the command prompt.

A grouping of files or other folders, graphically represented by a folder icon, in Windows NT. A folder is analogous to a file system directory, and many folders are, in fact, directories. A folder may contain other folders as well as file objects. See also directory.

A user's complete name, usually consisting of the last name, first name, and middle initial. The full name is information that can be maintained by User Manager for Domains as part of the information identifying and defining a user account. See also user account.

A normal user account in a domain. Most user accounts are global accounts. If there are multiple domains in the network, it is best if each user in the network has a global account in only one domain, and each user's access to other domains is accomplished through the establishment of domain trust relationships. See also local account.

group that can be used in its own domain, servers and workstations of the domain, and trusting domains. In all of these instances, global groups can be granted rights and permissions and can become a members of local groups. However, they can contain only user accounts from their own domains. Global groups provide a handy way to create sets of users from inside the domain that are available for use both in and out of the domain. See also group, local group.

In User Manager for Domains, an account containing other accounts that are called members. The permissions and rights granted to a group are also provided to its members, making groups a convenient way to grant common capabilities to collections of user accounts. In the Advanced Server, groups are managed with User Manager for Domains. See also built-in groups, global group, local group, user account.

The groups to which a user account belongs. Permissions and rights granted to a group are also provided to its members. In most cases, the actions a user can perform are determined by the group memberships of the user account that the user logged on with. See also group.

A unique name identifying a local or global group to the Advanced Server. A group's name cannot be identical to any other group name or user name of its own domain or workstation. See also global group, local group.

An account on a server that allows a user without an individual user account to access the server's resources.

A server that is part of a domain but does not appear in the list of servers.

A directory that is assigned to a user and contains files and programs for that user. A home directory can be assigned to an individual user or can be shared by many users.

Any device that is attached to the network and uses TCP/IP.

High-performance file system (HPFS); primarily used with the OS/2 operating system version 1.2 or later.

In directory replication, the servers or workstations that receive copies of the master set of directories from an export server. See also directory replication.

In directory replication, the path to which imported subdirectories, and the files in those subdirectories, are stored on an import computer. See also directory replication.

The messenger protocol of TCP/IP, responsible for addressing and sending TCP packets over the network. IP provides a best-effort, connection-less delivery system that does not guarantee that packets arrive at their destination or that they are received in the sequence in which they were sent. See also Transmission Control Protocol.

Communication among the component processes of a program, between different computers running parts of a single program, or between two programs working together.

Hardware lines over which devices can send signals to get the attention of the processor when the device is ready to accept or send information. Typically, each device connected to the computer uses a separate IRQ.

Used to identify a node on a network and to specify routing information. Each node on the network must be assigned a unique IP address, which is made up of the network ID, plus a unique host ID assigned by the network administrator. This address is typically represented in dotted-decimal notation, with the decimal value of each octet separated by a period (for example, 138.57.7.27).

An administrative resource that controls how interprocess communications operate on servers. A server's IPC$ resource must be shared before the resources shared by the server can be viewed on the network. See also ADMIN$, named pipe.

A folder that appears in the left pane of a Registry Editor window. A key can contain subkeys and value entries. For example: System is a key of HKEY_LOCAL_MACHINE. See also subkey.

Advanced Server initialization file.

A UNIX system daemon that monitors the network, receiving and accepting incoming connection requests, and then invokes the service that is requested.

The master control process for Advanced Server. Under normal circumstances, this process should not be modified.

Advanced Server processes that control individual client sessions. These are managed by lmx.ctrl.

A user account provided in a domain for a user whose global account is not in a trusted domain. Not required where trust relationships exist between domains. See also global account, user account.

A group that can be granted permissions and rights only for the servers of its own domain. However, it can contain user accounts and global groups both from its own domain and from trusted domains. Local groups provide a way to create handy sets of users from both inside and outside the domain, to be used only at servers of the domain. See also global group, group.

A printer that is directly connected to one of the ports on your computer.

The days and hours during which a user account can connect to a server. When a user is connected to a server and the logon hours are exceeded, the user either is disconnected from all server connections or is allowed to remain connected but denied any new connections.

Files that can be assigned to user accounts. Typically a batch file, a logon script runs automatically every time the user logs on. It can be used to configure a user's working environment at every logon, and it allows an administrator to affect a user's environment without managing all aspects of it. A logon script can be assigned to one or more user accounts. See also batch program.

When a user logs on, the computer authenticating the logon locates the specified logon script (if one has been assigned to that user account) by following that computer's local logon script path. See also logon script.

The workstations from which a user is allowed to log on.

The period of time a password can be used before the system requires the user to change it. See also Account policy.

Sends and receives messages sent by administrators or by the Alerter service. See also Alerter service.

The period of time a password must be used before the user can change it. See also Account policy.

An interprocess communication mechanism that allows one process to communicate with another local or remote process.

Performs authentication of domain logons, and keeps the domain's directory database synchronized between the domain controller and the other Advanced Servers of the domain.

See shared directory.

A service for distributed computing systems that provides a distributed file system, eliminating the need for keeping multiple copies of files on separate computers.

The portion of an IP address that identifies a group of computers and devices located on the same logical network.

The computer name of a server followed by the share name of a shared resource and, optionally, a relative path. See also UNC.

Windows NT file system, an advanced file system designed for use specifically within the Windows NT operating system. It supports file system recovery, extremely large storage media, long file names, and various features for the POSIX subsystem. It also supports object-oriented applications by treating all files as objects with user-defined and system-defined attributes.

Any piece of information, created by using a Windows-based application with object linking and embedding capabilities, that can be linked or embedded into another document.

A user or group assigned to a file or other resource. The owner of a resource can control access to it.

A unique string of characters that must be provided before a logon or an access is authorized. A password is a security measure used to restrict logons to user accounts and access to computer systems and resources. A password for a user account can be up to 14 characters, and is case-sensitive. See also Account policy.

The number of new passwords that must be used by a user account before an old password can be reused. See also Account policy.

A sequence of directory (or folder) names that specifies the location of a directory, file, or folder within the directory tree. Each directory name and file name within the path (except the first) must be preceded by a backslash (\). For example, to specify the path of a file named Readme.Wri on the Winnt\system32 directory on drive C, you would type c:\winnt\system32\readme.wri.

A rule associated with an object (usually a directory, file, or printer) to regulate which users can have access to the object and in what manner. See also right.

In an Advanced Server domain, the computer running Advanced Server or Windows NT Server that authenticates domain logons and maintains the master copy of the directory database for a domain. A domain has only one PDC.

The hardware that produces printed output.

A program that is invoked instead of sending a file to a printer.

A queue that stores print jobs and sends them in turn to a printer or pool of printers. See also shared printer queue.

In Windows NT terminology, the software interface between the operating system and the print device. Equivalent to shared printer queue in Advanced Server.

A program that converts graphics commands into specific printer languages.

Fonts that are built into your printer. These fonts are usually located in the printer's read-only memory (ROM).

Shows information for one of the printers that you have installed or to which you are connected. For each printer, you can see what documents are waiting to be printed, who owns them, how large they are, and other information.

Composed of two or more identical print devices associated with one shared printer queue.

A file that starts an application or program. A program file has an .exe, .pif, .com, or .bat filename extension.

A collection of applications. Grouping your applications makes them easier to find when you want to start them.

A computer that listens to name query broadcasts and responds for those names not on the local subnet. The proxy communicates with the name server to resolve names and then caches them for a time period.

A WINS server that pulls in replicas from its push partner by requesting them and then accepting the pushed replicas.

A WINS server that sends replicas to its pull partner upon receiving a request from it.

To update displayed information with current data.

The Advanced Server Registry is a database repository for information about a computer's configuration. It is organized in a hierarchical structure and is composed of subtrees and their keys and value entries.

Administration of one computer by an administrator located at another computer and connected to the first computer across the network.

A message-passing facility that allows a distributed application to call services available on various computers in a network. Used during remote administration of computers.

See directory replication.

Any part of a computer system or a network, such as a disk drive, printer, or memory, that can be allotted to a program or a process while it is running, or shared over a local area network.

Authorizes a user to perform certain actions on the system. Rights apply to the system as a whole, and are different from permissions, which apply to specific objects. See also permission.

The Remote Procedure Call service is the RPC subsystem for Advanced Server. It includes the endpoint mapper and other related services.

Security Accounts Manager. Advanced Server protected subsystem that maintains the directory database and provides an application programming interface (API) for accessing the database.

Fonts displayed on your screen. Soft-font manufacturers often provide screen fonts that closely match the soft fonts for your printer. This ensures that your documents look the same on the screen as they do when printed.

A unique value that identifies a logged-on user to the security system. Security IDs (SIDs) can identify one user or a group of users.

Records security events. This helps track changes to the security system and identify any possible breaches to security. For example, depending on the Audit settings in User Manager for Domains, attempts to log on to the system may be recorded in the security log. See also event.

For an Advanced Server domain, the security policies consist of the Account, User Rights, Audit, and Trust Relationships policies, and are managed with User Manager for Domains.

One or more cover sheets generated before a print job; also called a banner page.

A computer that provides shared resources to network users. See also client.

An application used to view and administer domains, workgroups, and computers.

Provides RPC (remote procedure call) support, and file, print, and named pipe sharing. See also RPC service.

A process that performs a specific system function and often provides an application programming interface (API) for other processes to call. Advanced Server services are RPC-enabled, meaning that they use Remote Procedure Calls to communicate.

A link between a client and a server. A session consists of one or more connections to shared resources on a server computer from a client computer.

To make resources available to network users.

The name of a shared resource.

Specify the maximum access that may be granted to a user or group on any file or directory residing on a share. See also directory access permissions, special access permissions.

A directory to which network users can connect.

See shared directory.

In Advanced Server, the mechanism through which a collection of print devices is accessed by networked users with the appropriate permissions. Equivalent to a "printer" in Windows NT terminology. See also print queue.

Any device, data, or program that is used by more than one other device or program. For Advanced Server, shared resources refer to any resources that are made available to network users, such as directories, files, printers, and named pipes.

See security ID.

The directory that contains the file or files you intend to copy or move.

A combination of individual permissions that can be set on files and directories. See also directory access permissions, share permissions.

A directory within a directory. Also called a folder within a folder.

A Registry key within a Registry key. Appears as a folder within a folder in the left pane of a Registry Editor window.

To replicate the domain database from the primary domain controller (PDC) to one backup domain controller (BDC) of a domain, or to all the BDCs of a domain. This usually is performed automatically by the system, but can also be invoked manually by an administrator.

The order in which you must type a command and the elements that follow the command. Advanced Server commands have up to four elements: command name, parameters, switches, and values.

Users with the authority to perform a limited number of administrative tasks. Operators have more authority on the network than regular users but less authority than full administrators. Compare to administrator.

A file containing only letters, numbers, and symbols. A text file contains no formatting information, except possibly tabs, linefeeds and carriage returns. A text file is an ASCII file.

A service that identifies a server as the time source for a domain. Other computers synchronize their system clocks with the time server.

If a device is not performing a task, the amount of time the computer should wait before detecting it as an error.

A connection-based Internet protocol responsible for breaking data into packets, which the IP protocol sends over the network. This protocol provides a reliable, sequenced communication stream for network communication.

A set of networking protocols that provide communications across interconnected networks made up of computers with diverse hardware architectures and various operating systems. TCP/IP includes standards for how computers communicate and conventions for connecting networks and routing traffic.

Device-independent fonts that can be reproduced on all print devices. TrueType fonts are stored as outlines and can be scaled and rotated.

Trust relationships are links between domains that enable pass-through authentication, in which a trusting domain honors the logon authentications of a trusted domain. With trust relationships, a user who has only one user account in one domain can potentially access the entire network. User accounts and global groups defined in a trusted domain can be given rights and resource permissions in a trusting domain, even though those accounts do not exist in the trusting domain's directory database.

Security policy that defines which domains are trusted and which domains are trusting.

A name given to a device, computer, or resource to enable other users and applications to establish explicit connections and access the resources over the network. The following is an example of a UNC: \\servername\sharename where servername is the name of a server to which a connection is being made, and sharename is the name of a shared directory to be accessed on that server.

Uninterruptable power supply; a battery-operated power supply connected to a computer to keep the system running during a power failure.

Manages an Uninterruptable power supply connected to a computer. See also UPS.

Consists of all the information that defines a user to the Advanced Server. This includes items such as the user name and password required for the user to log on, the groups in which the user account has membership, and the rights and permissions the user has for using the system and accessing its resources. For the Advanced Server, user accounts are managed with User Manager for Domains. See also group.

See directory database.

The user profile that is loaded by a server when a user's assigned profile cannot be accessed, such as when a user without an assigned profile logs on to a computer for the first time, or when a user logs on to the guest account.

An application that is used to manage security for domains and administer user accounts, groups, and security policies.

An application that is used to manage security for domains, and administer user accounts, groups, and security policies. A unique name identifying a user account to the Advanced Server. An account's user name cannot be identical to any other group name or user name of its own domain or workstation. See also user account.

In Windows NT, configuration information can be retained on a user-by-user basis and saved in user profiles. This information includes all the per-user settings of the Windows NT environment, such as the desktop arrangement, personal program groups and the program items in those groups, screen colors, screen savers, network connections, printer connections, mouse settings, window size and position, and more. When a user logs on, the user's profile is loaded and the user's Windows NT environment is configured according to that profile.

See right.

Manages the assignment of rights to groups and user accounts.

The string of data that appears in the right pane of a Registry Editor window and which defines a value of the currently selected key. A value entry has three parts: name, data type, and the value itself.

In a PostScript printer, a part of memory that stores font information. The memory in PostScript printers is divided into banded memory and virtual memory. The banded memory contains graphics and page-layout information needed to print your documents. The virtual memory contains any font information that is sent to your printer either when you print a document or when you download fonts.

A partition or collection of partitions that have been formatted for use by a file system.

A name resolution service that resolves Windows networking computer names to IP addresses in a routed environment. A WINS server handles name registrations, queries, and releases. See also IP address.

A collection of computers that are grouped for viewing purposes. Each workgroup is identified by a unique name. See also domain.

Any networked PC using server resources. See also client, primary domain controller, backup domain controller, server.