In an overview of Windows 2000's (Win2K's) Active Directory (AD) a few weeks ago, I described objects and containers and explained how users can query AD to locate them. However, For example, to make a shared folder called Budget available to the folks in the finance department, an administrator (or someone else with the proper authority) must share the folder and publish it in the Finance Organizational Unit (OU). You can publish computers, contacts, groups, OUs, printers, users, and shared folders.
What Must You Publish Manually?
AD automatically publishes most objects, including users and computer objects, when you create them. However, you must publish the following objects manually in AD on Windows 2000 Server (Win2K Server):
You can also grant rights to other individuals or groups to publish objects in certain OUs so that they can manage their department resources.
When you install a printer on a Win2K server, you automatically publish the printer in AD, as Screen 1 shows. Let's discuss the procedure for manually publishing objects in AD.
Publishing shared folders. You have to publish all shared folders in some container in Active Directory Users and Computers (ADUC). Typically, you create OUs and publish objects in them instead of in the built-in containers. You don’t want to use built-in containers because you need to organize network resources by grouping them into OUs. The default containers exist so that there’s a place for objects when you upgrade from NT 4.0. You need to move users to the new OUs and then delegate certain individuals or groups to manage these OUs. You can’t delete or rename the built-in containers, so you’re stuck with the names. OUs are also used to apply group policies. If you were to use the Users OU, for example, it contains not only the Guests account, but the Domain Admins group. So if you apply a policy to restrict guests, you’ll lock yourself out as well if you are a domain administrator.
To create a shared folder called Customers in a Sales OU, right-click Sales OU and select Shared Folder. Type Customers in the Name box and enter the path to the folder in the network path box using the format \\server\share. Unfortunately, there's no Browse button to help you locate existing shared folders, so you have to create the folders that you want to share and then publish them in the OU. But a Browse button isn't the only thing missing here: If you make a typographical error, ADUC publish the folder anyway. You can mistype a folder's name, and you won't know that you made an error until users report that they can’t locate the published folder. Unfortunately, Microsoft needs to do some serious work to improve the process of sharing and locating shared folders. Searching shared folders is the most common of all the searches that users conduct in AD, and yet the shared folder search capabilities are the most poorly designed.
Once you have created a shared folder, you can double-click the folder and enter a description and keywords. The keyword feature is really cool. As Screen 2 shows, you can add keywords that users can search on—they no longer need to know server names, locations, or share names. For example, if Chris sends an email message to Sharee to let her know that he has updated the new vendors list, Sharee can search for the keywords New Vendors in the Sales OU, and the results will take her straight to \\corpdata\customers.
Publishing downlevel printers. As I mentioned earlier, AD publishes printers attached to Win2K Server machines automatically. To publish a downlevel printer, right-click the OU you want to publish the printer in and enter the network path to the pre-Win2K print share using the format server\share. You can't add downlevel printers that don't exist (as you can with shared folders).
Publishing Dfs Roots. Publishing a Dfs root is similar to publishing a shared folder. Right-click the OU and select Shared Folder, but enter the name of the Dfs root as the shared folder.
Searching for Objects in AD
Now that we know how to publish objects, let's talk about how to locate them in AD. You can easily locate computers, printers, and users under "Search for other items" by clicking Start, Search, For Files or Folders. However, Microsoft has made searching for shared folders more difficult:
Be aware that if you right-click an OU, you'll limit your search to that OU. To search an entire directory, you might have to select Entire Directory next to In, as Screen 3 shows. As you can see, you can also search for Users, Contacts, and Groups; Computers; Printers; and OUs. The Custom Search option lets you search for several additional categories, such as Trusted Domains and Certificate Templates.
I know of several other methods for searching for shared folders in AD, but the bottom line is that there's no simple way. In some early Win2K builds, you could get to the Find command by right-clicking My Network Places—a convenient way to locate AD objects, including shared folders—but Microsoft has removed that option. To get to the Find option quickly, go to Start, Run and type the case-sensitive command
Rundll32 dsquery,OpenQueryWindow