Providing a Smooth Migration to The Next version of Domains

Migrating from a Windows NT 4.0 environment to the next version of Windows NT domain will be easy because of backward compatibility for existing Windows NT security and account replication protocols. A smooth migration is available because Windows NT has the following interoperability features:

• The next version of the Windows NT domain controller will play the role of a Windows NT 4.0 BDC and receive domain account replication from an existing Windows NT 4.0 PDC.
• Windows NT 4.0 workstations can send network authentication requests using the NTLM authentication protocol to the next version of the Windows NT Domain Controller, thereby acting as a BDC in the Windows NT 4.0 domain.
• The next version of Windows NT Domain Controllers will establish trust relationships with Windows NT 4.0 domains and support pass-through authentication between domains. This means that not all domains in an enterprise are required to upgrade to the next revision oft he Windows NT domain security at the same time.

The next version of the Windows NT Domain Controllers will eventually replace Windows NT 4.0 Domain Controllers in a gradual upgrade of Windows NT 4.0 BDCs to next version of the Windows NT Domain Controllers. Windows NT 4.0 account management tools are used on the Primary Domain Controller as long as the PDC is running Windows NT 4.0. Eventually, all domain controllers can be switched to use the Windows NT Server Distributed Services Technology preview for account management and multimaster account replication.

Windows NT support for multiple authentication protocols means that from a single domain logon at the desktop, users can access Windows NT services anywhere in a mixed domain environment, including:

• A Windows NT server in the logon, or home domain, using Kerberos session tickets issued by the Key Distribution Center (KDC) on the domain controller.
• A Windows NT server in a trusted domain, using a Kerberos referral to the KDC in the trusted domain, to issue a session ticket to the remote server.
• Or, a Windows NT 4.0 server in a trusted domain using NTLM pass-through authentication between the client, the Windows NT 4.0 server, and the trusted domain controller.

Because Windows NT will continue to support NTLM authentication, Windows NT 4.0 clients that do not use Kerberos authentication will also be able to connect to next version of Windows NT servers.

These interoperability features allow flexibility for organizations to plan and implement a migration strategy to the next version of Windows NT servers that fit their business needs.