active directory and pdc

With NT, the PDC has the only read/write copy of the SAM database. Clients in an NT network prefer very strongly to authenticate to that PDC, even if it means crossing a WAN. The PDC distributes changes to the BDCs. W2K allows updates to all Domain Controllers. The updates are passed to the other domain controllers based on site rules. The updates are have time stamps which makes time management very important in W2K.

W2K has a PDC Emulator service to satisfy down level clients. If EVERYTHING that will EVER authenticate to your network is W2K or later, you don't need that service.

There are FSMO roles that are assigned to individual servers, but that will be a later question.

In Windows NT, the SAM (Security DB) is present on all Domain Controllers(DC's). However, the only writable SAM is on the PDC. BDC's just authenticate clients. Think of it like this, the PDC pushes any changes in the SAM to the BDC's.
In Windows 2000, the security has moved to Active Directory (AD), there is no more SAM per say. Any DC in Win2K can update the AD. The changes are assigned an ID and are replicated to all DC's. There is no Primary DC. If not running in Native Mode, then there is a PDC emulator in Windows 2000. This service will push updates to older NT 4.0 BDC's until you've upgraded them.

Jordan

The difference of Windows 2000 AD and NT PDC is as follows:
1. No such thing as a PDC in AD, since every DC has a writable copy of the SAM
2. AD is a service activated/deactivated on any 2000 server, no need to reinstall in order to demote a DC.
3. Yes AD supports BDC's, however they are not called BDC's they are called DC's, since in AD every DC is a PDC (not really, since there is such a thing as FSMO roles/opration master/global catalog, but for the sake of this answer there is no such thing as a PDC).
What is nice about this is if you ever have to rebuild a server that acts as a DC for whatever reason (you just bought a new one or whatever), you just run dcpromo on that server which tells all the other DC's that this server is not a DC anymore. They you do whatever you want with that server, when it's up and running again you can run dcpromo again and add it as a DC to your AD. If you have to do the above and this is the only DC, you can just go to any other windwos 2K server run dcpromo, run dcpromo on the original server, rebuild your computer and you still have your domain.

This question was auto closed due to inactivity