Global Catalog in Windows 2000 Active Directory

This article explores the specific function of the Global Catalog (GC) within Microsoft Windows 2000 Active Directory searches. It details how the Global Catalog acts as a centralized index for multi-domain forests, how it handles client queries via dedicated network ports, and the mechanism it uses to optimize search performance while conserving network bandwidth.

In a Windows 2000 Active Directory environment, the Global Catalog serves as a distributed data repository that contains a full replica of all directory objects for its host domain, along with a partial, read-only replica of every object in all other domains within the forest. Its primary search function is to enable rapid, forest-wide discovery of resources without requiring queries to be referred across multiple domain controllers in different domains.

Forest-Wide Search Resolution

When a user or application performs a search across the entire Active Directory forest—such as locating a user's email address, a shared printer, or a specific computer—the client directs the query to a Global Catalog server. Without the Global Catalog, a forest-wide search would require the client to contact a domain controller in every single domain in the forest individually, causing significant network traffic and high query latency. The Global Catalog resolves this by consolidating cross-domain search operations into a single point of inquiry.

The Partial Attribute Set (PAS)

To prevent excessive replication traffic and conserve storage, the Global Catalog does not replicate every attribute of every object from other domains. Instead, it replicates the Partial Attribute Set (PAS). The PAS consists of the attributes most commonly used in search queries, such as:

  • Given Name (first name) and Surname (last name)
  • User Principal Name (UPN) and sAMAccountName (logon name)
  • Email addresses
  • Object GUIDs and Security Identifiers (SIDs)

If a user searches for an object using an attribute contained within the PAS, the Global Catalog server fulfills the request immediately. If the query requires attributes not stored in the PAS, the Global Catalog directs the client to a domain controller in the specific domain that holds the full object record. System administrators can customize which attributes are included in the PAS by modifying the Active Directory schema.

Dedicated Query Ports

Active Directory clients differentiate between standard domain searches and forest-wide Global Catalog searches using distinct TCP/IP ports:

  • Port 389: Standard Lightweight Directory Access Protocol (LDAP) port, used to query the local domain partition of a domain controller.
  • Port 3268: Dedicated Global Catalog LDAP port, used to execute forest-wide searches across the Partial Attribute Set.
  • Port 3269: Dedicated LDAP over SSL (LDAPS) port for secure Global Catalog queries.

When an application or client initiates an enterprise-wide search, it explicitly connects to port 3268, signaling the directory service to evaluate the query against the Global Catalog database rather than the local domain database.

Authentication and Universal Group Membership

Beyond manual searches for directory resources, the search function of the Global Catalog is essential for user authentication in Windows 2000 native-mode domains. During logon, the domain controller handling the request must query a Global Catalog server to resolve the user's Universal Group memberships. Because Universal Groups can contain members from any domain in the forest, their memberships are indexed exclusively in the Global Catalog. If a Global Catalog server cannot be reached during an interactive logon in a native-mode domain, the logon process fails (with an exception for members of the local Domain Admins group), underscoring the search engine's role in core operating system functionality.