Global Catalog Role in Windows 2000 Multi-Tree Logon

In a multi-tree Microsoft Windows 2000 Active Directory forest, the Global Catalog (GC) server is essential for successfully authenticating and logging on users. It acts as a forest-wide index containing a partial attribute set of every object in the enterprise, enabling the directory to locate accounts across disparate domain trees, resolve enterprise-wide User Principal Names (UPNs), and determine Universal Group memberships. Without access to a Global Catalog, standard user authentication across multiple trees in a native-mode environment cannot complete.

Resolving User Principal Names (UPNs)

In a forest containing multiple domain trees with non-contiguous namespaces (for example, company.com and subsidiary.org), users frequently log on using a User Principal Name (such as user@subsidiary.org) rather than a legacy NetBIOS name (SUBSIDIARY\user).

Because a standard Domain Controller (DC) only maintains the directory database for its own domain, it cannot identify accounts originating from a different tree. When a logon request with an unfamiliar domain suffix reaches a DC, the DC queries the Global Catalog. Because the GC maintains a replica of all objects in the forest, it quickly identifies the user's account, locates the specific tree and domain hosting the account, and routes the authentication request to the correct DC.

Universal Group Membership Enumeration

In Windows 2000 native-mode domains, security tokens require the inclusion of Universal Groups. Unlike Global and Domain Local groups, Universal Group memberships are not replicated to every standard domain controller; they are stored exclusively on Global Catalog servers.

During the logon process:

  1. The authenticating DC contacts a Global Catalog server.
  2. The GC queries the directory to compile a complete list of the user’s Universal Group memberships across all trees in the forest.
  3. The GC returns these Security Identifiers (SIDs) to the authenticating DC.
  4. The DC incorporates these SIDs into the user's access token (or Kerberos ticket).

If a Global Catalog is unavailable during a native-mode logon attempt, the logon fails. Windows 2000 enforces this restriction to prevent a user from accidentally bypassing access restrictions or gaining unauthorized access that might depend on deny permissions assigned to a Universal Group.

Kerberos Referral and Forest Trust Paths

Multiple trees in a Windows 2000 forest are interconnected by two-way, transitive Kerberos trust relationships routed through the forest root domain. When a user in one tree attempts to access resources or authenticate across to another tree, the local Key Distribution Center (KDC) uses the Global Catalog to determine the target domain's location within the forest hierarchy. The GC provides the directory pathing needed for the KDC to issue the appropriate Kerberos referral tickets along the trust path between the trees.