Directory, Configuring

MCTS 70-640 Cert

Guide:

Windows Server

2008

Active

Directory,

Configuring

Don Poulton

Pearson

800

East

96th Street

iv MCTS 70-640 CertGuide: WindowsServer2008 Active

_{Directory, Configuring}

Table

of Contents

Introduction 3

Goals and Methods 3

How ThisBook Is

_Organized

4

Study

andExam

_{Preparation Tips}

7

Learning Styles

7

StudyTips

8

Study Strategies

9

Pretesting

Yourself

10 Exam

_Prep

_Tips

10

Microsoft 70-640 Exam

_Topics

12

Chapter

1

_Getting

Started with Active

_Directory

17

The FoundationofActive

_Directory

17 X.S00 17

LDAP 18

Naming

Standards of X.500andLDAP 19

Distinguish

ed Names 19 Relative

_{Distinguished}

Names 20

User

_Principal

Names 21

Globally Unique Identifiers

21

Security Identifiers

21

Active

_Directory

Canonical Names 22

The

_Building

Blocks ofActive

Directory

22

Namespaces

22

Objects

23 Containers 24 Schemas 24 Global

_Catalogs

24 Partitions 25

V

Global

_Catalog

Servers 31

Operations

Masters 32

New Features of Active

_Directory

in Windows Server 2008 33

Server

_Manager

35

Adding

Roles and Features 36

Command-Line Server

_Management

36 Windows Server2008R2 37

Summary

40

Chapter

2

_Installing

and

_Configuring

DNSfor Active Directory 43 "Do I KnowThis

_Already?"

Quiz

43

The HierarchicalNatureofDNS 48

Installing

DNS onWindowsServer2008 R2 49

Configuring

DNS Zones 51

DNSZone

_Types

52

Primary

Zones S3

Secondary

Zones 53 Stub Zones S3

Active

_{Directory-Integrated}

Zones 53 GkbalNames Zones 54

DNS Name Server Roles 55

Primary

Name Server 55

Secondary

NameServer 55

Caching-Only

Server 56

Forwarders 56

Creating

DNS Zones 57 Forward

_Lookup

Zones 57 Reverse

_Lookup

Zones 59

DNS Resource Records 61

Configuring

DNS Zone

_Properties

62

Configuring

Zone

_Types

63

Adding

Authoritative DNS ServerstoaZone 63

Dynamic, Nondynamic,

and Secure

_Dynamic

DNS 64

Zone

_Scavenging

65 TimetoLive 66

Integrating

DNS withWINS 68

MCTS 70-640 Cert Guide: WindowsServer2008Active

Directory, Configuring

Complete

the Tables and Lists from

_Memory

71 Definitions of

_Key

Terms 71

Chapter

3

_Installing

Active

Directory

Domain Services 73 "Do I KnowThis

_Already?"

Quiz

73

Planning

the Active

_Directory

_Namespace

77

Subdividing

the Active

_{Directory Namespace}

77

Administrativeor

Geographical

Organization

ofDomains 78

Use

_ofMultiple

Trees 79 Best Practices 80

Creating

Forests and Domains 81

Requirements

for

_Installing

Active

_Directory

Domain Services

Installing

Active

_Directory

Domain Services 82

New Forests 83

New Domains in

_Existing

Forests 88

Existing

Domains 89

Performing

Unattended Installations of Active

_Directory

90 Server Core DomainControllers 92

Removing

Active

_Directory

92

Interoperability

with Previous Versions of Active

_Directory

93 Forest and Domain Functional Levels 94

Upgrading

Domain and Forest Functional Levels 95 The_Adprep

_Utility

96

Running

the Adprep IfarestprepCommand 96

Running

the Adprep Idomainprep Command 97

Upgrading

aWindowsServer 2003 DomainController 97

AdditionalForest and Domain

_{Configuration}

Tasks 98

Verifying

the

_Proper

Installationof Active

_Directory

98

Active

_{Directory Migration}

Toolv.3.1 100

AlternativeUser

_Principal

Name Suffixes 101 ReviewAll the

_{Key Topics}

103

Complete

the Tables and Lists from

_Memory

103 Definitions of

_Key

Terms 104

Chapter

4

_Configuring

DNS Server

_Settings

and

_Replication

107 "Do I Know This

_Already?"

_Quiz

107

Configuring

DNS Server

_Settings

112

Forwarding

112

vii Root Hints 116

Configuring

Zone

_Delegation

117 D

_{ebug Logging}

119

Event

_Logging

121

DNS

_Security

Extensions 121

AdvancedServer

_Options

123

Server

_Options

123

Round Robin 124 Disable Recursion 125 Name

_Checking

125

Loading

Zone Data 126 Server

_Scavenging

126

Monitoring

DNS 127

Configuring

Zone Transfers and

_Replication

128

Replication Scope

128

Types

of Zone Transfers 130 Full Zone

_Transfer

130 lncre?nental Zone

_Transfer

131

Configuring

Zone

_Transfers

132

Configuring

DNS

_Notify

133

SecureZone Transfers 134

Configuring

Name Servers 136

Application Directory

Partitions 138

Installing

and

_{Configuring Application Directory}

Partitions 138

CreatingApplication Directory

Partition

_Replicas

139

Application Directory

Partition

_Reference

Domains 139 Review All the

_{Key Topics}

140

Complete

the Tables and Lists from

_Memory

140 Definitions of

_Key

Terms 140

Chapter5 Global

_Catalogs

and

_Operations

Masters 143 "Do IKnowThis

_Already?"

_Quiz

143

Configuring

Global

_Catalog

Servers 148

Planning

the PlacementofGlobal

_Catalog

Servers 148

Promoting

Domain ControllerstoGlobal

Catalog

Servers 150

Using

Universal

_Group

_{Membership Caching}

151

MOTS70-640 Cert Guide: Windows Server 2008 ActiveDirectory, Configuring

Configuring Operations

Masters 153 Schema Master 153

Configuring

theSchema 154

Extending

theSchema 155

Deactivating

Schema

_Objects

159

Domain

_Naming

Master 160 PDC Emulator 160

TimeService 161

Infrastructure Master 162 RID Master 162

Placement of

_Operations

Masters 163

Transferring

and

_Seizing

of

_Operations

Master Roles 164

Transferring Operations

Master Roles 165

Seizing Operations

Masters Roles 167 Review All the

_Key

_Topics

169

Complete

theTables and Listsfrom

_Memory

169

Definitionsof

_Key

Terms 170

Chapter

6

_Configuring

Active

_Directory

Sites and

_Replication

173 "DoIKnow This

_Already?"

Quiz 173

The Needfor Active

_Directory

Sites 178

Configuring

Sites and Subnets 179

Creating

Sites 180

Adding

D omain Controllers 181

Creating

and

_Using

Subnets 182

Site

_Links,

Site Link

_Bridges,

and

_Bridgehead

Servers 184 The Need for SiteLinks andSiteLink

_Bridges

184

Configuring

SiteLinks 185

SiteLink

_Bridges

185

SiteLinkCosts 186 Sites Infrastructure 189

Knowledge Consistency

Checker 189 Intersite

_Topology

Generator 189

Configuring

Active

_Directory

_Replication

189

Concepts

of Active

_{Directory Replication}

190 Intersite and Intrasite

_Replication

191

Distributed File

_System

192

ix

Bridgehead

Servers 193

Replication

Protocols 194

PortsUsed

_for

Intersite

_Replication

195

Replication Scheduling

196 Intersite

_{Replication Scheduling}

196 Intrasite

_Replication

_Scheduling

198

Forcing

Intersite

_Replication

200 Review All the

_Key

_Topics

201

Complete

theTablesand Lists from

_Memory

202 Definitions of

_Key

Terms 202

Chapter

7 AdditionalActive

_Directory

Roles 205 "Do IKnow This

_Already?"

Quiz 205

New Server Rolesand Features 210

Active

_Directory

_Lightweight

_Directory

Services 211

Installing

AD LDS 213

Installing

the AD LDS Role 213

Installing

AD LDSInstances 214

Configuring

Data WithinADLDS 217

Using

the ADSIEdit

_Snap-in

217

UsingLdp.exe

218

Using

the Active

_Directory

Schema

_Snap-in

220

Using

theActive

_Directory

Sites and Services

_Snap-in

221

Migrating

to ADLDS 221

Configuring

anAuthentication Server ₂₂₂

Creating

ADLDS User Accountsand

_Groups

222

Binding

toanADLDS Instance -withanADLDS User 224

Using

ADLDSonServer Core 224

Active

_{Directory Rights}

_Management

_{Services 225}

Installing

AD RMS 226

Certificate

_Request

andInstallation 228

Self-Enrollments 230

Delegation

230

Active

_{Directory Metadirectory}

Services 231

Active

_Directory

FederationServices 231

Installing

the AD FS Server Role 2 3 3

x MOTS 70-640 CertGuide: Windows Server 2008 ActiveDirectory,

Configuring

Configuring

FederationTrusts 238

Creating

Claims 239

Creating

AccountStores 240

Enabling

Applications

241

Creating

FederationTrusts 242

Windows Server 2008 R2 Virtualization 244 Review M the

_{Key Topics}

247

Complete

theTablesand Lists from

_Memory

247

Definitions of

_Key

Terms 248

Chapter

8

_Read-Only

Domain Controllers 251 "Do I KnowThis

_Already?"

Quiz

251

Installing

a

Read-Only

DomainController 254

Planning

theUse of RODCs 254

Installing

RODCs 256

Prestaging

anRODC 257

Managing

a

Read-Only

DomainController 259 Unidirectional

_Replication

260

Administrator Role

_Separation

261

Read-Only

DNS 262

BitLocker 263

Preparing

Your

_Computer

to Use BitLocker 265

Enabling

BitLocker 265

Managing

BitLocker 269

Replication

of Passwords 270

Planning

aPassword

Replication

Policy

271

Configuring

aPassword

Replication

Policy

2 72

Credential

_Caching

213

Administering

theRODCs Authentication Lists 275 syskey 276

Review ail the

_Key

_Topics

278

Definitions of

_Key

Terms 278

Chapter

9 Active

_Directory

User and

_Group

Accounts 281 "DoIKnow This

_Already?"

_Quiz

281

Creating

User and

_Group

Accounts 286

Introducing

UserAccounts 2 86

Introducing

Group

Accounts 287

xi

Useof

_Template

Accounts 290

Using

Bulk

_Import

toAutomateAccount Creation 291

Csvde 292

Ldifde 293 Dsadd 294

AdditionalCommand-LineTook 295

Scripts

296

Configuring

the UPN 296 UPN

_Suffixes

296

.

Adding

or

Removing

UPN

_Suffixes

291

Configuring

Contacts 298

Creating

Distribution Lists 299

Managing

and

_Maintaining

Accounts 300

Creating

Organizational

Units 301

Configuring Group

Membership

304 AGDLP/AGUDLP 306

Account Resets 308

Deny

Domain Local

_Group

308 ProtectedAdmin 309

Local Versus Domain

_Groups

310

Deprovisioning

Accounts 312

Delegating

Administrative Control ofActive

_{Directory Objects}

313

ReviewAllthe

_{Key Topics}

317

Complete

the Tablesand Lists from

_Memory

318

Definitionsof

_Key

Terms 318

Chapter

10 Trust

_{Relationships}

in Active

_Directory

321 "Do I Know This

_{Already? "Quiz}

321

Types

of Trust

_{Relationships}

325 Transitive Trusts 325 Forest Trusts 326

ExternalTrustsand Realm Trusts 326 ShortcutTrusts 327

Creating

and

_Configuring

Trust

_{Relationships}

328

Creating

aForestTrust

Relationship

329

Creating

External Trust

_{Relationships}

335

Creating

Realm Trust

_{Relationships}

336

xii MCTS 70-640 Cert Guide: Windows Server 2008 ActiveDirectory,

Configuring

Managing

Trust

_{Relationships}

338

Validating

Trust

_{Relationships}

338

Authentication

_Scope

338 SID

_Filtering

340

Removing

aCross-forest Trust

Relationship

341

Review All the

_{Key Topics}

343

Complete

the Tables and Lists from

_Memory

343 Definitions of

_Key

Terms 343

Chapter

11

_Creating

and

_{Applying Group Policy Objects}

345 "Do I Know This

_Already?"

_Quiz

345

Overview of

_{Group Policy}

351

Components

of

_{Group Policy}

351

Group

Policy

Containers 352

Group Policy

Templates

352

New Features of

_{Group Policy}

in Windows Server 2008 and Windows Server 2008 R2 354

Creating

and

_Applying

GPOs 355

Managing

GPOs 359

Linking

GPOs 360

Managing

GPO Links 361

Deleting

a GPO 362

Delegating

Control

_of

GPOs 362

Specifying

aDomain Controller 365

Configuring

GPO

_Hierarchy

and

_{Processing Priority}

365

OVHierarchy

361

Enforced

367 Block Inheritance 369

Modifying

the

_{Sequence of}

GPO

_Application

3 70

Disabling

User

_Objects

370

Group

Policy Filtering

371

Security

Filtering of

GPOs 371

Windows

_Management

Instrumentation 3 74 Windows PvmerShell 374

Configuring

GPO

_Templates

376

Group

Policy Loopback

Processing

377

User

_Rights

378

ADMX Central Store 379

xiii Restricted

_Groups

3 84

Starter GPOs 385

ShellAccess Policies 387 Review All the

_Key

_Topics

38 9

Complete

the Tables and Lists from

_Memory

389 Definitions of

_Key

Terms 390

Chapter

12

_{Group Policy}

Software

_Deployment

393

"DoIKnowThis

_Already?"

Quiz

393

Types

of Software

_Deployment

398

Assigning

and

_Publishing

Software 399

Assigning

Software

toUsers 399

Assigning Software

to

_Computers

399

Publishing Software

to Users 399

Deploying

Software

_{Using Group Policy}

400 ZAP Files 402

SoftwareInstallation

_Properties

403 Software

_{Package Properties}

405

Upgrading

Software 407

Use of Transform Filesto

Modify

Software

_Packages

409

Redeployment

of

_Upgraded

Software 411

Removal of Software 413 Review All the

_{Key Topics}

414

Complete

the Tables and Listsfrom

_Memory

414

Definitions of

_Key

Terms 414

Chapter

13 AccountPolicies andAudit Policies 417 "Do I Know This

_Already?"

Quiz 417

Useof

_{Group Policy}

to

Configure Security

422

Configuring

Account Policies 422

Domain Password Policies 423 Account Lockout 426

Unlocking

anAccount 427

Kerberos

_Policy

428

Fine-Grained PasswordPolicies 428 Password

_Settings

Precedence 429

Configuring

Fine-GrainedPassword Policies 430

Managing

Fine-Grained Password Policies 43 J

MCTS 70-640 Cert Guide:Windows Server 2008 Active

Directory, Configuring

Security Options

436

Using

Additional

_{Security Configuration}

Tools 439

Auditing

of Active

_Directory

Services 441

New Features of Active

_{Directory Auditing}

441

Using

GPOsto

_{Configure Auditing}

442

Available

_Auditing

_Categories

442

Configuring

Basic

_Auditing

Policies 443

Configuring

Advanced AuditPolicies 446

Using

Auditpol.exe to

_{Configure Auditing}

447 ReviewAllthe

_{Key Topics}

449

Complete

the Tablesand Lists from

_Memory

450 Definitions of

_Key

Terms 450

Chapter

14

_Monitoring

Active

_Directory

453 "Do I Know This

_{Already?" Quiz}

453 Tools UsedtoMonitor Active

_Directory

459

NetworkMonitor 459

Task

_Manager

463

Configuring

Application Priority

465 EventViewer 466

Customizing

Event Viewer 468

Customizing

Event Viewer Detail 470

Reliability

and Performance Monitor 471 Resource Monitor 473

Reliability

Monitor 473

Performance

Monitor 476 DataCollector Sets 479

Windows

_System

Resource

_Manager

484

Server Performance Advisor 486

XV

showconn 493

replsummary 494

dcdiag 494

Troubleshooting

the

_Application

of

_{Group Policy Objects}

496

Resultant Set of

_Policy

496

Planning Mode/Group Policy

Modeling

497

Logging

Mode/Group

Policy

Results 501

Using

the

_Delegation

_of

Control Wizard 509 Gpresult 509

Review All the

_{Key Topics}

512

Complete

the Tables and Lists from

_Memory

513

Definitions of

_Key

Terms 513

Chapter

15

_Maintaining

Active

_Directory

515 "DoI KnowThis

_Already?"

Quiz 515

Backing

Up

and

_Recovering

Active

_Directory

520

Backup

Permissions 521

Use of Windows Server

_Backup

521

Installing

Windows Server

_Backup

521

Backing Up

Critical Volumes

_of

aDomain Controller 522

Thewbadmin Command 525

Scheduling

a

Backup

526

Using

Removable Media 527

Recovering

Active

_Directory

528

Directory

Services Restore Mode 528

Performing

aNonauthoritativeRestore 529

Using

thewbadmin CommandtoRecover Your Server 534

Performing

anAuthoritative Restore 536

Recovering

Back-Links

_{ofAuthoritatively}

Restored

_Objects

537

Performing

aFullServer

Recovery of

aDomain Controller 538

Linked-Value

_Replication

and Authoritative Restore

_{of Group Memberships}

539

The Active

_{Directory Recycle}

Bin 540

Enabling

theActive

_Directory

_Recycle

Bin 541

Using

the Active

_Directory

_Recycle

BintoRestore Deleted

Objects

543

Backing Up

and

_Restoring

GPOs 545

Backing

Up

GPOs 545

Restoring

GPOs 545

Importing

GPOs 547

MOTS 70-640 Cert Guide: Windows Server 2008 Active Directory,

Configuring

Offline Maintenance of Active

_Directory

549

RestartableActive

_Directory

549

Offline

_{Defragmentation}

and

_Compaction

550

Online

_{Defragmentation}

551

Offline Defragmentation

551

Active

_Directory

Database

_Storage

Allocation 553 Review All the

_{Key Topics}

555

Complete

the Tables and Lists from

_Memory

556 Definitions of

_Key

Terms 556

Chapter

16

_Installing

and

_Configuring

CertificateServices 559 "Do I Know This

_Already?"

_Quiz

559

What's New with CertificateServices inWindowsServer 2008?

NewFeatures of Active

_Directory

Certificate Services in Windows Server 2008 R2 564

Installing

Active

_Directory

Certificate Services 565

Configuring

Certificate

_{Authority Types}

and Hierarchies 565

Installing

Root CAs 567

Installing

Subordinate CAs 571

Understanding

Certificate

_Requests

571

Using

Certificate PracticeStatements 572

Configuring

Certificate

_Authority

Server

_Settings

573

Installing

theCertificates

_Snap-in

573

Working

with CertificateStores 575

Using Group Policy

to

_{Import Certificates}

575

Backing Up Certificates

and

_Keys

576

Restoring

Certificates

and

_Keys

577

Using Group Policy

toEnable Credential

_Roaming

578

Backing Up

and

_Restoring

Certificate Databases 580

Assigning

Administration Roles 581

Configuring Certificate

Server Permissions 582

Review All the

_{Key Topics}

583

Complete

the Tables andLists from

_Memory

584 Definitions of

_Key

Terms 5 84

Chapter

17

_Managing

Certificate

_Templates,

_Enrollments, and Certificate Revocation 587

"Do IKnow This

_Already?"

Quiz 587

xvii

Understanding

Certificate

_Template

_Types

592

Configuring

Certificate

_Templates

593

Securing

Template

Permissions 595

Enabling

the Use

_{of Templates}

591

Managing

Different Certificate

_Template

Versions 597

Archiving

Keys

599

Configuring Key Recovery Agents

599

Managing

Certificate Enrollments 602

Understanding

Network DeviceEnrollmentServices 602

Enabling

CertificateAutoenrollment 605

Configuring

WebEnrollment 606

Configuring

SmartCard Enrollment 609

Creating

Enrollment

_Agents

610

Using Group Policy

to

_Require

Smart Cards

_for

_Logon

614

Managing

CertificateRevocation 616

Configuring

CertificateRevocation Lists 617

Configuring

a CPJL Distribution Point 619

Troubleshooting

CRLs 620

Configuring

Online

_Responders

621

Configuring Responder Properties

622

Adding

aRevocation

_{Configuration}

623

Configuring

Arrays

624

Configuring Authority

InformationAccess 624 Review All the

_{Key Topics}

62 5

Complete

the Tables and Lists from

_Memory

626 Definitions of

_Key

Terms 626

Practice Exam 629

Answersto Practice Exam 691

AppendixA Answers to the "Do I Know This_Already?" Quizzes 729

Appendix

B

_Installing

Windows Server 2008 R2 763

Glossary

773 Index 796 Elements Availableon CD

Appendix

C

_Memory

Tables 3