Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Exam Objectives
This exam is broken up into five different categories. We will look at what you have to know in each category to pass the exam.
Planning and Implementing an Active Directory Infrastructure
- Plan a strategy for placing global catalog servers.
- Evaluate network traffic considerations when placing global catalog servers.
- Evaluate the need to enable universal group caching.
- Plan flexible operations master
role placement.
- Plan for business continuity of operations master roles.
- Identify operations master role dependencies.
The servers that function as the schema master, PDC emulator, domain naming master, infrastructure master and RID master require a single server approach.
- Implement an Active Directory
directory service forest and
domain structure.
- Set an Active Directory forest and domain functional level based on requirements.
- Establish trust relationships. Types of trust relationships might include external trusts, shortcut trusts, and cross-forest trusts.
- Create the forest root domain.
- Create a child domain.
- Create and configure Application Data Partitions.
- Install and configure an Active Directory domain controller.
The highest-level container in Active Directory is the forest. A single forest is the simplest model. Because forests can contain millions of objects, there are few technical reasons why the majority of organizations cannot deploy a single forest to meet their needs.
The first domain created by default is the forest root domain. All objects in a single forest are listed in the global catalog.
A child domain is a new domain under the parent. It will share a contiguous namespace with the parent domain. You create the child domain using the Active Directory Installation Wizard.
NtdsUtil is a command line utility that can be used to create application directory partitions.
Installing an AD domain controller is an important step that requires a lot of planning. Small organizations may only need one domain controller, but should have two for redundancy. To promote a member server to a domain controller, run the command line utility DCpromo.exe
- Implement an Active Directory
site topology.
- Configure site links.
- Configure preferred bridgehead servers.
Site Links are created to link sites. Replication traffic will travel these links. Every site must be included in a site link in order for changes to be replicated between domain controllers.
Assigning a bridgehead server manually can create problems.
The Knowledge Consistency Checker (KCC) automatically assigns one or more bridgehead servers to make sure that changes in Active Directory are replicated across a site link one at a time.
- Plan an administrative delegation strategy.
- Plan an organizational unit (OU) structure based on delegation requirements.
- Plan a security group hierarchy based on delegation requirements.
A global catalog server is a domain controller that provides the ability to locate objects from any domain without having to know the domain name. Global catalog servers can use a lot of bandwidth because of replication.
You should not place a global catalog server where there is already network congestion. It will not be able to respond to queries in a timely fashion.
Universal group caching can be enabled in lieu of a global catalog server for smaller networks or if bandwidth is an issue.
Administration of Active Directory components can be delegated allowing for decentralized management.
You can use OUs to delegate administration to a group or an individual allowing for management of local data and resources.
The three types of security groups are domain local, global and universal.
Managing and Maintaining an Active Directory Infrastructure
- Manage an Active Directory
forest and domain structure.
- Manage schema modifications.
- Add or remove a UPN suffix.
There can only be one schema per forest. The attributes that are defined in the forest affect all domains and OUs. There are default attributes that cannot be modified and there are others that can be added or deleted.
A User Principal Name is added through the Active Directory Domains and Trusts.
- Manage an Active Directory site.
- Configure replication schedules.
- Configure site link costs.
- Configure site boundaries.
- Monitor Active Directory replication
failures. Tools might include
Replication Monitor, Event Viewer,
and support tools.
- Monitor Active Directory replication.
- Monitor File Replication service (FRS) replication.
To monitor replication, you would use the Directory Service Event Log in Event Viewer, Repadmin.exe or Dcdiag.exe.
To monitor FRS replication you can use Event Viewer events associated with the File Replication Service or use FRSDiag.exe, which is a command line utility.
- Restore Active Directory services.
- Perform an authoritative restore operation.
- Perform a nonauthoritative restore operation.
An authoritative restore is most commonly used in cases in which a change was made within the directory that must be reversed, such as deleting an OU by mistake.
A nonauthoritative restore is most commonly used in cases when a DC fails because of a hardware or software related reasons.
- Troubleshoot Active Directory.
- Diagnose and resolve issues related to Active Directory replication.
- Diagnose and resolve issues related to operations master role failure.
- Diagnose and resolve issues related to the Active Directory database.
As mentioned before, the Knowledge Consistency Checker (KCC) is responsible by default for setting up replication inside and outside the site. Inside replication will be optimized for speed and outside replication will be optimized for bandwidth.
Replication should be configured to occur during off hours, which is usually at night.
You may have several links that can be used for replication. Active Directory Sites and Services can be used for assigning costs to those links. The Knowledge Consistency Checker will use this information and will avoid links that have a high cost associated with it.
You need to consider what will happen if connectivity between sites is disrupted. If your site does not have its own domain controller, data servers, DHCP servers, etc., it will not be able to function.
Some of the new tools in Windows 2003 that can be used to troubleshoot AD are: Dsadd.exe, Dsget.exe, Dsmod.exe, Dsmove.exe, DSQuery.exe and DSrm.exe
A system administrator needs to review the Directory Service Log frequently to stay on top of replication problems.
If a current operations master has become unavailable, you can use the Ntdsutil.exe utility to seize the operations master role.
Once again, Event Viewer will help you to troubleshoot and diagnose problems relate to the Active Directory database.
Planning and Implementing User, Computer, and Group Strategies
- Plan a security group strategy.
- Plan a user authentication strategy.
- Plan a smart card authentication strategy.
- Create a password policy for domain users.
- Plan an OU structure.
- Analyze the administrative requirements for an OU.
- Analyze the Group Policy requirements for an OU structure.
- Implement an OU structure.
- Create an OU.
- Delegate permissions for an OU to a user or to a security group.
- Move objects within an OU hierarchy.
You create an OU using Active Directory Computers and Users. You simply right-click on the location where you want a new OU and then choose New, Organization Unit.
The Delegation of Control Wizard is used to delegate control of an OU to a specific user or group.
The easiest way to move an OU to a different location in Active Directory is to simply drag and drop. You can also right-click on the OU and choose move or use the Dsmove.exe command line utility.
Organizing users or computers into groups makes your life as an administrator much easier. Instead of assigning permissions to dozens of users individually, you can create a group containing those users and assign permissions to the group. The four types of groups are Local, Domain Local, Global and Universal.
There are many attributes that can be assigned to a user account: Account Expiration, Logon Hours, Enable/Disable, Locked Out, Must Change Password at next Logon, Cannot Change Password, Password Never Expires.
A smart card allows a user to login using their card and a PIN. Smart cards store certificates, public and private keys, and passwords.
Passwords have become much more complex since users started logging in. You must determine how you will setup the password requirements in your organization. You can set your password length, require it to have upper and lower case, require it to have a number and require it to have special characters.
An Organizational Unit is used to delegate and decentralize control in your organization.
An Organization Unit is the smallest unit to which a Group Policy can be applied. Group Policies can be set to control the behavior of security and desktop configurations. Group Policies are applied in the following order: Local, Site, Domain, Parent and Child.
Planning and Implementing Group Policy
- Plan Group Policy strategy.
- Plan a Group Policy strategy by using Resultant Set of Policy (RSoP) Planning mode.
- Plan a strategy for configuring the user environment by using Group Policy.
- Plan a strategy for
configuring the computer
environment by using
Group Policy.
- Computer startup and shutdown
- User logon and logoff
- Registry based policy settings
- Security settings
- Scripts
- Folder Replication
- Application deployment and management
Group Policies should not be taken lightly. Applying a poorly conceived GP can create many problems for you. Resultant Set of Policy (RSoP) is a tool that allows you to review and test new policies before implementation.
These settings are used to configure policies which affect users. The computer which the user is logging on to does not influence whether these settings are applied. User configuration settings are applied when a user logs on to the computer.
- Configure the user environment
by using Group Policy.
- Distribute software by using Group Policy.
- Automatically enroll user certificates by using Group Policy.
- Redirect folders by using Group Policy.
- Configure user security settings by using Group Policy.
One key design feature of Active Directory is to ease the process of deploying software within an organization. Microsoft included the ability to deploy and distribute software using Group Policy. You can assign an application, which causes it to be installed automatically or you can publish an application, which allows the user to decide if the application should be installed.
You need to be familiar with Public Key Infrastructure, Encrypted Files Systems, Automatic Certificate Requests and Trusted Root Certificate Authorities.
Folder Redirection Group Policy Object can be used to redirect folders. You would use this if you wanted all of your users’ folders to point to a server. This would prevent users from saving data locally where it would probably not get backed up regularly.
Security policies can affect Password Policy, Account Lockout Policy, Group Membership, User Rights Assignment, Authentication, Available Resources and Security Options.
- Deploy a computer environment by using Group Policy.
- Distribute software by using Group Policy.
- Automatically enroll computer certificates by using Group Policy.
- Configure computer security settings by using Group Policy.
Group Policies can dictate a users wallpaper, desktop, available applications, standardized messages, etc.
As mentioned earlier, Group Policy can distribute mandatory software or make optional software available.
This is similar to automatically enrolling user certificates in that you need to be familiar with Public Key Infrastructure, Encrypted Files Systems, Automatic Certificate Requests and Trusted Root Certificate Authorities.
This too is similar to configuring user security settings. The types of things you can control with Group Policy are Password Policy, Account Lockout Policy, Kerberos Policy, User Rights Assignment and Security Options.
Managing and Maintaining Group Policy
- Troubleshoot issues related to Group Policy application deployment. Tools might include RSoP and the gpresult command.
- Maintain installed software by using Group Policy.
- Distribute updates to software distributed by Group Policy.
- Configure automatic updates for network clients by using Group Policy.
Just as you can distribute software using Group Policy, you can use Group Policy to make changes to the original deployment. You can even remove software with Group Policy.