MCSE 70-294 Exam Prep: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure (2nd Edition)

MCSE 70-294 Exam Prep Planning, Implementing, and Maintaining a Microsoft® Windows® Server™ 2003 Active Directory Infra...

Author: Don Poulton

27 downloads 855 Views 9MB Size Report

This content was uploaded by our users and we assume good faith they have the permission to share this book. If you own the copyright to this book and it is wrongfully on our website, we offer a simple DMCA procedure to remove your content from our site. Start by pressing the button below!

Report copyright / DMCA form

DOWNLOAD PDF

MCSE 70-294 Exam Prep Planning, Implementing, and Maintaining a Microsoft® Windows® Server™ 2003 Active Directory Infrastructure Don Poulton

800 East 96th Street • Indianapolis, Indiana 46240 USA

MCSE 70-294 Exam Prep: Planning, Implementing, and Maintaining a Microsoft® Windows® Server™ 2003 Active Directory Infrastructure Copyright ® 2007 by Que Publishing All rights reserved. No part of this book shall be reproduced, stored in a retrieval system, or transmitted by any means, electronic, mechanical, photocopying, recording, or otherwise, without written permission from the publisher. No patent liability is assumed with respect to the use of the information contained herein. Although every precaution has been taken in the preparation of this book, the publisher and author assume no responsibility for errors or omissions. Nor is any liability assumed for damages resulting from the use of the information contained herein. International Standard Book Number: 0-7897-3651-9 Printed in the United States of America First Printing: November 2006 09

08

07

06

4

3

2

1

Trademarks All terms mentioned in this book that are known to be trademarks or service marks have been appropriately capitalized. Que Publishing cannot attest to the accuracy of this information. Use of a term in this book should not be regarded as affecting the validity of any trademark or service mark.

Warning and Disclaimer Every effort has been made to make this book as complete and as accurate as possible, but no warranty or fitness is implied. The information provided is on an “as is” basis. The authors and the publisher shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from the information contained in this book or from the use of the CD or programs accompanying it.

Bulk Sales Que Publishing offers excellent discounts on this book when ordered in quantity for bulk purchases or special sales. For more information, please contact U.S. Corporate and Government Sales 1-800-382-3419 [email protected] For sales outside of the U.S., please contact: International Sales [email protected] Library of Congress Cataloging-in-Publication Data Poulton, Don. MCSE 70-294 exam prep : planning, implementing, and maintaining a Microsoft Windows server 2003 active directory infrastructure / Don Poulton. -- 2nd ed. p. cm. Earlier ed. under title: Windows Server 2003 active directory infrastructure, 2004. ISBN 0-7897-3651-9 (pbk.) 1. Electronic data processing personnel--Certification. 2. Microsoft software--Examinations-Study guides. 3. Directory services (Computer network technology)--Examinations--Study guides. 4. Microsoft Windows server. I. Poulton, Don Windows Server 2003 active directory infrastructure. II. Title. QA76.3.P68 2006 005.4'476--dc22 2006032881

PUBLISHER Paul Boger ACQUISITIONS EDITOR Betsy Brown DEVELOPMENT EDITOR Dayna Isley MANAGING EDITOR Patrick Kanouse PROJECT EDITOR Mandie Frank COPY EDITOR Mike Henry PROOFREADER Leslie Joseph TECHNICAL EDITOR Marc Savage PUBLISHING COORDINATOR Vanessa Evans INTERIOR DESIGNER Ann Jones COVER DESIGNER Gary Adair PAGE LAYOUT Molly Sharp

The Safari® Enabled icon on the cover of your favorite technology book means the book is available through Safari Bookshelf. When you buy this book, you get free access to the online edition for 45 days. Safari Bookshelf is an electronic reference library that lets you easily search thousands of technical books, find code samples, download chapters, and access technical information whenever and wherever you need it. To gain 45-day Safari Enabled access to this book:

. Go to http://www.quepublishing.com/safarienabled . Complete the brief registration form . Enter the coupon code U5KV-46ZJ-8SIV-N8JL-UKY1 If you have difficulty registering on Safari Bookshelf or accessing the online edition, please email [email protected].

Contents at a Glance Introduction

xix

Microsoft ® 70-294 Exam Objectives

xxvii

Study and Exam Preparation Tips

xxix

Part I: Exam Preparation CHAPTER 1 Concepts of Windows Server 2003 Active Directory CHAPTER 2 Planning and Implementing an Active Directory Infrastructure

3 35

CHAPTER 3 Managing an Active Directory Infrastructure

115

CHAPTER 4 Maintaining an Active Directory Infrastructure

205

CHAPTER 5 Planning User, Computer, and Group Strategies

299

CHAPTER 6 Implementing User, Computer, and Group Strategies

367

CHAPTER 7 Planning and Implementing Group Policy

423

CHAPTER 8 Managing Group Policy

533

Part II: Final Review Fast Facts

609

Practice Exam

645

Practice Exam Answers

679

Part III: Appendixes APPENDIX A Accessing Your Free MeasureUp Practice Test

701

APPENDIX B MeasureUp’s Product Features

703

APPENDIX C Review Questions and Answers

707

Glossary

723

Index

737

Table of Contents Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xix Microsoft 70-294 Exam Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxvii Study and Exam Preparation Tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxix Learning Styles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxx Study Tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxx Study Strategies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxx Pretesting Yourself . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxxii Exam Preparation Tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxxii The MCSE Exam Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxxii New Question Types: Simulation Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . xxxiv Putting It All Together . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxxv Final Considerations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxxviii Part I: Exam Preparation Chapter 1: Concepts of Windows Server 2003 Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 A Brief History of Directory Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 How Is Active Directory Built? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 X.500 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 LDAP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Naming Standards of X.500 and LDAP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 The Building Blocks of Active Directory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Namespaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Containers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Schema . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Global Catalog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Partitions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Directory Services Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

vi

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

Logical Components of Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Forest. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Organizational Units. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Review of Active Directory Components. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Physical Components of Active Directory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Domain Controllers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Global Catalog Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Flexible Operations Masters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Reviewing Active Directory’s Physical Components . . . . . . . . . . . . . . . . . . . . . . . 26 Some Advantages of Active Directory over Older Directory Services. . . . . . . . . 26 What Is New in Windows Server 2003 Active Directory? . . . . . . . . . . . . . . . . . . . . . . . 27 What Is New in Windows Server 2003 Release 2 Active Directory? . . . . . . . . . . . . . . 30 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Suggested Readings and Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Chapter 2: Planning and Implementing an Active Directory Infrastructure . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Planning the Active Directory Namespace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Subdividing the Active Directory Namespace. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Administrative or Geographical Organization of Domains. . . . . . . . . . . . . . . . . . 40 Active Directory Namespace Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Building an Active Directory Forest. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Creating the Forest Root Domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Active Directory Domain Controllers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Creating Child Domains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Uninstalling Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Application Directory Partitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 Upgrading Windows 2000 Domains and Forests . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Building an Active Directory Forest Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

vii

Contents

Windows Server 2003 Functional Levels. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 Domain Functional Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 Forest Functional Levels and Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 Renaming Domains and Domain Controllers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Functional Levels Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79 Sharing Active Directory Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 Global Catalog Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 Universal Groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84 Sharing Active Directory Information Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Placement of Flexible Operations Master Roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Business Continuity of Operations Master Roles . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Operations Master Role Dependencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 Operations Masters Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Apply Your Knowledge. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 Exam Questions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 Answers to Exam Questions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 Suggested Readings and Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 Chapter 3: Managing an Active Directory Infrastructure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 Active Directory Trust Relationships . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 Trust Relationships Within an Active Directory Forest . . . . . . . . . . . . . . . . . . . 119 Interforest Trust Relationships . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 Establishing Trust Relationships . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122 Managing Trust Relationships . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Active Directory Federation Services (ADFS). . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 Understanding Trust Relationships . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 Active Directory Forest and Domain Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 Managing Schema Modifications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141 Adding or Removing a UPN Suffix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151 Understanding the Directory Forest and Domain Structure . . . . . . . . . . . . . . . 155

viii

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

Active Directory Site Topology. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 Creating Sites. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 156 Configuring Sites. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157 Configuring Site Boundaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 Configuring Site Links . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162 Site Link Bridges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 Knowledge Consistency Checker . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165 Configuring Connection Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 Inter-Site Topology Generator . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168 Preferred Bridgehead Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169 Configuring Replication Schedules. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171 Configuring Site Link Costs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183 Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184 Apply Your Knowledge. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 185 Exam Questions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192 Answers to Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199 Answers to Exam Questions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 199 Suggested Readings and Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203 Chapter 4: Maintaining an Active Directory Infrastructure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208 Managing and Monitoring Active Directory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208 Active Directory Support Tools. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208 Active Directory Support Tools Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243 Monitoring Active Directory Replication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243 Monitoring FRS Replication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244 Restoring Active Directory Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248 Backing Up Active Directory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248 Restoring Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 256 Managing the Active Directory Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264 Restoring Active Directory Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267

ix

Contents

Troubleshooting Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267 Diagnosing Issues Related to Active Directory Replication . . . . . . . . . . . . . . . . 267 Diagnosing Issues Related to Operations Master Role Failures. . . . . . . . . . . . . 272 Diagnosing Issues Related to the Active Directory Database . . . . . . . . . . . . . . . 276 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282 Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282 Apply Your Knowledge. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283 Exam Questions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 289 Answers to Exam Questions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294 Suggested Readings and Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297 Chapter 5: Planning User, Computer, and Group Strategies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302 Security Groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302 Functional Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303 Planning a Distribution Group Strategy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306 Planning a Security Group Strategy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307 User and Group Creation Strategies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312 Group Nesting Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317 User Authentication Strategy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317 Smart Cards . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 318 Domain Password Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349 Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349 Apply Your Knowledge. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 350 Exam Questions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 358 Answers to Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 362 Answers to Exam Questions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 363 Suggested Readings and Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 365

x

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

Chapter 6: Implementing User, Computer, and Group Strategies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 367 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370 Administrative Delegation Strategies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370 Planning an OU Structure Based on Delegation Requirements . . . . . . . . . . . . 371 Planning a Security Group Hierarchy Based on Delegation Requirements . . . 378 Administrative Delegation Strategy Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . 383 OU Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 384 Administrative Requirements for an OU Structure . . . . . . . . . . . . . . . . . . . . . . . 385 Group Policy Requirements for an OU Structure . . . . . . . . . . . . . . . . . . . . . . . . 387 Implementing an OU Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391 Managing an OU Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 408 Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 408 Apply Your Knowledge. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409 Exam Questions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 414 Answers to Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 419 Answers to Exam Questions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 419 Suggested Readings and Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 421 Chapter 7: Planning and Implementing Group Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 423 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 426 The Concept of Group Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 426 Components of Group Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 427 Group Policy Containers (GPCs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 427 Group Policy Templates (GPTs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 428 Planning the Application of Group Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 429 Group Policy Inheritance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 429 Using the Group Policy Management Console (GPMC) . . . . . . . . . . . . . . . . . . 431 Creating and Managing GPOs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 434 Group Policy for Users and Computers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445 Best Practices for Managing Group Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 456 Some Strategies for Planning a Set of GPOs . . . . . . . . . . . . . . . . . . . . . . . . . . . . 456 Group Policy Application Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461

xi

Contents

Deploying the User and Computer Environment with Group Policy . . . . . . . . . . . . 462 Software Installation Using Group Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 462 User and Computer Environment Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 473 Enrolling User and Computer Certificates with Group Policy . . . . . . . . . . . . . 475 Enrolling User and Computer Certificates with Group Policy Review . . . . . . 481 Configuring Security Settings with Group Policy . . . . . . . . . . . . . . . . . . . . . . . . 481 Redirecting Folders with Group Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 496 Administrative Templates Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 512 Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513 Apply Your Knowledge. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 514 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 514 Exam Questions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 521 Answers to Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 528 Answers to Exam Questions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 529 Suggested Readings and Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 532 Chapter 8: Managing Group Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 533 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 536 Resultant Set of Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 536 RSoP Planning Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 537 RSoP Logging Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 548 Gpresult . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 562 Other Tools for Troubleshooting Group Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 566 Gpupdate . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 566 Gpotool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567 Advanced System Information. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567 RSoP and Gpresult Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 569 Maintaining Software with Group Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 570 Distributing Updates to Software Installed Using Group Policy. . . . . . . . . . . . 570 Configuring Automatic Updates for Network Clients Using Group Policy . . 577 RSoP and Software Installation Using Group Policy . . . . . . . . . . . . . . . . . . . . . 580 Group Policy Application Upgrade Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 580

xii

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

Troubleshooting Group Policy Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 581 Use of RSoP to Troubleshoot Group Policy Security Settings . . . . . . . . . . . . . 581 Use of Gpresult to Troubleshoot Group Policy Security Settings . . . . . . . . . . 584 Best Practices When Troubleshooting Group Policy Settings . . . . . . . . . . . . . . 585 Chapter Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 586 Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 587 Apply Your Knowledge. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 587 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 588 Exam Questions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 596 Answers to Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 601 Answers to Exam Questions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 603 Suggested Readings and Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606 Part II: Final Review Fast Facts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 609 Planning and Implementing an Active Directory Infrastructure . . . . . . . . . . . . . . . . . 610 Plan a Strategy for Placing Global Catalog Servers . . . . . . . . . . . . . . . . . . . . . . . 610 Plan Flexible Operations Master Role Placement . . . . . . . . . . . . . . . . . . . . . . . . 611 Implement an Active Directory Service Forest and Domain Structure. . . . . . . 614 Implement an Active Directory Site Topology . . . . . . . . . . . . . . . . . . . . . . . . . . . 617 Plan an Administrative Delegation Strategy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 618 Managing and Maintaining an Active Directory Infrastructure . . . . . . . . . . . . . . . . . . 619 Manage an Active Directory Forest and Domain Structure . . . . . . . . . . . . . . . . 620 Manage an Active Directory Site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 622 Monitor Active Directory Replication Failures. . . . . . . . . . . . . . . . . . . . . . . . . . . 623 Restore Active Directory Directory Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 624 Troubleshoot Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 626 Planning and Implementing User, Computer, and Group Strategies . . . . . . . . . . . . . 629 Plan a Security Group Strategy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 629 Plan a User Authentication Strategy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 630 Plan an OU Structure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 631 Implement an OU Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 632 Planning and Implementing Group Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 634 Plan a Group Policy Strategy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 634 Configure the User Environment Using Group Policy. . . . . . . . . . . . . . . . . . . . 636 Deploy a Computer Environment Using Group Policy . . . . . . . . . . . . . . . . . . . 639

xiii

Contents

Managing and Maintaining Group Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 641 Troubleshoot Issues Related to Group Policy Application Deployment. . . . . . 641 Maintain Installed Software Using Group Policy. . . . . . . . . . . . . . . . . . . . . . . . . 642 Troubleshoot the Application of Group Policy Security Settings . . . . . . . . . . . 644 Practice Exam . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 645 Exam Questions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 646 Practice Exam Answers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 679 Part III: Appendixes Appendix A: Accessing Your Free MeasureUp Practice Test . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 701 Appendix B: MeasureUp’s Product Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 703 Multiple Testing Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 703 Study Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 703 Certification Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 703 Custom Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 703 Missed Question Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 704 Non-Duplicate Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 704 Question Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 704 Random Questions and Order of Answers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 704 Detailed Explanations of Correct and Incorrect Answers . . . . . . . . . . . . . . . . . . . . . . . 705 Attention to Exam Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 705 Technical Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 705 Appendix C: Review Questions and Answers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 707 Chapter 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 707 Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 707 Answers to Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 708 Chapter 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 709 Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 709 Answers to Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 710

xiv

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

Chapter 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 711 Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 711 Answers to Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 712 Chapter 4 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 713 Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 713 Answers to Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 714 Chapter 5 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 715 Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 715 Answers to Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 715 Chapter 6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 716 Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 716 Answers to Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 716 Chapter 7 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 717 Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 717 Answers to Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 718 Chapter 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 719 Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 719 Answers to Review Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 720 Glossary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 723 Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 737

About the Author Don Poulton, MCSA, MCSE, A+, Network+, Security+, has been involved with computers since the days of 80-column punch cards. After a career of more than 20 years in environmental science, Don switched careers and trained as a Windows NT 4.0 MCSE. He has been involved in consulting with a couple of small training providers as a technical writer, during which time he wrote training and exam prep materials for Windows NT 4.0, Windows 2000, and Windows XP. In addition, he has worked on programming projects, both in his days as an environmental scientist, and more recently with Visual Basic to update an older statistical package used for multivariate analysis of sediment contaminants. When not working on computers, Don is an avid amateur photographer who has had his photos displayed in international competitions and published in magazines such as Michigan Natural Resources Magazine and National Geographic Traveler. Don also enjoys traveling and keeping fit. Don lives in Burlington, Ontario, with his wife, Terry.

About the Reviewer Marc Savage is a senior national technical advisor and technical trainer for Nexient. Combined with more than 11 years of experience in microcomputer training and systems development in the private, public, and nonprofit organization sectors his professional expertise is focused particularly on providing companies with a clear vision and direction in regards to Microsoft products. Marc currently holds the following certifications: MCT, MCSE, MCSA, CNE, A+, Network +, ITIL, and HDA. Over the past ten years Marc as worked on many titles at New Riders and Que Publishing. When not in front of his computer, Marc spends his time with his lovely wife Lynne and two daughters Isabelle and Carolyne. He can be reached at [email protected].

Dedication To my terrific wife, Terry, who has stood by me and supported me throughout this project.

Acknowledgments I would like to thank all of the outstanding staff at Que Publishing, especially Carole McClendon and Betsy Brown, who worked with me throughout the project and whose copyediting improved the content and readability of the text. Thanks also to Kim Lindros, who put me in touch with Carole and Betsy at the start of this project. Lastly, thanks also go out to Marc Savage, the technical editor, who provided highly valuable constructive comments and suggestions for improving this book.

We Want to Hear from You! As the reader of this book, you are our most important critic and commentator. We value your opinion and want to know what we’re doing right, what we could do better, what areas you’d like to see us publish in, and any other words of wisdom you’re willing to pass our way. As Publisher for Que Publishing, I welcome your comments. You can email or write me directly to let me know what you did or didn’t like about this book—as well as what we can do to make our books better. Please note that I cannot help you with technical problems related to the topic of this book. We do have a User Services group, however, where I will forward specific technical questions related to the book. When you write, please be sure to include this book’s title and author as well as your name, email address, and phone number. I will carefully review your comments and share them with the author and editors who worked on the book. Email:

[email protected]

Mail:

Paul Boger Publisher Que Publishing 800 East 96th Street Indianapolis, IN 46240 USA

Reader Services Visit our website and register this book at www.examcram.com/register for convenient access to any updates, downloads, or errata that might be available for this book.

Introduction MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure is for network architects, system administrators, and other technical professionals who are pursuing the goal of becoming a Microsoft Certified System Engineer (MCSE). This book covers the Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure exam (70-294), which is a core exam for this certification. The exam is designed to measure your skill in managing and maintaining Active Directory in a Windows Server 2003 environment.

R2 This book covers all the objectives that Microsoft has established for exam 70-294. It has been updated to include coverage of the Service Pack 1 (SP1) and Release 2 (R2) upgrades of the Windows Server 2003 operating system. In the book, you will see special R2 icons by the new R2 material the 70-294 exam covers.

Who Should Read This Book This book is designed to cover all the objectives that Microsoft created for this exam, thereby helping you meet your certification goals by preparing you for Exam 70-294. It doesn’t offer end-to-end coverage of Active Directory in Windows Server 2003; rather, it helps you develop the specific core competencies that Microsoft says that administrators who support Active Directory in Windows Server 2003 will need to master. In a Windows Server 2003 network, the ability to install, support, and troubleshoot Active Directory is critical to the success of an administrator. As in Windows 2000, Active Directory is intimately integrated into Windows Server 2003, and you cannot have a domain structure without Active Directory. The exam touches on all the major components of Active Directory that are critical to a successful domain and forest implementation. Although volumes of information are available on the history, theory, and underlying applications, this book does not cover these portions of the services in detail. The purpose of this book is to provide an introduction to these services in general, provide an in-depth look at the Windows Server 2003 implementations of Active Directory, and prepare you to take the exam. One additional area that is new to this exam is the emphasis on security. In keeping with the Microsoft Trustworthy Computing initiatives, Microsoft is putting much greater emphasis than in the past on the security facets of all of its Windows Server 2003 exams. Because a great deal of related information exists that this book is not able to cover, each chapter in this book contains a section called “Suggested Readings and Resources” that points you

xx

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

to sources that can fill in the blanks. Therefore, for example, although you might not be a Group Policy expert by the time you complete this book, you’ll know how to implement, configure, and troubleshoot Group Policy and its underlying concepts. You’ll also have a recommendation for some additional reading if you need to understand exactly what the makeup of Group Policy object (GPO) looks like. One of the most common questions with any of the Microsoft certification tests is, “Do I need to take a class to pass this test?” You can pass the exam by learning the material in this book, without taking a class. Of course, depending on your own personal study habits and learning style, you might benefit from studying this book and taking a class. However, one thing that is difficult for any book to provide is hands-on experience with the product. If you can set up an environment that enables you to perform the exercises outlined in this book (you’ll find hardware and software recommendations for this environment at the end of this introduction), you’re going to be in good shape. You’ll be in especially good shape if you have the opportunity to work with Windows Server 2003 in a production environment. Even if you are not planning to take the exam, you might find this book useful. The wide range of topics covered by the Microsoft exam objectives will certainly help you to accomplish the Active Directory management tasks at your job. Experienced MCSEs looking for a reference on the new features Microsoft included in Windows 2003 Server Active Directory in particular should appreciate the coverage of topics here. Microsoft assumes that the typical candidate for this exam will have a minimum of one year’s experience implementing and administering Active Directory in medium to very large network environments.

How This Book Helps You This book gives you a self-guided tour of all the areas of the product that are covered by the Planning, Implementing, and Maintaining a Windows 2003 Active Directory Infrastructure exam. The goal is to teach you the specific skills that you need to achieve your MCSE certification. You will also find helpful hints, tips, examples, exercises, and references to additional study materials. Specifically, this book is set up to help you in the following ways: . Organization—This book is organized around the individual objectives from

Microsoft’s preparation guide for the Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure exam. All objectives are covered in this book. They are not covered in the same order that you will find them on the official preparation guide (which you can download from http://www.microsoft.com/

xxi

Introduction

learning/exams/70-294.asp) but are reorganized for more logical teaching. I have also tried to make the information more accessible in several ways: . The full list of exam topics and objectives is included in this introduction. . After the introduction, you will encounter the “Study and Exam Prep Tips” sec-

tion. Read this section early on to help you develop study strategies. This section provides some general guidelines for preparing for a Microsoft certification exam. It also provides you with valuable exam-day tips and information. . Each chapter begins with a list of the objectives covered in that chapter. . Each chapter also begins with an outline that provides an overview of the material

and the page numbers where particular topics can be found. . The objectives are repeated where the material most directly relevant to it is cov-

ered (unless the whole chapter addresses a single objective). . Instructional features—This book is designed to provide you with multiple ways to

learn and reinforce the exam material. Following are some of the helpful methods: . Objective Explanations—As mentioned previously, each chapter begins with a list

of the objectives covered in the chapter. In addition, immediately following each objective is a more detailed explanation that puts the objective in the context of the product. . Study Strategies—Each chapter also offers a selected list of study strategies: exer-

cises to try or additional material to read that will help you learn and retain the material that you’ll find in the chapter. . Exam Alerts—Exam alerts appear in the margin to provide specific exam-related

advice. Such alerts might address material likely to be covered (or not covered) on the exam, ways to remember it, or particular exam quirks. . Review breaks and summaries—Crucial information is summarized at various

points in the book in lists or tables. Each chapter ends with a summary as well. . Key terms—A list of key terms from the chapter appears at the end of each chap-

ter. The glossary toward the end of the book defines each term. . Notes—Notes contain various kinds of useful information, such as tips on tech-

nology or administrative practices, historical background on terms and technologies, and side commentary on industry issues. . Warnings—When using sophisticated information technology, the potential for

mistakes always exists; catastrophes can even occur because of improper application of the technology. Warnings alert you to such potential problems.

xxii

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure . In the Field sidebars—These relatively extensive discussions cover material that

might not be directly relevant to the exam but is useful as reference material or in everyday practice. The Field sidebars also provide useful background or contextual information that is necessary for understanding the larger topic under consideration. . Exercises—Found at the end of the chapters in the “Apply Your Knowledge” sec-

tion and in the “Challenge Exercises” found throughout the chapters, exercises are performance-based opportunities for you to learn and assess your knowledge. . Step by Steps—These are hands-on tutorial instructions that walk you through

tasks and functions that are relevant to the exam objectives. . Extensive practice test options—The book provides numerous opportunities for you

to assess your knowledge and practice for the exam. The practice options include the following: . Exam Questions—These questions also appear in the “Apply Your Knowledge”

section. They reflect the kinds of multiple-choice questions that appear on the Microsoft exams. Use them to practice for the exam and to help you determine what you know and what you may need to review or study further. Answers and explanations are provided later in the section. . Practice exam—A practice exam is included in the “Final Review” section of the

book. The “Final Review” section and the practice exam are discussed later in this Introduction. . MeasureUp Practice Tests—MeasureUp provides further practice questions. For

a complete description of MeasureUp’s test engine, see Appendix B, “MeasureUp’s Product Features.” . Review questions—These open-ended questions appear in Appendix C. They

enable you to quickly assess your comprehension of what you read in each chapter. Appendix C includes answers to the review questions. . Final Review—This part of the book provides valuable tools for preparing for the exam. . Fast Facts—This condensed version of the information contained in the book is

extremely useful for last-minute review. . Practice Exam—A practice exam is included in this book. As much as possible,

questions on this practice exam are written in styles similar to those used on the actual exam. Use the practice exam to assess your readiness for the real thing. Use the extensive answer explanations to improve your retention and understanding of the material.

xxiii

Introduction

The book includes several other features, such as the “Suggested Readings and Resources” section at the end of each chapter that directs you to additional information that can aid you in your exam preparation and your real-life work. Valuable appendixes are provided as well, including a glossary and a description of what is on the CD-ROM. For more information about the exam or the certification process, contact Microsoft at 800-636-7544 or [email protected] or visit www.microsoft.com/learning/.

Hardware and Software You Will Need As a self-paced study guide, this book is meant to help you understand concepts that you must refine through hands-on experience. To make the most of your studying, you need to have as much background on and experience with Windows Server 2003 as possible. The best way to do this is to combine studying with working on real networks, using the products on which you will be tested. This section describes the minimum computer requirements you need in order to enjoy a solid practice environment. The minimum computer requirements to ensure that you can study everything on which you’ll be tested are one or more workstations running Windows 2000 Professional or Windows XP Professional, and two or more servers running Windows Server 2003—all connected by a network. Many of the examples, exercises, and references in this book refer to Internet websites, so an Internet-connected network would be a benefit. Because this book looks at the core networking capabilities of the Windows Server 2003 family, the minimum requirements listed are specific to Windows Server 2003 Standard Edition, which has all the features covered by this exam and the lowest minimum hardware requirements. To get the full benefit of the exercises in this book, you need the following lab equipment: . Workstations—The workstation configuration should meet the following requirements: . Computer listed on the Microsoft Hardware Compatibility List (HCL) . Pentium 150MHz or better (Pentium processor 233MHz or better for

Windows XP) . 64MB RAM (128MB for Windows XP) . 2GB hard disk with a minimum of 650MB free space (1.5GB free space for

Windows XP) . 3.5-inch 1.44MB floppy drive . VGA video adapter (Super VGA adapter for Windows XP) . VGA monitor (Super VGA adapter for Windows XP)

xxiv

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure . Mouse or equivalent pointing device . CD-ROM drive . Network interface card (NIC) . Presence on an existing network or use of a hub to create a test network (Internet

connection beneficial for some exercises) . Microsoft Windows 2000 Professional or Windows XP Professional . Servers—The server(s) should meet the following requirements: . Two or three computers listed on the Microsoft HCL . Pentium 133MHz or better—Microsoft recommends a 550MHz processor . 256MB RAM (128MB is the minimum supported, but performance will suffer with

just 128MB) . 1GB free hard disk space . 3.5-inch 1.44MB floppy drive . VGA video adapter . VGA monitor . Mouse or equivalent pointing device . CD-ROM drive . NIC . Presence on an existing network or use of a hub to create a test network . Microsoft Windows Server 2003 Standard Edition (Enterprise Edition will also

work but is not needed) You should be able to use one computer in a dual-boot arrangement between Windows Server 2003 and Windows 2000 or XP Professional. A few exercises call for three machines running Windows Server 2003, but you should be able to do these exercises by configuring one machine as a dual-boot installation between two installations of Windows Server 2003. Two products that have proven invaluable to us in the writing field are VMWare (http://www.vmware.com) and Microsoft Virtual PC (http://www.microsoft.com/windows/ virtualpc/default.mspx). These products allow you to create and run multiple virtual client sessions on your PC. You can even run multiple domain controllers on a single PC; I created and tested the exercises in Chapter 3, “Managing an Active Directory Infrastructure,” using three

xxv

Introduction

virtual installations of Windows Server 2003 on a host machine running Windows XP Professional with 768 MB RAM, allocating 128 MB RAM to each virtual installation. Microsoft, of course, is highly motivated to spread the word about Windows Server 2003 to as many people as possible. You can download trial versions of Windows Server 2003 R2, along with other Microsoft products here: http://www.microsoft.com/windowsserver2003/ evaluation/trial/default.mspx. It is generally easiest to obtain access to the necessary computer hardware and software in a corporate business environment. It can be difficult, however, to allocate enough time within the busy workday to complete a self-study program. Most of your study time will likely occur after normal working hours, away from the everyday interruptions and pressures of your regular job.

This page intentionally left blank

Microsoft 70-294 Exam Objectives Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Exam Number: 70-294 Associated Certifications: MCP, MCSE on Windows Server 2003 Length: 40–45 questions, including simulations

Exam Description The Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure exam is one of six core exams required of candidates pursuing the Microsoft Certified Systems Engineer (MCSE) on Windows Server 2003. The exam is designed to measure your skill in managing and maintaining Active Directory in a Windows Server 2003 environment. Each top-level exam objective is related to a job skill that the candidate is expected to have and demonstrate.

Exam Objectives Exam 70-294 consists of the following five objectives, each with several subobjectives.

Unit/Objective/Subobjective

Page

Planning and Implementing an Active Directory Infrastructure Plan a strategy for placing global catalog servers. 83 . Evaluate network traffic considerations when placing global catalog servers. 83 . Evaluate the need to enable universal group caching. 85 Plan flexible operations master role placement. 87 . Plan for business continuity of operations master roles. 87 . Identify operations master role dependencies. 95 Implement an Active Directory directory service forest and domain structure. 45 . Create the forest root domain. 45 . Create a child domain. 60 . Create and configure Application Data Partitions. 67 . Install and configure an Active Directory domain controller. 53 . Set an Active Directory forest and domain functional level based on requirements. 73 . Establish trust relationships. Types of trust relationships might include external trusts, shortcut trusts, and cross-forest trusts. 118

Unit/Objective/Subobjective

Page

Implement an Active Directory site topology. 152 . Configure site links. . Configure preferred bridgehead servers.

162 169

Plan an administrative delegation strategy.

370

. Plan an organizational unit (OU) structure based on delegation requirements. . Plan a security group hierarchy based on delegation requirements.

370 378

Managing and Maintaining an Active Directory Infrastructure Manage an Active Directory forest and domain structure. 132 . Manage trust relationships. . Manage schema modifications. Manage an Active Directory site. . Configure replication schedules. . Configure site link costs. . Configure site boundaries.

132 141 159 171 181 159

Continues on Following Page

Objective Matrix Continued

Unit/Objective/Subobjective

Page

Monitor Active Directory replication failures. Tools might include Replication Monitor, Event Viewer, and support tools. 208 . Monitor Active Directory replication. . Monitor File Replication Service (FRS) replication.

244

Restore Active Directory directory services.

257

208

. Perform an authoritative restore operation. 262 . Perform a nonauthoritative restore operation. 257 Troubleshoot Active Directory.

267

. Diagnose and resolve issues related to Active Directory replication. 267 . Diagnose and resolve issues related to operations master role failure. 272 . Diagnose and resolve issues related to the Active Directory database. 276

Planning and Implementing User, Computer, and Group Strategies Plan a security group strategy.

302

Plan a user authentication strategy.

318

. Plan a smart card authentication strategy. 318 . Create a password policy for domain users. 335 Plan an OU structure.

385

. Analyze the administrative requirements for an OU. 385 . Analyze the Group Policy requirements for an OU structure. 387 Implement an OU structure. . Create an OU. . Delegate permissions for an OU to a user or to a security group. . Move objects within an OU hierarchy.

391 391 396 400

Unit/Objective/Subobjective

Page

Planning and Implementing Group Policy Plan Group Policy strategy.

445

. Plan a strategy for configuring the user environment by using Group Policy. 445 . Plan a strategy for configuring the computer environment by using Group Policy. 445 Configure the user environment by using Group Policy. . Distribute software by using Group Policy. . Automatically enroll user certificates by using Group Policy. . Redirect folders by using Group Policy. . Configure user security settings by using Group Policy. Deploy a computer environment by using Group Policy.

462 462 475 496 481 462

. Distribute software by using Group Policy. 462 . Automatically enroll computer certificates by using Group Policy. 475 . Configure computer security settings by using Group Policy. 481

Managing and Maintaining Group Policy Troubleshoot issues related to Group Policy application deployment. Tools might include RSoP and the Gpresult command. 548 Maintain installed software by using Group Policy. 570 . Distribute updates to software distributed by Group Policy. . Configure automatic updates for network clients by using Group Policy.

570 577

Troubleshoot the application of Group Policy security settings. Tools might include RSoP and the Gpresult command. 581

Study and Exam Preparation Tips

This element of the book provides you with general guidelines for preparing for any certification exam, including Exam 70-294, “Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure.” It is organized into four sections. The first section addresses learning styles and how they affect preparation for the exam. The second section covers exam preparation activities and general study tips. This is followed by an extended look at the Microsoft certification exams, including a number of specific tips that apply to the various Microsoft exam formats and question types. Finally, changes in Microsoft’s testing policies and how they might affect you are discussed.

xxx

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

Learning Styles To best understand the nature of preparation for the test, it is important to understand learning as a process. You are probably aware of how you best learn new material. You might find that outlining works best for you, or, as a visual learner, you might need to see things. You might need models or examples, or maybe you just like noodling around. Whatever your learning style, test preparation takes place over time. Obviously, you shouldn’t start studying for a certification exam the night before you take it; it is very important to understand that learning is a developmental process. Understanding learning as a process helps you focus on what you know and what you have yet to learn. Thinking about how you learn should help you recognize that learning takes place when you are able to match new information to old. You have some previous experience with computers and networking. Now you are preparing for this certification exam. Using this book, software, and supplementary materials will not just add incrementally to what you know; as you study, the organization of your knowledge actually restructures as you integrate new information into your existing knowledge base. This leads you to a more comprehensive understanding of the tasks and concepts outlined in the objectives and of computing in general. Again, this happens because of a repetitive process rather than a singular event. If you keep this model of learning in mind as you prepare for the exam, you will make better decisions concerning what to study and how much more studying you need to do.

Study Tips There are many ways to approach studying, just as there are many different types of material to study. However, the tips that follow should work well for the type of material covered on Microsoft certification exams.

Study Strategies Although individuals vary in the ways they learn information, some basic principles of learning apply to everyone. You should adopt some study strategies that take advantage of these principles. One of these principles is that learning can be broken into various depths. Recognition (of terms, for example) exemplifies a surface level of learning in which you rely on a prompt of some sort to elicit recall. Comprehension or understanding (of the concepts behind the terms, for example) represents a deeper level of learning than recognition. The ability to analyze a concept and apply your understanding of it in a new way represents further depth of learning. Your learning strategy should enable you to know the material at a level or two deeper than mere recognition. This will help you perform well on the exams. You will know the material

xxxi

Study and Exam Preparation Tips

so thoroughly that you can go beyond the recognition-level types of questions commonly used in fact-based multiple-choice testing. You will be able to apply your knowledge to solve new problems.

Macro and Micro Study Strategies One strategy that can lead to deep learning includes preparing an outline that covers all the objectives and subobjectives for the particular exam you are working on. You should delve a bit further into the material and include a level or two of detail beyond the stated objectives and subobjectives for the exam. Then you should expand the outline by coming up with a statement of definition or a summary for each point in the outline. An outline provides two approaches to studying. First, you can study the outline by focusing on the organization of the material. You can work your way through the points and subpoints of your outline, with the goal of learning how they relate to one another. For example, you should be sure that you understand how each of the main objective areas for Exam 70-294 is similar to and different from another. Then, you should do the same thing with the subobjectives; you should be sure that you know which subobjectives pertain to each objective area and how they relate to one another. Next, you can work through the outline, focusing on learning the details. You should memorize and understand terms and their definitions, facts, rules and tactics, advantages and disadvantages, and so on. In this pass through the outline, you should attempt to learn detail rather than the big picture (the organizational information that you worked on in the first pass through the outline). Research has shown that attempting to assimilate both types of information at the same time interferes with the overall learning process. If you separate your studying into these two approaches, you will perform better on the exam.

Active Study Strategies The process of writing down and defining objectives, subobjectives, terms, facts, and definitions promotes a more active learning strategy than merely reading the material does. In human information-processing terms, writing forces you to engage in more active encoding of the information. Simply reading over the information leads to more passive processing. You need to determine whether you can apply the information you have learned by attempting to create examples and scenarios on your own. You should think about how or where you could apply the concepts you are learning. Again, you should write down this information to process the facts and concepts in an active fashion. The hands-on nature of the exercises at the ends of the chapters provides further active learning opportunities that will reinforce concepts as well.

xxxii

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

Common-Sense Strategies You should follow common-sense practices when studying: You should study when you are alert, reduce or eliminate distractions, and take breaks when you become fatigued.

Pretesting Yourself Pretesting allows you to assess how well you are learning. One of the most important aspects of learning is meta-learning. Meta-learning has to do with realizing when you know something well or when you need to study some more. In other words, you recognize how well or how poorly you have learned the material you are studying. For most people, this can be difficult to assess. Review questions, practice questions, and practice tests are useful in that they reveal objectively what you have learned and what you have not learned. You should use this information to guide review and further studying. Developmental learning takes place as you cycle through studying, assessing how well you have learned, reviewing, and assessing again until you feel you are ready to take the exam. You might have noticed the practice exam included in this book. You should use it as part of the learning process. The MeasureUp test simulation software also provides you with an excellent opportunity to assess your knowledge. You should set a goal for your pretesting. A reasonable goal would be to score consistently in the 90% range. See Appendix B, “MeasureUp’s Product Features,” for further explanation of the test simulation software.

Exam Preparation Tips After you have mastered the subject matter, the final preparatory step is to understand the presentation of the exam. Make no mistake: A Microsoft Certified Professional (MCP) exam will challenge both your knowledge and your test-taking skills. The following sections describe the basics of exam design, the exam formats, and hints targeted to each of the exam formats.

The MCSE Exam Format Every MCSE exam is released in one of two basic formats: fixed form and case study. What this book calls exam format is really little more than a combination of the overall exam structure and the presentation method for exam questions. Each exam format uses the same types of questions. These types or styles of questions include multiple-rating (or scenario-based) questions, traditional multiple-choice questions,

xxxiii

Study and Exam Preparation Tips

and simulation-based questions. It’s important to understand the types of questions you will be asked and the actions required to properly answer them. Understanding the exam formats is key to good preparation because the format determines the number of questions presented, the difficulty of those questions, and the amount of time allowed to complete the exam.

Fixed-Form The basic format for the MCSE exam is the traditional fixed-form exam. As its name implies, the fixed-form exam presents a fixed set of questions during the exam session and is the most likely form you will encounter for Exam 70-294. The individual questions are presented in random order during a test session. If you take the same exam more than once, you won’t necessarily see the same questions. The reason is that two or three final forms are typically assembled for every fixed-form exam Microsoft releases. They are usually labeled Forms A, B, and C. The final forms of a fixed-form exam are identical in terms of content coverage, number of questions, and allotted time, but the questions are different. You might notice, however, that some of the same questions appear on, or rather are shared among, different final forms. When multiple final forms of an exam share questions, the percentage of sharing is generally small. Many final forms share no questions, but some older exams might have a 10% to 15% duplication of exam questions on the final exam forms. Fixed-form exams also have a fixed time limit in which you must complete the exam. The MeasureUp practice exams provide fixed-form exams. The score you achieve on a fixed-form exam, which is always reported for MCSE exams on a scale of 0 to 1,000, is based on the number of questions you answer correctly. The exam’s passing score is the same for all final forms of a given fixed-form exam. The typical format for the fixed-form exam is as follows: . 50–60 questions. . 75–90 minute testing time . Question review is allowed, including the opportunity to change your answers

Case Study Exams The case study–based format for Microsoft exams first appeared with the advent of the 70-100 exam (the original “Solution architectures” exam). This format then appeared in the Windows 2000 Server MCSE Design exams, and has since been continued in the Windows Server 2003 Design exams (the 70-297 and 70-298 exams). The test-taker is presented with a series of testlets, which are independent sections in the exam that include a case study with 10 to 20 questions that apply to the case study. The case study is a long scenario-like description of an information

xxxiv

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

technology situation, and includes information that you must extract and integrate with your understanding of Microsoft technology in order to answer the questions properly. A case study exam typically consists of three to five of these testlets. After you have completed each testlet, you move on to another testlet, with its case study and associated questions. You are typically allowed more time to complete a case study exam (as much as three hours) because of the intricacy of the scenarios presented. You cannot return to a previous testlet once you have moved on. While Microsoft currently employs the case study format for the Design exams only, exam formats are subject to change at any time without notice. Refer to the information provided at http://www.microsoft.com/learning/exams for up-to-date exam taking information.

New Question Types: Simulation Questions A variety of question types can appear on MCSE exams. Examples of multiple-choice questions and scenario-based questions appear throughout this book and the MeasureUp software. Simulation-based questions are new to the MCSE exam series. Simulation-based questions reproduce the look and feel of key Microsoft product features for testing purposes. The simulation software used in MCSE exams has been designed to look and act, as much as possible, just like the actual product. Consequently, answering simulation questions in a MCSE exam entails completing one or more tasks just as if you were using the product itself. The format of a typical Microsoft simulation question consists of a brief scenario or problem statement along with one or more tasks that you must complete to solve the problem. This advice sounds obvious, but your first step when you encounter a simulation is to read the question carefully. Do not go straight to the simulation application! You must assess the problem presented and identify the conditions that make up the problem scenario. Note on the scratch paper provided the tasks that must be performed or outcomes that must be achieved to answer the question and review any instructions on how to proceed. The next step is to launch the simulator by using the button provided. After clicking the Show Simulation button, you will see a feature of the product presented in a dialog box. The simulation application will partially cover the question text on many test center machines. Feel free to reposition the simulation or move between the question text screen and the simulation by using hotkeys, using point-and-click navigation, or even clicking the simulation launch button again. It is important to understand that your answer to the simulation question will not be recorded until you move on to the next exam question. This gives you the added ability to close and reopen the simulation application (using the launch button) on the same question without losing any partial answer you have made.

xxxv

Study and Exam Preparation Tips

The third step is to use the simulator as you would the actual product to solve the problem or perform the defined tasks. Again, the simulation software is designed to function, within reason, just as the product does. However, don’t expect the simulation to reproduce product behavior perfectly. Most importantly, do not allow yourself to become flustered if the simulation does not look or act exactly like the product. There are two final points that will help you tackle simulation questions. First, respond only to what is being asked in the question; do not solve problems that you are not asked to solve. Second, accept what is being asked of you. You might not entirely agree with conditions in the problem statement, the quality of the desired solution, or the sufficiency of defined tasks to solve the problem adequately. Always remember that you are being tested on your ability to solve the problem as it is presented. If you make any changes beyond those required by the question, the item will be scored as wrong on an MCSE exam.

Putting It All Together As you can see, Microsoft is making an effort to utilize question types that go beyond asking you simply to memorize facts. These question types force you to know how to accomplish tasks and understand concepts and relationships. You should study so that you can answer these types of questions rather than those that simply ask you to recall facts. Given all the different pieces of information presented so far, the following sections present a set of tips that will help you successfully tackle the exam.

More Pre-Exam Preparation Tips Generic exam-preparation advice is always useful. Tips include the following: . Become familiar with the product. Hands-on experience is one of the keys to success

on any MCP exam. . Review the current exam-preparation guide on the Microsoft Training & Certification

website. The documentation Microsoft makes available on the Web identifies the skills that every exam intends to test. Exam objectives occasionally change, so be abreast of the most recent developments. . Read all the material. Microsoft has been known to include on its exams material not

expressly specified in the objectives. This book includes additional information not reflected in the objectives in an effort to give you the best possible preparation for the examination—and for the real-world network experiences to come. . Memorize foundational technical detail, but remember that MCP exams are generally

heavier on problem solving and application of knowledge than on questions that require only rote memorization.

xxxvi

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure . Do the Step by Steps and complete the exercises in each chapter. They will help you

gain experience in using the specified methodology or approach. All Microsoft exams are task- and experience-based and require you to have experience actually performing the tasks on which you will be tested. . Use the review and exam questions to assess your knowledge. Don’t just read the chap-

ter content; use the questions to find out what you know and what you don’t. If you are struggling at all, study some more, review, and then assess your knowledge again. . Develop your own questions and examples for each topic listed in the exam objectives.

If you can develop and answer several questions for each topic, you should not find it difficult to pass the exam. . Find a study buddy. This might sound corny, but it works. You should find a coworker

or friend who is also preparing for the exam and use them to improve your knowledge. Quiz each other and assist each other with sections where you feel your knowledge is weak. . Take any of the available practice tests. We recommend the one included in this book

and the ones available through MeasureUp. As a supplement to the material bound with this book, try the free practice tests available on the Microsoft MCP website. . Look on the Microsoft MCSE website for samples and demonstration items. These

items tend to be particularly valuable for one significant reason: They help you become familiar with any new testing technologies before you encounter them on an MCSE exam.

During the Exam Session The following generic exam-taking advice that you’ve heard for years applies when you’re taking an MCP exam: . Take a deep breath and try to relax when you first sit down for your exam session. It

is very important that you control the pressure you might (naturally) feel when taking exams. . You will be provided scratch paper, usually in the form of one or two erasable plastic

sheets. Take a moment to write down any facts and technical detail that you have committed to short-term memory. . Carefully read all information and instruction screens. These displays have been put

together to give you information relevant to the exam you are taking. . Accept the nondisclosure agreement and preliminary survey as part of the examination

process. Complete them accurately and quickly move on.

xxxvii

Study and Exam Preparation Tips . Read the exam questions carefully. Reread each question to identify all relevant detail. . In fixed-form exams, tackle the questions in the order in which they are presented.

Skipping around won’t build your confidence; the clock is always counting down. . Don’t rush, but also don’t linger on difficult questions. The questions vary in degree of

difficulty. Don’t be flustered by a particularly difficult or wordy question. In addition to considering the basic preparation and test-taking advice presented so far, you also need to consider the challenges presented by the different exam designs, as described in the following sections.

Tips for Fixed-Form Exams Because a fixed-form exam is composed of a fixed, finite set of questions, you should add these tips to your strategy for taking a fixed-form exam: . Note the time allotted and the number of questions on the exam you are taking. Make

a rough calculation of how many minutes you can spend on each question, and use this figure to pace yourself through the exam. . Take advantage of the fact that you can return to and review skipped or previously

answered questions. Record the questions you can’t answer confidently on the scratch paper provided, noting the relative difficulty of each question. If a check box labeled Marked is available, select it; this assists you in returning to the question at the end of the exam because you will receive a summary list of all questions showing which ones you have marked. When you reach the end of the exam, return to the more difficult questions. . If you have session time remaining after you complete all the questions (and if you

aren’t too fatigued!), review your answers. Pay particular attention to questions that seem to have a lot of detail or that require graphics. . As for changing your answers, the general rule of thumb here is don’t! If you read the

question carefully and completely and you felt like you knew the right answer, you probably did. Don’t second-guess yourself. If, as you check your answers, one clearly stands out as incorrect, however, of course you should change it. But if you are at all unsure, go with your first impression.

Tips for Answering Simulation Questions Following are tips for answering the simulation questions: . Avoid changing any simulation settings that don’t pertain directly to the problem solu-

tion. Solve the problem you are being asked to solve and nothing more.

xxxviii

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure . Assume default settings when related information has not been provided. If something

has not been mentioned or defined, it is a noncritical detail that does not factor into the correct solution. . Be sure that your entries are syntactically correct, paying particular attention to your

spelling. Enter relevant information just as the product would require it. . Close all simulation application windows after completing the simulation tasks. The

testing system software is designed to trap errors that could result when using the simulation application, but trust yourself over the testing software. . If simulations are part of a fixed-form exam, you can return to skipped or previously

answered questions and change your answer. However, if you choose to change your answer to a simulation question or even attempt to review the settings you made in the simulation application, your previous response to that simulation question will be deleted.

Final Considerations Finally, a number of changes in the MCP program affect how frequently you can repeat an exam and what you will see when you do: . Microsoft has an exam retake policy. The rule is “two and two, and then one and two.”

That is, you can attempt any exam twice with no restrictions on the time between attempts. However, after the second attempt, you must wait two weeks before you can attempt that exam again. After that, you are required to wait two weeks between subsequent attempts. Plan to pass the exam in two attempts or plan to increase your time horizon for receiving the MCP credential. . New questions are always being seeded into the MCP exams. After gathering perform-

ance data on new questions, the examiners replace older questions on all exam forms. This means that the questions appearing on exams change regularly. These changes mean that the brute-force strategies for passing MCP exams have lost their viability. Therefore, if you don’t pass an exam on the first or second attempt, it is likely that the exam’s form could change significantly by the next time you take it. It could have a completely different set of questions or new question types. Microsoft’s intention is not to make the exams more difficult by introducing unwanted change, but to create and maintain valid measures of the technical skills and knowledge associated with the different MCP credentials. Preparing for an MCP exam has always involved not only

xxxix

Study and Exam Preparation Tips

studying the subject matter but also planning for the testing experience itself. With the continuing changes, this is now truer than ever.

NOTE Exam-taking Advice—Although this book is designed to prepare you to take and pass Exam 70-294, there are no guarantees. To really work with Windows Server 2003 Active Directory, you need a solid foundation in practical skills. This book and the Microsoft Certified Professional program are designed to ensure that you have that solid foundation. When taking the actual certification exam, make sure that you answer all the questions before your time limit expires. Do not spend too much time on any one question. Remember that unanswered questions are always scored as incorrect. If you are unsure about an answer, answer the question the best you can; then mark it for review when you have finished the rest of the questions. Be sure to read each question carefully and read all the answers before you make a selection. A question might have an answer that is close, but one of the other answers might, in fact, be a better answer. If you select an answer before reading all the choices, you might miss the best answer. Get a good night’s sleep before the exam. If you don’t know the exam information by the night before the exam, an all-night cram session will just make you tired when you are taking the exam. You need to be at your sharpest when you take this exam; don’t handicap yourself with sleep deprivation.

Remember, the primary objective of this book is not the exam; it is to ensure that you understand the material. After you understand the material, passing the exam should be simple. Knowledge is a pyramid; to build upward, you need a solid foundation. This book and the MCP programs are designed to ensure that you have that solid foundation. Good luck!

NOTE No Substitute for Experience The single best study tip that anyone can give you is to actually work with the product that you’re learning! Even if you could become a “paper MCSE” simply by reading books, you wouldn’t get the real-world skills that you need to be a success.

This page intentionally left blank

PART I

Exam Preparation Chapter 1 Concepts of Windows Server 2003 Active Directory Chapter 2 Planning and Implementing an Active Directory Infrastructure Chapter 3 Managing an Active Directory Infrastructure Chapter 4 Maintaining an Active Directory Infrastructure Chapter 5 Planning User, Computer, and Group Strategies Chapter 6 Implementing User, Computer, and Group Strategies Chapter 7 Planning and Implementing Group Policy Chapter 8 Managing Group Policy

This page intentionally left blank

1

CHAPTER ONE

Concepts of Windows Server 2003 Active Directory Active Directory version 2.0? For those of you who have worked only with Windows NT 4.0 servers and domains, Active Directory is an entirely new means of managing domains and enterprises. If you have some experience managing Novell NetWare servers, you will be familiar with many of the concepts of Active Directory. And for those of you who have worked with Active Directory in Windows 2000, you will find many new features that improve the way things are done and therefore ease the burden of administration. We begin this study guide by looking at what Active Directory is and explaining its features and concepts in a manner that sets the stage for the coming chapters. This chapter does not contain any formal Microsoft exam objectives, but you should become familiar with the terms discussed here. This information guides you as you study how to create your first Active Directory forest and domain and learn how to administer them on a day-to-day basis.

Outline Introduction

5

A Brief History of Directory Services

5

Physical Components of Active Directory

21

Sites

21

Domain Controllers

22

6

Global Catalog Servers

23

X.500

6

Flexible Operations Masters

24

LDAP

7

Schema Master

24

Naming Standards of X.500 and LDAP

8

Domain Naming Master

25

Distinguished Names

8

PDC Emulator

25

Relative Distinguished Names

9

Infrastructure Master

25

RID Master

26

How Is Active Directory Built?

User Principal Names

9

Globally Unique Identifiers

10

Security Identifiers

10

Active Directory Canonical Names

10

The Building Blocks of Active Directory 11 Namespaces

11

Objects

12

Containers

12

Schema

12

Global Catalog

13

Partitions

14

Directory Services Review

14

Logical Components of Active Directory 15 Domain

15

Tree

16

Forest

17

Organizational Units

17

Review of Active Directory Components 21

Reviewing Active Directory’s Physical Components

26

Some Advantages of Active Directory over Older Directory Services

26

What Is New in Windows Server 2003 Active Directory?

27

What Is New in Windows Server 2003 Release 2 Active Directory?

30

Chapter Summary

33

Key Terms Suggested Readings and Resources

33 34

Introduction Before we show you how to build and administer an Active Directory network, we need to show you the concepts on which Microsoft built Active Directory. We start by taking a brief look at what went before Active Directory to show the need for Microsoft to completely rebuild its directory service from the ground up. Those of you who have worked with Windows NT 4.0 will be familiar with its flat, self-limiting directory service that served its purposes well but limited companies with large networks and forced them to employ a series of domains to be able to build enterprise-sized networks. Beginning with Windows 2000, Microsoft introduced the new hierarchical directory service, Active Directory. We designed this chapter to acquaint those who have not used Windows 2000 Active Directory with the concepts and terms that Active Directory uses. This material is necessary for the proper understanding of topics in the chapters to come. Those of you who are experienced with Windows 2000 Active Directory and are upgrading your qualifications to Windows Server 2003 might want to skip most of this chapter. You should refer to the sections titled “What Is New in Windows Server 2003 Active Directory?” to acquaint yourself with the most important new features in this release. In addition, the section titled “What Is New in Windows Server 2003 Release 2 Active Directory?” introduces new features added with the Release 2 (R2) version of Windows Server 2003.

A Brief History of Directory Services In the days of Windows NT, Microsoft’s notion of directory services was rooted in the concepts developed in the era of Microsoft’s LAN Manager, a pre-Windows product. At this time, the concept of domains as logical groupings of computers was introduced. Each domain contained a single primary domain controller (PDC), which employed a database called the Security Accounts Manager (SAM) to hold objects such as user, group, and computer accounts. With his user account, a user could access any resource, such as a file, folder, or printer, for which he had permissions. Permissions for these objects were included with each object and made reference to the SAM to determine users’ group memberships and rights. Consequently, it was possible to think of a domain as a security boundary. The domain concept segmented the network world and allowed for access to information located within each group of computers, but it did not permit access to information located in a different group of computers. To access resources across the domain boundary, Microsoft introduced the concept of trusts. Simply stated, one domain could trust another domain that users in that domain were who they said they were, and could be permitted to use the trusting domain’s resources. In this way, the user could access resources in a trusted domain, again according to the permissions granted to that resource.

6

Chapter 1: Concepts of Windows Server 2003 Active Directory

As the size of an organization and the number of domains it contained grew, the trust relationships and amount of work needed to administer them grew rapidly. Likewise, the chances of problems increased. Microsoft recognized that something had to be done about this situation and looked to other established directory systems including the Novell Directory Services (NDS), which is built on the X.500 directory services specification and uses a hierarchical structure rather than the flat structure of the Windows NT directory service. In Windows Server 2003, Microsoft has added new features that improve its ease of use and management.

How Is Active Directory Built? Before studying the structure of Active Directory itself, we will take a little time to introduce the concepts of the X.500 and Lightweight Directory Access Protocol (LDAP) protocols, which are central to understanding Active Directory and its structure. Microsoft utilized the industry-standard LDAP interface as a basis for Active Directory so that third-party developers could more easily design add-on components capable of interacting with Active Directory and other LDAP-enabled databases. For more information on LDAP, refer to Request for Comments (RFC) 1777, which is available on the Internet.

X.500 X.500 was developed to help network users locate users elsewhere so that they could send email messages. It also provided information on applications that required access to resources elsewhere on the network, and on management systems that needed to know the name and location of objects on the network. First appearing in 1988, X.500 used an inverted tree concept to identify and describe all objects contained in a hierarchical database. In the inverted tree hierarchical structure, countries formed the top level (next to the root) and organizations and their organizational roots formed branches beneath these roots. The complete hierarchical X.500 system was known as the directory. X.500 used three types of information to locate resources: . Name services located specific names . Electronic address books identified addresses on the network . Directory services of centrally managed electronic address books helped users search

across networks The complete directory database, called the Directory Information Base (DIB), provides a total information-locating resource. Entries in the database are known as objects. Objects include items such as user accounts, files, and folders, as well as resources, such as printers.

7

How Is Active Directory Built?

The problem with X.500 was that it proved to be more complex than what most organizations needed. As originally created, X.500 was too open for the entire world to see. In addition, it was expensive and, in its original implementation, slower than other resource-locating methods.

LDAP LDAP is a protocol originally designed by the Internet Engineering Task Force (IETF) to work as a front-end client service to X.500–compatible directory services. Alternatively, it can function as a directory service on its own. LDAP is a subset of X.500 that operates on TCP/IP networks and, as compared to X.500, uses a lower level of system resources. LDAP is used as an Internet directory standard that is capable of providing open access to directory services over the Internet or a corporate intranet. Using a text-based query system, it allows users to quickly and easily query directories containing information such as usernames, email addresses, telephone numbers, and other user attributes. It has gone through several versions that are defined in RFCs for use as Internet standards. Active Directory supports versions 2 and 3 of LDAP. The most recent implementations of LDAP go beyond the X.500 standards in providing a solution needed to offer a global directory service. Included are such features as the support for extended character sets as used by various global languages and an easier referral mechanism to hand queries from one server to another. An extension mechanism is also provided to facilitate future development of the LDAP standard. LDAP uses the inverted tree concept originated by X.500 to identify and describe all objects contained in its database. Entries within LDAP’s inverted tree can include containers that hold other objects and leaf objects that represent entities such as people, computers, printers, and so on. Introduced with X.500 and further refined by LDAP is a series of definitions that have carried over into the Active Directory naming scheme. The hierarchical naming scheme is illustrated in Figure 1.1 and is explained in the next section.

Root

Country (C)

Organization (O)

Organizational Unit (OU)

Canada

U.S.A

Microsoft

Accounting

Australia

Quepublishing.com

Production

Management

Resources (users, computers, folders, printers, etc.)

The LDAP hierarchical naming scheme.

FIGURE 1.1

8

Chapter 1: Concepts of Windows Server 2003 Active Directory

Naming Standards of X.500 and LDAP Originating with X.500 and expanded on by LDAP is a series of naming standards that define the path to any object defined in the directory. Because Active Directory uses LDAP as the protocol of choice for accessing objects in the directory, you should know these naming paths and their components to understand the capabilities of Active Directory fully. The naming paths include the distinguished names and relative distinguished names. Additional identifiers you should be familiar with include the User Principal Names (UPNs) and Globally Unique Identifiers (GUIDs). We introduce these identifiers later in this chapter.

Distinguished Names A distinguished name (DN) defines the complete path from the top of the tree to the object and uniquely identifies each object in the LDAP inverted tree. The concept of distinguished names, which originated in the X.500 specifications, is a global one that was laid out with specific goals in mind. Those goals include the following: . To provide an unambiguous representation of the name of any resource . To provide a readily understood format for the majority of names . To achieve an attractive representation of information within several different layouts . To clearly represent the contents of the object being defined

To achieve these goals, a series of X.500-based delimiters was developed with standard abbreviation names, some of which were shown in Figure 1.1. These abbreviations comprise the complete definition of each DN. RFC 1779 gives the complete specification of distinguished names, including the complete syntax and full list of delimiters. The most common delimiters include . CN—Common name . OU—Organizational unit . DC—Domain component . O—Organization name . C—Country name

For any given object, the DN is a unique and unambiguous identification of the object and its location within the directory structure. In other words, two different objects can never have exactly the same DN. To specify a DN, include the name of the object itself, followed by the containers and the parent containers that hold the name in order. Note that a distinguished

9

How Is Active Directory Built?

name may contain more than one occurrence of a given delimiter. The following is an example of a distinguished name: CN=Tim Brown,OU=Inventory,DC=Quepublishing,DC=com

NOTE Displaying the DN Active Directory snap-in tools generally do not display the DN as shown in this example. We show this example to illustrate how LDAP recognizes the components of the DN. However, it is helpful to know the concept of the distinguished name and how objects fit together into the Active Directory hierarchy. You will see more of how these elements fit together as you progress through this training guide—for example, when you need to restore Active Directory objects. See Chapter 4, “Maintaining an Active Directory Infrastructure,” for more information.

Relative Distinguished Names The relative distinguished name (RDN) is the most granular part of the distinguished name, and it identifies a specific attribute of the object itself. For example, in the distinguished name given in the preceding section, the RDN is the first part: CN = Tim Brown. Within any given parent container, no two objects can have the same RDN; however, two objects within different containers can have the same RDN. An analogy could be the fact that more than one city with the same name can exist, as long as the cities are located in different states, such as Springfield, Illinois, and Springfield, Massachusetts. The DNs for these cities could be as follows: CN=Springfield,OU=IL,C=US and CN=Springfield,OU=MA,C=US The CN in these examples defines the exact city as opposed to a different city such as Chicago or Boston; therefore, the CN is also the RDN here.

User Principal Names In addition to the DN and RDN described in the preceding sections, Active Directory uses the concept of the User Principal Name (UPN), which is introduced here and is intimately related to these other names. The UPN is a user’s shortcut name that can be the same as a logon name or email address. For example, referring to the DN described earlier, the UPN could be [email protected].

10

Chapter 1: Concepts of Windows Server 2003 Active Directory

Globally Unique Identifiers Every object stored in Active Directory also has a unique identifier called the Globally Unique Identifier, or GUID, which is a 128-bit hexadecimal number assigned when the object is created in Active Directory. The GUID is stored in an attribute called objectGUID, which exists for every object in Active Directory. Unlike the DN or RDN, this identifier never changes even if you move or rename the object. For example, an employee leaves the company and is replaced; you want the new employee to have the same rights and privileges as the old one, so you rename the user account. This account retains the GUID of the old account. However, if you were to delete an object and then later re-create another object with the same DN, the GUID would not be the same; this is the reason that if you have deleted an object, such as a user or group account, and then must re-create it, you must re-create all properties and attributes associated with the object.

Security Identifiers The security identifier (SID) is a value that uniquely identifies a security principal such as a user, group, service, or computer account within the Active Directory forest. (We introduce the concept of forests later in this chapter.) Every account is issued an SID when it is created. SIDs are used to identify security principals in Windows Server 2003 for access control purposes. No two objects in the forest can have the same SID. It contains two components: a domain portion, which is identical for all objects in the same domain, and a relative identifier (RID), which is unique for every object. A SID can change under certain circumstances, such as if a user is moved from one domain to another. As with the GUID, if you delete an object and later re-create an object with the same name, the SID would not be the same. Windows Server 2003 uses the SID, rather than the GUID, in determining object access, for reasons of backward compatibility. Windows NT 4.0 used the SID for this purpose, and these SIDs are maintained when a Windows NT domain is upgraded to Windows Server 2003.

Active Directory Canonical Names The canonical name is a version of the DN that Active Directory displays. It lists the RDNs from the root downward (that is, in reverse sequence to the DN) and does not use the RFC 1779 naming attribute descriptors. However, the canonical name does use the domain name system (DNS) domain name. For the DN given previously, the Active Directory canonical name would be as follows: Quepublishing.com/inventory/TimB

11

The Building Blocks of Active Directory

The Building Blocks of Active Directory Active Directory can support an almost unlimited scope of functions and capabilities in an enterprise network, from small-scale operations to a global-scale multidomain enterprise. Microsoft took the concepts of X.500 and LDAP, which we already discussed, and molded them with a series of new components to come up with Active Directory’s structure. To this end, Active Directory embraces the following concepts: . Namespace . Object . Container . Schema . Global catalog . Partition

We briefly introduce each of these concepts in the following sections.

Namespaces The concept of a namespace originated with early incarnations of the Internet. This term refers to a bounded area within which a name is resolved or translated into information that is encompassed by the name. For an analogy, you can think of a telephone directory as a type of namespace in which names are resolved to phone numbers; its area is bounded within the city, county, or other geographic area that is served by the directory. An example in the computer world is that of a hostname that represents an IP address. Microsoft took this concept and expanded on it until it encompassed any type of information that anyone might have a need to locate. Further, Microsoft made this concept dynamic so that when items were added, moved, or removed, the directory would reflect these actions. The result was Active Directory. Namespaces can be either flat or hierarchical. Flat namespaces have only one level at which they store information, such as the NetBIOS naming concepts used in Windows NT 4. Hierarchical namespaces, as the name suggests, use several levels of name definition, such as those found in an Internet name like www.sales.quepublishing.com. Here, com represents the top level, quepublishing represents a second-level domain, sales is a subdomain, and www is a web server name. As you are undoubtedly aware, DNS uses this type of namespace. The DNS naming scheme is used to create the structure of the Active Directory namespace, permitting interoperability with Internet technologies; therefore, the concept of namespaces is central to Active Directory. By integrating this concept with the system’s directory services,

12

Chapter 1: Concepts of Windows Server 2003 Active Directory

Active Directory facilitates the management of the multiple namespaces often found in the heterogeneous software and hardware environments of corporate networks. The two types of namespaces are contiguous and disjointed. They are defined as follows: . Contiguous—The name of the child objects in the hierarchy contains the name of the

parent object; for example, the relationship between domains within the same tree. . Disjointed—The name of a child object in the hierarchy does not contain the name

of the parent object; for example, the relationship between different trees in the same forest.

Objects An object is any specific item that can be cataloged in Active Directory. Examples of objects include users, computers, printers, folders, and files. These items are classified by a distinct set of characteristics, known as attributes. For example, a user can be characterized by a username, full name, telephone number, email address, and so on. Note that in general, objects in the same container have the same types of attributes but are characterized by different values of these attributes. The Active Directory schema defines the extent of attributes that can be specified for any object. The Active Directory service, in turn, classifies objects into classes. These classes are logical groupings of similar objects, such as users. Each class is a series of attributes that define the characteristics of the object.

Containers A container is an object designed to hold other objects within the directory. A folder could be considered a container because it holds the files and subfolders located beneath it. Like other objects, containers have their own attributes. Forests, trees, domains, and OUs are all different types of containers because they are all designed to contain other objects.

Schema The schema is a set of rules that define the classes of objects and their attributes that can be created in Active Directory. It defines what attributes can be held by objects of various types, which of the various classes can exist, and what object class can be a parent of the current object class. For example, the User class can contain user account objects and possess attributes such as password, group membership, home folder, and so on. You can mark attributes as indexed, which means that instances of the attribute are added to a searchable index and are more easily located by a user searching by the container in which the

13

The Building Blocks of Active Directory

attributes are located. This feature improves search time but increases the size (and replication time) of the Active Directory database. When you first install Active Directory on a server, a default schema is created; it contains definitions of commonly used objects and properties such as users, computers, and groups. This default schema also contains definitions of objects and properties needed for the functioning of Active Directory. The Active Directory schema is extensible; that is, you can define new types and attributes of directory objects, as well as new attributes for existing objects. In doing so, you can adapt the schema to a given type of business; for example, a wholesaler might want to add a warehouse object to the directory, including information specific to that business. Additions to the schema are implemented automatically and are stored within the Active Directory database. Applications can be built to extend the schema and can use such extensions immediately.

WARNING Schema Modification As we discuss in Chapter 3, “Managing an Active Directory Infrastructure,” modifying the schema is serious business. Improper modifications to the schema can harm or disable the domain controllers or even the entire network. For this reason, Microsoft has included a group called Schema Admins. Only members of this group have the right to modify the schema.

Global Catalog The global catalog is a central information database that can hold data describing objects throughout the Active Directory forest namespace. Active Directory builds up the global catalog by replicating information between all domain controllers in the forest. In this way, a comprehensive and complete database of all available objects is automatically built up. To extend the telephone directory analogy we referred to earlier in the chapter, you can think of the global catalog as a yellow pages directory that facilitates your locating a specific type of resource, such as a color printer on the seventeenth floor of your building. As well as providing a physical location that contains a subset of all information in each domain’s Active Directory database, the global catalog is a service that permits the resolution of many common queries that originate from anywhere in the forest. It holds and organizes the common attributes used in search operations, such as user and group names, filenames, and so on. All information pertaining to universal groups, including their membership, is found here. Usernames are stored in the UPN format; because of this, a user can log on to any computer in the forest by employing the UPN. By default, Active Directory stores the global catalog on the first domain controller in a new forest. It is possible to either move or copy the global catalog to another domain controller.

14

Chapter 1: Concepts of Windows Server 2003 Active Directory

Partitions Active Directory is divided into several partitions—not to be confused with disk partitions— that allow the enterprise-level network to be scaled to enormous proportions while remaining manageable. A schema partition and a configuration partition are stored on all domain controllers within an Active Directory forest, and application and domain partitions are common to domain controllers within a domain. The roles of these partitions are as follows: . Domain partition—This partition contains information about all objects such as

users, groups, computers, and organizational units in a domain. It is replicated to all domain controllers within the domain, and a subset of this information is replicated to global catalog servers in the forest. . Schema partition—This partition contains definitions of all objects and their attrib-

utes. Rules for creating and working with them are also located here. This partition is replicated to all domain controllers in the forest. . Configuration partition—This partition contains information about the structure of

Active Directory in the forest, including domains, sites, and services. It is replicated to all domain controllers in the forest. . Application directory partition—New to Windows Server 2003, this partition con-

tains application-specific data that needs to be replicated throughout specified portions of the forest. Also referred to as application partition, it can be replicated to a specific domain controller or to any set of domain controllers anywhere in the forest. In this way, it differs from the domain partition in which Active Directory replicates data to all domain controllers in that domain. It also contains DNS information for Active Directory–integrated DNS zones.

Directory Services Review Following is a summary of Active Directory and how it is built: . Microsoft designed and built Active Directory according to the concepts of the X.500

and LDAP networking protocols. . The distinguished name (DN) is a unique identifier that fully defines and locates any

object used in Active Directory. . The schema is a set of rules that define the classes of objects and their attributes in

Active Directory. . The global catalog is a central information database that holds data describing objects

throughout the Active Directory namespace.

15

Logical Components of Active Directory

Logical Components of Active Directory As already mentioned, Active Directory is a hierarchical database. This logical grouping of resources facilitates the locating of a resource by its name rather than by its physical location. Proceeding from the largest unit to the smallest one, the logical structure of Active Directory consists of forests, trees, domains, organizational units (OUs), and objects. Because a domain is the basic unit on which Active Directory is built, we introduce the domain first, followed by trees and forests (in which domains are located), and then organizational units, which are containers located within a domain.

Domain As already emphasized, the domain is the core building block of Active Directory. A domain is a logical grouping of computers and users that share a common database containing user accounts and other security information. In Windows NT 4.0, it was defined by a single PDC with its centralized SAM that holds information pertaining to all the users, groups, and computers in that domain. As in Windows 2000, the Active Directory database file (ntds.dit) defines the domain in Windows Server 2003. Each domain has its own ntds.dit file, which is stored on (and replicated among) all domain controllers by a process called multimaster replication. The domain controllers manage the configuration of domain security and store the directory services database. This arrangement permits central administration of domain account privileges, security, and network resources. Networked devices and users belonging to a domain validate with a domain controller at startup. All computers that refer to a specific set of domain controllers make up the domain. In addition, group accounts such as global groups and domain local groups are defined on a domainwide basis. In Windows NT 4.0 a domain was limited to about 40,000 objects (users, groups, or computers). Theoretically, a Windows Server 2003 domain could hold millions of objects. However, moderate- to large-size companies should consider the benefits that a multiple-domain structure offers. Some benefits of using multiple domains are as follows: . Domains can be considered security boundaries. In other words, domain administrators

can define access control lists (ACLs) that determine users’ access rights and permissions to objects within the domain at the domain level. Also, each administrator has the authority to set security policy only within his domain. . You can specify how resources in each domain can be accessed using Group Policy,

which can be configured on a domainwide basis. Group Policies have full control over all objects in the domain but do not have any authority over objects in other domains. . You can configure domains along geographical lines; for example, a multinational com-

pany may organize its network with a domain for every country. In this manner, the company can deal with legal and other country-specific issues.

16

Chapter 1: Concepts of Windows Server 2003 Active Directory . You can configure domains along business lines, such as a parent company with a series

of subsidiaries. This configuration simplifies reorganization should a subsidiary be sold or a new one acquired.

Tree A tree is a grouping of domains that share a contiguous namespace (see Figure 1.2). In other words, a tree contains a parent domain whose name is reflected in all child domains within that tree. For example, if the parent domain is quepublishing.com, additional domains in the same tree could have names such as products.quepublishing.com, accounts.quepublishing.com, or management.quepublishing.com. In addition, these child domains can also be parents of domains at a lower level—for example, Canada.products.quepublishing.com and USA.products.quepublishing.com. A domain called examcram.com would not belong to the same tree. Following the inverted tree concept originated by X.500, the tree is structured with the parent domain at the top and child domains beneath it. quepublishing.com

A tree consists of a group of domains that share a contiguous namespace, with the parent domain at the top.

FIGURE 1.2

accounts.quepublishing.com

products.quepublishing.com

management.quepublishing.com

WARNING Domain Hierarchy Although you could theoretically have any number of child domain levels, administration becomes difficult if there are more than a few levels. Try to avoid a domain hierarchy that is too complex.

By default, all domains in a tree link together with two-way, transitive trust relationships. You will learn more about trusts in Chapter 3.

17

Logical Components of Active Directory

Forest A forest is a grouping of domain trees that do not share a contiguous namespace (see Figure 1.3). For example, two trees whose parent domain names are quepublishing.com and examcram.com can be joined in a forest relationship, with each tree having its own namespace. Recalling the definition of namespace as a bounded area in which the directory can resolve names, the forest itself is also a namespace; in this case, it is a disjointed namespace. In other words, the two portions of the namespace do not share a name in common. By default, twoway transitive trust relationships exist between the parent domains in each tree throughout the forest. Again, these trust relationships do not need to be explicitly configured. In addition, all domains in the forest share a common schema, configuration, and global catalog.

quepublishing.com

accounts.quepublishing.com

products.quepublishing.com

examcram.com

FIGURE 1.3 A forest is a group of trees that form a disjointed namespace.

In a forest, one domain has to be the forest root domain. The forest root domain is always the first domain created when a new forest is created.

NOTE Creating a Forest You must first create the forest root; then you can create additional trees in the forest or additional domains in any tree in the forest. With the default Windows Server 2003 tools, you cannot join an existing domain to a tree or forest. Available third-party tools, however, can perform the tasks of pruning and grafting, as they are called. Alternatively, you can enable access between domains in different forests by creating a forest trust relationship. We discuss this trust relationship in Chapter 3.

Organizational Units An organizational unit is used to group objects within a domain into logical administrative groups (see Figure 1.4). It is a convenient grouping for holding objects that pertain to a given

18

Chapter 1: Concepts of Windows Server 2003 Active Directory

work unit, section, or department of an organization, such as the manufacturing department. A hierarchy of OUs is analogous to a hierarchy of folders on a disk; indeed, within the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in, the various OUs are depicted as folder icons.

Accounts

Receivable

Products

Payable

Domestic

quepublishing.com

Export

FIGURE 1.4 You can create hierarchies of OUs within your domain structure.

Each OU can contain any type of noncontainer object such as users, groups, and computers. In addition, it can contain additional OUs within it. Therefore, you can build an OU hierarchy to any depth within the domain. You can also modify or remove a series of OUs. Within each OU, you can perform actions such as creating, moving, deleting, and modifying objects within the OU, as easily as the OUs themselves. Some uses of OUs are as follows: . Apply different sets of policies to users with different requirements. For example, you

might want to apply a different desktop to accountants than to engineers. You can do this by specifying Group Policy Objects (GPOs) that apply to the respective OUs. . Delegate control of certain user and/or computer accounts to a subset of assistant

administrators so that they can be responsible for accounts located within only a portion of the company and can perform activities such as resetting passwords and so on. . Separate various types of objects. For example, you can use one OU to hold just client

computers, another for member servers, another for domain controllers, and yet another for user and group accounts. In fact, Microsoft creates a default Domain Controllers OU when you install Active Directory.

19

Logical Components of Active Directory

Child Domains or Organizational Units? As you have probably noticed, it is possible to configure corporate divisions either as additional domains or as OUs within the domain. Organizations have different reasons for preferring one type of structure over another. International companies might want to create a single domain for each country in which they operate. This configuration provides flexibility in dealing with issues such as legal requirements, language, currency, and so on. Other companies might want to separate operational divisions—for example, manufacturing, sales, and administration. Considerations such as plans for future acquisitions or divestitures or the opening of new operating divisions can play a role in deciding what organizational model you should adopt. When planning a domain structure, you should ensure that corporate management plays a significant role in the planning process and that the top executives are informed of any decisions made at all stages of the planning process. We discuss the planning of domains and OUs further in Chapter 2, “Planning and Implementing an Active Directory Infrastructure.”

Challenge Designing an Active Directory Forest and Domain Structure In this chapter we have looked at the logical containers of Active Directory—forests, trees, domains, and OUs. We have shown how it is possible to design an Active Directory infrastructure in more than one way, compared to the simpler design structures that were available in Windows NT 4.0. To obtain the best use of these features, you need to plan the deployment of Active Directory in advance of its actual installation. It is not enough simply to go ahead and upgrade all your company’s Windows NT domains to Active Directory, as many companies have found out in the years since Windows 2000 was introduced. Consider a fictional, multinational company named Widgets.com, with business in North America, Europe, Australia, and Japan. The company manufactures widgets and distributes them to independent retailers by means of a system of wholesale distribution centers. Table 1.1 shows a few business details about this company.

TABLE 1.1 Widgets.com Business Operations Country United States

Operations Corporate administrative headquarters and business offices, located in Atlanta, GA Ten manufacturing facilities in eight states Twenty wholesale distribution centers (continues)

20

Chapter 1: Concepts of Windows Server 2003 Active Directory

TABLE 1.1 Continued Country Canada

Operations One manufacturing facility Three wholesale distribution centers

United Kingdom

European administrative headquarters Two manufacturing facilities Four wholesale distribution centers

France

One manufacturing facility, designed to handle the entire western European continent One wholesale distribution center

Germany

One wholesale distribution center

Italy

One wholesale distribution center

Japan

Asian administrative headquarters One manufacturing facility One wholesale distribution center

Australia

Australian administrative headquarters One manufacturing facility Two wholesale distribution centers

The company has hosted multiple Windows NT domains with at least one domain at each location at which it does some type of business. The result was a huge conglomeration of multiple domains and trust relationships, security lapses, and administrative headaches. Management saw the use of Active Directory as a way out of its problems. Review the company’s structure and build paper models of possible tree, domain, and OU structures that would fit this company’s structure. There is no single correct solution to this problem; several different outcomes are possible and might work equally well. Look at the following as a basic series of steps that you should follow: 1. Determine the number of domains required. 2. Determine whether to upgrade existing domains or deploy new domains. Remember that existing Windows NT domains cover only a single office, manufacturing facility, or distribution center. 3. Select the forest root domain. 4. Decide on a tree structure. Do you want a single tree encompassing the entire company or multiple trees representing continents or countries? 5. Decide on the domain structure and a logical sequence of domain names. Remember that you should try to minimize the number of domains deployed in the forest. You can employ OUs to subdivide your directory structure further in terms of administrative units.

21

Physical Components of Active Directory

Review of Active Directory Components Following is a review of Active Directory’s logical structure: . A domain is a logical grouping of computers and users that share a common database

containing user accounts and other security information. . A tree is a group of domains that share a contiguous namespace—in other words,

a parent domain with one or more child domains. . A forest is a group of domain trees that do not share a contiguous namespace. . An organizational unit (OU) is used to group objects within a domain into logical

administrative groups.

Physical Components of Active Directory These divisions of Active Directory are only logical ones; you can have several domains, even an entire forest, at one location, or alternatively, you can have a single domain spread out over several buildings or cities. Microsoft has provided a means to recognize and take into account the physical structure of the enterprise. This fact is important for various reasons, including the need to maintain the replication of the Active Directory database over slow wide area network (WAN) links that exist between physical sites and the need for users to be able to log on to a domain controller over a high-speed link.

Sites A site is a set of one or more IP subnets connected by a high-speed, always available local area network (LAN) link. Figure 1.5 shows an example with two sites, one located in Chicago and the other in New York. In other words, a site is contained within one building, or perhaps within several adjacent buildings in a campus setting. The boundary of the site is typically the boundary of the LAN. A subnet can be associated with only a single site. Sites contain only resource objects, such as computers. By contrast, it is assumed that different sites are connected by slower, WAN links that might be available only at certain times of the day or on demand. Using sites permits you to configure Active Directory replication to take advantage of the high-speed connection. It also enables users to connect to a domain controller using a reliable, high-speed connection.

22

Chapter 1: Concepts of Windows Server 2003 Active Directory

NOTE Site and Domain Topologies The site topology of a network is different from the domain topology. Consequently, you can have one domain across more than one site, and you can have one site that contains multiple domains. You can even have multiple domains, each with portions thereof, on the same multiple sites.

Chicago

New York

FIGURE 1.5 A site is a grouping of resources in one physical location and is distinct from any domain grouping.

Domain Controllers Domain controllers (DCs) are Windows Server 2003 computers on which Active Directory has been installed. Likewise, any server on which Active Directory is installed is automatically a domain controller. These servers authenticate users on the domain and replicate information to other domain controllers. All changes to domain configuration, such as adding user accounts, are performed at a domain controller. The DC stores a complete copy of all objects contained within the domain—along with the Active Directory schema and configuration—in the Active Directory database file, ntds.dit. Note that the DC stores domain partition information only for the domain to which it belongs, but it stores schema and configuration partition information for the entire Active Directory forest. Each DC can write to Active Directory. Every domain must have at least one DC. A domain may have more than one DC; having more than one DC provides the following benefits: . Fault tolerance—If one domain controller goes down, another one is available to

authenticate logon requests and locate resources through the directory. . Load balancing—All domain controllers within a site participate equally in domain

activities, thus spreading the load out over several servers. This configuration optimizes the speed at which requests are serviced.

23

Physical Components of Active Directory

You can promote a Windows Server 2003 computer to the role of DC by running the dcpromo.exe program, which you can start from the Run command or from the Configure Your Server Wizard (see Figure 1.6) or the new Manage Your Server program. We discuss the details of promoting a server in Chapter 2.

FIGURE 1.6 You can configure various roles, including that of domain controller, by using the Configure Your Server Wizard.

Global Catalog Servers When you install the first domain controller in a new domain, this domain controller is also a global catalog server by default. In other words, it stores a copy of the global catalog, and users can query it to locate resources within the forest. Active Directory replicates this information to other global catalog servers in the forest. You can also designate additional domain controllers in the domain as global catalog servers. Doing so spreads out the task of locating resources between servers, thus facilitating response to user queries. This capability is especially important for domains that span more than one site. You can also move the global catalog role from one domain controller to another, if necessary. The global catalog server performs the following directory roles: . Locates objects within the forest—When a user searches for objects such as people,

folders, or printers, the global catalog enables her to locate objects in other domains within the forest. Active Directory automatically directs any search for the entire directory to the global catalog server. . Authenticates users by their UPN—When a user logs on to a domain other than his

home domain using the UPN (for example, [email protected] logging on to the products.quepublishing.com domain), the domain controller in the

24

Chapter 1: Concepts of Windows Server 2003 Active Directory products.quepublishing.com domain contacts the global catalog server to obtain

authentication information for this user. . Provides universal group membership information—A universal group can include

members from any domain in the forest, and its membership information, including permissions for resources assigned to it, is stored at the global catalog server. It supplies this information to a DC when a user who belongs to a universal group logs on. New to Windows Server 2003, a DC can then cache this information to facilitate future logons by the same user.

Flexible Operations Masters Although you can make most changes to Active Directory from any domain controller in the forest, you can perform certain functions only from specific locations. Microsoft has defined five specific roles, known as flexible single-master operations (FSMO) roles, which are assigned to specific domain controllers. The following two roles are located in only a single domain controller in the forest: . Schema master . Domain naming master

The other three roles are located on one domain controller in each domain: . PDC emulator . Infrastructure master . Relative identifier (RID) master

All five of these roles are located on the first domain controller installed in a new forest, and the three domain-specific roles are initially located on the first domain controller for each additional domain in the same forest. You can transfer these operations master roles to other domain controllers or seize their roles when a domain controller holding them becomes inoperable. Lack of availability of these operations masters affects the day-to-day management of Active Directory, as we discuss in the following sections.

Schema Master The schema master holds the only writable copy of the Active Directory schema and is the only location at which you can perform updates and modifications to the schema. If this role is unavailable, you cannot edit the schema until it is restored. We discuss the managing of schema modifications in Chapter 3.

25

Physical Components of Active Directory

Domain Naming Master The domain naming master plays a role in ensuring that names of newly created domains adhere to the proper naming conventions for new trees or child domains in existing trees, as described earlier in this chapter and illustrated in Figures 1.2 and 1.3. It also plays a role in removing domains from the forest. When you run dcpromo.exe on a server and select options to create a child domain or a new domain tree, the server contacts the domain naming master for this purpose. If this role is unavailable, you cannot create a new domain or remove an existing domain from the forest. We discuss creating child domains and new domain trees in Chapter 2.

PDC Emulator In a domain that contains Windows NT 4.0 backup domain controllers (BDCs) and is operating at the Windows 2000 mixed functional level, the PDC emulator propagates any changes to user properties, such as password changes to the BDCs. When a user logs on to a BDC from a down-level client computer, the BDC contacts the PDC emulator to ensure that modified credentials are available. If the user changes her password, the password change is handled by the PDC emulator, which replicates the changes to other domain controllers. This role is necessary because the NT 4.0 BDCs contain a read-only copy of the directory database. The PDC emulator also acts as a domain master browser for NetBIOS-based clients attempting to locate domain resources. If this role is unavailable, down-level clients cannot change their passwords. They also might be unable to log on if changes in their user account properties have taken place. In a mixed-mode domain with NT 4.0 BDCs, it would be impossible to make changes to any domain properties and have them propagate properly to the BDCs if the PDC emulator were unavailable. The PDC emulator in the forest root domain also operates as a time synchronization master and synchronizes the time on the various domain controllers. In its absence, the clocks on other domain controllers might lose their synchronization. This loss could cause problems in replication of the Active Directory database to other domain controllers.

Infrastructure Master The infrastructure master updates references from objects, such as membership in domain groups, in its domain to objects in other domains. When an administrator in any domain makes any changes to objects in his domain, the infrastructure master receives the changes from a global catalog server, updates this information in its database, and replicates the changes to the other domain controllers in its domain. This point is important because domain local groups can contain users and global or universal groups from other domains as well as the domain in which the group is located, and global groups can be made members of universal or domain local groups in other domains.

26

Chapter 1: Concepts of Windows Server 2003 Active Directory

WARNING Don’t Place the Infrastructure Master and Global Catalog Server on the Same Computer Because the infrastructure master must work with the global catalog server to keep group membership current, these two roles should be located on different servers from each other. Otherwise, the infrastructure master cannot locate any outdated data. For the infrastructure master to function properly, it should be located in the same site as a global catalog server.

RID Master The RID master assigns security identifiers (SIDs) to objects created in the domain. Every SID has two parts: a domain identifier that is common to all objects in the domain and a relative identifier (RID) that is unique to each object. In other words, no two objects in the same domain can have the same RID. The RID master hands out a pool of several hundred RIDs to every domain controller in the domain so that they can create new objects with unique identifiers. If this role is unavailable, other domain controllers cannot create new objects if they have no unused RIDs available.

Reviewing Active Directory’s Physical Components Following is a review of Active Directory’s physical structure: . A site is a set of one or more IP subnets connected by a high-speed LAN link. . A domain controller is a Windows Server 2003 computer on which Active Directory

has been installed. These servers authenticate users and replicate Active Directory data throughout the domain. . A global catalog server stores a copy of the global catalog and is used for communica-

tion between domains. . An operations master is a domain controller that performs one or more of five specific

roles that can be performed only from a single domain controller in the domain or forest.

Some Advantages of Active Directory over Older Directory Services Those of you who are just beginning to study Active Directory might wonder, “Why do we have to move from the comfort of the classic Windows NT directory service?” or “Why should we go to Active Directory?” The following are a few of the limitations of a Windows NT directory structure that Active Directory has improved on:

27

What Is New in Windows Server 2003 Active Directory? . Restricted size of the SAM—As already mentioned, the SAM is a flat database that

includes all user, group, and computer accounts. Because of its size limit, it cannot have more than about 40,000 objects representing approximately 25,000 user accounts. Many companies have required a multiple-domain model simply to circumvent this restriction. . Single point of failure—Because the PDC is the only computer with a read/write ver-

sion of the SAM, you cannot make any changes to domain containers should it become unavailable. . Poor operational performance—Because there is only a single PDC, the extent of

daily operations is limited to the capacity of this machine. This situation is more acute if the PDC is situated across a WAN link in another physical location. . Poor replication performance—If you have a large domain with many BDCs, the

PDC has to devote considerable effort in keeping the database replicated properly because of the hub-and-spoke replication topology (one PDC replicating directly to all BDCs). Active Directory sets up a replication topology that involves all domain controllers for a more efficient replication performance. . Limited management granularity—There is no capability for creating groups with

limited management capacity, except for groups such as Server Operators and Account Operators. In particular, you cannot delegate the administration of a portion of a domain to individuals or groups. Active Directory fixes this problem with its administrative delegation capability. . Nontransitive trust relationships—In Windows NT, you must configure all trust

relationships manually. In particular, trust relationships do not extend to more than two domains. (For example, if domain A trusts domain B and domain B trusts domain C, domain A does not trust domain C unless you configure an additional trust.) . Limited control of users’ desktops—In Windows NT, you can exert limited control

over what users can do on their desktops with System Policy. Active Directory presents Group Policy, which as you will see in Chapter 7, “Planning and Implementing Group Policy,” and Chapter 8, “Managing Group Policy,” provides a far greater capability of controlling desktops, applications, security, and much more.

What Is New in Windows Server 2003 Active Directory? Building on the initial version of Active Directory in Windows 2000, Microsoft has introduced a number of new features that enhance the manageability of Active Directory and increase its

28

Chapter 1: Concepts of Windows Server 2003 Active Directory

dependability. These new features thereby help to reduce the total cost of ownership of Active Directory. In the various chapters of this study guide, we discuss the enhancements of Windows Server 2003 alongside the older features. Here, we outline the more significant new features of Windows Server 2003 Active Directory. . Domain renaming—New to Windows Server 2003 is the ability to change the DNS

and/or NetBIOS names of any domain within the forest. Administrators can now make changes more easily in their Active Directory design—for example, when a company is sold or renamed. In a similar manner, you can also rename domain controllers. . Forest trusts—Administrators can configure trust relationships between different

Active Directory forests. This feature enables a user located in one forest to securely access resources in another forest. This capability can be useful when a new subsidiary company is acquired or when a company is hired under contract. . Schema modification—Microsoft has added new capabilities for redefining attributes

and class definitions in the Active Directory schema, including the deactivation of attributes that are no longer needed. . DNS enhancements—When you install the first domain controller, Windows creates

a more fully functional version of DNS, complete with the initial forward and reverse lookup zones. The debugging of problems related to improper DNS configuration is also simplified. . Enhancements to Group Policy—Microsoft has added new tools to facilitate the

management of Group Policy, as well as a considerable number of new policies that extend administrators’ ability to manage their domains. In particular, the new Resultant Set of Policy tool facilitates the task of resolving conflicts between multiple policies. The Group Policy Management Console is an optional add-on tool that simplifies Group Policy administration. . Application directory partition—This partition of Active Directory contains applica-

tion-specific data that needs to be replicated to specific domain controllers in the domain, and possibly to other domains in the forest. Certain types of applications create an application directory partition for ease of replication to other domain controllers. Its use can reduce replication traffic by replicating its data only to specific domain controllers. . New command-line tools—These new tools facilitate the administration of Active

Directory from the command line. This in turn enables administrators to schedule more tasks from the Task Scheduler, including tasks such as backups that are most conveniently run late at night when network use is minimal. You can even do some tasks remotely from the command line, such as remote administration of a server from your cell phone using only a wireless keyboard and the phone’s keypad.

29

What Is New in Windows Server 2003 Active Directory? . New wizards—Windows Server 2003 features new and improved wizards to facilitate

installation and management of Active Directory. They include the Manage Your Server application and enhancements to the Configure Your Server Wizard and the Active Directory Migration Tool version 2.0. . Active Directory Application Mode (ADAM)—Available as a separate component,

this new mode runs as a service and can be deployed on any member server as well as a domain controller. It addresses directory-related application deployment scenarios and is useful in fields such as e-commerce. ADAM also enables the functionality of directory-related applications beyond the domain or forest in which the application exists, or the use of such applications outside an Active Directory environment. . Improved ease of adding other domain controllers to an existing domain—You

can now use backup media to reduce the time required to add a new domain controller. This capability is especially useful in the case of a remote office. Rather than employing a lengthy replication of Active Directory partitions over a slow link, you can back up the domain controller’s system state to a CD, ship the CD to the remote office, and have staff at that office restore this data to the new DC. . Domain controller renaming—In Windows 2000, if you had to rename a domain

controller, it was necessary to demote the computer to a member server, rename it, and then promote it back to domain controller. Windows Server 2003 allows you to rename a domain controller without the need for demoting it. . New domain and forest functional levels—Because down-level domain controllers

do not support the new Windows Server 2003 functionality, Microsoft has introduced the following new domain functional levels: . Windows 2000 mixed—The default when you create a new domain, this func-

tional level allows support for domain controllers running Windows NT 4.0 and Windows 2000 in the same domain. It does not support new features introduced in either Windows 2000 or 2003, such as universal security groups and enhanced group nesting. . Windows 2000 native—This functional level allows support for Windows 2000

domain controllers but not Windows NT 4.0 domain controllers. It supports features of Windows 2000 Active Directory but not new Windows Server 2003 features such as those discussed in this section. . Windows Server 2003 interim—Used when upgrading a Windows NT 4.0

domain to Windows Server 2003, this functional level supports Windows NT 4.0 BDCs but does not support Windows 2000 domain controllers. . Windows 2003 native—This functional level supports all enhanced features of

Windows 2003 Active Directory but does not support domain controllers running older Windows versions.

30

Chapter 1: Concepts of Windows Server 2003 Active Directory

Microsoft has also introduced three forest functional levels: . Windows 2000 interim—The default when you first create a new forest, this

functional level allows support for domains operating in any of the domain functional levels. It does not support Windows Server 2003; rather, it supports only forestwide features such as domain renaming and enhanced schema modification. . Windows 2003 interim—Used when upgrading a Windows NT 4.0 enterprise

to a Windows 2003 forest, this functional level supports Windows NT 4.0 and Windows Server 2003 domain controllers, but not Windows 2000 domain controllers. . Windows 2003 native—This functional level supports only domains running

in the Windows 2003 native functional level and provides total support for all Windows Server 2003 Active Directory features. To facilitate the integration of Windows Server 2003 domain controllers into Windows 2000 domains, Microsoft has introduced a new command-line tool, Adprep. Located in the i386 folder of the installation CD-ROM, this tool, which prepares a Windows 2000 domain for upgrade, has two parameters: /forestprep and /domainprep. . /forestprep—Run this command on the schema master to prepare the forest for

upgrade. It extends the schema to receive the new Windows Server 2003 enhancements, including the addition of directory descriptors of certain objects. You should run this command before running the Adprep /domainprep tool on any of the domains. . /domainprep—Run this command on the infrastructure master of each domain to pre-

pare the Windows 2000 domain for upgrade to Windows Server 2003. It adjusts ACLs on Active Directory objects and on the Sysvol shared folder for proper access by Windows Server 2003 domain controllers.

What Is New in Windows Server 2003 Release 2 Active Directory? R2 Early in 2006, Microsoft introduced an interim upgrade to Windows Server 2003 known as Release 2, or R2. Built on the security improvements introduced in Service Pack 1 (SP1), R2 upgrades several important security and functionality features of Windows Server 2003, pending the release of the next Windows Server version, expected in late 2007.

31

What Is New in Windows Server 2003 Release 2 Active Directory?

Although Microsoft has not updated the 70-294 exam objectives to reflect the new components of R2, they might appear on exam questions related to the present objectives. Consequently, you should be familiar with these features. We introduce the following important Active Directory–related features here and describe these features in more detail at relevant locations in this study guide: . Security Configuration Wizard—Introduced with SP1, the Security Configuration

Wizard assists you in creating consistent security policies that can be applied to a series of servers. Policies created with the assistance of this wizard can be deployed using Group Policy to a site, domain, or OU. . Enhancements to ADAM—ADAM provides a storage location for directory-enabled

application data. Included is a setup wizard that enables you to create instances of ADAM along with associated application directory partitions. You can also create an ADAM administrator account in the configuration partition for administering the associated instance, and specify LDAP and Secure Socket Layer ports associated with this instance. Also included is an improved version of the LDAP editor tool (LDP) that includes the capability of accessing any LDAP server along with an ACL editor. ADAM also integrates with the low-level Active Directory Services Interfaces Editor (ADSI Edit) that enables you to view, edit, and delete Active Directory objects. See Chapter 2 for more information. . Active Directory Federation Services (ADFS)—ADFS provides a single sign-on

capability for authentication of users to multiple web-based applications. It facilitates the authentication of clients, suppliers, and partner company employees requiring access to web-based applications. ADFS securely shares credentials across enterprise borders, thereby eliminating the need to set up user accounts for these individuals. ADFS-based applications include a web agent that authenticates external users based on membership in groups created by the external organization for which you have specifically granted access. See Chapter 3 for more detail. . Services for UNIX—Provides password synchronization between Active Directory

servers and servers running UNIX Network Information Service, thereby enabling authentication across the two systems. . Improvements to Distributed File System (DFS)—DFS now includes two new

technologies that enable improved data (including Active Directory) replication across WANs. See Chapter 4 for more information: . DFS Namespaces—Enables you to present groups of folders located on different

servers as a virtual namespace tree. A new DFS Management snap-in facilitates management tasks and includes a wizard that simplifies the creation of new namespaces.

32

Chapter 1: Concepts of Windows Server 2003 Active Directory

EXAM ALERT Remember both terminologies The 70-294 exam might use the older FRS terminology. Understand that either term—FRS or DFS replication— might appear, and that they refer to the same feature.

. DFS Replication—Replaces Windows 2000 and

Windows Server 2003 File Replication Service (FRS), and provides improved multimaster replication across WANs. A new mechanism called remote differential compression (RDC) provides the capability of replicating only the changed portions of files, which can speed up Active Directory replication significantly.

. MMC version 3.0—Provides improved functionality for snap-ins written using .NET

APIs. An improved interface features an Actions pane that facilitates the performance of common tasks. Several new snap-ins, an improved Add/Remove Snap-in dialog box, and improved error-reporting capabilities have also been introduced. Automatically installed with Windows Server 2003 R2, you can also install MMC 3.0 on Windows XP Professional computers on which SP2 has been installed. MMC 3.0 will also be included in the upcoming Windows Vista release. For additional new features of R2, refer to What’s New in Windows Server 2003 R2 in the “Suggested Readings and Resources” section at the end of this chapter.

33

Chapter Summary

Chapter Summary In this chapter, we introduced you to the various concepts you should understand about Active Directory. We mentioned the shortcomings of the old Windows NT directory service and introduced the X.500 and LDAP building blocks on which Microsoft built Active Directory. We described the components of the Active Directory database, including the various objects and their attributes. Active Directory uses the LDAP distinguished name definitions, along with security identifiers (SIDs) and Globally Unique Identifiers (GUIDs) to identify every object uniquely. We introduced you to the series of Active Directory containers, including forests, trees, domains, and organizational units (OUs). We also introduced you to the schema and the global catalog, as well as the physical components of Active Directory, including sites and domain controllers. Specialized domain controllers (global catalog servers and the various operations masters) perform key operations that control the functionality of the domain and the forest. Finally, we summarized the most important new Windows Server 2003 Active Directory features that improve the functionality and ease the administration of domains and forests, as well as added features within R2.

Key Terms . Backup domain controller (BDC) . Container . Distinguished name (DN) . Domain . Domain controller . Domain name system (DNS) . Domain naming master . Flexible single-master operations (FSMO) . Forest . Functional level . Global catalog . Global catalog server . Globally Unique Identifier (GUID)

34

Chapter 1: Concepts of Windows Server 2003 Active Directory . Hierarchical . Infrastructure master . Lightweight Directory Access Protocol (LDAP) . Namespace . Object . Organizational unit (OU) . PDC emulator . Primary domain controller (PDC) . Relative distinguished name (RDN) . RID master . Schema . Schema master . Security identifier (SID) . Site . Tree . User Principal Name (UPN) . X.500

Suggested Readings and Resources 1. Microsoft Corporation. “Active Directory Collection.” http://technet2.microsoft.com/

WindowsServer/en/library/6f8a7c80-45fc-4916-80d9-16e6d46241f91033.mspx?mfr=true. 2. Microsoft Corporation. “What’s New in Windows Server 2003 R2.”

http://technet2.microsoft.com/WindowsServer/en/Library/f9d70026-ae8b-4969-87551ea1edc4e38e1033.mspx?mfr=true. 3. Microsoft Corporation. “Windows Server 2003 Active Directory.”

http://www.microsoft.com/windowsserver2003/technologies/directory/activedirectory/ default.mspx. 4. Microsoft Corporation. “Why Upgrade From Windows NT 4.0 to Windows Server

2003.” http://www.microsoft.com/windowsserver2003/evaluation/whyupgrade/nt4/ nt4townet.mspx.

2

CHAPTER TWO

Planning and Implementing an Active Directory Infrastructure Objectives This chapter covers the following Microsoft-specified objectives for the Planning and Implementing an Active Directory Infrastructure section of the Windows Server 2003 Active Directory Infrastructure exam:

Plan a strategy for placing global catalog servers . Evaluate network traffic considerations when placing global catalog servers. . Evaluate the need to enable universal group caching. . This objective is designed to ensure that you understand the importance of global catalog servers. To ensure that users can log on to Active Directory rapidly from any location, global catalog servers need to be available. In addition, universal group caching enables a user to log on without the need to contact a global catalog server after she has logged on previously to the same domain controller. You need to know the impact of global catalog servers on network traffic and how this traffic can be reduced by implementing universal group caching.

Plan flexible operations master role placement . Plan for business continuity of operations master roles. . Identify operations master role dependencies. . This objective evaluates your understanding of the importance of the operations master roles and what happens if one of them is not available. You need to understand what each operations master does and how to transfer these roles to other domain controllers.

Implement an Active Directory directory service forest and domain structure . Create the forest root domain. . Create a child domain. . Create and configure application data partitions. . Install and configure an Active Directory domain controller. . Set an Active Directory forest and a domain functional level based on requirements. . This objective ensures that you can create an Active Directory forest, including root and child domains, and raise its functional level to obtain the total benefits of an Active Directory implementation. You should keep in mind that installing Active Directory and installing a domain controller are one and the same. You should also understand the differences between installing child domains, installing additional trees in a forest, and installing additional domain controllers to an existing domain. You need to know when to raise your domain’s and forest’s functional level, and the benefits provided by doing so. In addition, you need to know how to create, manage, locate, and delete application directory partitions.

Outline Introduction Planning the Active Directory Namespace Subdividing the Active Directory Namespace Administrative or Geographical Organization of Domains

38

Domain Functional Levels

73

38

Forest Functional Levels and Requirements

74

39

Renaming Domains and Domain Controllers

77

Functional Levels Review

79

40

Use of Multiple Trees

41

Best Practices

41

Active Directory Namespace Review

Windows Server 2003 Functional Levels 73

43

Building an Active Directory Forest

43

Creating the Forest Root Domain

45

Sharing Active Directory Information Global Catalog Servers Evaluating Network Traffic Considerations When Placing Global Catalog Servers Universal Groups

81 82

83 84

53

Verifying Active Directory Installation

Evaluating the Need to Enable Universal Group Caching

85

53

Installing an Additional Domain Controller

Sharing Active Directory Information Review

87

55

Installing a Domain Controller from Backup Media

57

Active Directory Domain Controllers

87

67

Transferring Operations Master Roles

90

67

Using the Command Line to Transfer Operations Master Roles

93

Seizing Operations Master Roles

94

60

Uninstalling Active Directory

63

Application Directory Partitions

Creating Application Directory Partition Replicas

68

Application Directory Partition Reference Domains

69

Listing All Known Application Directory Partitions

69

Deleting Application Directory Partitions

70

Active Directory Application Mode (ADAM)

70

Upgrading Windows 2000 Domains and Forests Building an Active Directory Forest Summary

87

Business Continuity of Operations Master Roles

Creating Child Domains

Creating Application Directory Partitions

Placement of Flexible Operations Master Roles

Operations Master Role Dependencies

95

Operations Masters Review

98

Chapter Summary Key Terms Apply Your Knowledge

72 72

99 99 100

Exercises

100

Exam Questions

104

Answers to Exam Questions

110

Suggested Readings and Resources

113

Study Strategies This chapter covers how you set up Active Directory in various combinations of trees and domains. It also covers the management of global catalog servers and operations masters. You should understand how these components of Active Directory work together to keep your network functioning properly. In particular, you should pay attention to the following: . The different methods of installing domain controllers and how the installation procedure varies according to the logical creation point of each domain controller. . The benefits and requirements of the various domain and forest functional levels of Active Directory. . The functions of the global catalog servers and operations masters, and the problems that can occur if they are offline. You also need to know how to add global catalog servers and move operations master roles from one server to another.

38

Chapter 2: Planning and Implementing an Active Directory Infrastructure

Introduction In Chapter 1, “Concepts of Windows Server 2003 Active Directory,” we covered the basic building blocks of the logical Active Directory structure: forests, trees, domains, and organizational units (OUs). We also covered the concept of sites for distinguishing portions of the network separated physically by slow WAN links. The act of installing Active Directory on a server is conceptually very simple. You need only run the dcpromo.exe command and provide answers to the questions the wizard asks. Installing Active Directory is also simpler than installing a Windows NT 4.0 domain controller, for which you had to reinstall a server from scratch to promote a member server to domain controller or demote a domain controller to member server. The actual act of installing Active Directory, however, can be thought of as the tip of the iceberg. Before you install Active Directory, you need to plan how Active Directory will fit into your company’s corporate and geographical structure as well as your expectations for future growth and the potential for acquiring other companies. This chapter serves only as a basic introduction to the topic of planning.

Planning the Active Directory Namespace As we discussed in Chapter 1, the domain is the primary administrative unit within an Active Directory namespace. Windows Server 2003 uses the concept of domains to separate available resources among registered users. It is also the basic security unit, as you will see throughout this book, because many of the security requirements in Active Directory are focused at the domain level. Therefore, it is important to begin the process of planning any company’s Active Directory namespace from the viewpoint of the domain structure. All planning starts from the name of your company’s root domain. Recall in Chapter 1 that each tree has a root domain that is located at the top of the inverted tree structure. All subdomains contain this root domain name in their own domain name. In addition, the first domain in the entire forest is not only a root domain, but is also the forest root. Also, the top-level domain names used on the Internet and defined in the DNS hierarchy are included. The latter is not an absolute requirement if you are planning a domain that has no Internet representation whatsoever, but what company these days does not have a presence on the Internet? Therefore, it makes sense that your root domain can take the same name as your Internet domain name as registered with InterNIC (Internet Network Information Center). Consider a fictional company with an Internet domain name of company.biz. Although you can use this name as your Active Directory root domain name, it creates a risk of revealing your company’s Active Directory structure to the public Internet. Consequently, you might want to keep the internal name separate and use something like company.local for the Active Directory root domain name of the same fictional company.

39

Planning the Active Directory Namespace

Subdividing the Active Directory Namespace You can subdivide your namespace within Active Directory in two ways: . Separate domains . Organizational units (OUs)

In many instances, the use of separate domains or OUs would serve just as well as the other. In larger companies, the use of separate domains often arose from the limitations of the Security Accounts Manager (SAM) database in Windows NT. Because the Active Directory database can hold millions of objects, this limitation is seldom of importance in Active Directory design. For this reason, and because a single domain structure is the easiest type of structure to administer, this method is the best means of organizing your company’s namespace if possible. There is no specific need to create separate domains for administrative functions, geographical sites, or departments in the company. Logically, you can handle this function by setting up a system of OUs. An internal system of OUs provides the following additional advantages: . It can be administered either centrally or locally. The concept of delegation of control

in Active Directory facilitates the assignment of individuals as local administrators. . User authentication is simpler and faster within a single domain environment, regard-

less of where a user is located. . It is far simpler to modify when needed—for example, if your company is reorganized. . It is flexible and can include an internal hierarchy of departments, sections, work units,

and so on. There are, however, reasons for using separate domains for discrete divisions of your company: . This approach can facilitate decentralized administration of network resources. . In the case of multiple Internet domain names, the domain can be built to mirror the

Internet functionality. . Multiple domains representing different geographical locations might reduce the

amount of replication traffic across slow WAN links. . User account requirements that vary among departments or locations, such as pass-

word complexity, can be handled only by separate domains. . International legal and language needs might be handled more easily by using separate

domains. . Very massive organizations can be broken down into a domain structure.

40

Chapter 2: Planning and Implementing an Active Directory Infrastructure

Administrative or Geographical Organization of Domains You can organize a series of domains along either administrative or geographical means. For example, Figure 2.1 shows mycompany.com organized along three administrative divisions— Accounting, Products, and Advertising—all reporting to a Management group; contrasted with the company’s main offices located in San Francisco, Dallas, Toronto, and Atlanta.

Management

Accounting

Products

Advertising

Toronto

San Francisco Atlanta Dallas

FIGURE 2.1 Administrative and geographical divisions of mycompany.com.

You need to take into account conditions that favor either the administrative or geographical model. This can include the following factors: . Plans for future offices in additional cities . Projected growth of each of the company’s divisions . Potential for reorganization of the company along new departmental lines . Requirements for centralized or decentralized administration of the company . Needs for different security levels in either certain departments or certain offices . Current or future use of one or more Internet DNS namespaces

Such factors suggest the best domain organization for your company’s Active Directory namespace.

41

Planning the Active Directory Namespace

NOTE Plan Your Active Directory Deployment Carefully Due to the nature of Active Directory, the idea of domain planning is very different with Windows Server 2003 than it was with Windows NT 4.0. It is essential that you develop a tactical deployment plan before you begin. First, you must carefully evaluate the physical and administrative structure of the company. Then you will be in a position to decide on an administrative model and hence an appropriate domain structure. At the same time, be extremely careful and thorough in making your choice. It is far easier to create new OUs and move objects to them than to do the same with domains. Although you can rename a domain in Windows Server 2003 Active Directory, this process can be problematic and disruptive to proper network communication.

Use of Multiple Trees Within the Active Directory forest, you may have one or more trees. As outlined in Chapter 1, the main difference between trees and forests is that domains within a tree share a contiguous namespace, whereas domains located in different trees in the same forest have a disjointed namespace. Thus, quepublishing.com and examcram.com are root domains in two separate trees of the same forest. In almost all multiple domain enterprises, it makes sense to employ a single tree. The major exception occurs when two companies merge and want to maintain their separate identities. Their identities, and indeed their Internet namespaces, are best served by having more than one tree in the forest.

NOTE The Empty Forest Root Domain Another way of designing a multidomain forest is to employ an empty forest root domain, with a series of child domains representing administrative or geographical divisions of the company. The root domain contains only a small number of objects, and you can readily control membership in the Enterprise Admins and Schema Admins groups. The impact of business decisions such as the spin-off or renaming of subsidiary companies can be handled more readily. On the other hand, you must ensure that the forest root domain controllers are carefully secured and protected against disaster because their loss effectively destroys the entire forest structure.

Best Practices Planning the Active Directory domain structure is an act that has far-reaching implications. This process is something that cannot simply be decided by a few network administrators sitting down with a few diagrams of the network and company business structures. Rather, it must involve the company’s senior and middle management as well as business strategy specialists and representatives from remote offices. If you use internally developed applications,

42

Chapter 2: Planning and Implementing an Active Directory Infrastructure

representatives of the development team should be involved. The following several guidelines will help you make your Active Directory implementation proceed smoothly: . Know everything there is to know about the network—Although this guideline

might sound intuitive for senior administrators who have built the network from the ground up, those who have come on the scene more recently need to gather information about everything that must be accounted for in an Active Directory plan. . Employ a test lab—The lab should contain representative domain controllers, mem-

ber servers, and client computers. Set up a mini-version of your complete network and engage the assistance of a representative set of users to test all facets of the implementation thoroughly. . Prepare thorough documentation—This point can never be understated. Use tools

such as Microsoft Visio to prepare diagrams of different levels of company detail, from the major administrative units down to the smallest workgroups. Visio is a tool that is specifically designed for preparing administrative diagrams such as those required in this scenario. This exercise also helps in optimizing communication between technical individuals and top management. . Use an email distribution list to keep everyone informed—When all concerned

individuals have full access to the latest developments, unpleasant surprises are minimized. . Keep all employees informed—Although the regular workers might not understand

the details of what is happening, they should be informed of the summary points of any planned changes. They will then be much more able to cope with the changes. In addition, they could provide valuable feedback. . Ensure that all top managers know what’s happening—This point also can never

be understated. This helps prevent unpleasant surprises and the need to redo portions of the planning process. . Understand thoroughly the network’s TCP/IP infrastructure—Your under-

standing helps in designing the network and DNS configuration that is the foundation of the Active Directory infrastructure. It is especially true in developing the proper site structure, as will be discussed in Chapter 3, “Managing an Active Directory Infrastructure.” . Develop and adhere to an adequate security policy—Thoroughly review any secu-

rity policy that your company already has in place. Apply the policy’s constraints to the proper design of your company’s domain structure. Make any appropriate changes as you develop the Active Directory infrastructure.

43

Building an Active Directory Forest . Know the capabilities of your WAN links—If your network includes slow WAN

links, test and monitor the use of these links before and during the Active Directory implementation to ensure that you have the optimum configuration.

Active Directory Namespace Review Following are the key aspects involved in planning an Active Directory namespace from the viewpoint of the domain structure: . You can use either subdomains or OUs to subdivide your Active Directory namespace.

Although employing OUs in a large domain is simple, you might want to employ more than one domain for several reasons. . Two common means of organizing a series of domains are administrative and

geographical. . It is essential to plan the Active Directory structure thoroughly before starting any

kind of implementation. Keep everyone informed at all stages of the process.

Building an Active Directory Forest After you have created a comprehensive plan for your organization’s Active Directory structure, you are almost ready to install Active Directory. The first task that you must perform is to install the first domain controller for the forest root domain. You need to understand and realize several points before you actually start the process of installing Active Directory. First, the computer on which you install Active Directory must meet the following requirements: . Operating system—The computer must be running Windows Server 2003 Standard

Edition, Enterprise Edition, or Datacenter Edition. Note that a server running Windows Server 2003 Web Edition cannot be promoted to a domain controller. . Hard disk space—The computer must have a minimum of 200MB of disk space for

the Active Directory database, plus at least 50MB of disk space for the transaction log files, and additional space if it is a global catalog server. As the number of objects in Active Directory grows, the required disk space increases rapidly. The recommended minimum disk space is 1GB. It is wise to plan for this requirement in advance according to your network’s current and future anticipated size. . A disk volume formatted with the NTFS file system—Not only is having such a

volume recommended for file security, but it is also required for the SYSVOL folder. If this is not available, Active Directory installation cannot start.

44

Chapter 2: Planning and Implementing an Active Directory Infrastructure

NOTE Use of a Fault-Tolerant Disk Volume It is highly recommended that you use a fault-tolerant disk volume such as RAID-1 (disk mirroring) or RAID-5 (disk striping with parity) to hold the Active Directory database, log files, and SYSVOL folders. This enables the domain controller to continue functioning in the event of a disk failure until you are able to shut the server down to replace the failed disk. But remember that fault tolerance is no substitute for regular backups. We discuss backup and restore of domain controllers in Chapter 4, “Maintaining an Active Directory Infrastructure.”

. A DNS server—You must have available a DNS server that supports service (SRV)

resource records and the dynamic update protocol. This can be a Windows 2000, Windows Server 2003, or Berkeley Internet Name Domain (BIND) 4.9.7 or higher server. BIND versions 8.2.1 and higher provide complete Active Directory functionality. It need not be on the same server as the intended domain controller, but it should be if you want to integrate the DNS database with Active Directory. If an appropriate DNS server is not available, you will be prompted to install one during the Active Directory installation. . Administrative privileges—You must be using an account with the appropriate

administrative privileges for creating a domain on an existing Windows Server 2003 network. For creating the first domain controller, you must be logged on as a local administrator on the standalone server. To add a domain to a forest, you must be logged on as a member of the Enterprise Admins group, and to add a domain controller to an existing domain, you must be logged on as a member of the Domain Admins or Enterprise Admins group.

Active Directory and UNIX DNS Many companies have operated UNIX-based DNS servers in recent years. These servers have cooperated well with networks that run Windows NT, but with the advent of Active Directory in Windows 2000 and now Windows Server 2003, DNS has become elevated to a pivotal role. The popularity of UNIX-based DNS servers traces back to the beginnings of the Internet and the need for an automated naming service that could translate domain names to IP addresses and did not require continual manual updates, as the original system of HOSTS files did. The first DNS implementations were hosted on UNIX servers. They employed the Berkeley Internet Name Domain, which was developed at the University of California in Berkeley. A series of updates to BIND followed, each adding new features to DNS. BIND versions 4.9.7 and later allow SRV resource locator records, and versions 8.1.2 and later allow dynamic updating. As you have learned here, the Active Directory Installation Wizard installs DNS if a suitable DNS server is not available on the network. However, many companies have found that the wizard asks to install DNS despite the presence of a UNIX-based DNS server on the network. (continues)

45

Building an Active Directory Forest (continued)

What is the reason for this? It lies in the BIND version, as explained here, because Active Directory requires the ability to create SRV resource records. Although it is not required, the ability to support dynamic DNS is highly desirable. Therefore, you need to update the BIND version to 4.9.7 or later to be able to use the UNIX DNS server with Active Directory, and you should update to version 8.2.1 or later for full capabilities.

In addition, you should also be aware of the following changes that are made when you upgrade a server to a domain controller: . Local user and group accounts are deleted—Because all user and group account

information is stored in Active Directory, accounts contained within the standalone server’s SAM database are deleted. You must create domain user accounts that embody the privileges of the existing user accounts. The only exception is for the first domain controller in a domain; its local user accounts are migrated to the Users container in Active Directory. Before starting to install Active Directory, make sure that you have enumerated the existing accounts and their permissions so that you can re-create them later. . Permissions on resources are reset—Because the accounts no longer exist, neither

do the permissions granted to them. Therefore, all permissions revert to Everyone, Read, and will have to be reconfigured after new domain accounts have been created. . Encryption keys are lost—If you have encrypted data using the Encrypting File

System (EFS), you should decrypt these files before installing Active Directory, or at least export the cryptographic keys. These files will otherwise become unreadable. You can always re-encrypt the files later.

Creating the Forest Root Domain Objective:

Implement an Active Directory directory service forest and domain structure . Create the forest root domain

Microsoft has provided the Active Directory Installation Wizard with the capabilities of installing domain controllers under all conceivable scenarios. This wizard can perform the following tasks: . Create a new forest . Create a new domain tree . Create the first domain controller in a new domain

46

Chapter 2: Planning and Implementing an Active Directory Infrastructure . Create additional domain controllers for an existing domain . Install a DNS server if a suitable DNS server is not available . Create the Active Directory database and log files . Create the shared system volume, SYSVOL . Remove Active Directory services

The options presented by the Active Directory Installation Wizard depend on whether you are creating a new forest, a new tree in an existing forest, a new domain in an existing tree, or a new child domain. The additional options are covered in the “Installing an Additional Domain Controller,” “Creating Child Domains,” “Installing a Domain Controller from Backup Media,” and “Uninstalling Active Directory” sections of this chapter. Step by Step 2.1 outlines the procedure for creating the first domain controller in a new forest.

STEP BY STEP 2.1 Installing the First Domain Controller 1. Start the Active Directory Installation Wizard. You can do this by clicking Start, Run, typing dcpromo, and pressing the Enter key. You can also do this by clicking Start, Administrative Tools, Manage Your Server. This procedure displays the Manage Your Server dialog box, as shown in Figure 2.2.

Starting the Active Directory Installation Wizard from the Manage Your Server dialog box.

FIGURE 2.2

2. If you are using Manage Your Server, click Add or Remove a Role, and in the Configure Your Server Wizard page that appears, verify that you have performed the listed steps. Then click Next and perform the following steps:

47

Building an Active Directory Forest . The wizard tests your network settings and then displays a Server Role page. Select Domain Controller (Active Directory) and click Next. . On the Summary of Selections page, review the options and click Next to start the Active Directory Installation Wizard. 3. The Active Directory Installation Wizard displays a Welcome page. Click Next. 4. The Operating System Compatibility page, shown in Figure 2.3, informs you that improved Windows Server 2003 security settings affect how older versions of Windows communicate with the domain controller. Windows 95 and NT 4.0 Service Pack 3 and earlier cannot meet the new requirements and therefore cannot log on to a Windows Server 2003 domain controller. Click Next.

You are informed about security settings that prevent some older Windows clients or non-Windows systems from logging on to the Windows Server 2003 domain controller.

FIGURE 2.3

5. On the Domain Controller Type page, ensure that Domain Controller for a New Domain is selected and then click Next (see Figure 2.4).

FIGURE 2.4

Creating a new domain.

48

Chapter 2: Planning and Implementing an Active Directory Infrastructure 6. On the Create New Domain page, select Domain in a New Forest to create the first domain in a new forest and then click Next (see Figure 2.5).

FIGURE 2.5

Creating a new forest.

7. On the New Domain Name page, type the full DNS name of the new domain to be created (for example, quepublishing.com) in the text box provided and then click Next (see Figure 2.6).

Specifying the new domain name.

FIGURE 2.6

8. The NetBIOS Domain Name page should display the most qualified (first) part of the domain name (for example, QUEPUBLISHING), as shown in Figure 2.7. This name is used by down-level clients, such as Windows 98 or NT 4.0, to connect to the domain controller. Accept this or type a different name, and then click Next. This name must be unique to the entire Active Directory forest. You generally should accept this name unless you have a good reason to do otherwise.

49

Building an Active Directory Forest

Specifying the NetBIOS name of the domain.

FIGURE 2.7

9. The Database and Log Folders page, shown in Figure 2.8, displays the default locations of these folders. You might want to move one of these folders to a different physical drive for improved performance. Click Next when you are ready.

Specifying the locations of the database and log files.

FIGURE 2.8

10. The Shared System Volume page, shown in Figure 2.9, displays the default location of the SYSVOL folder. You might want to move this folder to a different drive for improved performance. It must be placed on an NTFS-formatted partition. Click Next when you are ready.

50

Chapter 2: Planning and Implementing an Active Directory Infrastructure

Specifying the location of the SYSVOL folder.

FIGURE 2.9

11. The wizard searches for a DNS installation and then displays the DNS Registration Diagnostics page. If it does not find an appropriate DNS server, the wizard offers to install DNS on the domain controller, as shown in Figure 2.10. You should accept this option and then click Next.

FIGURE 2.10 Specifying the installation of DNS on the new domain controller.

NOTE Using an Existing DNS Server If you are using an existing DNS server, you should ensure that the server you are promoting is configured with the address of the DNS server before you run dcpromo.

12. The Permissions page offers a selection between two permissions levels. If you are operating Windows NT 4.0 Remote Access Service (RAS) servers on the network, you need to select the weaker security level, which is represented by the Permissions Compatible with Pre-Windows 2000 Server Operating Systems option, so that they authenticate properly to the domain controller. Otherwise, leave the default

51

Building an Active Directory Forest option of Permissions Compatible Only with Windows 2000 or Windows Server 2003 Operating Systems selected, as shown in Figure 2.11. Then click Next.

FIGURE 2.11

Specifying security

permissions.

WARNING Security Risk Selecting the Pre-Windows 2000 Servers option presents a security risk. Selecting this option adds the Everyone group to the Pre-Windows 2000 Compatible Access group. As a result, everyone, whether authenticated or not, can read any property of any user or group account in the directory. The best option is to upgrade the RAS servers to Windows 2000 or Windows Server 2003.

13. The Directory Services Restore Mode Administrator Password page, shown in Figure 2.12, asks for the password used to start the domain controller in the Directory Services Restore Mode. Type and confirm a suitable password and then click Next.

FIGURE 2.12 Specifying the Directory Services Restore Mode Administrator password.

52

Chapter 2: Planning and Implementing an Active Directory Infrastructure

WARNING Use a Secure Password You should use a hard-to-guess password that includes a mix of upper- and lowercase letters, numerals, and punctuation characters. Be sure to write down this password and store it in a secured location, such as a locked drawer or cabinet where you keep backup tapes. The local Administrator account uses this password to log on to this computer when it is started in Directory Services Restore Mode. This is a special mode used for restore operations and for certain maintenance options, such as defragmenting the database file or moving it to another location. This account is the only local account that will exist after Active Directory installation is complete. See Chapter 4 for more details.

14. The Summary page displays a summary of the options you have configured. If any option is incorrect, click Back to correct it; click Next to install Active Directory. 15. The Active Directory Installation Wizard displays a progress page as it installs and configures DNS and Active Directory (see Figure 2.13). If it asks you for the Windows Server 2003 CD-ROM, insert it and click OK.

FIGURE 2.13

Installing Active Directory.

16. When installation of Active Directory is complete, the wizard displays a completion page. Click Finish. 17. You are told you must restart the computer to complete the Active Directory installation. Click Restart Now to restart the computer.

EXAM ALERT Placing the Database and Log Folders The purpose of placing the database and log folders on a separate drive from the SYSVOL folder is only to improve I/O performance. Such an act does not improve on security or fault tolerance, as an exam question might lead you to believe. Installing Active Directory You should be aware of the prerequisites that must be satisfied before you can install Active Directory. They include the differences between installing the first or additional domain controllers, new trees, and child domains. You might have to follow the proper installation steps in a simulation question on the exam. Remember that you need an NTFS partition to hold the SYSVOL folder, and remember that DNS must be available and support SRV resource records and (preferably) dynamic updates.

53

Building an Active Directory Forest

Active Directory Domain Controllers Objective:

Implement an Active Directory directory service forest and domain structure . Install and configure an Active Directory domain controller

After you have installed the first domain controller in your forest, you should perform the following additional tasks: . Verify the initial configuration of the first domain controller—Problems in Active

Directory installation usually show up as error messages during the installation process. However, occasional problems do not manifest themselves in this way; if not corrected, they could lead to more serious trouble at a later stage. . Verify the proper configuration of the DNS server—If the DNS server has not

been properly installed, many errors could occur at later stages, including the inability to contact the first domain controller when installing additional domain controllers or child domains. Users might also have difficulty logging on or accessing domain resources. . Install one or more additional domain controllers—To provide redundancy and

fault tolerance, you should install at least one additional domain controller. For a domain that spans large numbers of users and physical sites, additional domain controllers are necessary, including at least one at each additional site.

Verifying Active Directory Installation After you have installed Active Directory, you should take several steps to verify the installation. Step by Step 2.2 outlines several steps you should take to ensure the proper installation of Active Directory.

STEP BY STEP 2.2 Verifying Active Directory Installation 1. Click Start, Administrative Tools. As shown in Figure 2.14, Active Directory installation should include three default MMC snap-ins, which include the following: . Active Directory Domains and Trusts—Manages trust relationships with other forests and with Windows NT 4.0 domains . Active Directory Sites and Services—Manages Active Directory sites and replication . Active Directory Users and Computers—Manages users, groups, OUs, and computers in the domain, including Group Policy

54

Chapter 2: Planning and Implementing an Active Directory Infrastructure

FIGURE 2.14 Three snap-ins for managing Active Directory should appear at the top of the Administrative Tools folder.

2. Open Active Directory Users and Computers. Expand your domain name and ensure that the following containers are present: Computers, Users, and ForeignSecurityPrincipals. A Domain Controllers OU should also be present. 3. Select the Domain Controllers OU. An account with the name of the server should appear in the details pane, as shown in Figure 2.15.

FIGURE 2.15 A computer account for your new domain controller should appear in Active Directory Users and Computers.

55

Building an Active Directory Forest 4. The Administrative Tools folder should also contain a link to the DNS snap-in. Click this link to open the DNS snap-in. 5. Expand the server to reveal a link to Event Viewer as well as forward and reverse lookup zones, and then expand the forward lookup zone. You should see two folders for your domain name, one of them prefixed with _msdcs. Each contains several subfolders. 6. Look for SRV resource records in the _tcp and _udp nodes. If they are not present, wait a few minutes and refresh the display. If they are still not present, right-click the zone name and choose Properties. As Figure 2.16 shows, an Active Directory–integrated zone should exist, and the Dynamic Updates list should read Secure only. If not, change these values and then restart the Netlogon service to force the SRV resource records to be re-registered.

FIGURE 2.16 The zone Properties dialog box should indicate secure dynamic updates and an Active Directory–integrated zone.

7. After you have verified these records, close the DNS snap-in. 8. Click Start, My Computer, and navigate to the system root folder (usually C:\Windows). Verify that the NTDS (Active Directory database) and SYSVOL (shared system volume) folders are present. If you specified another location while running the Active Directory Installation Wizard, navigate to that location.

Installing an Additional Domain Controller Having installed and verified the first domain controller in the new forest, you should next install an additional domain controller in the same domain. You need a computer running any edition of Windows Server 2003 except the Web edition, and the server should first become a

56

Chapter 2: Planning and Implementing an Active Directory Infrastructure

member server in the domain in which it will be a domain controller. You also need to use an account with Domain Admins or Enterprise Admins membership. The procedure for installing the second domain controller is quite straightforward, as Step by Step 2.3 shows.

STEP BY STEP 2.3 Installing a Second Domain Controller 1. Click Start, Run, type dcpromo, and press Enter. You can also use the Manage Your Server Wizard, as described in Step by Step 2.1. 2. Click Next twice to bypass the Welcome page and the Operating System Compatibility page of the Active Directory Installation Wizard. 3. On the Domain Controller Type page, select Additional Domain Controller for an Existing Domain and then click Next. 4. The Network Credentials page asks for the username and password of an account with administrative privileges in the domain. If the computer is already configured as a member server in the domain, the domain name should appear, as shown in Figure 2.17; otherwise, type it in. Then click Next.

FIGURE 2.17 You need to supply credentials for an administrator account in the domain in which you are creating an additional domain controller.

5. The Additional Domain Controller page displays the name of the domain for which the server will become an additional domain controller, as shown in Figure 2.18. If this name is incorrect, type it or click Browse to locate the proper domain. Then click Next.

57

Building an Active Directory Forest

FIGURE 2.18 Specifying the domain in which you are making an additional domain controller.

6. Confirm or modify the locations of the Active Directory database and log files and then click Next. 7. Confirm or modify the location of the SYSVOL folder and then click Next. 8. Type and confirm the directory services restore mode administrator password and then click Next. 9. Review the information presented on the Summary page. If anything is incorrect, click Back. Otherwise, click Next to begin installing Active Directory. 10. When the completion page appears, click Finish and restart your computer as directed.

After you have completed installing each additional domain controller, you should verify the installation as described in Step by Step 2.2, except for the DNS step. DNS is not automatically installed on an additional domain controller. If you need DNS on the additional domain controller, you should use the Manage Your Server Wizard or Control Panel Add or Remove Programs to install it.

EXAM ALERT DNS Is Assumed to Exist You might see a tricky exam question that asks you to troubleshoot a DNS problem occurring during installation of another domain controller. Not only does dcpromo not install DNS when installing an additional domain controller, Active Directory does not even check that the DNS server is present and functioning. The system assumes that the presence of a DNS server was established when the first domain controller was installed.

Installing a Domain Controller from Backup Media The Active Directory Installation Wizard provides an Install from Media option that enables you to perform a domain controller installation using a system state backup from another

58

Chapter 2: Planning and Implementing an Active Directory Infrastructure

domain controller in the same domain as a source of Active Directory information. The Install from Media feature provides the following advantages: . Less time required to copy domain and global catalog information to the new domain

controller. . Less network traffic during domain controller promotion. . Less time required for recovery of a failed domain controller.

To install a new domain controller from media, first perform a system state backup of an existing domain controller in the same domain. Refer to Chapter 4, Step by Step 4.12, “Backing Up System State Data,” for instructions. You then restore this backup to the server you want to promote, and run the Active Directory Installation Wizard using the /adv option. Step by Step 2.4 shows you how:

STEP BY STEP 2.4 Installing a Domain Controller from Media 1. Log on to the server to be promoted as a member of the local Administrators group. 2. Click Start, Run, type ntbackup, and press Enter. 3. On the welcome page of the Backup or Restore Wizard, click Advanced Mode. 4. Select the Restore and Manage Media tab. 5. From the Tools menu, select Catalog a Backup File, type or browse to the location of the system state backup you have created, and then click OK. As shown in Figure 2.19, you can specify a network location.

FIGURE 2.19

be restored.

Locating the backup file to

59

Building an Active Directory Forest 6. The backup is added to the left pane of the backup window. Expand this entry to locate and select the system state backup. 7. From the Restore files to drop-down list, select Alternate location and then specify C:\Ntdsrestore in the Alternate location text box, as shown in Figure 2.20. Click Start Restore.

FIGURE 2.20 You will need to restore system state to an alternate location.

8. Click OK to accept the warning that not all system state data will be restored to the alternate location and then click OK again to perform the restore. 9. When the restore is completed, click Close and then close the Backup Utility dialog box. 10. Click Start, Run, type dcpromo /adv, and press Enter. 11. Click Next twice to bypass the Welcome page and the Operating System Compatibility page of the Active Directory Installation Wizard. 12. On the Domain Controller Type page, select Additional Domain Controller for an Existing Domain and then click Next. 13. On the Copying Domain Information page shown in Figure 2.21, select the location to which you restored the backup files. If necessary, click Browse to locate the backup files. Then click Next.

60

Chapter 2: Planning and Implementing an Active Directory Infrastructure

FIGURE 2.21 The Copying Domain Information page enables you to choose whether to copy information across the network or from restored backup files.

14. If the restored backup files were from a domain controller configured as a global catalog server, the Global Catalog page asks whether you want to configure the new domain controller as a global catalog. Click Yes or No as required and then click Next. 15. On the Network Credentials page, type the name and password of an account with domain administrative privileges and then click Next. 16. Follow steps 6 to 10 of Step by Step 2.3 to complete installation of the domain controller.

NOTE Use Dcpromo /adv to Create a Domain Controller at a Remote Site If you need to install a domain controller at a remote site connected to the rest of the network by a slow WAN link, using Dcpromo /adv reduces the time required to create the domain controller because it avoids the transfer of a large quantity of Active Directory data across the slow link.

Creating Child Domains Objective

Implement an Active Directory directory service forest and domain structure . Create a child domain

In building an Active Directory tree structure, you will encounter the need to create child domains in the same tree. The procedure, which is similar to that of creating a forest root domain, is outlined in Step by Step 2.5.

61

Building an Active Directory Forest

STEP BY STEP 2.5 Creating a Child Domain 1. Click Start, Run, type dcpromo, and press Enter. You can also use the Manage Your Server Wizard, as described in Step by Step 2.1. 2. Click Next twice to bypass the Welcome page and the Operating System Compatibility page of the Active Directory Installation Wizard. 3. On the Domain Controller Type page, ensure that Domain Controller for a New Domain is selected and then click Next. 4. On the Create New Domain page, select Child Domain in an Existing Domain Tree and then click Next. 5. On the Network Credentials page, type the name and password of an administrator account in the parent domain. If the domain name does not appear, type it and then click Next. 6. On the Child Domain Installation page, type the names of the parent and child domains in the text boxes provided and then click Next. These names are combined to produce the complete DNS name of the child domain, which is also displayed as shown in Figure 2.22.

FIGURE 2.22

Specifying the name of the

child domain.

7. The NetBIOS Domain Name page displays the NetBIOS name used by down-level Windows clients to connect to the new domain. This name must be unique within the entire forest. Accept this name or type a different name, and then click Next.

NOTE Remember That Each Domain Must Have a Unique NetBIOS Name If the NetBIOS Domain Name page displays the name of the parent domain, you must overtype this name with a unique name such as the first part of the child domain name you specified in step 6.

62

Chapter 2: Planning and Implementing an Active Directory Infrastructure 8. Confirm or modify the locations of the Active Directory database and log files and then click Next. 9. Confirm or modify the location of the SYSVOL folder and then click Next. 10. As shown in Figure 2.23, the DNS Registration Diagnostics page verifies the existence of a DNS server on the parent domain controller, if available. Otherwise, it informs you that you need to install DNS on this server, as shown previously in Figure 2.10. If so, accept the option to install DNS and then click Next.

WARNING Remember That Each Domain Must Have a Properly Functioning DNS Server If you select the I Will Correct the Problem Later by Configuring DNS Manually (Advanced) option in Figure 2.10, make very sure that you install, configure, and test DNS on the appropriate server immediately after completing the domain controller installation. Improper DNS configuration is the source of many problems with Active Directory.

FIGURE 2.23

Confirming the availability of

a DNS server.

11. The Permissions page offers a choice of default permissions, as explained previously and shown in Figure 2.11. Unless you have a specific need to do otherwise (such as using Windows NT 4.0 RAS servers), accept the default of Permissions Compatible Only with Windows 2000 or Windows Server 2003 Operating Systems, and then click Next. 12. Type and confirm a Directory Services Restore Mode Administrator password and then click Next. 13. Review the information on the Summary page. If necessary, click Back to make any needed corrections. Then click Next to install Active Directory. 14. When the Completing the Active Directory Installation Wizard page appears, click Finish and then restart the computer.

63

Building an Active Directory Forest

Again, you should verify proper installation of Active Directory and install at least one additional domain controller for your new child domain. Another similar option that you might encounter in building your Active Directory infrastructure is that of creating a new domain tree in the same forest. The procedure for doing so is similar to that of Step by Step 2.4, except that on the Create New Domain page (shown previously in Figure 2.5), you select the Domain Tree in an Existing Forest option.

The Test Lab Last year, a major auto parts manufacturer realized that its Windows NT 4.0 network was not handling its increasing business demands in an optimal fashion. Orders were delayed and customers were starting to turn to competitors. Knowing that Windows Server 2003 would soon appear on the horizon, the domain administrators formulated a plan and presented it to the company’s management, obtaining approval to upgrade the company’s domain controllers and member servers to the new operating system. One weekend, the administrators introduced two new domain controllers to the network and upgraded it to Windows Server 2003 domain functional level. They moved user and computer accounts onto the new servers and had everything ready for Monday morning, or so they thought. Monday came, no users could log on, no one could access anything on the network, orders had to be taken by hand, and frustration mounted. Quickly, the senior domain administrator re-installed a Windows NT 4.0 PDC and restored the domain database from a backup tape. Soon the network returned to a semblance of normalcy, but only after hours of delay and without any new improvements. Meeting the next day to discuss what went wrong, the different administrators had varying opinions. The realization was there, however, that they hadn’t tested the implementation properly. One of the administrators had suggested doing a test lab a few months before, but management had declined his idea. Now it came up again and management was more accepting. The company created a team consisting of several network administrators, a manager, and a few computer-savvy users. They built an Active Directory network in the test lab with servers and client computers that were representative of what the employees used, installed all the company’s applications, and tested everything thoroughly. As errors occurred, the team sought out the causes and implemented corrections. They found out that two important applications needed improvements to run in the Active Directory environment. After they had completed all this testing, they were in a far better position to implement Active Directory on their production network, and the next attempt succeeded smoothly, with only a few minor glitches that were quickly remedied.

Uninstalling Active Directory On some occasions you might want to uninstall Active Directory. Some of these situations include the need to upgrade to a more powerful server or to undo a serious configuration

64

Chapter 2: Planning and Implementing an Active Directory Infrastructure

problem. You can uninstall Active Directory by running dcpromo on a domain controller, should you need to demote it to a member server for any reason. Follow Step by Step 2.6 to demote a domain controller.

STEP BY STEP 2.6 Demoting a Domain Controller 1. Click Start, Run, type dcpromo, and press Enter. 2. Click Next to bypass the Welcome page of the Active Directory Installation Wizard. 3. The Remove Active Directory page, shown in Figure 2.24, informs you that removing Active Directory converts the domain controller to a member server. If the domain controller is the last domain controller in the domain, select the check box labeled This Server is the Last Domain Controller in the Domain. Then click Next.

FIGURE 2.24 The Remove Active Directory page summarizes what happens when you remove the last domain controller in the domain.

4. If the server holds the last replica of any application directory partitions, the Application Directory Partitions page informs you (see Figure 2.25). Click Next to enable the wizard to remove application partitions.

65

Building an Active Directory Forest

FIGURE 2.25 You are informed of the application directory partitions that will be deleted.

5. The Confirm Deletion page informs you that all application directory partitions will be deleted. Select the check box labeled Delete All Application Directory Partitions on This Domain Controller and then click Next. 6. The Administrator Password page asks for a password to be assigned to the new local administrator account. Type and confirm a suitable password and then click Next. 7. The Summary page presents a summary of actions you have performed (see Figure 2.26). Review the information presented and click Back if you need to make any changes. Click Next to begin the demotion.

FIGURE 2.26 The Summary page provides a summary of what will happen when you demote the server.

8. Active Directory charts the progress of domain controller demotion and displays a completion page when the process is done. Click Next and restart the computer.

66

Chapter 2: Planning and Implementing an Active Directory Infrastructure

Challenge You are a network administrator for a company named Example, Inc. Your company operates an Active Directory network with a single forest named example.com. Your user account is a member of the Enterprise Administrators group, your username is JohnD, and your password is Tr64Ys5. Example acquires another company named Samples. Samples does not have an Active Directory domain, but you must create a new domain, which will be named Samples.com. The new domain must share a common schema with the existing domain. Samples has their own IT staff, which will continue to manage their own resources and users. You need to create a domain for Samples that will fulfill these requirements. Try to work through this exercise on your own. If you have difficulty, refer to the steps that follow: 1. Log on to the server to be promoted as an administrator. 2. Click Start, Run, type dcpromo, and then press Enter. 3. Click Next to bypass the introductory page of the Active Directory Installation Wizard, and then click Next again to bypass the Operating System Compatibility page. 4. On the Domain Controller Type page, select Domain Controller for a New Domain and then click Next. 5. On the Create New Domain page, select Domain Tree in an Existing Forest and then click Next. 6. On the Network Credentials page, type JohnD as your username and Tr64Ys5 as your password. Click Next. 7. On the New Domain Tree page, type samples.com and then click Next. 8. On the NetBIOS Domain Name page, accept the default of SAMPLES and then click Next. 9. Click Next twice to accept the default locations for the database and log folders and the SYSVOL shared folder. 10. On the DNS Registration Diagnostics page, ensure that the option to install and configure DNS is selected and then click Next. 11. On the Permissions page, accept the default option and then click Next. 12. Type and confirm a restore mode password and then click Next. 13. On the Summary page, review the options and then click Next to begin Active Directory installation. 14. When informed that active Directory installation is complete, click Finish and then click Restart Now to restart the server.

67

Building an Active Directory Forest

Application Directory Partitions Objective

Implement an Active Directory directory service forest and domain structure . Create and configure application data partitions

An application directory partition (also simply called an application partition) is a new feature of Windows Server 2003 that contains application-specific data that needs to be replicated to only specific domain controllers in one or more domains of the Active Directory forest. DNS stores its Active Directory integrated zone data in an application directory partition. Services such as the Telephony Application Programming Interface (TAPI) can also store their data in an application partition. These programs and services usually create their own application directory partitions as required. By utilizing application directory partitions, Active Directory replicates their data to other domain controllers in the forest. A benefit of application directory partitions is that their data can be replicated to only specific domain controllers, as opposed to domain partitions, which are replicated to all domain controllers in the domain. Consequently, replication traffic is reduced. For example, DNS application directory partitions are replicated to only those domain controllers running DNS. The same application directory partition can replicate to domain controllers in more than one domain in the forest.

Creating Application Directory Partitions Developers can use the Active Directory Services Interface (ADSI) to create application directory partitions in which their programs can store data. This means of creating application directory partitions is beyond the scope of this study guide. Interested readers can find details on the Microsoft website. Here, we discuss the use of the ntdsutil command-line utility for creating and managing application directory partitions. This utility is used to perform Active Directory maintenance operations from the command line. We discuss additional uses of ntdsutil in Chapter 4. An application directory partition is identified by its LDAP distinguished name (DN). For example, you could create an application partition named app on the quepublishing.com domain by using the DN dc=app,dc=quepublishing,dc=com. Step by Step 2.7 outlines the procedure for using ntdsutil for creating an application directory partition.

68

Chapter 2: Planning and Implementing an Active Directory Infrastructure

STEP BY STEP 2.7 Creating an Application Directory Partition 1. Log on to a domain controller or member server as a member of the Domain Admins or Enterprise Admins group. 2. Open a command prompt and type ntdsutil. This command starts the ntdsutil command-line utility and displays an ntdsutil command prompt. 3. At this prompt, type domain management. 4. At the domain management prompt, type connection. 5. At the connection prompt, type connect to server <server>, where <server> is the name of the domain controller to which you want to connect. 6. Type quit to return to the domain management prompt. 7. At this prompt, type create nc <domain_controller>, where is the DN of the application directory partition you want to create, and <domain_controller> is the name of the domain controller on which you want to create the partition. Type null to create the application directory partition on the current domain controller. 8. You receive a prompt informing you that the object was added to the directory, as shown in Figure 2.27. Type quit twice to exit the ntdsutil utility.

FIGURE 2.27

Creating an application directory partition.

Creating Application Directory Partition Replicas The previous procedure creates an application partition on the indicated domain controller only. To replicate the partition to other domain controllers in the domain or forest, you need to create an application directory partition replica. In this manner, you can control the set of domain controllers among which the partition is replicated.

69

Building an Active Directory Forest

The procedure for creating a replica is the same as that for creating the application directory partition, as outlined in Step by Step 2.7, except that at step 7, you need to type add nc replica <domain_controller>. The DN you specify should be the same as that of the partition you have created, and <domain_controller> is the name of the domain controller on which the replica is to be placed. Should you no longer require a replica on a given domain controller, you can follow this procedure, using the remove nc replica command in place of the add nc replica command.

Application Directory Partition Reference Domains The application directory partition reference domain is the parent domain of the application directory partition; in other words, it is the domain name as included in the partition’s DN. It is also known as the security descriptor reference domain. You can change an application directory partition’s reference domain by using the ntdsutil utility. Follow the procedure in Step by Step 2.7, and in step 7, type set nc reference domain , where is the DN of the desired reference domain.

Listing All Known Application Directory Partitions You can easily list the distinguished names of all known application directory partitions on a domain controller. Follow the procedure in Step by Step 2.7, and at step 7, type list. As shown in Figure 2.28, this procedure displays all application directory partitions contained on the domain controller to which you are connected.

FIGURE 2.28 Listing all application directory partitions on a given server.

To list the domain controllers holding replicas of a given application directory partition, follow the same procedure and type list nc replicas , where is the DN of the application directory partition of concern.

70

Chapter 2: Planning and Implementing an Active Directory Infrastructure

NOTE Listing Application Directory Partitions You do not need to have administrative credentials to list application directory partitions. You can perform this task from an ordinary user’s account.

Deleting Application Directory Partitions You can also use ntdsutil to delete application directory partitions that are no longer required. Use the procedure outlined in Step by Step 2.7, and at step 7, type delete nc <domain_controller>.

Active Directory Application Mode (ADAM) As introduced in Chapter 1, Active Directory Application Mode (ADAM) is a special mode of Active Directory that provides directory services for applications using standard application programming interfaces (APIs). Because ADAM runs as a user service and not a system service, you can start and stop ADAM instances as necessary. You can also add or remove instances without impacting the integrity of the Active Directory database. An example where ADAM is useful is in the management of a Web portal application that requires the hosting of users that require authentication without creating an Active Directory domain. You can host a Web portal that stores personalization information outside of Active Directory. Note that you can install ADAM on Windows XP Professional as well as Windows Server 2003.

R2 ADAM has been considerably enhanced in Windows Server 2003 R2 with new features such as the capability for creating users in the configuration partition that can act as ADAM administrators. A new Active Directory to ADAM Synchronizer tool enables the synchronization of Active Directory objects to an ADAM instance. A Schema Analyzer tool enables you to migrate the Active Directory schema to ADAM. You can install ADAM from the Windows Components Wizard in Control Panel Add or Remove Programs. After you have installed ADAM, an entry appears in the All Programs menu with links to the following components: . ADAM ADSI Edit—Opens the ADAM ADSI Edit snap-in, which enables you to

view, modify, create, or delete Active Directory objects. We briefly discuss ADAM ADSI Edit in Chapter 4. . ADAM Help—Provides a comprehensive help interface on all ADAM components,

including all management utilities. . ADAM Tools Command Prompt—Provides a command line from which you can

launch ADAM tools. Table 2.1 introduces the tools that you can launch from this command prompt.

71

Building an Active Directory Forest . Create an ADAM instance—Starts the Active Directory Application Mode Setup

Wizard, which enables you to create an ADAM instance or a replica of an existing instance. You can specify the LDAP and SSL ports that computers will use for accessing the instance, the LDAP distinguished name of an application directory partition, file locations associated with the ADAM instance, and any LDIF files to be imported into the application directory partition. You can also specify the service account used by ADAM as well as the user or group that will have administrative privileges over the ADAM instance.

TABLE 2.1 ADAM Command Line Tools Tool

Description

ADAM Csvde

Imports or exports data files from Active Directory in comma-separated value (CSV) format

ADAM Ldifde

Creates, modifies, or deletes Active Directory objects; extends the schema; exports data to other applications or services; or imports data into ADAM from other directory services

Adaminstall

Installs ADAM in unattended mode from a preconfigured setup file

Adamsync

Synchronizes Active Directory objects to an ADAM instance

Adamuninstall

Removes an ADAM instance

ADSchemaAnalyzer

Facilitates the migration of the Active Directory schema into an ADAM instance

Dsacls

Displays and modifies access control entries (ACEs) in the access control list (ACL) of ADAM objects

Dsdbutil

Provides advanced command-line tools for ADAM management

Dsdiag

Facilitates the analysis and troubleshooting of Active Directory or ADAM directory services

Dsmgmt

Provides additional ADAM management command-line utilities

Ldp

Provides a dialog box from which you can perform several management functions, including connecting to a specified LDAP server, adding objects to or deleting objects from Active Directory, modifying objects or their attributes, searching for attributes, running additional LDP utilities, and so on

Repadmin

Manages Active Directory and ADAM replication

We discuss several of these tools in more detail in later chapters of this study guide. For further information on using ADAM and its component tools, refer to the ADAM help files and to the Microsoft paper, “Introduction to Active Directory Application Mode,” included in the “Suggested Readings and Resources” section at the end of this chapter.

72

Chapter 2: Planning and Implementing an Active Directory Infrastructure

Upgrading Windows 2000 Domains and Forests Microsoft has made several hundred changes and additions to the Windows Server 2003 Active Directory schema. When you upgrade a Windows 2000 domain and forest to Windows Server 2003, you first need to incorporate these changes to the schema for the upgrade to take place properly. Microsoft has provided the Active Directory Preparation Tool (Adprep) for purposes of preparing the Windows 2000 domain and forest for upgrade to Windows Server 2003. Adprep, together with a series of LDIF files containing the schema upgrades, is found in the \I386 folder of the Windows Server 2003 CD-ROM. Step by Step 2.8 shows you how to pre-

pare a Windows 2000 forest for upgrading to Windows Server 2003.

STEP BY STEP 2.8 Preparing a Windows 2000 Forest for Upgrading to Windows Server 2003 1. At the schema master of the Windows 2000 forest, insert the Windows Server 2003 CD-ROM. 2. Click Start, Run, type d:\winnt32 /checkupgradeonly, where d: is the drive letter of the CD-ROM drive. Then click OK. This extracts Adprep to the Winnt\System32 folder and copies the LDIF files containing the schema upgrades. 3. Still at the schema master, click Start, Run, type Adprep /forestprep, and then click OK. This action performs the schema upgrade, and upgrades Active Directory permissions and modifies the display specifiers to support the added classes. 4. If the infrastructure master is on a different server, repeat steps 1 and 2 to extract the Adprep files to that server. 5. At the infrastructure master, click Start, Run, type Adprep /domainprep, and then click OK. This prepares the domain by adding support for new trust relationships plus a new container within the System container for tracking the updates. 6. If the Windows 2000 forest contains more than one domain, repeat steps 4 and 5 at the infrastructure master of every domain.

Building an Active Directory Forest Summary Following is a review of the facts you should know in regard to working with dcpromo and with application directory partitions: . You use the dcpromo program to create all types of Active Directory domain con-

trollers. This program also installs DNS and creates the Active Directory database and log folders and the SYSVOL folder. . The first domain controller to be created assumes the role of forest root domain

controller.

73

Windows Server 2003 Functional Levels . Remember the different options available in dcpromo for creating new trees, child

domains, and additional domain controllers for existing domains. . Running dcpromo on a domain controller demotes it to a member server. . An application directory partition stores application data on domain controllers. It

enables the storing of data on a subset of domain controllers in the domain or forest, and only the designated domain controllers replicate this partition. . ADAM is a special mode of Active Directory that provides directory services for appli-

cations. It provides a series of administrative tools that you can use to manage ADAM instances or Active Directory in general. . To upgrade a Windows 2000 forest to Windows Server 2003, you need to run Adprep /forestprep on the schema master and then run Adprep /domainprep on the infra-

structure master of each domain in the forest.

Windows Server 2003 Functional Levels Objective

Implement an Active Directory directory service forest and domain structure . Set an Active Directory forest and domain functional level based on requirements

When Microsoft introduced Active Directory in Windows 2000, it created two modes of operation to deal with the new features that legacy Windows NT servers were unable to deal with. They were known as mixed mode (which was created for backward compatibility purposes and supported only features available on Windows NT 4.0 domain controllers) and native mode (which supported all new Active Directory features, such as universal security groups and enhanced group nesting). Active Directory in Windows Server 2003 extends this concept further by introducing domain and forest functional levels. We briefly introduced these functional levels in Chapter 1, and we discuss them in more detail in the following sections.

Domain Functional Levels Windows Server 2003 Active Directory supports four domain functional levels: . Windows 2000 mixed—Similar to mixed mode in Windows 2000 Active Directory,

this functional level supports only features that are available with Windows NT 4.0 domain controllers. This is the default functional level at which a newly created Windows Server 2003 domain operates.

74

Chapter 2: Planning and Implementing an Active Directory Infrastructure . Windows 2000 native—Similar to native mode in Windows 2000 Active Directory,

this functional level supports only features that are available with Windows 2000 domain controllers. When you use this functional level, you cannot have any Windows NT 4.0 domain controllers on your domain. When you upgrade a Windows 2000 domain to Windows Server 2003, it initially operates at this functional level. . Windows Server 2003 interim—This functional level supports only Windows NT

4.0 and Windows Server 2003 domain controllers. It appears only when upgrading Windows NT 4.0 domain controllers to Windows Server 2003, supports the same functionality as Windows 2000 mixed functional level, and does not support Windows 2000 domain controllers. . Windows Server 2003—This functional level supports all features available with

Active Directory in Windows Server 2003. It supports only domain controllers running Windows Server 2003. The Windows 2000 mixed functional level does not allow the following features that are available in the Windows 2000 native functional level: . Universal security groups . Enhanced group nesting . Conversion of group types between security and distribution . SID history

The following additional features are available when you convert the functional level to Windows Server 2003: . Renaming of domain controllers . Update logon time stamp . Kerberos Key Distribution Center (KDC) version numbers . User password on InetOrgPerson object

Forest Functional Levels and Requirements Windows Server 2003 supports the following three forest functional levels: . Windows 2000—Supports domain controllers running any of Windows NT 4.0,

Windows 2000, or Windows Server 2003. . Windows Server 2003 interim—Supports domain controllers running Windows

NT 4.0 or Windows Server 2003. This level appears only when upgrading domain

75

Windows Server 2003 Functional Levels

controllers in Windows NT 4.0 domains to Windows Server 2003. It supports features from the Windows 2000 forest functional level plus group membership replication improvements and an improved Inter-Site Replication Topology Generator. . Windows Server 2003—Supports only domain controllers running Windows

Server 2003. The following new features of Active Directory in Windows Server 2003 are enabled only when the forest is operating at the Windows Server 2003 functional level: . Forest trusts . Domain renaming . Global catalog replication tuning . Defunct schema objects . Linked value replication . Improved replication algorithms . Dynamic auxiliary classes . InetOrgPerson object class change

The requirement for operating your Active Directory forest at any particular functional level is essentially the version of domain controllers you can have on the network. For domain functional levels, the requirements are as follows: . To operate at the Windows 2000 native functional level, you need to upgrade all

Windows NT 4.0 domain controllers to either Windows 2000 Server or Windows Server 2003. After you have upgraded to this functional level, you cannot introduce a Windows NT 4.0 domain controller. Note, however, that you can have Windows NT 4.0 member servers and client computers. . To operate at the Windows Server 2003 native functional level, you need to upgrade all

Windows NT 4.0 and Windows 2000 domain controllers to Windows Server 2003. After you have upgraded to this functional level, you cannot introduce any domain controllers that run either of these operating systems. Note, however, that you can have member servers and client computers running these operating systems.

EXAM ALERT Functional Levels You should understand the differences between domain and forest functional levels and the capabilities of the various functional levels. Know when upgrading domain functional levels is acceptable and understand the prerequisites for upgrading the forest functional level to Windows Server 2003.

76

Chapter 2: Planning and Implementing an Active Directory Infrastructure

To raise the forest functional level to Windows Server 2003, there is only one requirement: You must first raise the functional level of all domains in the forest to Windows Server 2003. In addition, you need to know that the upgrade to any of these domain or forest functional levels is one-way only; in other words, after you have upgraded the functional level, you cannot go back to a lower functional level. In addition, after you have raised the forest functional level to Windows Server 2003, you cannot introduce a new Windows NT or 2000 domain to the forest. Step by Step 2.9 shows you how to raise the domain functional level.

STEP BY STEP 2.9 Raising the Domain Functional Level 1. Click Start, Administrative Tools, Active Directory Domains and Trusts. 2. In the console tree, right-click your domain name and choose Raise Domain Functional Level. This selection displays the Raise Domain Functional Level dialog box, as shown in Figure 2.29.

FIGURE 2.29

Raising the domain functional

level.

3. Select the required functional level from the drop-down list and then click Raise. 4. You are warned that this operation affects the entire domain and cannot be reversed (see Figure 2.30). Click OK to raise the functional level.

FIGURE 2.30 You receive this warning when raising the domain functional level.

77

Windows Server 2003 Functional Levels 5. You receive a message informing you that the functional level was successfully raised and that it will now replicate to each domain controller in the domain. Click OK.

Step by Step 2.10 shows you how to raise the forest functional level.

STEP BY STEP 2.10 Raising the Forest Functional Level 1. Click Start, Administrative Tools, Active Directory Domains and Trusts. 2. At the top of the console tree, right-click Active Directory Domains and Trusts and select Raise Forest Functional Level. 3. In the Raise Forest Functional Level dialog box, select Raise (see Figure 2.31).

FIGURE 2.31

Raising the forest functional

level.

4. You are warned that this operation affects the entire forest and cannot be reversed. Click OK to raise the functional level. 5. You receive a message informing you that the functional level was successfully raised and that it will now replicate to each domain controller in the domain. Click OK.

Renaming Domains and Domain Controllers As discussed in Chapter 1, Active Directory in Windows Server 2003 provides the capability of renaming domains and domain controllers after the domain and forest functional levels have been raised to Windows Server 2003. Microsoft provides the rendom.exe utility for purposes of renaming domains. This tool is available as a free download from the Microsoft website; you download and run a file called

78

Chapter 2: Planning and Implementing an Active Directory Infrastructure domainrename.exe, which starts a setup wizard that installs the utility in the C:\Program Files\Microsoft Domain Rename Tools folder on your server. Running this tool consists of

running a series of commands from the command prompt, which are described in the “Step by Step Guide to Implementing Domain Rename,” which is referenced in the “Suggested Readings and Resources” section at the end of this chapter.

EXAM ALERT Domain Renaming You do not need to know the procedural details for renaming domains for the 70-294 exam. However, you should know that the rendom.exe tool is used for this purpose, and the domain and forest must be at the Windows Server 2003 functional level.

WARNING Understand the Implications of Domain Ranaming Renaming a domain is a serious operation that requires careful planning. Its complexity is directly related to the size of the domain, and it can break server applications such as Exchange and IIS. For example, domain renaming is not supported if Exchange 2000 is present. All domain controllers must be successfully updated or removed from the renamed domain. In addition, you must reboot all member computers twice after all domain controllers are updated.

To rename a domain controller, the forest and domain functional levels must be at the Windows Server 2003 level. The procedure is the same as with renaming other computers, as shown in Step by Step 2.11:

STEP BY STEP 2.11 Renaming a Domain Controller 1. Click Start, right-click My Computer, and choose Properties. 2. On the Computer Name tab of the System Properties dialog box, click Change. 3. Click OK to accept the warning that renaming the domain controller might cause it to become temporarily unavailable. 4. In the Computer Name Changes dialog box, type the new name and then click OK. 5. If requested, enter the name and password of an administrative account and then click OK. 6. Click OK twice and then click Yes to complete the renaming and restart the computer.

79

Windows Server 2003 Functional Levels

Functional Levels Review This section presents a detailed discussion of functional levels, which are described as follows: . Microsoft introduced the concept of functional levels to allow for backward compati-

bility with domain controllers running older Windows versions. . The Windows 2000 mixed domain functional level supports any of Windows NT 4.0,

Windows 2000, and Windows Server 2003 domain controllers. It allows only limited Active Directory functionality. . The Windows 2000 native domain functional level supports only Windows 2000 and

Windows Server 2003 domain controllers. It supports all the functionality of Windows 2000 Active Directory. . The Windows Server 2003 interim domain functional level appears only when upgrad-

ing Windows NT 4.0 domains and supports only Windows NT 4.0 and Windows Server 2003 domain controllers. . The Windows Server 2003 domain functional level supports only Windows Server

2003 domain controllers and allows complete Active Directory functionality. . The three forest functional levels are Windows 2000, Windows Server 2003 interim,

and Windows Server 2003. To upgrade to the Windows Server 2003 forest functional level, all domains must operate at the Windows Server 2003 domain functional level. . When you upgrade a domain or forest functional level, you cannot go back to the pre-

vious functional level. . You can use the rendom.exe command-line tool to rename a domain after raising the

functional level to Windows Server 2003. . Renaming a domain controller is similar to renaming other computers, providing that

the functional level has been raised to Windows Server 2003.

Challenge Upgrading Windows NT Domain Controllers and Functional Levels Many companies have been satisfied with their Windows NT 4.0 domains and have never upgraded them to Windows 2000. Now with the advent of Windows Server 2003 and Microsoft discontinuing its support for NT, you might encounter companies that are planning to upgrade their Windows NT domains directly to Windows Server 2003. (continues)

80

Chapter 2: Planning and Implementing an Active Directory Infrastructure (continued)

In this exercise, you are required to upgrade a Windows NT 4.0 primary domain controller (PDC) and backup domain controller (BDC) owned by a fictional company named Widgets to Windows Server 2003; then you need to raise the domain and forest functional levels. In a real-world situation, you should prepare an additional BDC and take it offline in case you encounter problems with the upgrade. This way, you can restore the domain to working condition by bringing the BDC back online and promoting it to a PDC. You will need two computers on which you have installed Windows NT 4.0 Server as PDC and BDC of a domain named widgets. Before you begin this exercise, you should have installed Service Pack 5 or 6a on these computers. If you have created separate disk partitions on your computers, you should be able to use the same computers on which you have installed Windows Server 2003 by installing Windows NT to a different partition. You should also be aware that this exercise will take two to three hours to complete, or possibly more, depending on the processor speed and RAM in your computers. First, you upgrade the PDC to Windows Server 2003, installing Active Directory in the process. Next, you upgrade the BDC. Finally, you upgrade the domain and forest functional levels. You should try working through this exercise on your own. If you are stuck, take a look at the following steps: 1. Insert the Windows Server 2003 CD-ROM in the drive of the PDC. 2. The Welcome to the Microsoft Windows Server 2003 Family screen appears. Click Install Windows Server 2003, Standard (or Enterprise) Edition. 3. On the Welcome to Windows Setup screen, ensure that the drop-down list reads Upgrade (Recommended) and then click Next. 4. Accept the license agreement and then click Next. 5. Type the product key and then click Next. 6. The Report System Compatibility screen shows any items that are not compatible with Windows Server 2003—in particular, Windows 95 and NT interoperability issues. Click Details to see more information about any selected item. When you are finished, click Next. 7. The computer reboots twice, and Windows Server 2003 installation proceeds. You have plenty of time for a long coffee break at this point. 8. The computer reboots a third time, the Administrator account is automatically logged on, and the Active Directory Installation Wizard starts. 9. Click Next to bypass the Welcome page and the Compatibility page. 10. Ensure that Domain in a New Forest is selected and then click Next. 11. On the Install or Configure DNS page, select No, Just Install and Configure DNS on This Computer and then click Next. 12. Type widgets.com as the full DNS name for the domain and then click Next. 13. The Forest Functional Level page asks you to choose the forest functional level. Choose Windows 2000 and then click Next. (continues)

81

Sharing Active Directory Information (continued)

14. Click Next to accept the default database and log file locations; click Next to accept the default SYSVOL location. 15. On the Permissions page, select Permissions Compatible Only with Windows 2000 or Windows Server 2003 Operating Systems and then click Next. 16. Type and confirm a Directory Services Restore password and then click Next. 17. On the Summary page, click Next to begin installing Active Directory. 18. When the completion page appears, click Finish and restart the computer. 19. Log on to the new domain controller with the administrator account and password used in Windows NT 4.0. 20. Repeat steps 1–7 at the BDC. After Windows Server 2003 installation is complete, the Active Directory Installation Wizard starts. 21. Click Next to bypass the Welcome page and the Compatibility page. 22. On the Additional Domain Controller or Member Server page, select Additional Domain Controller and then click Next. 23. If this computer is not configured for DNS name resolution, the Configure Domain Naming Service Client page appears. If you receive this page, right-click My Network Places, click Properties, and access the TCP/IP Properties dialog box for your network connection. Specify the IP address of the former PDC as the preferred DNS server and close this dialog box. Then click Next in the Active Directory Installation Wizard. 24. On the Network Credentials page, type the name and password of the domain administrator account used when upgrading the PDC. 25. Repeat steps 14–19 to complete the installation of Active Directory on this computer. 26. At the former PDC, open the Active Directory Users and Computers console, right-click the Widgets.com domain, and select Raise Domain Functional Level. Raise the domain functional level to Windows Server 2003. 27. After the domain functional level is raised, open the Active Directory Domains and Trusts console and raise the forest functional level to Windows Server 2003.

Sharing Active Directory Information For users to achieve the maximum benefit of Active Directory, they must be able to locate resources on the network, whether they are in the local domain, another domain in the forest, or a trusting forest. In Chapter 1, we introduced the concept of the global catalog. We also introduced several directory roles performed by the global catalog, including providing universal group information. In this chapter, we look further into the strategy of placing global catalog servers and universal group information and show you how you can configure these aspects of the directory.

82

Chapter 2: Planning and Implementing an Active Directory Infrastructure

Global Catalog Servers Recall that a global catalog server keeps a subset of information pertaining to objects located in its domain, as well as summary information pertaining to objects in other domains of its forest. In doing so, users can search the entire forest for resources that they might require. The global catalog server also contains information related to forestwide concerns, such as membership in universal groups. By default, the first domain controller in the forest is a global catalog server. You can add additional global catalog servers by following the procedure outlined in Step by Step 2.12.

STEP BY STEP 2.12 Designating an Additional Global Catalog Server 1. Click Start, Administrative Tools, Active Directory Sites and Services. 2. In the console tree, expand the site in which the required server is located. 3. Expand the Servers folder located therein and expand the folder for the desired server. 4. Right-click the NTDS Settings folder and choose Properties. 5. On the General tab of the NTDS Settings Properties dialog box, select the Global Catalog check box, as shown in Figure 2.32. Then click OK.

FIGURE 2.32

Configuring a domain controller to act as a global catalog server.

83

Sharing Active Directory Information

You can also remove the global catalog server role from a domain controller. Simply follow the procedure in Step by Step 2.12 and clear the Global Catalog check box.

Evaluating Network Traffic Considerations When Placing Global Catalog Servers Objective

Plan a strategy for placing global catalog servers . Evaluate network traffic considerations when placing global catalog servers

Recall that the function of a global catalog server is to assist users in locating resources anywhere on the network. In addition, it maintains information on universal group membership. If you have just a single domain in your forest, the global catalog server plays a minor role, and it is unlikely that you would need to designate additional global catalog servers. You need to be concerned with the following two opposing issues when deciding how many global catalog servers to deploy and where to deploy them: . As your forest increases in size, the size of the global catalog, and hence the amount of

replication traffic among global catalog servers, increases. The global catalog servers replicate with each other in a loop that is separate from other Active Directory replication. The more global catalog servers you deploy, the greater the amount of replication traffic generated. . On the other hand, with increasing forest size, the forest will have more users with

cross-domain queries. Consequently, the time required for users to reach resources in other domains will increase unless you add global catalog servers that users can easily reach. Adding such global catalog servers is especially important in multisite networks. When a user logs on to a given domain controller for the first time in a large enterprise, it is important for this domain controller to connect to a global catalog server to obtain information about any universal groups to which the user might belong. This information includes access permissions assigned to these groups. If the user is located in a branch office that does not have a global catalog server locally present, the domain controller must cross the slow link to the location in which the global catalog server resides. This results in slow logon performance, particularly when several users are logging on at the same time. Consider Figure 2.33, in which users in the head office and in Branch Office 1 have access to a global catalog (GC) server in their own sites; consequently, the logon and object search times are fast. However, users in Branch Office 2 must access a global catalog server in the head office across the slow intersite link. This can result in unacceptably slow logon and object search times, particularly if there is a lot of other intersite traffic. Furthermore, should the slow

84

Chapter 2: Planning and Implementing an Active Directory Infrastructure

link go down and the global catalog server become unavailable as a result, users would be unable to log on at all.

GC

GC

GC

Branch Office 1 Fast Logon and Access Times

Head Office

Branch Office 2 Slow Logon and Access Times

FIGURE 2.33 Logon and search times are much faster when a global catalog server is located onsite.

If sufficiently high bandwidth exists between two sites, locating a global catalog server at the remote site might not be necessary. You should monitor the growth in network traffic and check with users to see whether performance suffers. You should balance the need for additional global catalog servers against users’ need for additional disk space and Active Directory replication bandwidth. A new feature of Windows Server 2003 Active Directory, known as universal group caching, enables users to log on without access to a global catalog server, after they have logged on once to a given DC. We discuss this topic next.

Universal Groups We introduced the universal group in Chapter 1 as a group of users that can come from any domain in the forest. In the present discussion, it suffices to note that you can add users and groups from any domain in the forest to a universal group, and then either assign permissions directly to the group or add it to a domain local group, to which you assign the required permissions. It is important that universal group information be available in order to create a complete access ticket for any user as he logs on. As already mentioned, logon will fail if a global catalog server

85

Sharing Active Directory Information

is not available for any reason. However, as we have mentioned, you can use universal group caching to enable user logons without the need for accessing a global catalog server.

Evaluating the Need to Enable Universal Group Caching Objective

Plan a strategy for placing global catalog servers . Evaluate the need to enable universal group caching

Simply put, when you employ universal group caching, any domain controller that services a user’s logon will store any universal group information the first time that user logs on. In addition, the cache is periodically refreshed from the global catalog so that it reflects changes in universal group membership or permissions. When the user logs on again, the domain controller uses the cached information to ensure a fast, correct logon. Universal group caching is available at any domain or forest functional level that supports universal groups. It offers the following advantages: . You do not require a global catalog server at every site in your forest. . Logon times are faster because the domain controller no longer has to access a global

catalog server at every logon. . Bandwidth usage is reduced because the domain controllers do not need to replicate all

the objects found in the forest.

NOTE Ensure Optimum Replication of Universal Group Information Make sure that global catalog servers are no more than one replication hop away from all domain controllers in which universal group caching has been enabled. This way, you ensure optimum updating of universal group information in the universal group cache.

Balanced against the advantages of universal group caching is the possibility that a user can log on without updated information being available, should you make a change in universal group membership or permissions and the user logs on before the remote domain controller has updated its cache. This situation could be a potential security risk—for example, if you have denied access to a folder containing sensitive data to a universal group or a domain local group into which the universal group is nested. However, keep in mind that without universal group caching, no users can log on if the global catalog server is unavailable. Simply put, it becomes a question of convenience versus the possibility of incomplete security. Universal group caching is implanted at the site level with the Active Directory Sites and Services snap-in. Administer the following procedure, outlined in Step by Step 2.13.

86

Chapter 2: Planning and Implementing an Active Directory Infrastructure

STEP BY STEP 2.13 Enabling Universal Group Caching 1. Click Start, Administrative Tools, Active Directory Sites and Services. 2. In the console tree, expand the site in which the required server is located. 3. Select the required site name. If you have not configured any sites yet, this site will be named DefaultFirst-Site-Name. 4. In the details pane, right-click NTDS Settings and choose Properties. 5. In the Site Settings tab of the NTDS Site Settings Properties dialog box, select the check box labeled Enable Universal Group Membership Caching and then click OK (see Figure 2.34).

FIGURE 2.34

Enabling universal group caching.

EXAM ALERT Global Catalogs and Universal Group Caching You can use either of these options to facilitate logon at a remote site in a multidomain forest. If the exam question informs you that logons are slow and does not mention slow access to resources, the most likely answer is to enable universal group caching. If the exam question informs you that resource access across a WAN is slow, you need to configure a global catalog. Also remember that you do not need to enable both a global catalog and universal group caching at the same site.

87

Placement of Flexible Operations Master Roles

Sharing Active Directory Information Review Let’s review the following strategies for placing global catalog servers and universal group information and for configuring these aspects of the directory. . The global catalog server stores and replicates a subset of information on all domains

of the Active Directory forest. . Although the first domain controller in the forest is automatically a global catalog

server, you can designate additional domain controllers to be global catalog servers. . Having a global catalog server at each Active Directory site is helpful in expediting

user logons and locating resources. You need to balance this need with the amount of intersite replication traffic it creates. . You can enable universal group caching on any domain controller. This enables users

to log on without having to contact a global catalog server after they have logged on to the domain controller for the first time.

Placement of Flexible Operations Master Roles In Chapter 1, we introduced the five operations master roles and their functions. Initially, these roles are all located on the first domain controller installed in a new forest. This includes the two forestwide operations masters (domain naming master and schema master). The first domain controller in subsequent domains of the same forest holds the three domainwide operations master roles (PDC emulator, infrastructure master, and RID master). After you have installed additional domain controllers, you might have to move one or more of these roles. In this section, we discuss the need for moving some of these roles to other domain controllers.

Business Continuity of Operations Master Roles Objective

Plan flexible operations master role placement . Plan for business continuity of operations master roles

Although Active Directory has improved on the old Windows NT PDC/BDC model by creating all domain controllers as peers, some roles in Active Directory still can be performed only by a given domain controller. In a nutshell, this is the reason for the five operations master (or FSMO) roles.

88

Chapter 2: Planning and Implementing an Active Directory Infrastructure

NOTE Only Windows 2000 or 2003 Domain Controllers Can Hold an FSMO Role If your domain is operating at the Windows 2000 mixed functional level and contains one or more Windows NT 4.0 BDCs, these BDCs cannot hold any of the FSMO roles.

Moving one or more FSMO roles to different domain controllers has the obvious benefit of load balancing; in other words, the tasks associated with each role are distributed among different domain controllers. At the same time, you need to be aware of the need for availability of the FSMO servers and what can happen should any of the FSMO servers be unavailable for any reason. Some examples follow: . When you create a new child domain or an additional domain tree, the server you are

promoting to domain controller must contact the domain-naming master to ensure that the domain name you are providing is unique. If the domain naming master is unavailable, you cannot create a new child domain. However, business continuity still occurs in the absence of this FSMO—that is, until you need to create a new child domain. . Should you need to modify the schema, you must be able to connect to the schema

master. Modifications include installing software such as Exchange Server, which automatically creates several new schema definitions. Such an installation will fail if the schema master is unavailable. Again, business continuity still occurs in the absence of this server, until a need to modify the schema arises. . In a domain running at the Windows 2000 mixed functional level, you must be able to

connect to the PDC emulator to make user account modifications. Users changing their passwords must be able to connect to the PDC emulator. Although normal logons can proceed in the absence of the PDC emulator, any changes to user account properties will fail should this server be unavailable. Older Windows clients also look to this computer as the master browser for populating Network Neighborhood and for any system policies you have configured. . When operating at the Windows 2000 interim functional level, the PDC emulator is

responsible for recording password changes and replicating them to the BDCs. At any domain functional level, the PDC emulator still plays the important role of time server. It ensures that the clocks on all domain controllers remain synchronized. Should the PDC emulator be unavailable and the clocks on other domain controllers go out of sync, certain operations could fail or generate errors.

89

Placement of Flexible Operations Master Roles . When you are adding new users or groups, or modifying group membership on various

servers, these servers must all connect to the infrastructure master to ensure that different administrators are not performing conflicting changes. For example, if two administrators in two different cities create a user named JohnD at the same time, a problem would occur. In such a case, the infrastructure master will generate a uniqueness error. . The infrastructure master also tracks changes in group membership that can cross

domains. This capability is important because domain local groups can contain users and global groups in other domains, and global groups can be made members of domain local groups in other domains. In addition, these groups can be members of universal groups and vice versa. In the absence of the infrastructure master, these changes will fail. . When administrators create new user, group, or computer accounts in a domain

operating in the Windows 2000 native or Windows Server 2003 functional level, the domain controller on which the accounts are created must assign a security identifier (SID) to each account. This SID uniquely identifies the account to Active Directory, thereby differentiating it from other accounts in the domain. So that SIDs never become duplicated in the domain, an FSMO computer known as the RID master assigns a pool of 500 relative identifiers (the last portion of the SID) to each domain controller in the domain. The RID master sends a new pool to each domain controller when it has fewer than 50 remaining. In the absence of a RID master, domain controllers can continue to create accounts until the pool of identifiers on that server is exhausted, after which account creation will fail. It is evident from these examples that some operations masters must be more continuously available for business continuity than others. Problems arise most rapidly if the infrastructure master (and, in the Windows 2000 mixed functional level, the PDC emulator) is unavailable. All operations masters should be located on domain controllers that are accessible to as much of the network as possible over a fast link.

EXAM ALERT Operations Master Roles Know what each operations master does and the effect of its being offline. Know also how to recover from various types of operations master problems. You will be asked about troubleshooting the effects of operations masters being offline, and whether to transfer or seize operations master roles.

90

Chapter 2: Planning and Implementing an Active Directory Infrastructure

Transferring Operations Master Roles Following are several reasons that you might want to transfer an operations master role from one server to another: . Doing so enables you to provide load balancing, as already mentioned. The most fre-

quently shifted role is that of the PDC emulator. . You need to perform planned maintenance on or upgrade the computer holding one or

more FSMO roles. . Perhaps an FSMO role has been placed at a location that is behind a slow link and is

creating excessive WAN traffic after some type of shift in a company’s operations. . It is usually preferable to keep the servers hosting the FSMO roles near the administra-

tors who are responsible for them. . You need to ensure that the infrastructure master is not on the same domain controller

as the global catalog server in a multidomain environment. . In general, you should keep the domain naming master and the schema master on the

same server, and this server should be located close to another server on the same subnet that you can use as a backup. For these and other reasons, you might have to transfer an operations master role from one domain controller to another. You can do this from any domain controller in the domain. Step by Step 2.14 shows you how to transfer the three domain-level operations master roles.

STEP BY STEP 2.14 Transferring Operations Master Roles at the Domain Level 1. Log on to a domain controller as a member of the Domain Admins group. 2. Click Start, Administrative Tools, Active Directory Users and Computers. 3. In the console tree, right-click Active Directory Users and Computers and choose Connect to Domain Controller. 4. In the Connect to Domain Controller dialog box, shown in Figure 2.35, select the server to which you want to transfer the role(s) and click OK.

91

Placement of Flexible Operations Master Roles

FIGURE 2.35

Connecting to another domain controller.

5. Right-click your domain name and choose Operations Masters. 6. On the Operations Masters dialog box, shown in Figure 2.36, select the tab corresponding to the role to be changed. On that tab, click Change to transfer the role.

FIGURE 2.36 The Operations Masters dialog box enables you to transfer any of the three domain-based operations master roles.

7. A message box asks you to confirm the role transfer. Click Yes.

92

Chapter 2: Planning and Implementing an Active Directory Infrastructure 8. Repeat steps 6 and 7 for any additional roles to be transferred. 9. When you are finished, click Close to close the Operations Masters dialog box.

Transferring the forest-based operations master roles is slightly different from that of domainbased operations masters. Follow Step by Step 2.15 to transfer the domain naming master role.

STEP BY STEP 2.15 Transferring the Domain Naming Master Role 1. Log on to the domain controller to which you want to transfer the role as a member of the Enterprise Admins group. 2. Click Start, Administrative Tools, Active Directory Domains and Trusts.

NOTE You Can Also Transfer This Role When at Another Domain Controller Simply right-click Active Directory Domains and Trusts and select Connect to Domain Controller. Then browse to the proper domain and select the domain controller to which you want to transfer the role.

3. In the console tree, right-click Active Directory Domains and Trusts and select Operations Master. This displays the current holder of the domain naming master role. 4. In the Change Operations Master dialog box, shown in Figure 2.37, click Change.

FIGURE 2.37

The Change Operations Master dialog box.

5. You receive a confirmation message box. Click Yes to transfer the role. 6. You are informed that the operations master was successfully transferred. Click OK and then close the Change Operations Master dialog box.

93

Placement of Flexible Operations Master Roles

Transferring the schema master role is similar to that of the domain-naming master, except that you must be a member of the Schema Admins group, and you use the Active Directory Schema MMC to perform the transfer. This console is not present by default when Active Directory is installed. We discuss registering and installing this console in Chapter 3. After you have done so, follow the steps in Step by Step 2.15, substituting this console for the Active Directory Domains and Trusts console.

Using the Command Line to Transfer Operations Master Roles You can also transfer operations master roles from the command line, by employing the ntdsutil utility, as described in Step by Step 2.16.

STEP BY STEP 2.16 Using the Command Line to Transfer Operations Master Roles 1. Log on to a domain controller as a member of the appropriate group. 2. Open a command prompt and type ntdsutil. 3. At the ntdsutil command prompt, type roles. 4. At the FSMO maintenance command prompt, type connection. 5. At the server connections command prompt, type connect to server <domain_controller>, where <domain_controller> is the name of the server to which you want to connect. 6. At the server connections command prompt, type quit. 7. At the FSMO maintenance command prompt, type transfer , where is the role (PDC emulator, RID master, infrastructure master, domain naming master, or schema master) you want to transfer. 8. A message box asks you to confirm the role transfer (see Figure 2.38). Click Yes and then click OK in the confirmation dialog box that appears.

FIGURE 2.38 Changing an operations master role from the command line.

9. Repeat steps 7 and 8 to transfer additional roles as needed. 10. Type quit to exit the FSMO maintenance command prompt. 11. Type quit to exit the ntdsutil command prompt.

94

Chapter 2: Planning and Implementing an Active Directory Infrastructure

Seizing Operations Master Roles The procedures for transferring operations master roles work only if the domain controller currently holding the role is online. If this domain controller were to crash, you would need to seize the role.

WARNING Seize a Role Only If You Know You Cannot Restore the Current Operations Master to Operation Before you seize the missing role, make sure that the problem is not due to network connectivity or a temporary server problem. If you were to seize a role and later bring back the former holder of that role online, Active Directory would probably become corrupted. After seizing a role, you need to reformat the disk of the former role holder, reinstall Windows Server 2003, and promote it to domain controller.

To seize an operations master role, use the ntdsutil command as described in Step by Step 2.17.

STEP BY STEP 2.17 Seizing Operations Master Roles 1. Log on to a domain controller as a member of the appropriate group. 2. Open a command prompt and type ntdsutil. 3. At the ntdsutil command prompt, type roles. 4. At the FSMO maintenance command prompt, type connection. 5. At the server connections command prompt, type connect to server <domain_controller>, where <domain_controller> is the name of the server that is to receive the seized role. 6. At the server connections command prompt, type quit. 7. At the FSMO maintenance command prompt, type seize , where is the role (PDC emulator, RID master, infrastructure master, domain naming master, or schema master) you want to seize. 8. A confirmation message box asks you to confirm the role seizure, as shown in Figure 2.39. Click Yes to seize the role.

95

Placement of Flexible Operations Master Roles

FIGURE 2.39

Seizing an operations

master role.

9. ntdsutil first tries to connect to the server and confirm that it is not available. After it receives an error message, it seizes the role, displaying the output shown in Figure 2.40.

FIGURE 2.40 Completing the seizure of an operations master role.

10. Type quit twice and then exit the command prompt.

NOTE ntdsutil Will Not Seize the Role If the Server Holding the Role Is Online If ntdsutil finds that the server holding the role you are seizing is online, it transfers the role rather than seizes it.

Operations Master Role Dependencies Objective

Plan flexible operations master role placement . Identify operations master role dependencies

You should not place the infrastructure master on the same domain controller as a global catalog server unless you have configured all domain controllers as global catalog servers.

96

Chapter 2: Planning and Implementing an Active Directory Infrastructure

A dependency exists between the schema master and the global catalog. It is possible to list every schema attribute in the global catalog by selecting the Replicate This Attribute to the Global Catalog option, located on the Properties dialog box for the attribute. (We discuss the schema, its attributes, and their properties in Chapter 3.) Selecting this option adds information pertaining to that attribute to the global catalog, requiring a fast connection to the nearest global catalog server. This includes the installation of programs such as Exchange that add attributes to the schema. You should be aware that this option causes Windows 2000 global catalog servers to completely rebuild their global catalogs, resulting in a large amount of network traffic. Windows Server 2003 replicates only the changes in the global catalog produced by such a schema modification, thereby causing much less network traffic. If you have a mixture of Windows 2000 and 2003 on your global catalog servers, the various servers still act in this manner according to the particular operating system in use. This behavior is true regardless of the functional level at which the domains and forest are operating.

EXAM ALERT Placement of Operations Masters You should remember the following key points about operations master placements: First, on a network that has a large number of pre-Windows 2000 computers, place the PDC emulator at the site containing the largest number of these computers. Second, remember that the infrastructure master must not be located on the same server as a global catalog server unless all domain controllers are configured as global catalog servers or you are operating in a single domain model.

Challenge Operations Masters and Global Catalog Servers After you have created an Active Directory forest and domain structure and added a second domain controller to each domain, you should think about the placement of the various operations masters and global catalog servers. The object of this exercise is to understand the requirements for placing global catalog servers and operations masters in an Active Directory forest containing two domains: widgets.com and inventory.widgets.com. Each domain has two domain controllers: server01.widgets.com, server02.widgets.com, server11.inventory.widgets.com, and server12.inventory.widgets.com. To do this exercise completely, you need a test lab containing four computers on which you have installed Windows Server 2003 Standard or Enterprise Edition with the domains as specified here. If you don’t have this amount of hardware available, you can still do portions of the exercise and, at any rate, should follow through the required steps. You want to ensure that users in either domain can access resources anywhere in the forest, with fault-tolerant capabilities as permitted by the product’s limitations. (continues)

97

Placement of Flexible Operations Master Roles (continued)

You should try working through this problem on your own first. There could be more than one solution to the problem. If you are stuck or need guidance, follow these steps and look back at the Step by Step procedures for more detailed information. 1. Working from server01.widgets.com, open Active Directory Sites and Services. 2. In the console tree, expand the Default-First-Name-Site object, expand the Servers container, and expand the server02.widgets.com folder. 3. Right-click the NTDS Settings folder and choose Properties. 4. Select the Global Catalog check box and then click OK. 5. Repeat steps 1–4 at server11.inventory.widgets.com and designate server12.inventory.widgets.com as a global catalog server. 6. Back at server01.widgets.com, open Active Directory Users and Computers. 7. Right-click widgets.com and choose Connect to Domain Controller. 8. In the Connect to Domain Controller dialog box, select server02.widgets.com and click OK. 9. Right-click widgets.com and choose Operations Masters. 10. Select the PDC tab, click Change, and confirm the operation. 11. Repeat step 10, selecting either one of the other two tabs. 12. Close the Operations Masters dialog box. 13. In the console tree of Active Directory Users and Computers, right-click Active Directory Users and Computers and choose Connect to Domain. 14. Browse to inventory.widgets.com and then click OK. 15. Right-click Active Directory Users and Computers again and choose Connect to Domain Controller. 16. Repeat steps 8–12, specifying server12.inventory.widgets.com as the server to which you will move two operations master roles. Think about the answers to the following questions: If you were to have three domain controllers in each domain, what would you do differently in moving around operations master roles? Also, why didn’t we configure alternative locations for the schema master and domain naming master in the inventory.widgets.com domain?

98

Chapter 2: Planning and Implementing an Active Directory Infrastructure

Operations Masters Review Following is a review of the five operations masters: . Active Directory designates five operations masters, which perform roles that are suit-

able for single-master replication only. . Two of these operations masters are forestwide: the schema master and the domain

naming master. . The other three operations masters are domainwide: the infrastructure master, the

PDC emulator, and the RID master. . The infrastructure master should not be located on the same domain controller as a

global catalog server unless all domain controllers are configured as global catalog servers.

99

Chapter Summary

Chapter Summary This chapter guided you through the basics of planning and implementing Active Directory in Windows Server 2003 and provided you with practical experience in creating and configuring domains. You learned how to create the various domain controllers that are required for new and existing forests, trees, and domains using the Active Directory Installation Wizard (dcpromo). In addition, you learned the importance of domain and forest functional levels and how to raise these levels. You also learned how to prepare a Windows 2000 forest for upgrading to Windows Server 2003. Next you learned about global catalog servers and flexible operations master roles. You learned the importance of these roles and how to create additional global catalog servers and transfer or seize operations master roles. The next chapter will introduce you to the various types of Windows Server 2003 trust relationships, the schema, and UPN suffixes. It will also introduce you to creating, configuring, and managing sites in Active Directory.

Key Terms . Active Directory Application Mode (ADAM) . Application directory partition . BIND . Child domain . dcpromo . Domain functional levels . Domain partition . DNS . EFS . Forest functional levels . Global catalog servers . Interim functional levels

100

Chapter 2: Planning and Implementing an Active Directory Infrastructure . NetBIOS . NTFS . rendom . SRV resource records . SYSVOL . Universal group caching

Apply Your Knowledge The 70-294 exam tests your knowledge of the various situations that can be encountered when installing and configuring Active Directory. You need to be aware of the differences encountered when installing additional domain controllers, new domain trees, and new child domains. You also need to know how to create application directory partitions, configure global catalog servers, and manage operations masters. The exercises and exam questions presented here serve to reinforce these requirements. Note that you may encounter drag-and-drop or hot-spot questions on the exam. Due to the limitations of the printed page, we are unable to include questions of these types in the exam questions section. However, the explanations suggest the possibility of these question types where appropriate.

Exercises In Windows Server 2003, as in Windows 2000, a server must be running Active Directory to take on the role of domain controller, and vice versa. You promote a server to be a domain controller by running the Active Directory Installation Wizard. This practice differs from that of Windows NT 4, in which you had to re-install a server from scratch to be able to promote it from a member server to be either a primary or backup domain controller. To perform these exercises, you should have at least two computers on which you have installed Windows Server 2003 Standard Edition or Enterprise Edition as a standalone server, and have formatted the system root partitions with the NTFS file system. The exercises assume that the computers are named Server1 and Server2. You will be installing two domain controllers for an Active Directory domain named domain1.com.

101

Apply Your Knowledge

2.1 Installing a Forest Root Domain Controller This exercise demonstrates the procedure you can use to create a new domain named domain1.com. You can do this exercise on either of the two computers. Estimated Time: 20 minutes 1. Click Start, Run. Type dcpromo in the Run dialog box and then click OK. 2. The Active Directory Installation Wizard is started with a Welcome page. Click Next. 3. The Operating System Compatibility page informs you that improved Windows Server 2003 security settings affect how older versions of Windows communicate with the domain controller. Click Next. 4. On the Domain Controller Type page, ensure that the radio button labeled Domain Controller for a New Domain is selected and then click Next. 5. On the Create New Domain page, ensure that the radio button labeled Domain in a New Forest is selected and then click Next. 6. On the New Domain Name page, in the text box labeled Full DNS Name for New Domain, type the name of the new domain to be created—in this case domain1.com—and then click Next. 7. After a few seconds, the NetBIOS Domain page appears. Make sure that the most qualified (first) part of your domain name (for example, DOMAIN1) is displayed. Then click Next. 8. On the Database and Log Folders page, note the locations for these files and then click Next. 9. On the Shared System Volume page, note the location specified and then click Next. 10. On the DNS Registration Diagnostics page, select Install and Configure the DNS Server on This Computer, and Set This Computer to Use This DNS Server As Its Preferred DNS Server and then click Next. 11. On the Permissions page, select Permissions Compatible with Only Windows 2000 or Windows 2003 Server Operating Systems and then click Next. 12. On the Directory Services Restore Mode Administrative Password page, type a suitable password in the Password and Confirm Password text boxes and then click Next. 13. The Summary page provides a summary of the options you have entered. Ensure that these options are correct and then click Next. 14. When Active Directory installation is completed, the Completing the Active Directory Installation Wizard page appears. Click Finish. 15. You are told that you must restart the computer to complete the Active Directory installation. Click Restart Now to restart the computer.

102

Chapter 2: Planning and Implementing an Active Directory Infrastructure

2.2 Installing a Second Domain Controller In this exercise, you add a second domain controller to the domain1.com domain you just created. You should perform this exercise on the second computer running Windows Server 2003 Standard Edition or Enterprise Edition. The system root folder should also be formatted with NTFS. First, specify the IP address of the first domain controller as this computer’s preferred DNS server so that it can locate the domain controller by name. Estimated Time: 20 minutes 1. Log on to the second server as an administrator. 2. Click Start, Control Panel, and double-click Network Connections. 3. On the Network Connections dialog box, right-click your network connection and choose Properties. 4. On the Local Area Connection Properties dialog box, select Internet Protocol and click Properties. 5. If the IP address of the domain controller you just created in exercise 2.1 is not present, enter it in the Preferred DNS Server text box and then click OK. 6. Close the Local Area Connection Properties dialog box and the Network Connections dialog box. 7. Click Start, Run, type dcpromo, and then press Enter. 8. Click Next twice to bypass the Welcome page and the Operating System Compatibility page of the Active Directory Installation Wizard. 9. On the Domain Controller Type page, select Additional Domain Controller for the Same Domain, and then click Next. 10. On the Network Credentials page, type the username, password, and domain that you specified in exercise 2.1 and then click Next. 11. On the Additional Domain Controller page, if domain1.com is not listed in the Domain Name text box, type it and then click Next. 12. On the Database and Log Folders page, accept the default location and click Next. 13. On the Shared System Volume page, accept the default location and click Next. 14. On the Directory Services Restore Mode Administrative Password page, type a suitable password in the Password and Confirm Password text boxes and then click Next. 15. The Summary page provides a summary of the options you have entered. Ensure that these options are correct and then click Next. 16. When Active Directory installation is completed, the Completing the Active Directory Installation Wizard page is displayed. Click Finish and restart your computer.

103

Apply Your Knowledge

2.3

Creating an Application Directory Partition

In this exercise, you create an application directory partition named Apps on the Server1 server. You then create a replica of the partition on the Server2 server so that replication of the application directory partition can take place. Estimated Time: 5 minutes 1. Log on to Server1 as an administrator. 2. Open a command prompt and type ntdsutil. 3. At the ntdsutil prompt, type domain management. 4. At the domain management prompt, type connection. 5. At the connection prompt, type connect to server server1 and then type quit. 6. At the domain management prompt, type create nc dc=apps,dc=domain1,dc=com null. 7. At the domain management prompt, type connection. 8. At the connection prompt, type connect to server server2 and then type quit. 9. At the domain management prompt, type add nc replica dc=apps,dc=domain1,dc=com null. 10. Type quit twice and then exit the command prompt.

2.4

Upgrading Domain and Forest Functional Levels

In this exercise, you upgrade the functional levels of your new domain to receive the full capabilities provided in Windows Server 2003 Active Directory. You can complete this upgrade from either server. Estimated Time: 5 minutes 1. Log on as an administrator. 2. Click Start, Administrative Tools, Active Directory Users and Computers. 3. Right-click domain1.com and choose Raise Domain Functional Level. 4. In the Raise Domain Functional Level dialog box, select Windows Server 2003 from the drop-down list, click Raise, and then click OK twice. 5. Click Start, Administrative Tools, Active Directory Domains and Trusts. 6. Right-click Active Directory Domains and Trusts and choose Raise Forest Functional Level. 7. In the Raise Forest Functional Level dialog box, select Windows Server 2003, click Raise, and then click OK twice. 8. Close all open dialog boxes and MMC consoles.

104

Chapter 2: Planning and Implementing an Active Directory Infrastructure

Exam Questions 1. Nolan is a network administrator for a company that operates an Active Directory network consisting of two domains. The company has offices in Los Angeles and Tokyo, which are connected by a 128-kbps WAN link. Each office is represented by a separate Active Directory site, as well as its own domain. Nolan’s company stores resource location information in Active Directory so that users can perform searches to locate the appropriate resources using the Entire Directory option. However, users in the Tokyo office report that search times for resources are unacceptably slow. What can Nolan do to improve search times at the Tokyo office?

❍

A. Configure a global catalog server at the Tokyo office.

❍

B. Enable universal group caching at the Tokyo office.

❍

C. Configure a domain controller for the Los Angeles domain in the Tokyo office.

❍ D. Configure a domain controller for the Tokyo domain in the Los Angeles office. 2. Steve’s company has just merged with another large company and is converting its network organization over to a single domain model. Several OUs represent various departments, and several sites represent the cities where the company conducts business. The merged company has decided to consolidate its call center operations in St. Louis. These operations have previously been scattered around several cities in North America. Since the consolidation, Steve has received complaints of slow operation of certain administrative actions across the network. He realizes that one reason for this slowdown is that junior administrators have been adding user accounts for the merged organization in batches. After some investigation of the causes of this problem, he decides that poor placement of an operations master on the network is the cause of the problem. To solve this problem, Steve needs to move the operations master to a more powerful machine with better network connectivity in St. Louis. Which of the following operations masters should he move?

❍

A. Domain naming master

❍

B. Infrastructure master

❍

C. Schema master

❍ D. Relative Identifier (RID) master 3. Lynn is the network administrator for a company that operates an Active Directory domain in which all domain controllers run Windows 2000 Server. The company wants to upgrade the domain controllers to Windows Server 2003. Lynn’s user account is a member of the Domain Admins, Enterprise Admins, and Schema Admins groups in her company’s domain.

105

Apply Your Knowledge What actions does Lynn need to perform to upgrade the domain controllers to Windows Server 2003? To answer this question, select the two required actions from the list that follows in the sequence in which she must execute them.

❏

A. Run the Adprep /domainprep command at the infrastructure master.

❏

B. Run the Adprep /forestprep command at the infrastructure master.

❏

C. Run the Adprep /domainprep command at the PDC emulator.

❏ D. Run the Adprep /forestprep command at the schema master. ❏

E. Run the Adprep /domainprep command at the schema master.

❏

F. Run the Adprep /forestprep command at the domain naming master.

4. Your company is operating an Active Directory forest consisting of a single tree with an empty root domain and four child domains that represent operational divisions. You are responsible for maintaining the operations masters. In total, how many operations masters are present in this tree?

❍

A. One schema master, one domain naming master, one RID master, one PDC emulator, and one infrastructure master.

❍

B. Five schema masters, five domain naming masters, five RID masters, five PDC emulators, and five infrastructure masters.

❍

C. One schema master, one domain naming master, five RID masters, five PDC emulators, and five infrastructure masters.

❍ D. One schema master, one domain naming master, four RID masters, four PDC emulators, and four infrastructure masters. 5. The day after completing a three-week vacation, you come to the office and discover that users have complained that one of the domain controllers is not accepting logons. On checking Event Viewer, you notice several W32Time errors. You connect to the problematic domain controller and discover that its time is 15 minutes slow. Which of the following operations masters should you check for problems?

❍

A. Infrastructure master

❍

B. Schema master

❍

C. RID master

❍ D. PDC emulator 6. Andrew’s company operates a domain that was recently upgraded from Windows NT 4.0 to Windows Server 2003. Because the company budget allows for only two Windows Server 2003 domain controllers, it is still operating two Windows NT 4.0 servers as backup domain controllers. One Monday morning, users at several computers running Windows NT 4.0 Workstation complain

106

Chapter 2: Planning and Implementing an Active Directory Infrastructure that they were asked to change their passwords, but the password change was not accepted and they are unable to log on. Which of the following is the most likely reason for this problem?

❍

A. The infrastructure master is down.

❍

B. The PDC emulator is down.

❍

C. One of the Windows NT 4.0 backup domain controllers is down.

❍ D. Because the domain is running at the Windows 2000 mixed functional level, the users are unable to change their passwords. 7. You are the senior network administrator for examcram.com, which operates an Active Directory forest consisting of a root domain named examcram.com and two child domains named sales.examcram.com and accounting.examcram.com. All domains operate at the Windows 2000 native domain functional level. Domain controllers in the examcram.com domain run Windows Server 2003, and domain controllers in the two child domains run Windows 2000 Server. You need to rename all domain controllers in the examcram.com domain. Which actions should you perform?

❍

A. Raise the domain functional level of the forest root domain and each child domain to Windows Server 2003, and then raise the forest functional level of the forest root domain to Windows Server 2003.

❍

B. Raise the domain functional level of the forest root domain to Windows Server 2003, and then raise the forest functional level of the forest root domain to Windows Server 2003.

❍

C. Raise the domain functional level of the forest root domain and each child domain to Windows Server 2003, and then raise the forest functional level of all domains to Windows Server 2003.

❍ D. Raise the forest functional level of the forest root domain to Windows Server 2003, and then raise the domain functional level of the forest root domain and each child domain to Windows Server 2003.

❍

E. Raise the forest functional level of the forest root domain to Windows Server 2003, and then raise the domain functional level of the forest root domain to Windows Server 2003.

❍

F. Raise the forest functional level of all domains to Windows Server 2003, and then raise the domain functional level of the forest root domain and each child domain to Windows Server 2003.

8. Evelyn’s company consists of two divisions, one of which is located in New York and the other in London. A 512Kbps frame relay link connects the two locations. The company’s network is organized as a single domain. Administrators at each location control all aspects of their networks, including users, groups, and computers.

107

Apply Your Knowledge Managers in both divisions complain that sending data between them takes a long time. On checking the link, Evelyn discovers that it is running at 100% capacity. The company budget does not provide for upgrading to a faster link. Which of the following should Evelyn suggest as a means of reducing the load on the link?

❍

A. Create two OUs, one for each location.

❍

B. Create two sites, one for each location.

❍

C. Create two domains, one for each location.

❍ D. Create two forests, one for each location. 9. Debbie is the network administrator for a company that operates an Active Directory forest containing three domains and several sites that represent cities in which the company does business. The forest and all domains operate at the Windows Server 2003 functional level. As shown in the work area in Figure 2.41, two sites are located in Dallas and Houston. The Dallas site includes two domain controllers, Server1 and Server2, both configured as global catalog servers. The Houston site includes two domain controllers, Server3 and Server4, neither of which is configured as a global catalog server. The two sites are connected by a dedicated ISDN link. Users in the Houston site report that logon times are often unacceptably slow. Debbie needs to configure the network so that logon times are improved without generating excessive replication traffic. What should she do?

❍

A. Configure Server3 and Server4 as global catalog servers.

❍

B. Configure Server3 and Server4 with universal group membership caching.

❍

C. Configure the Dallas site with universal group membership caching.

❍ D. Configure the Houston site with universal group membership caching. Place configuration here.

Global Catalog Server Universal Group Membership Caching

Server1 Server2

ISDN

Place configuration here.

Server3 Server4

Dallas

Houston

Place configuration here.

Place configuration here.

FIGURE 2.41 Improve logon times without generating excessive replication traffic.

10. Heather is the IT manager of a community college whose administrative staff is planning the college’s new Windows Server 2003 domain infrastructure. Eight domain controllers will be located in various campus buildings. The college’s administrators and technical support staff are to be based in an annex to the computer sciences department that would include a powerful server acting as the forest root domain controller. This server would incorporate the roles of global catalog server,

108

Chapter 2: Planning and Implementing an Active Directory Infrastructure schema master, domain naming master, and infrastructure master. Servers in other buildings would take on the other operations master roles. After studying the proposal carefully, Heather asked the administrative staff to modify the operations master setup. Which of the following should the staff change?

❍

A. The infrastructure master computer does not need to be located close to the IT staff. A more sensible change would be to move this role elsewhere and have the PDC emulator located close to the support staff.

❍

B. The schema master and domain naming master roles cannot function properly if they are hosted by the same computer.

❍

C. The global catalog server and infrastructure master roles cannot function properly if they are hosted by the same computer.

❍ D. The college’s computer help center, which is staffed by students who work part-time shifts and is located in the student union building, needs frequent access to the infrastructure master. Locating this role there would make sense. 11. You are attempting to promote a server called SVR3 to a domain controller using the dcpromo tool. However, when you attempt to run this tool, you get an error message and the tool will not start. Which of the following conditions explains the reason you were unable to use the dcpromo tool?

❍

A. SVR3 is configured to receive an IP address from a DHCP server.

❍

B. SVR3 cannot find a DNS server that can handle SRV resource records.

❍

C. SVR3’s hard disk is configured with the FAT32 file system.

❍ D. SVR3 is unable to locate a certificate server on the network. 12. Susan has created an application directory partition, named DC1, on a domain controller in the company.com domain to store data from a custom accounting package and replicate it to domain controllers DC2 and DC3. DC3 is located in a child domain named production.company.com. What does she need to do to enable the partition to replicate to these domain controllers?

❍

A. Create new application directory partitions on both DC2 and DC3.

❍

B. Create application directory partition replicas on both DC2 and DC3.

❍

C. Specify production.company.com as the application directory partition reference domain.

❍ D. Use Active Directory Domains and Trusts to add production.company.com as a replication destination for the partition. 13. Marilyn is the systems administrator for her company, which runs a large Active Directory network that consists of several domains all contained within one tree structure. This company has operations in both North America and Europe. Marilyn works in the Boston head office, where the root

109

Apply Your Knowledge domain is established, including the domain controllers that hold the roles of domain naming master and schema master. One weekend, the domain naming master crashed, and the hardware techs discovered that it requires several new parts, including a new SCSI hard drive, and that the parts will take more than a week to be delivered and installed. However, Marilyn ur gently needs to create two new domains that will encompass the company’s newly expanded European operations. Without a functioning domain naming master, she is unable to create the new domains. She realizes that it is necessary to have another domain controller seize the role of domain naming master. Which of the following does Marilyn need to do to accomplish this task?

❍

A. Use the ntdsutil command-line utility.

❍

B. Use Active Directory Domains and Trusts.

❍

C. Use Active Directory Users and Computers.

❍ D. Reinstall another computer with Windows Server 2003. Use dcpromo.exe to promote it to a domain controller and specify that it is to be a domain naming master. 14. George’s company operates an Active Directory network with three domains. Because users require access to resources in all three domains, he has created several universal groups. One child domain has two sites connected by a 56K link. Each site has two domain controllers, one of which is a global catalog server at each site, and they are configured to replicate once each night. One day, the global catalog server at the smaller of the two sites crashed, and George had to order several hardware components to bring it back online. The next day, users at that site complained of excessively long logon times. The remaining domain controller does not have enough disk space to support hosting the global catalog. What should George do to expedite logon times until he can bring the failed domain controller up again?

❍

A. Configure more frequent replication with the other site in that domain.

❍

B. Change the scope of all the universal groups to global.

❍

C. Transfer the RID master role to the remaining domain controller at that site.

❍ D. Enable universal group caching on the remaining domain controller at that site. 15. Your company operates a network that contains three domains with eight sites, each representing different cities in which company offices are located. The domains represent separate business divisions. Some users require access to resources in other domains at other sites, and lately access has been slow at busy times of the day. You decide that there is a need for several additional global catalog servers in each domain. Which tool should you use to create these global catalog servers?

❍

A. The ntdsutil command-line tool.

❍

B. Active Directory Domains and Trusts.

❍

C. Active Directory Sites and Services.

❍ D. You cannot create more than one global catalog server per domain.

110

Chapter 2: Planning and Implementing an Active Directory Infrastructure

Answers to Exam Questions 1. A. Nolan should configure a global catalog server at the Tokyo office. It contains directory information about all objects in the forest, including the location of resources in each domain of the forest. Universal group caching stores information about universal group membership in the domain controller where it is implemented, but does not store information about resources in Active Directory, so answer B is wrong. Replicating the entire contents of each domain between domain controllers in the two sites across the WAN link would overload the link and is unnecessary for solving this problem, so answers C and D are wrong. See the section “Global Catalog Servers.” 2. D. The RID master assigns sequences of relative identifiers (RIDs) to every domain controller in the domain. If the RID master is overtaxed because of all operations including the assignment of RIDs, Steve should move this role to another more suitable domain controller. The infrastructure master updates references to objects in its domain that point to objects in another domain, so answer B is wrong. The PDC emulator acts as a primary domain controller when Windows NT or 9x clients must receive password changes or other user actions, so answer C is wrong. The domain-naming master ensures that domain names throughout the Active Directory forest are unique, so answer A is wrong. See the section “Placement of Flexible Operations Master Roles.” 3. D, A. To prepare the domain for upgrading to Windows Server 2003, Lynn must first run the Adprep /forestprep command at the schema master, and not the domain naming master or infrastructure master. She must then run the Adprep /domainprep command at the infrastructure master, and not at any other operations master. Therefore, answers B, C, E, and F are incorrect. You should note that in an “ordered list” or “build list and reorder” exam question, you must place the required items in the proper order for the answer to be scored correct. Therefore, specifying the answer to this question as “A, D” is incorrect. A question of this type would appear as a “drag and drop” question type on the exam. See the section “Upgrading Windows 2000 Domains and Forests.” 4. C. The schema master and domain naming master are forestwide roles, so only one of these roles exists in the forest, and answer B is wrong. The RID master, PDC emulator, and infrastructure master are domainwide roles, so each domain has one of these roles, for a total of five each and answer A is wrong. An empty root domain still has all five operations masters, so answer D is wrong. See the section “Placement of Flexible Operations Master Roles.” 5. D. The PDC emulator looks after the synchronizing of time on all domain controllers in the domain. If it is not functioning properly, time could drift and create this kind of problem. The infrastructure master is used to update object references in its domain that point to objects in another domain in the forest. The schema master keeps track of all changes to the schema. The RID master allocates sequences of relative identifiers (RIDs) to domain controllers for use when new objects are created in Active Directory. None of these other operations masters track time, so answers A, B, and C are wrong. See the section “Placement of Flexible Operations Master Roles.” 6. B. When a domain contains a mixture of Windows NT 4.0, Windows 2000, and Windows Server 2003 domain controllers, it operates in the Windows 2000 mixed functional level. Windows NT 4.0 client computers can be authenticated at any domain controller, but functions such as password changes can be accommodated only at the PDC emulator, which acts as a primary domain controller for these clients. The infrastructure master computer updates object references in its domain that point to

111

Apply Your Knowledge resources in another domain. Its absence might affect access to resources but not password changes, so answer A is wrong. Windows NT 4.0 BDCs can authenticate users but not change their passwords, so answer C is wrong. Although Windows 2000 mixed functional level does not allow improvements such as universal groups and enhanced group nesting, it does not affect users’ ability to change passwords, so answer D is wrong. See the section “Windows Server 2003 Functional Levels.” 7. A. You need to raise the forest functional level to Windows Server 2003 to be able to rename domain controllers. To raise the forest functional level to Windows Server 2003, you first need to raise the domain functional level of all domains to Windows Server 2003. You cannot raise the forest functional level to Windows Server 2003 until the domain functional level of all domains has been raised to Windows Server 2003, so answer B is incorrect. You must raise the domain functional level of all domains to Windows Server 2003 before you raise the forest functional level to Windows Server 2003, so answers D and E are incorrect. You need to perform the forest action on the root domain (examcram.com) only and not on the child domains, so answers C and F are incorrect. See the section “Renaming Domains and Domain Controllers.” 8. C. In this situation, in which business including network administration is essentially autonomous at the two locations, Evelyn should consider creating two domains, one for each location. This approach makes sense because domains are both a replication and a security boundary. Only the schema and configuration partitions, and possibly one or more application directory partitions, need to be replicated across the slow link. She cannot use OUs for reducing the amount of replication, so answer A is wrong. Use of sites is more desirable if administrators have to work more closely together, so answer B is wrong. She does not need to establish two forests, so answer D is wrong. See the section “Planning the Active Directory Namespace.” 9. D. Debbie needs to configure the Houston site for universal group membership caching. Logon times at the Houston site are slow because the domain controllers at this site need to contact the domain controllers at the Dallas site for universal group membership information. Universal group membership caching is enabled for a site from the NTDS Settings node of the Active Directory Sites and Services snap-in, and applies to all domain controllers in a site. Therefore, it is incorrect to suggest that universal group membership caching is enabled on a specific domain controller (Server3 or Server4), and answer B is incorrect. She needs to enable universal group caching at the site without global catalog servers; therefore, answer C is incorrect. The users in Houston are complaining only about slow logons and not about slow resource connections, so it is not necessary to configure Server3 or Server4 as a global catalog server; therefore answer A is incorrect. See the section “Evaluating the Need to Enable Universal Group Caching.” 10. C. Due to the way that the system determines references to external objects, the infrastructure master cannot be hosted on the same domain controller where the global catalog is located. For this reason, one of these roles should be hosted on another server. It is possible to administer the servers remotely, including the infrastructure master. Consequently, the location of this computer does not matter, so answer A is wrong. The domain naming master and schema master can operate on the same server without difficulties, so answer B is wrong. The students at the help center do not need access to the infrastructure master, so answer D is wrong. See the section “Placement of Flexible Operations Master Roles.”

112

Chapter 2: Planning and Implementing an Active Directory Infrastructure 11. C. An NTFS partition is required to support the SYSVOL folder, and dcpromo will give you an immediate error message should one not be present. The use of NTFS is always desirable anyway so that you can configure the proper security including permissions on the server. Although a domain controller having an automatically assigned IP address is not the best approach, this will not prevent dcpromo from running, so answer A is wrong. A DNS server that supports service (SRV) resource records and the dynamic update protocol must be available. However, dcpromo will offer to install one for you if it cannot locate one, so answer B is wrong. You do not need a certificate server to be able to run dcpromo, so answer D is wrong. See the section “Creating the Forest Root Domain.” 12. B. The application directory partition replica is used to create replicas of the application directory partitions on the domain controllers to which Susan wants the data replicated. The ntdsutil tool is used to create and configure application directory partitions. Creating additional application directory partitions creates separate partitions without any link to the partition she has already created, so answer A is wrong. Specifying a reference domain merely changes which domain is the parent domain of the application directory partition, so answer C is wrong. She cannot use Active Directory Domains and Trusts to configure application directory partitions, so answer D is wrong. See the section “Application Directory Partitions.” 13. A. To seize the role of domain naming master, Marilyn needs to use the ntdsutil command-line utility. It is appropriate to seize this role in this scenario because the hard disk of the old computer has failed and it will have to be reinstalled after parts have arrived. Consequently, to Active Directory it will be an entirely new computer, and the old computer will never be online again. Role seizure is appropriate under these circumstances. Using Active Directory Domains and Trusts, Marilyn can transfer the role of domain naming master to another computer but not seize this role, so answer B is wrong. Active Directory Users and Computers can transfer any of the three domainwide operations master roles but cannot seize any of these roles, so answer C is wrong. Marilyn cannot specify the role of domain naming master during the promotion of another computer to domain controller, so answer D is wrong. See the section “Placement of Flexible Operations Master Roles.” 14. D. Universal group caching enables any domain controller that services a user’s logon to store universal group information the first time the user logs on. It enables users to log on without the need to contact the global catalog server that is located across the slow link. More frequent replication does not help because this does not replicate universal group information to a domain controller that is not a global catalog server; therefore, answer A is wrong. Changing the scope of universal groups to global might enable faster logons, but it would allow access to resources in the same domain only, so answer B is wrong. The RID master has nothing to do with universal groups, so answer C is wrong. See the section “Evaluating the Need to Enable Universal Group Caching.” 15. C. You can designate additional global catalog servers by using the Active Directory Sites and Services tool and going to the Properties dialog box for the NTDS Setting object. The Active Directory Domains and Trusts and the ntdsutil tool cannot designate global catalog servers, so answers A and B are wrong. Although you can have only one of each operations master roles in each domain, you can have as many global catalog servers as you want, so answer D is wrong. See the section “Global Catalog Servers.”

113

Apply Your Knowledge

Suggested Readings and Resources 1. Boswell, W. 2000. “Deploying Windows Server 2003 Domains,” Chapter 9 of Inside

Windows Server 2003. Boston: Addison-Wesley. 2. Microsoft Corporation. “Active Directory Branch Office Planning Guide.”

http://www.microsoft.com/windows2000/techinfo/planning/activedirectory/ branchoffice/default.asp. 3. Microsoft Corporation. “Active Directory Collection.” http://technet2.microsoft.com/

WindowsServer/en/library/6f8a7c80-45fc-4916-80d9-16e6d46241f91033.mspx?mfr =true. 4. Microsoft Corporation. “Designing the Site Topology.” http://technet2.microsoft.com/

WindowsServer/en/Library/d9a82c36-8e7f-491a-81ec-532f73ea70e71033.mspx?mfr =true. 5. Microsoft Corporation. “Enabling Advanced Windows Server 2003 Active Directory

Features.” http://technet2.microsoft.com/WindowsServer/en/Library/a4072f1a-4a464d54-85ed-d469fd6547aa1033.mspx?mfr=true. 6. Microsoft Corporation. “Installing Windows Server 2003 R2.” http://

technet2.microsoft.com/WindowsServer/en/library/c68efa05-c31e-42c9-aed60391130ceac21033.mspx?mfr=true. 7. Microsoft Corporation. “Introduction to Active Directory Application Mode.” http://

download.microsoft.com/download/5/7/a/57a8d3ed-89f7-4878-b945-b68c447f288a/ Adam.DOC. 8. Microsoft Corporation. “Microsoft Windows Server 2003 Deployment Kit, Designing

and Deploying Directory and Security Services.” http://technet2.microsoft.com/ WindowsServer/en/Library/d2ff1315-1712-48e4-acdc-8cae1b593eb11033.mspx?mfr=true. 9. Microsoft Corporation. “Migrating Windows NT Server 4.0 Domains to Windows

Server 2003 Active Directory.” http://www.microsoft.com/windowsserver2003/ evaluation/whyupgrade/nt4/nt4domtoad.mspx. 10. Microsoft Corporation. “Step by Step Guide to Implementing Domain Rename.”

http://download.microsoft.com/download/c/f/c/cfcbff04-97ca-4fca-9e8c-3a9c90a2a2e2/ Domain-Rename-Procedure.doc.

This page intentionally left blank

3

CHAPTER 3

Managing an Active Directory Infrastructure Objectives This chapter covers the following Microsoft-specified objectives for the Planning and Implementing an Active Directory Infrastructure and Managing and Maintaining an Active Directory Infrastructure sections of the Windows Server 2003 Active Directory Infrastructure exam: Implement an Active Directory directory service forest and domain structure . Establish trust relationships. Types of trust relationships might include external trusts, shortcut trusts, and crossforest trusts. . Business requirements might dictate the need to use more than one forest in your enterprise. You need to understand how to create trust relationships with external forests and when to use external trusts or forest trusts. You should also understand when to use shortcut trusts within multiple-domain forests.

Manage an Active Directory forest and domain structure . Manage trust relationships . Manage schema modifications . Add or remove a UPN suffix . This objective is intended to make sure that you can manage several components of the Active Directory forest and domain structure. You should be aware of the different types of trust relationships you can configure within and between forests. You should also understand how to work with the Active Directory schema and how to use UPN suffixes to facilitate management and user logon in multiple-domain enterprises.

Implement an Active Directory site topology . Configure site links . Configure preferred bridgehead servers . This objective evaluates your knowledge of how Active Directory handles networks that are distributed among different physical locations separated by low-speed WAN links. You need to understand how to create and configure sites, site link bridges, and bridgehead servers, and how the Inter-site Topology Generator and Knowledge Consistency Checker operate.

Manage an Active Directory site . Configure replication schedules . Configure site link costs . Configure site boundaries . This objective is intended to make sure that you know how to manage several components of the links between Active Directory sites. You should understand the factors that affect intrasite and intersite replication and when to modify replication schedules and site link costs.

Outline Introduction

118

Active Directory Trust Relationships

118

Active Directory Site Topology

155

Creating Sites

156

Configuring Sites

157

Trust Relationships Within an Active Directory Forest

119

Interforest Trust Relationships

120

Configuring Site Boundaries

Establishing Trust Relationships

122

Configuring Site Links

162

Creating an External Trust

122

Site Link Bridges

163

Creating a Forest Trust

128

Knowledge Consistency Checker

165

Creating a Shortcut Trust

130

Configuring Connection Objects

166

132

Inter-Site Topology Generator

168

132

Preferred Bridgehead Servers

169

Managing Trust Relationships Validating Trust Relationships

Adding Domain Controllers

Changing the Authentication Scope 134

Specifying a Licensing Server

157 158 159

Configuring Replication Schedules

171

Configuring Name Suffix Routing

134

Removing a Crossforest Trust Relationship

What Does Active Directory Replicate?

171

137

Active Directory Federation Services (ADFS)

How Does Active Directory Replication Work?

172

138

Intrasite Replication

173

Understanding Trust Relationships

140

Intersite Replication

174

Active Directory Forest and Domain Structure

141

Configuring Site Link Costs

Managing Schema Modifications

141

Manually Forcing Replication

Installing the Schema Snap-In

142

Using the Schema Snap-In

145

Deactivating Schema Objects Adding or Removing a UPN Suffix Understanding the Directory Forest and Domain Structure

149 151 155

Chapter Summary Key Terms Apply Your Knowledge

179 181 183 184 185

Exercises

185

Exam Questions

192

Answers to Exercises

199

Answers to Exam Questions

199

Suggested Readings and Resources

203

Study Strategies This chapter builds on the foundations of the preceding chapter by covering the administration of forests and sites, as well as the Active Directory schema. As you work your way through the chapter, you should pay attention to the following: . Understand the different types of trust relationships available and when you should use them. In addition, you should know the differences between incoming and outgoing trust directions. . Understand the importance of schema modifications and the potential consequences of making such modifications. . Understand the ways you can create sites, site links, and site link bridges, and the importance of the Knowledge Consistency Checker and the Inter-Site Topology Generator. . Understand the way Active Directory replication works and its importance in keeping all domain controllers up to date. . Know the differences between intrasite and intersite replication and the way site topology affects replication.

118

Chapter 3: Managing an Active Directory Infrastructure

Introduction Now that you have created an Active Directory forest with a child domain and configured global catalog servers and operations masters, it is time to examine several issues related to multisided and multiforest Active Directory deployments. In this chapter, we cover several issues related to management of trust relationships among Active Directory forests, as well as schema modifications. We then turn our attention to creating, configuring, and managing sites, including replication and site links.

Active Directory Trust Relationships Objective

Implement an Active Directory directory service forest and domain structure . Establish trust relationships. Types of trust relationships might include external trusts, shortcut trusts, and cross-forest trusts.

Prospects of globalization and international commerce have increased the possibility of companies operating multiforest network enterprise structures. Before we look at the intricacies of interforest trusts, we briefly review trust relationships as they exist within a single forest. Before we look at the intricacies of Windows 2000 and interforest trusts, we will briefly review trust relationships as they existed within NT 4.0. Those of you who are upgrading from Windows NT 4.0 will be familiar with the trust relationships used to allow users in one domain to access resources in another domain. You could configure one domain to trust another one so that users in the second domain could access resources in the first one. Windows NT 4.0 did not create any trust relationships by itself; administrators in both the trusting and trusted domains had to configure every trust relationship. The domain where the resources are located is referred to as the trusting or resource domain, and the domain where the accounts are kept is referred to as the trusted or accounts domain. Some characteristics of trust relationships in Windows NT 4.0 follow: . In a one-way trust relationship, the trusting domain makes its resources available to

the trusted domain (see Figure 3.1). With the appropriate permissions, a user from the trusted domain can access resources on the trusting domain. However, users in the trusting domain are unable to access resources in the trusted domain, unless a two-way trust is set up.

119

Active Directory Trust Relationships

In a one-way trust relationship, the trusting domain holds the resources that users in the trusted domain need to access.

FIGURE 3.1

Trusting Domain

Trusted Domain

. A trust relationship exists between only two domains. Each trust relationship has just

one trusting domain and just one trusted domain. . A two-way trust relationship between domains is simply the existence of two one-way

trusts in opposite directions between the domains. . In Windows NT 4.0, trust relationships were not transitive; that is, if Domain A trusts

Domain B and Domain B trusts Domain C, these relationships do not mean that Domain A automatically trusts Domain C. To have such a relationship, a third trust relationship must be set up whereby Domain A trusts Domain C (see Figure 3.2). If Domain A trusts Domain B and Domain B trusts Domain C in a nontransitive trust, Domain A does not trust Domain C. In a transitive trust relationship, Domain A automatically trusts Domain C through Domain B when the other two trusts are created.

FIGURE 3.2 B

A

B

C Non-transitive

A

C Transitive

Trust Relationships Within an Active Directory Forest Active Directory in Windows 2000 introduced the concept of two-way transitive trusts that flow upward through the domain hierarchy toward the tree root domain and across root domains of different trees in the same forest. This includes parent-child trusts between parent and child domains of the same tree and tree root trusts between the root domains of different trees in the same forest. Because of this arrangement, administrators no longer need to configure trust relationships between domains in a single forest.

120

Chapter 3: Managing an Active Directory Infrastructure

NOTE Managing Trust Relationships You should be aware that only members of the Domain Admins group can manage trusts.

In addition, Windows Server 2003 provides for another trust relationship called a shortcut trust. It is an additional trust relationship between two domains in the same forest, which optimizes the authentication process when a large number of users need to access resources in a different domain in the same forest. This capability is especially useful if the normal authentication path needs to cross several domains. Consider Figure 3.3 as an example.

A.com

A.A.com

B.com

B.A.com

B.B.com

Shortcut trusts are useful if the authentication path to another domain in the forest has to cross several domain boundaries.

FIGURE 3.3

C.A.A.com

C.B.B.com

Suppose that users in the C.A.A.com domain need to log on to the C.B.B.com domain, which is located in the second tree of the same forest. The authentication path must cross five domain boundaries to reach the C.B.B.com domain. If an administrator establishes a shortcut trust between the C.A.A.com and C.B.B.com domains, the logon process speeds up considerably. This is also true for shorter possible authentication paths such as C.A.A.com to B.A.com or B.A.com to B.B.com. This also facilitates the use of Kerberos when accessing resources located in another domain.

Interforest Trust Relationships Whenever there is need for accessing resources in a different forest, administrators have to configure trust relationships manually. Windows 2000 offers the capability to configure oneway, nontransitive trusts with similar properties to those mentioned previously, between domains in different forests. You have to configure every trust relationship between each

121

Active Directory Trust Relationships

domain in the different forests explicitly. If you need a two-way trust relationship, you have to manually configure each half of the trust separately. Windows Server 2003 makes it easier to configure interforest trust relationships. In this section, we study these trust relationships. In a nutshell, for forests that are operating at the Windows Server 2003 forest functional level, you can configure trusts that enable two-way transitive trust relationships between all domains in the relevant forests. If the forest is operating at any other functional level, you still need to configure explicit trusts as in Windows 2000. Windows Server 2003 introduces the following types of interforest trusts: . External trusts—These one-way trusts are individual trust relationships set up

between two domains in different forests, as could be done in Windows 2000. The forests involved might be operating at any forest functional level. You can use this type of trust if you need to enable resource sharing only between specific domains in different forests. You can also use this type of trust relationship between an Active Directory domain and a Windows NT 4.0 domain. . Forest trusts—As already mentioned, these trusts include complete trust relationships

between all domains in the relevant forests, thereby enabling resource sharing among all domains in the forests. The trust relationship can be either one-way or two-way. Both forests must be operating at the Windows Server 2003 forest functional level. The use of forest trusts offers several benefits: . They simplify resource management between forests by reducing the number of

external trusts needed for resource sharing. . They provide a wider scope of UPN authentications, which can be used across the

trusting forests. . They provide increased administrative flexibility by enabling administrators to split

collaborative delegation efforts with administrators in other forests. . Directory replication is isolated within each forest. Forestwide configuration modifi-

cations such as adding new domains or modifying the schema affect only the forest to which they apply, and not trusting forests. . They provide greater trustworthiness of authorization data. Administrators can use

both the Kerberos and NTLM authentication protocols when authorization data is transferred between forests. . Realm trusts—These are one-way nontransitive trusts that you can set up between an

Active Directory domain and a Kerberos V5 realm such as found in UNIX and MIT implementations.

122

Chapter 3: Managing an Active Directory Infrastructure

Establishing Trust Relationships This section examines creating two types of trust relationships with external forests: external trusts and forest trusts. We then look at the shortcut trust, which is the only configurable type of trust relationship between two domains in the same forest. Before you begin to create trust relationships, you must be aware of several prerequisites: . You must be a member of the Enterprise Admins group or the Domain Admins group

in the forest root domain. New to Windows Server 2003, you can also be a member of the Incoming Forest Trust Builders group on the forest root domain. This group has the rights to create one-way, incoming forest trusts to the forest root domain. If you hold this level of membership in both forests, you can set up both sides of an interforest trust at the same time. . You must ensure that DNS is properly configured so that the forests can recognize

each other. You might have to configure conditional forwarding to enable DNS servers in one forest to forward queries to DNS servers in the other forest so that resources are properly located. . In the case of a forest trust, both forests must be operating at the Windows Server

2003 forest functional level. Windows Server 2003 provides the New Trust Wizard to simplify the creation of all types of trust relationships. The following sections show you how to create these trust relationships.

Creating an External Trust Follow Step by Step 3.1 to create an external trust with a domain in another forest or a Windows NT 4.0 domain.

EXAM ALERT Trust Creation Can Be Tricky! Know the variations of the procedures so that you can answer questions about the troubleshooting of problems related to interforest access as they relate to the options available when creating trusts. In particular, be aware of the differences between the incoming and outgoing trust directions.

STEP BY STEP 3.1 Creating an External Trust 1. Click Start, Administrative Tools, Active Directory Domains and Trusts to open the Active Directory Domains and Trusts snap-in.

123

Active Directory Trust Relationships 2. In the console tree, right-click your domain name and choose Properties to display the Properties dialog box for the domain. 3. Select the Trusts tab. This tab contains fields listing domains trusted by this domain and domains that trust this domain. Initially these fields are blank, as in Figure 3.4.

You can manage trusts from the Trusts tab of a domain’s Properties dialog box.

FIGURE 3.4

4. Click New Trust to start the New Trust Wizard, as shown in Figure 3.5.

You can create new trust relationships by using the New Trust Wizard.

FIGURE 3.5

5. Click Next, and on the Trust Name page, type the name of the domain with which you want to create a trust relationship (see Figure 3.6). Then click Next.

124

Chapter 3: Managing an Active Directory Infrastructure

On the Trust Name page, you can enter the DNS or NetBIOS name of the domain with which you want to create a trust.

FIGURE 3.6

6. The Trust Type page, shown in Figure 3.7, offers you a choice between an external trust and a forest trust. Select External Trust and then click Next.

You can select the trust type required from the Trust Type page.

FIGURE 3.7

NOTE Trust Types If the forest functional level is not set to Windows Server 2003, the forest trust option will not appear. You might receive an option to create a realm trust or an external trust with a Windows domain.

7. The Direction of Trust page, shown in Figure 3.8, offers you a choice of the following three types of trusts:

125

Active Directory Trust Relationships . Two-Way—Creates a two-way trust. This type of trust allows users in both domains to be authenticated in each other’s domain. . One-Way: Incoming—Creates a one-way trust in which users in your (trusted) domain can be authenticated in the other (trusting) domain. Users in the other domain cannot be authenticated in your domain. . One-Way: Outgoing—Creates a one-way trust that users in the other (trusted) domain can be authenticated in your (trusting) domain. Users in your domain cannot be authenticated in the other domain.

The Direction of Trust page offers you options for creating one-way or two-way trusts.

FIGURE 3.8

8. Select a choice according to your network requirements and then click Next. 9. The Sides of Trust page, shown in Figure 3.9, allows you to complete both sides of the trust if you have the appropriate permissions in both domains. If this is so, select Both This Domain and the Specified Domain. Otherwise, select This Domain Only and then click Next.

The Sides of Trust page enables you to complete both sides of the trust if you have the appropriate permissions.

FIGURE 3.9

126

Chapter 3: Managing an Active Directory Infrastructure 10. If you selected This Domain Only on the Sides of Trust page, the Trust Password page appears, asking for a password for the trust. You must specify the same password when creating the trust in the other domain. Type and confirm a password that conforms to password security guidelines, click Next, and then skip to step 13. Ensure that you remember this password. 11. If you selected Both This Domain and the Specified Domain on the Sides of Trust page, the Outgoing Trust Properties—Local Domain page, shown in Figure 3.10, offers the following two choices in the scope of authentication for users in the trusted domain: . Domain-Wide Authentication—This option authenticates users from the trusted domain for all resources in the local domain. Microsoft recommends this option only for trusts within the same organization. . Selective Authentication—This option does not create any default authentication. You must grant access to each server that users need to access. Microsoft recommends this option for trusts that involve separate organizations, such as contractor relationships.

FIGURE 3.10 The Outgoing Trust Authentication Level-Local Domain page provides two choices of authentication scope for users in the trusted domain.

12. Select the appropriate type of authentication and then click Next. 13. The Trust Selections Complete page displays a list of the options that you have configured (see Figure 3.11). Review these settings to ensure that you have made the correct selections. If any setting is incorrect, click Back and correct it. Then click Next.

127

Active Directory Trust Relationships

FIGURE 3.11 The Trust Selections Complete page displays a review of the trust settings you specified.

14. The Trust Creation Complete page informs you that the trust relationship was successfully created. Click Next to finish the process. 15. The Confirm Outgoing Trust page asks whether you want to confirm the outgoing trust (see Figure 3.12). If you have configured the trust from the other side, click Yes, Confirm the Outgoing Trust. Otherwise, click No, Do Not Confirm the Outgoing Trust. Then click Next.

FIGURE 3.12 The Confirm Outgoing Trust page provides a chance to confirm the other side of the trust.

16. The Confirm Incoming Trust page asks whether you want to confirm the incoming trust. Choices are the same as on the previous page. If you want to confirm this trust, enter a username and password for an administrator account in the other domain. 17. The Completing the New Trust Wizard page verifies the confirmation of the trust from the other side. Click Finish.

128

Chapter 3: Managing an Active Directory Infrastructure 18. You are returned to the Trusts tab of the domain’s Properties dialog box (see Figure 3.13). The name of the domain with which you configured the trust now appears in one or both of the fields according to the trust type you created. Click OK to close this dialog box.

After you have created the trust relationship, the Trusts tab of the domain’s Properties dialog box shows the name of the trusted domain together with the trust type and transitivity. FIGURE 3.13

Creating a Forest Trust Recall that this type of trust can be created only between two Active Directory forests that are both operating at the Windows Server 2003 forest functional level. Follow Step by Step 3.2 to create a forest trust.

STEP BY STEP 3.2 Creating a Forest Trust 1. Make sure that the forest functional level of both forests is set to Windows 2003. See Chapter 2, “Planning and Implementing an Active Directory Infrastructure,” for details. 2. Follow steps 1–5 of Step by Step 3.1 to access the Trust Name page of the New Trust Wizard. 3. Type the name of the forest root domain with which you want to create a trust and then click Next. 4. On the Trust Type page, select Forest Trust and then click Next. 5. On the Direction of Trust page, select the appropriate direction for the trust and then click Next.

129

Active Directory Trust Relationships 6. On the Sides of Trust page, specify whether you want to create the trust for this domain only or for both this domain and the specified domain, and then click Next. 7. If you are creating the trust for both forests, specify a username and password for the specified forest and then click Next. If you are creating the trust for this forest only, specify the trust password that the administrator in the other forest will need to specify to complete the creation of the trust for her forest. Then click Next. 8. The Outgoing Trust Authentication Level—Local Forest page, shown in Figure 3.14, provides two choices that are similar to those provided by the Outgoing Trust Authentication Level—Local Domain page. Make a choice and then click Next.

FIGURE 3.14 The Outgoing Trust Authentication Level—Local Forest page provides two choices of authentication scope for users in the trusted forest.

9. The Trust Selections Complete page displays a list of the options that you have configured (refer to Figure 3.11). Review these settings to ensure that you have made the correct selections. If any setting is incorrect, click Back and correct it. Then click Next. 10. The Trust Creation Complete page informs you that the trust relationship was successfully created. Click Next to finish the process. 11. The Confirm Outgoing Trust page asks whether you want to confirm the outgoing trust (refer to Figure 3.12). If you have configured the trust from the other side, click Yes, Confirm the Outgoing Trust. Otherwise, click No, Do Not Confirm the Outgoing Trust. Then click Next. 12. The Confirm Incoming Trust page asks whether you want to confirm the incoming trust. Choices are the same as on the previous page. If you want to confirm this trust, enter a username and password for an administrator account in the other forest. 13. The Completing the New Trust Wizard page verifies the confirmation of the trust from the other side. Click Finish. 14. You are returned to the Trusts tab of the domain’s Properties dialog box (refer to Figure 3.13). The

130

Chapter 3: Managing an Active Directory Infrastructure name of the domain with which you configured the trust now appears in one or both of the fields according to the trust type you created. Click OK to close this dialog box.

EXAM ALERT Know When You Should Create a Forest Trust Know that all domains involved must be at the Windows Server 2003 domain functional level, and that the forests must be at the Windows 2003 forest functional level. Also remember that a forest trust is the simplest way to connect forests when access to resources in multiple domains is required, and when Kerberos authentication across the forest boundary is needed.

EXAM ALERT If You Rename a Domain, Cross-Forest Trusts Are Invalidated If a question informs you that a domain has been renamed and users are unable to access resources in an external forest, the reason for this problem is that both external and forest trust relationships are invalidated by the rename process. You need to delete and re-create the trust relationships following the renaming process.

Creating a Shortcut Trust Recall that this type of trust can be created between child domains in the same forest to expedite crossdomain authentication or resource access. Follow Step by Step 3.3 to create a shortcut trust relationship.

STEP BY STEP 3.3 Creating a Shortcut Trust 1. In Active Directory Domains and Trusts, right-click your domain and choose Properties. 2. On the domain’s Properties dialog box, select the Trusts tab and click New Trust to start the New Trust Wizard. 3. Click Next, and on the Trust Name and Password page, type the DNS name or NetBIOS name of the domain with which you want to establish a shortcut trust and then click Next. 4. On the Direction of Trust page (refer to Figure 3.8), choose the appropriate option (two-way, one-way incoming, or one-way outgoing) and then click Next. 5. On the Sides of Trust page, specify whether you want to create the trust for this domain only or for both this domain and the specified domain, and then click Next.

131

Active Directory Trust Relationships 6. If you are creating the trust for both domains, specify a username and password for an administrator account in the specified domain. If you are creating the trust for this domain only, specify the trust password that the administrator in the other domain will need to specify to complete the creation of the trust for her domain. Then click Next. 7. The Trust Selections Complete page displays a summary of the settings you have entered (refer to Figure 3.11). Click Back if you need to make any changes to these settings. Then click Next to create the trust. 8. The Trust Creation Complete page informs you that the trust relationship was successfully created. Click Next to configure the trust. 9. The Confirm Outgoing Trust page asks whether you want to confirm the other side of the trust. If you have created both sides of the trust, click Yes. Otherwise, click No and then click Next. 10. The Confirm Incoming Trust page asks whether you want to confirm the incoming trust. Choices are the same as on the previous page. If you want to confirm this trust, enter a username and password for an administrator account in the other domain. 11. The Completing the New Trust Wizard page informs you that you have created the trust. Click Finish to return to the Trusts tab of the domain’s Properties dialog box (refer to Figure 3.13). The name of the domain with which you configured the trust now appears in one or both of the fields according to the trust type you created. Click OK to close this dialog box.

If you have created only one side of the trust, an administrator in the other domain must repeat this procedure to create the trust from her end. She will have to enter the trust password you specified in this procedure.

A Separate Research Forest A major aircraft manufacturer landed a contract with NASA to design one module of a prototype spacecraft for a manned Mars mission. Realizing that the research necessary to complete this project successfully required a high level of security, management asked the senior network administrator to set up a separate forest in the organization’s Windows Server 2003 Active Directory design. For the project to succeed, researchers needed access to certain data stored in the organization’s existing forest. Their user accounts would be in the new forest. Users in the existing forest did not need to access data in the research forest. The administrator had to choose a trust model that would enable the appropriate levels of access. With these needs in mind, the administrator decided to implement a one-way external trust relationship in which the existing forest trusted the research forest. It was then possible to place the researchers who needed access into a group that could be granted access to the appropriate resources in the existing forest. Because the trust relationship was one-way, no access in the opposite direction was possible. We take a further look at the use of groups to grant crossforest access in Chapter 6, “Implementing User, Computer, and Group Strategies.”

132

Chapter 3: Managing an Active Directory Infrastructure

Managing Trust Relationships Objective

Manage an Active Directory forest and domain structure . Manage trust relationships

After you have created a crossforest trust, the following limited set of configuration options is available from the trust’s Properties dialog box: . Validate Trust Relationships—This option enables you to verify that a trust has been

properly created and that the forests can communicate with each other. . Change the Authentication Scope—This option enables you to change the selection

of domainwide authentication or selective authentication that you made during creation of the trust, should you need to modify access control to the trusting forest’s resources. . Configure Name Suffix Routing—This option provides a mechanism that you can

use to specify how authentication requests are routed across Windows Server 2003 forests. It is available only when forest trusts are used.

Validating Trust Relationships To access the trust’s Properties dialog box and validate a trust relationship, follow Step by Step 3.4.

STEP BY STEP 3.4 Validating a Trust Relationship 1. In Active Directory Domains and Trusts, right-click your domain name and choose Properties. 2. On the Trusts tab of the domain’s Properties dialog box, select the name of the other domain or forest and click Properties. 3. This action displays the trust’s Properties dialog box, as shown in Figure 3.15.

133

Active Directory Trust Relationships

FIGURE 3.15 The General tab of the Properties dialog box of the other domain provides information on the trust’s properties.

4. To validate the trust relationship, click Validate. 5. If the trust is in place and active, you receive a confirmation message box, as shown in Figure 3.16. Otherwise, you receive an error message, such as the one in Figure 3.17.

FIGURE 3.16

This message box informs you that the trust is

valid.

FIGURE 3.17

If the trust cannot be validated, an error message such as this informs you of the problem.

134

Chapter 3: Managing an Active Directory Infrastructure

Changing the Authentication Scope Follow Step by Step 3.5 to change the authentication scope that you set when you create the trust.

STEP BY STEP 3.5 Changing the Authentication Scope of a Trust Relationship 1. Select the Authentication tab of the trust’s Properties dialog box, as shown in Figure 3.18. 2. Select either Domain-Wide Authentication or Selective Authentication (as already described in Step by Step 3.1) and then click OK.

FIGURE 3.18

The Authentication tab of a trust’s Properties dialog box allows you to change the trust’s authenti-

cation scope.

Configuring Name Suffix Routing When you initially create a forest trust, all unique name suffixes are routed by default. A unique name suffix is a name suffix within a forest, such as a User Principal Name (UPN) suffix, Service Principal Name (SPN) suffix, or domain name system (DNS) forest or tree name that is not subordinate to any other name suffix. For example, the DNS forest name quepublishing.com is a unique name suffix within the quepublishing.com forest. Consequently, name suffixes in one forest do not exist in another forest.

135

Active Directory Trust Relationships

Name suffix routing is a mechanism that can manage the routing of authentication requests across Windows Server 2003 forests connected by forest trust relationships. It enables name suffixes that do not exist in one forest to be used to route authentication requests to another forest. This includes child name suffixes. As a result, when you view name suffixes in the Name Suffix Routing tab of the domain’s Properties dialog box, as shown in Figure 3.19, they are prefixed by * to indicate that they refer to the parent domain and all child domains. If you add new child domains to either forest, they automatically inherit the name suffix routing properties of other domains in the forest. After you add a new name suffix and validate the trust, it appears on the Name Suffixes tab with a status (shown on the Routing column) of Disabled. The Status column indicates New for a newly created name suffix.

FIGURE 3.19 The Name Suffix Routing tab of a trust’s Properties dialog box allows you to enable or disable name suffix routing between forests.

You might have to disable name suffix routing to prevent certain authentication requests from flowing across the forest trust. You might also have to enable name suffix routing for additional name suffixes you have created or to exclude a child name suffix from routing. Follow Step by Step 3.6 to configure these name suffix routing options.

STEP BY STEP 3.6 Configuring Name Suffix Routing 1. On the Name Suffix Routing tab of the trust’s Properties dialog box, select the suffix whose routing status is to be changed and then click Enable or Disable as required. 2. The routing status in the Routing column changes. In the case of enabling a new name suffix routing, the New entry disappears from the Status column.

136

Chapter 3: Managing an Active Directory Infrastructure 3. To exclude a child name suffix from routing, select the parent suffix and click Edit to display the Edit domain name dialog box (see Figure 3.20).

FIGURE 3.20 You can exclude a name suffix that does not exist in the specified forest from routing by specifying it on the Edit domain name dialog box.

4. To exclude the name suffix, click Add. On the Add Excluded Name Suffix dialog box, type the name of the suffix and then click OK (see Figure 3.21).

FIGURE 3.21 The Add Excluded Name Suffix dialog box allows you to exclude a name suffix from routing to the specified forest.

5. The excluded name suffix appears on the Edit domain name dialog box. Click OK.

NOTE Name Conflicts Can Occur If the same unique name suffix is used in two forests connected by a forest trust, a conflict (or collision) might occur. In such situations, the Status column on the Name Suffix Routing tab lists the conflict in the indicated domain. You cannot enable this suffix for name routing until you have removed the conflicting name suffix for the indicated domain.

137

Active Directory Trust Relationships

Removing a Crossforest Trust Relationship Sometimes you might need to remove a trust relationship between two forests. For example, a contract might have completed or been terminated, an acquisition of one company by another might have fallen through, and so on. You could have to remove and re-create a trust relationship if you have incorrectly specified properties such as an incorrect trust type or direction. You can remove a trust relationship from the Active Directory Domains and Trusts snap-in by following Step by Step 3.7.

STEP BY STEP 3.7 Removing a Trust Relationship 1. In Active Directory Domains and Trusts, right-click your domain name and choose Properties. 2. On the Trusts tab of the domain’s Properties dialog box, select the trust to be removed and click Remove. 3. You are asked whether you want to remove the trust from the local domain only or from the local domain and the other domain (see Figure 3.22). If you want to remove the trust from both domains, select Yes, Remove the Trust from Both the Local Domain and the Other Domain, type the username and password for an account with administrative privileges in the other domain, and then click OK.

FIGURE 3.22 You are asked whether you want to remove the trust from the local domain only or from the local domain and the other domain.

4. Click Yes on the next dialog box to confirm removing the trust. 5. You are returned to the Trust tab of the domain’s Properties dialog box. Notice that the name of the other domain has been removed.

138

Chapter 3: Managing an Active Directory Infrastructure

WARNING Removing the Trust If you remove the trust from the local domain only, it still appears from the other domain but generates an error if you attempt to validate it. An administrator from the other domain must remove the trust from that domain as well.

Active Directory Federation Services (ADFS) R2 As introduced in Chapter 1, Active Directory Federation Services (ADFS) is a new feature in Windows Server 2003 R2 that enables you to set up a single signon capability for users accessing multiple web applications within a single session. It enables companies and business partners to collaborate with each other without the need to establish trust relationships and without the need for users in these companies to remember multiple usernames and passwords. Figure 3.23 provides a simple example. Let’s assume that Quepublishing.com is hosting a web application to which users in its own company and partner company Examcram.com need access. Each company operates its own Active Directory forest, but IT directors in both companies do not want to set up a trust relationship similar to those already discussed in this chapter. Therefore, both companies set up a server running Windows Server 2003 R2 with ADFS that allow users in Examcram.com to authenticate to the web server operated by Quepublishing.com with their regular usernames and passwords. The Quepublishing.com ADFS server authenticates a user from Examcram.com and grants access to the web application. As you can see from Figure 3.23, this constitutes a type of trust between the ADFS servers without an external or forest trust between the two forests.

AD Domain

AD Domain Trust

Server Running ADFS

Server Running ADFS Access to Web Application

User

Web Server quepublishing.com

User examcram.com

FIGURE 3.23 ADFS enables users from one company to authenticate to a web application in a second company without the need for a separate username and password.

139

Active Directory Trust Relationships

To deploy ADFS, you must first install Internet Information Services (IIS) together with a Secure Sockets Layer (SSL) certificate on the server that will run ADFS. You can obtain a SSL certificate from a server running Certificate Services, which we introduce in Chapter 5. Then you can install ADFS from the Active Directory Services node of the Windows Components Wizard. This installs a Microsoft Management Console (MMC) snap-in from which you can manage all aspects of ADFS, including trust policies, Active Directory Application Mode (ADAM) account stores, and web applications that users will access through ADFS. The installation and configuration of ADFS is currently beyond the scope of the 70-294 exam (although this could be subject to change in the future). For further information on the capabilities and usage of ADFS, refer to “Overview of Active Directory Federation Services in Windows Server 2003 R2,” in the “Suggested Readings and Resources” section.

Challenge Adding and Removing Trust Relationships You are the head network administrator for Widgets, Inc., which operates an Active Directory forest named widgets.com. The company has a forest trust relationship with an Active Directory forest named example.com. Corporate executives for Widgets, Inc., sell Example off to another business and acquire a new company named Samples. Consequently, no access should be permitted between the Widgets, Inc., and Samples networks. Users in widgets.com and samples.com need access to resources on each other’s networks. The latter company operates a Kerberos V5 realm named samples.com. As a result of these business decisions, you are required to remove the forest trust relationship with Example and create a new trust relationship with Samples. How should you proceed? Try to work through this problem on your own first. If you are stuck or need guidance, follow these steps and look back at the Step by Step procedures for more detailed information. 1. Working from a domain controller in the widgets.com forest, open Active Directory Domains and Trusts. 2. In the console tree, right-click widgets.com and choose Properties. 3. On the Trusts tab, under Domains Trusted by This Domain (Outgoing Trusts), select example.com and click Remove. Click Yes to confirm removal of this trust. 4. Repeat for the incoming trust. 5. Click New Trust and then click Next to bypass the welcome page of the New Trust Wizard. 6. Type samples as the name of the realm for the trust and then click Next. 7. On the Trust Type page, ensure that Realm Trust is selected and then click Next. 8. On the Transitivity of Trust page, leave the default of Nontransitive selected and then click Next. (continues)

140

Chapter 3: Managing an Active Directory Infrastructure (continued)

9. On the Direction of Trust page, select Two-way and then click Next. 10. On the Trust Password page, type and confirm a secure password and then click Next. Ensure that you keep a record of the password you have entered. In the real world, you would provide the administrator of Examcram the password so that he could configure the opposite end of the trust. 11. On the Trust Selections Complete page, click Next and then click Finish.

Understanding Trust Relationships Following are points to remember regarding trust relationships: . In a one-way trust relationship, the trusting domain makes its resources available to

users in the trusted domain. A two-way trust relationship consists of two one-way trusts in opposite directions. . By default in Active Directory, all domains in a forest trust each other with two-way

transitive trust relationships. You can also create shortcut trusts between child domains to facilitate rapid authentication and resource access. . You need to set up all trust relationships between different forests explicitly. You can

set up either external one- or two-way trusts between specific domains in the two forests or a forest trust in which all domains in the two forests trust each other with two–way trusts. . A one-way incoming trust allows users in your (trusted) domain to be authenticated in

the other (trusting) domain, whereas a one-way outgoing trust allows users in the other (trusted) domain to be authenticated in your (trusting) domain. . Two authentication scopes are available: Domainwide authentication allows users from

the trusted domain to access all resources in the local domain. Selective authentication does not create any default authentication; you must grant access to each server that users need to access. You can change the authentication scope after trusts are set up, if necessary. . You can enable name suffix routing that simplifies authentication requests being routed

to another forest. New child domains added to either forest automatically inherit these name suffix routing properties; however, you can disable name suffix routing when required or exclude a child name suffix from routing. . ADFS enables you to set up a type of trust for users to access web applications in

another forest without the need for a separate username and password, without establishing a regular forest or external trust relationship.

141

Active Directory Forest and Domain Structure

Active Directory Forest and Domain Structure Now that you know about creating and administering trust relationships, we are ready to look at two additional aspects of forest and domain management: schema modifications and UPN suffixes.

Managing Schema Modifications Objective

Manage an Active Directory forest and domain structure . Manage schema modifications

As discussed in Chapter 1, “Concepts of Windows Server 2003 Active Directory,” the schema is a set of rules that define the classes of objects and their attributes that can be created in an Active Directory forest. All domains in a forest share a common schema, which is replicated to all domain controllers in the forest. However, only the schema master contains a writable copy of the schema; all other domain controllers contain a read-only replica of the schema. Active Directory stores information on the classes and attributes as instances of the classSchema and attributeSchema classes, respectively. The schema defines the attributes that can be held by objects of various types, the various classes that can exist, and the object class that can be a parent of the current object class. When you first install Active Directory, a default schema is created; it includes definitions for the common classes of objects, such as user, computer, and organizationalUnit. It also includes attribute definitions, such as lastName, userPrincipalName, telephoneNumber, and objectSid. Microsoft designed the schema to be extensible; in other words, you can add classes and attributes, together with their definitions, as required. In addition, you can remove classes and attributes that you no longer require, provided the forest is operating at the Windows Server 2003 functional level.

WARNING Take Great Care in Modifying the Schema Improper modifications can cause irreparable harm to Active Directory. For this reason, Microsoft created a global group called Schema Admins, and only members of this group can perform such modifications. As a best practice to avoid unauthorized modifications, you should remove all users from this group and add a user only when it is necessary to modify the schema. In addition, it is strongly advisable to create a test forest in a lab environment and test schema modifications here before deploying them to a production forest.

142

Chapter 3: Managing an Active Directory Infrastructure

Following are the characteristics of these classes: . Active Directory uses an instance of the classSchema class to define every object class

supported. For example, the mayContain and mustContain attributes describe attributes that an object class may and must contain. . You can use instances of the attributeSchema class to define every attribute that

Active Directory supports. For example, the attributeSyntax and isSingleValued attributes describe an attribute in a similar manner to the way in which attributes of a user object describe the user. . Active Directory uses a well-defined Schema container as a location in the directory

to store the instances of the attributeSchema and classSchema classes. This container has a distinguished name (DN) of the form CN=Schema,CN=Configuration, DC=quepublishing,DC=Com, where the DC items refer to the forest root domain name, using quepublishing.com as an example. For further information on object classes, their characteristics, and a description of the key attributes of a classSchema object, see “Characteristics of Object Classes” at the following address: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ad/ad/characteristics_of_ object_classes.asp For similar information for attributes, see “Characteristics of Attributes” at this address: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ad/ad/characteristics_ of_attributes.asp

Installing the Schema Snap-In You can perform schema modifications from any computer running Windows Server 2003 or Windows XP Professional by installing the Active Directory Schema snap-in on a server or installing the Windows Server 2003 Administration Tools Pack on a Windows XP Professional computer. If the computer is not the schema master, it creates a connection to the schema master when you start the snap-in. The Active Directory schema snap-in is not present by default when you first install Active Directory. Installation of this snap-in is a two-step process: registration and snap-in installation. Follow Step by Step 3.8 to register the snap-in.

STEP BY STEP 3.8 Registering the Active Directory Schema Snap-In 1. Ensure that you are logged on as a member of the Schema Admins group. 2. Click Start, Command Prompt.

143

Active Directory Forest and Domain Structure 3. Type regsvr32 schmmgmt.dll. 4. A message box informs you that the registration succeeded. See Figure 3.24.

FIGURE 3.24

Windows informs you when you have successfully registered the Active Directory Schema snap-in.

After you have registered the Active Directory Schema snap-in, you can add this snap-in to an empty Microsoft Management Console (MMC). Follow Step by Step 3.9 to install the Active Directory Schema snap-in.

STEP BY STEP 3.9 Installing the Active Directory Schema Snap-in to a New MMC Console 1. Click Start, Run. 2. Type mmc to open an empty MMC console. 3. Click File, Add/Remove Snap-In to open the Add/Remove Snap-In dialog box (see Figure 3.25).

FIGURE 3.25 Using the Add/Remove Snap-In dialog box, you can add a snap-in to a new or existing MMC console.

144

Chapter 3: Managing an Active Directory Infrastructure 4. Click Add to display the Add Standalone Snap-In dialog box. 5. Select Active Directory Schema, as shown in Figure 3.26, and then click Add.

FIGURE 3.26 Using the Add Standalone Snap-In dialog box, you can select one or more snap-ins to add to the MMC console.

6. Click Close to return to the Add/Remove Snap-In dialog box. 7. Click OK. The Active Directory Schema snap-in is added to the MMC console (see Figure 3.27).

FIGURE 3.27 On completion of this procedure, you have an MMC console containing the Active Directory Schema snap-in.

8. Click File, Save, and on the Save As dialog box, type a descriptive name for the console, such as Schema.msc. Then click Save.

The Schema snap-in is now available, and you can locate it from the Administrative Tools folder.

145

Active Directory Forest and Domain Structure

EXAM ALERT Remember the Prerequisites for Installing and Using the Schema Snap-In! First, you must be a member of the Schema Admins group. Then you must register the Active Directory Schema snap-in to make it available in the Add Standalone Snap-In dialog box.

Using the Schema Snap-In After you have installed the Schema snap-in, you can make any required modifications. Step by Step 3.10 shows you how to create a new attribute.

EXAM ALERT You Can Only Deactivate, Not Delete, Improper Schema Objects The exam might present you with a scenario in which an application has created incorrect schema attributes or classes. After objects have been created in the schema, you cannot delete them except by completely reinstalling Active Directory. Furthermore, you cannot rename schema objects. The proper solution to this problem is to deactivate these objects. This is also another reason to test new applications in a lab network before deploying them to the production network.

STEP BY STEP 3.10 Creating a New Schema Attribute 1. Click Start, Administrative Tools, Schema.msc. If you installed the Schema snap-in according to Step by Step 3.9, this selection opens the Schema snap-in. 2. Expand the Active Directory Schema container in the console tree. You see two containers: Classes and Attributes. 3. Select the Attributes container. As you can see in Figure 3.28, a long list of attributes is available.

FIGURE 3.28 By default, the Active Directory Schema snap-in contains a large number of attributes.

146

Chapter 3: Managing an Active Directory Infrastructure 4. Right-click Attributes and select Create Attribute. You are warned that creating schema objects in the directory is a permanent operation (see Figure 3.29).

FIGURE 3.29 This warning message informs you that creating schema objects is a permanent operation.

5. Click Continue. This action displays the Create New Attribute dialog box (see Figure 3.30).

FIGURE 3.30 You use the Create New Attribute dialog box to create attributes.

6. Enter information in the following text boxes to describe the attribute you are creating: . Common Name—A unique name that is related to the Lightweight Directory Access Protocol (LDAP) display name. . LDAP Display Name—A unique display name that programmers and system administrators can use to programmatically reference the object. . Unique X.500 Object ID—A unique X.500 Object ID (OID) is a unique identifier associated with all object classes or attributes in the directory. This identifier is required. . Description—An optional description for the attribute. . Syntax—Type of information stored by this attribute, such as a case-insensitive string, distinguished name, integer, numerical string, and so on. . Minimum and maximum—Depending on the syntax, can be an optional string length, minimum and maximum values of integers, and so on.

147

Active Directory Forest and Domain Structure

NOTE Object Identifiers An OID is not randomly generated; standards organizations such as the International Telecommunications Union issue these identifiers to ensure that they are not duplicated. To obtain a unique OID for a class or attribute that you want to create, you should contact one of these standards organizations.

7. Click OK. The attribute is created and displayed in the attributes list. If you have difficulty finding it, click the Name header to arrange the attributes in alphabetical order.

You can also create new classes by right-clicking the Classes container and choosing Create New Schema Class. The procedure is similar to that of Step by Step 3.10. After you have created new attributes and classes, you can easily add attributes to classes, as Step by Step 3.11 shows.

STEP BY STEP 3.11 Adding an Attribute to a Class 1. In the console tree of the Active Directory Schema snap-in, double-click Classes to expand it. This action displays a long list of available classes (see Figure 3.31).

FIGURE 3.31 By default, the Active Directory Schema snap-in contains a large number of classes.

2. Right-click the class to which you want to add an attribute and select Properties. This action displays the Properties dialog box for the selected class, as shown in Figure 3.32.

148

Chapter 3: Managing an Active Directory Infrastructure

FIGURE 3.32 In the Properties dialog box for a schema class, you make all modifications to the class.

3. Select the Attributes tab and then click Add to display the Select Schema Object dialog box, as shown in Figure 3.33.

You use the Select Schema Object dialog box to select the desired attribute.

FIGURE 3.33

4. Scroll down to locate the attribute and then click OK. You return to the Attributes tab of the user Properties dialog box, with the new attribute highlighted. 5. Click OK. 6. Close the Active Directory Schema console.

149

Active Directory Forest and Domain Structure

Deactivating Schema Objects After you have added an object (class or attribute) to the schema, you cannot simply delete it. However, you can deactivate an unneeded schema object by following the procedure outlined in Step by Step 3.12.

STEP BY STEP 3.12 Deactivating a Schema Object 1. Open the Active Directory Schema snap-in. 2. In the console tree, select either Classes or Attributes, depending on the type of object you want to deactivate. 3. In the details pane, scroll to locate the class or attribute you want to deactivate, right-click it, and choose Properties. 4. Clear the check box labeled Attribute is Active. You receive a message, like the one in Figure 3.34, warning you that if you make the schema object defunct, you will be unable to make further changes to it.

FIGURE 3.34 You receive a warning when you attempt to deactivate a schema object.

5. Click Yes to deactivate the object.

The step-by-step procedures given here provide you with a small example of the possible schema modifications. Other procedures are available to perform such tasks as creating new classes, adding values to a series of attributes, adding attribute display names, conducting searches based on the new attributes, and so on. Many of these procedures involve the use of scripts created using Microsoft Visual Basic for Scripting and are beyond the scope of the 70-294 exam. For additional details, see the first reference in the “Suggested Readings and Resources” section at the end of this chapter. Information is also available from the Windows Server 2003 Help and Support Center.

150

Chapter 3: Managing an Active Directory Infrastructure

Challenge Active Directory Schema Attributes and Classes The widgets.com organization you worked with in Chapter 2 needs to store employees’ Social Security numbers in their Properties dialog boxes in Active Directory Users and Computers. Although the Properties dialog box enables you to store a large number of attributes for each user, the Social Security number is not among them. The object of this exercise is to understand how to add an attribute to the schema and associate this attribute with a schema class. After you have done this, you should be able to create a custom VB script or application that modifies a user’s Properties dialog box in Active Directory Users and Computers, thereby enabling you to store employees’ Social Security numbers in Active Directory. Note that the unique X.500 Object ID given here was issued to Microsoft and is suitable for the use described in this exercise. You should try working through this problem on your own first. If you are stuck or need guidance, follow these steps and look back at the Step by Step procedures for more detailed information. 1. Working from server01.widgets.com, open Active Directory Schema. 2. Expand the console tree to locate the Classes and Attributes folders, right-click Attributes, and then select Create Attribute. 3. Click Continue to accept the warning that appears and display the Create New Attribute dialog box. 4. In the Create New Attribute dialog box, type in the information provided in the following table: Identifier

Enter the Following

Common Name

SocialSecurityNumber

LDAP Display Name

SocialSecurityNumber

Unique X.500 Object ID

1.2.840.113556.1.4.7000.142

Description

Employee Social Security Number

Syntax

Select Case Insensitive String from the drop-down list

Minimum

0

Maximum

11

5. Click OK to create the attribute and add it to the list in the details pane. 6. In the console tree, select Classes to display the list of classes in the details pane. 7. Scroll down to locate the user class, right-click it, and choose Properties. 8. On the Attributes tab of the user Properties dialog box, click Add to display the Select Schema Object dialog box. 9. Scroll down to select the SocialSecurityNumber attribute and then click OK. This action adds this attribute to the Optional field of the Attributes tab, as shown in Figure 3.35. (continues)

151

Active Directory Forest and Domain Structure (continued)

FIGURE 3.35 After you have added the new attribute, it appears in the Attributes tab of the user Properties dialog box.

10. Click OK to exit the user Properties dialog box. 11. Use any available scripting tools to create a VB script that enables you to enter employees’ Social Security numbers and display them in the Properties dialog box in Active Directory Users and Computers. This action is beyond the scope of the 70-294 exam and will not be further described here.

Adding or Removing a UPN Suffix As described in Chapter 1, a User Principal Name (UPN) is a logon name specified in the format of an email address such as [email protected]. It is a convenient means of logging on to a domain from a computer located in another domain in the forest or a trusted forest. Two types of UPNs are available: . Implicit UPN—This UPN is always in the form user@domain, such as mary@accounts. quepublishing.com. It is defined on the Account tab of a user’s Properties dialog box in Active Directory Users and Computers.

. Explicit UPN—This UPN is in the form string1@string2, where an administrator

can define values for both strings. For example, a user named Mary in the accounts. quepublishing.com domain could have an explicit UPN in the form mary@accts. Using explicit UPNs is practical when a company does not want to reveal its internal domain structure.

152

Chapter 3: Managing an Active Directory Infrastructure

New to Windows Server 2003 is the concept of the UPN suffix. This is the portion of the UPN to the right of the at (@) character. By default, the UPN suffix is the DNS domain name of the domain that holds the user account. You can add an additional UPN suffix to simplify administration and user logon processes. Doing so provides the following advantages: . A common UPN suffix simplifies logon procedures for all users in the forest. This is

especially true for users who have long child domain names. For example, a user with a default UPN of [email protected] could be provided with a simpler UPN such as Karen@quepublishing. . You can use the UPN suffix to hide the domain structure of the forest from users in

external forests and to configure remote access servers for visitor access. . You can use the UPN suffix in a case where a company has more than one division that

operates under different company names with separate email domains (for example, quepublishing.com or examcram.com) but are all located in a single Active Directory domain. Using an additional UPN suffix, these users can log on using their email addresses. You can also use the UPN suffix to log on to a domain in a trusting forest, except in the following situations: . If more than one forest uses the same UPN suffix, you can use it only to log on to a

domain in the same forest. . If you are using explicit UPNs and external trusts, you cannot log on to trusting

domains in another forest. See the section “Managing Trust Relationships” earlier in this chapter for information on external trusts. You can use the Active Directory Domains and Trusts MMC console to add or remove UPN suffixes. Follow Step by Step 3.13 to add a UPN suffix.

STEP BY STEP 3.13 Adding a UPN Suffix 1. Click Start, Administrative Tools, Active Directory Domains and Trusts. 2. In the console tree, right-click Active Directory Domains and Trusts and choose Properties. The Active Directory Domains and Trusts Properties dialog box opens, as shown in Figure 3.36.

153

Active Directory Forest and Domain Structure

FIGURE 3.36 You can use the Active Directory Domains and Trusts Properties dialog box to add or remove UPN suffixes.

3. Type the name of the desired UPN suffix (for example, examprep) in the text box and click Add. 4. The name of the UPN suffix is added to the large field in this dialog box. Click OK.

After you have added the UPN suffix, it is available for use when you are adding a new user account (see Figure 3.37) or configuring the properties of an existing user account from the Account tab of its Properties dialog box.

FIGURE 3.37 After you have added a UPN suffix, you can assign this suffix to a new user from the New Object—User dialog box.

154

Chapter 3: Managing an Active Directory Infrastructure

NOTE Troubleshooting Slow UPN Logons If you are using a UPN suffix to allow users to log on across domains in a multidomain forest, you might have to create a shortcut trust relationship if users report slow authentication times.

If you no longer need an added UPN suffix, you can follow a similar procedure to remove it. See Step by Step 3.14.

STEP BY STEP 3.14 Removing a UPN Suffix 1. At the top of the Active Directory Domains and Trusts snap-in, right-click Active Directory Domains and Trusts and choose Properties. The Active Directory Domains and Trusts Properties dialog box opens (refer to Figure 3.36). 2. Select the UPN suffix to be removed and click Remove. 3. You are warned that users who use this UPN suffix will no longer be able to log on with this UPN suffix (see Figure 3.38). 4. Click OK.

This message box warns you that user accounts referring to the UPN suffix will be unable to log on to the network if you delete the suffix. FIGURE 3.38

If you remove a UPN suffix, you should open the Active Directory Users and Computers console, select any users whose user accounts refer to the removed UPN suffix, and change the suffix in use from the Accounts tab of their Properties dialog box.

155

Active Directory Site Topology

Understanding the Directory Forest and Domain Structure Following are points you should remember about the directory forest and domain structure: . All domains in the Active Directory forest share a common schema. Although it is

replicated to all domain controllers in the forest, only the schema operations master contains a writable copy of the schema. . The schema contains classes of objects and a series of attributes that can be held by

objects of various types. It also defines the various classes that can exist and the attributes that can be defined for each specific object. . Because improper schema modifications can cause irreparable damage to Active

Directory, the following conditions must be met before you can modify the schema: You must be a member of the Schema Admins group, and you must register the Active Directory Schema snap-in before you can install it. . A UPN suffix is the portion of the UPN to the right of the at (@) character. You can

add an additional UPN suffix to simplify logon procedures for all users in the forest and hide the domain structure of the forest.

Active Directory Site Topology Objective

Implement an Active Directory site topology Recall from Chapter 1 the nature of sites in Active Directory. A site is a grouping of computers and other objects that is connected by high-speed LAN connections and contains one or more Internet Protocol (IP) subnets. A site consists of one or more IP subnets that share a fast, reliable connection such as a local area network (LAN) connection. Because wide area network (WAN) connections are slower and might not be continuously available, network segments located across a WAN should be configured as separate sites. Configuring network segments this way is especially important if your company needs to pay for the WAN link by the number of minutes it is active or the amount of data sent across it.

156

Chapter 3: Managing an Active Directory Infrastructure

When planning sites, you should assess the needs of various offices and divisions within your company, as well as the speed and utilization of the links between the offices. When assessing the needs, you should do the following: . Assess the physical environment—You should look at the locations in which your

company is conducting business and the nature of the internal and external network connections. Be sure to check factors such as the placement of domain controllers and the need to access resources at different offices. Even if locations are on different subnets, if they are connected by a reliable, fast, high-bandwidth link such as a T3 line, you might be able to include them in a single site. . Assess the need for frequent replication versus bandwidth usage—If a location

needs the most recent Active Directory information and is connected with a fast link, it does not need to be in a different site. . Identify the types of physical links between sites—The type, speed, and utilization

of the connection between locations are important factors. Active Directory provides the concept of site link objects that can be used to determine the replication schedule between sites that it links. A cost value also can be associated with it; this value determines when and how often replication can occur. . Configure site link bridges—The site link bridge is an Active Directory mechanism

that groups sites together to facilitate optimized intersite replication. We discuss site link bridges further later in this chapter.

Creating Sites When you first install Active Directory, all domain controllers are located in a single site with the rather ostentatious name of Default-First-Site-Name. If you want, you can rename this site in the same way you would rename a file or folder. After you have assessed the need for additional sites, creating a new site is simple. See Step by Step 3.15.

STEP BY STEP 3.15 Creating a New Site 1. Click Start, Administrative Tools, Active Directory Sites and Services. 2. Right-click the Sites folder and choose New Site. 3. In the New Object—Site dialog box, type the name of the site. Select a site link object from the list provided, as shown in Figure 3.39, and then click OK.

157

Active Directory Site Topology

FIGURE 3.39 You use the New Object—Site dialog box to create a new site.

4. You receive a message box listing other tasks you should perform, as shown in Figure 3.40. Click OK.

FIGURE 3.40 Windows reminds you of several tasks to be completed after creating a site.

5. The site you created appears in the console tree of Active Directory Sites and Services, and several default containers appear in the details pane.

Configuring Sites You should perform several tasks after you have created a site. These tasks include adding domain controllers to a site, specifying licensing servers, and configuring site boundaries. We describe these tasks in the sections that follow.

Adding Domain Controllers The first task you should complete is adding domain controllers to the site. Follow Step by Step 3.16 to perform the first task: adding a domain controller to the site you just created.

158

Chapter 3: Managing an Active Directory Infrastructure

STEP BY STEP 3.16 Adding Domain Controllers to a Site 1. In Active Directory Sites and Services, expand the site containing the domain controller you want to move to reveal a Servers folder. 2. Click this folder. The details pane lists the domain controllers that are located in this site. 3. Right-click the server to be moved and select Move. 4. In the Move Server dialog box, shown in Figure 3.41, select the site for the server and then click OK.

FIGURE 3.41

Moving a domain controller to a new site.

5. The moved server appears under its site in Active Directory Sites and Services.

Specifying a Licensing Server A licensing computer collects information from within the site for use by the Windows Server 2003 licensing administration tool. It need not be a domain controller, but it should be located within its site. Follow Step by Step 3.17 to select a licensing computer for a site.

STEP BY STEP 3.17 Selecting a Licensing Server 1. In the console tree of Active Directory Sites and Services, click the site to which you want to assign a licensing server. This action displays, among others, a Licensing Site Settings container in the details pane. 2. Right-click this container and choose Properties.

159

Active Directory Site Topology 3. On the Licensing Site Settings Properties dialog box, click Change. 4. In the Select Computer dialog box that appears, type or browse to the name of the desired server, as shown in Figure 3.42. Then click OK.

FIGURE 3.42

Selecting a licensing site server.

5. Click OK to close the Licensing Site Settings Properties dialog box.

Configuring Site Boundaries Objective

Manage an Active Directory site . Configure site boundaries

As we have emphasized, the purpose of using sites is to control replication of Active Directory information over slow links between geographically distinct locations. By itself, Active Directory has no knowledge of an organization’s physical network topology. Administrators must model the enterprise’s site topology to mirror the physical network. You can accomplish this by configuring each site to represent one or more IP subnets that are connected by highspeed links, as described in Step by Step 3.18.

STEP BY STEP 3.18 Assigning a Subnet to a Site 1. Click Start, Administrative Tools, Active Directory Sites and Services. 2. In the console tree, right-click the Subnets folder and choose New Subnet.

160

Chapter 3: Managing an Active Directory Infrastructure 3. In the New Object—Subnet dialog box, type the subnet IP address and subnet mask, as shown in Figure 3.43.

FIGURE 3.43 You can assign a subnet to a site from the New Object—Subnet dialog box.

4. The information is shown on the New Object—Subnet dialog box in the form of a network address/bits masked. Click OK. 5. In the Site Name field, select the site to which the subnet should belong and then click OK. 6. You return to the Active Directory Sites and Services snap-in. The subnet you created appears under the Subnets folder.

You can configure a limited set of properties for each subnet you have assigned. Follow Step by Step 3.19 to configure subnet properties.

STEP BY STEP 3.19 Configuring Subnet Properties 1. In the console tree, right-click the subnet and choose Properties. 2. On the General tab of the Properties dialog box, type a description for the subnet, as shown in Figure 3.44. This description is for information purposes only.

161

Active Directory Site Topology

FIGURE 3.44 The Subnet Properties dialog box enables you to specify a description and location for the subnet and change the site with which it is associated.

3. If you need to change the site to which the subnet is assigned, you can do so from the Site drop-down list box. 4. On the Location tab, you can type the location for the subnet. This location is also for information purposes only. 5. The Object and Security tabs function in a similar manner to those on other Properties dialog boxes.

NOTE Site Naming Conventions Subnet locations specified on the Location tab should follow a specific naming convention for your organization. These locations link to printer tracking in Active Directory. Refer to “Establishing a Naming Convention for Printer Locations” in Windows Server 2003 Help and Support Center for more information.

162

Chapter 3: Managing an Active Directory Infrastructure

Configuring Site Links Objective

Implement an Active Directory site topology . Configure site links

A site link is a path that Active Directory uses to replicate information between sites. Replication cannot take place between sites unless site links have been created. Because of the limited bandwidth that usually exists between sites, Active Directory handles intersite replication differently than intrasite. In a nutshell, intersite replication is compressed, whereas intrasite replication is not compressed. Intersite replication takes place at a lower, configurable frequency. We discuss intersite replication and its configuration later in this chapter. Site links can use either of two intersite transport protocols for replicating data: Remote Procedure Call (RPC) over IP and Simple Mail Transfer Protocol (SMTP). . RPC over IP—This protocol is the default replication method and the only one that

supports replication within a domain. It enables low-speed, synchronous replication of all directory partitions using remote procedure calls. . SMTP—This protocol is asynchronous email–based replication that can be used to

replicate the schema and configuration partitions of Active Directory and the global catalog between domains. You should use this protocol if the reliability of the link is not good. You need to install an enterprise certification authority (CA) if you are using this transport protocol. It signs the SMTP messages that are sent over this protocol. SMTP also must be installed on domain controllers using this site link. Site links are not created automatically. As outlined in Step by Step 3.20, you can create site links by using Active Directory Sites and Services.

STEP BY STEP 3.20 Creating Site Links 1. In the console tree of Active Directory Sites and Services, expand the Inter-Site Transports folder to reveal the IP and SMTP subfolders. 2. Right-click the folder corresponding to the transport protocol that is to be used and choose New Site Link. 3. In the New Object—Site Link dialog box, type a name for the site link (see Figure 3.45). Then make sure that the sites to be linked appear in the Sites in This Site Link field and click OK.

163

Active Directory Site Topology

FIGURE 3.45

Creating a site link.

EXAM ALERT Site Links You should be aware of the differences between IP and SMTP and know when you should use SMTP rather than IP for configuring a site link. Remember that SMTP site links replicate only the schema and configuration partitions of Active Directory, and that they require an enterprise certification authority.

Site Link Bridges By default, Active Directory bridges all site links. In other words, Active Directory creates a chain of site links that allow any two domain controllers to communicate directly with each other, whether or not they are directly linked with a site link. Implicitly, all site links for a single transport (IP or SMTP) are contained in one site link bridge for that transport. By default, all site links are bridged automatically. These links are also known as transitive site links. In some cases, you might have to disable automatic site link bridging and create your own site link bridges, such as in the following situations: . Your network is not completely routed. In other words, not all domain controllers can

communicate with one another. . A security policy prevents all domain controllers from communicating directly with

one another. . In some situations, the enterprise contains a large number of sites that are not well

connected.

164

Chapter 3: Managing an Active Directory Infrastructure

Follow the procedure in Step by Step 3.21 to disable automatic site link bridging and create your own site link bridges.

STEP BY STEP 3.21 Configuring Site Link Bridges 1. In the console tree of Active Directory Sites and Services, expand the Inter-Site Transports folder to reveal the IP and SMTP subfolders. 2. Right-click the transport (IP or SMTP) whose site link bridges you want to configure and choose Properties. 3. In the Properties dialog box for the transport (see Figure 3.46), clear the check box labeled Bridge All Site Links and then click OK.

FIGURE 3.46

Disabling automatic site link bridging.

4. Right-click the transport again and choose New Site Link Bridge. 5. In the New Object—Site Link Bridge dialog box (see Figure 3.47), type a name for the site link bridge, ensure that the site links you want bridged appear in the Site Links in This Site Link Bridge field, and then click OK.

165

Active Directory Site Topology

FIGURE 3.47

Creating a site link bridge.

EXAM ALERT Site Link Bridges In a multisite situation, you might encounter sites linked by different bandwidth links. If considerable intersite traffic is crossing a slow link and a faster link crossing three or more alternative sites is available, you might have to create a site link bridge that encompasses the faster links. This bridge will serve to direct intersite traffic across the fast links.

Knowledge Consistency Checker The Knowledge Consistency Checker (KCC) is a process that runs automatically on all domain controllers and creates Active Directory replication topologies, both intrasite and intersite. It creates optimum topologies at 15-minute intervals according to the conditions that exist at that time. As new sites and domain controllers are added, the KCC adjusts the replication topology to accommodate these changes. It uses a bidirectional ring topology that provides at least two paths between each domain controller for fault tolerance, and no more than three hops between any two domain controllers to reduce replication latency. It automatically adjusts the intrasite replication topology without administrator intervention.

NOTE Different Topologies for Different Purposes The KCC generates separate topologies for each of the schema, configuration, application, and domain partitions, and the global catalog, according to their individual requirements.

166

Chapter 3: Managing an Active Directory Infrastructure

For intersite replication, the KCC works from a single domain controller called the Inter-Site Topology Generator (ISTG) in each site and uses the information you have configured in Active Directory Sites and Services. It designates one or more servers, known as bridgehead servers, for each site to ensure that changes to Active Directory are replicated only once across any given site link. Although the KCC usually designates its own bridgehead servers, you can manually designate bridgehead servers from Active Directory Sites and Services. The KCC normally runs in the background without the need for any type of configuration. If you need to force the KCC to run at a given time, you can run the repadmin command-line utility or the replmon GUI-based utility. These tools are both located in the Support\Tools folder of the Windows Server 2003 CD-ROM. We discuss the use of this tool in Chapter 4, “Maintaining an Active Directory Infrastructure.”

Configuring Connection Objects A connection object is an Active Directory object that represents an inbound connection to a domain controller. It is utilized for replication from other domain controllers to the domain controller on which it is configured. The KCC in a site automatically creates connection objects between domain controllers within its site as well as connection objects for replication to other sites. Although the KCC endeavors to create an optimum set of connection objects, the administrator might have to configure connection objects manually if the connections created by the KCC do not link the specific domain controllers she wants to be connected.

WARNING Create Connection Objects Only If Absolutely Necessary If an administrator adds redundant connection objects, replication traffic might increase.

Follow Step by Step 3.22 to create a manual connection object.

STEP BY STEP 3.22 Creating and Configuring a Connection Object 1. In the console tree of Active Directory Sites and Services, expand the Servers folder in the site containing the domain controller for which you want to create an inbound connection object. 2. Right-click the NTDS Settings folder under the desired server and select New Active Directory Connection.

167

Active Directory Site Topology 3. In the Find Domain Controllers dialog box shown in Figure 3.48, select the server with which you want to create a connection and then click OK.

FIGURE 3.48 The Find Domain Controllers dialog box enables you to select the outbound server.

4. By default, the new connection object is named for the server with which you are creating the connection. In the New Object–Connection dialog box, accept this name or type a different name and then click OK. The new connection object is added to the details pane. 5. To modify the properties of the connection object, right-click it and choose Properties to display the dialog box shown in Figure 3.49. From here, you can configure any of the following options: . Description—Type an optional description for the connection object. . Transport—Select RPC, IP, or SMTP. You would not normally change this from the default of RPC. . Change Schedule—Select the times in which you want the replication schedule from its default of four times per hour to once or twice per hour, or none. . Replicate From Click Change to change the server from which replication takes place. This displays the same Find Domain Controllers dialog box shown in Figure 3.48. . Object tab Display information about the connection object, including its LDAP canonical name, the creation and modification dates, and update sequence numbers (USNs). This tab does not contain configurable items. . Security tab Configure permissions for users or groups. See Chapter 5, “Planning User, Computer, and Group Strategies.”

168

Chapter 3: Managing an Active Directory Infrastructure

FIGURE 3.49 The Properties dialog box enables you to configure the connection object.

6. Click OK when finished.

NOTE You Can Also Configure Automatically Generated Connection Objects Right-click an automatically generated connection object and choose Properties to configure any of the properties listed in Step by Step 3.22.

Inter-Site Topology Generator As we have already noted, the ISTG is the domain controller used by the KCC to create the intersite replication topology. The ISTG considers the cost of intersite connections and checks whether any domain controllers have been added to or removed from the site; the ISTG provides this information to the KCC, which then adds or removes connection objects to optimize replication as required. Only one domain controller per site acts as the ISTG. If the forest is operating at the Windows Server 2003 forest functional level, the KCC uses an improved, randomized process to determine the site’s bridgehead servers. It distributes the bridgehead replication workload more evenly among a site’s domain controllers, resulting in improved replication efficiency. The algorithm used allows a domain to contain as many as 3,000 sites. You can use the dcdiag tool from the Support\Tools folder of the Windows Server 2003 CD-ROM to identify the ISTG computer in each site.

169

Active Directory Site Topology

Preferred Bridgehead Servers Objective

Implement an Active Directory site topology . Configure preferred bridgehead servers

The bridgehead server is the domain controller designated by each site’s KCC to take charge of intersite replication. This server receives information replicated from other sites and then replicates it to the site’s other domain controllers. It ensures that the greatest portion of replication takes place within sites rather than between them. Usually, the KCC automatically decides which domain controller will act as the bridgehead server. If necessary, you can designate a specific domain controller to be the bridgehead server to specify the best conditions for intersite replication. Follow Step by Step 3.23 to designate a preferred bridgehead server.

WARNING Be Cautious About Choosing Bridgehead Servers Manually If you allow the KCC to select a bridgehead server and this server fails, the KCC will select another one. However, if you select a bridgehead server yourself and it fails, the KCC will not choose another bridgehead server.

STEP BY STEP 3.23 Designating a Preferred Bridgehead Server 1. In the console tree of Active Directory Sites and Services, expand the site where you need to designate a bridgehead server and then expand the Servers folder to locate the available servers. 2. Right-click the desired domain controller and choose Properties. 3. On the General tab of the server’s Properties dialog box, select the transport protocol(s) for which this domain controller should be a bridgehead server and then click Add, as shown in Figure 3.50.

170

Chapter 3: Managing an Active Directory Infrastructure

FIGURE 3.50 Designating a bridgehead server for the IP transport protocol.

4. Click OK.

NOTE Replication Across a Firewall If your network uses a firewall to protect a site, you must specify your firewall proxy server as a preferred bridgehead server. This ensures that the firewall server is the contact point for exchanging data with servers beyond the firewall.

Ports Used for Replication Between Sites By default, ISTG uses the TCP and UDP port 135 for RPC-based replication between sites. In addition, LDAP uses TCP and UDP port 389, LDAP over Secure Sockets Layer (SSL) uses TCP and UDP ports 636, Kerberos uses TCP and UDP port 88, Server Message Block (SMB) over IP uses TCP and UDP ports 445, and DNS uses TCP and UDP port 53. Global catalog servers also use TCP ports 3268 and 3269. You can specify any port for RPC-based replication by modifying the following Registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters

Add a REG_DWORD value named TCP/IP Port and specify the number of the port to be used. In addition, modify the following Registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTFRS\Parameters (continues)

171

Active Directory Site Topology (continued)

Add a REG_DWORD value named RPC TCP/IP Port Assignment and specify the same port number. Make these changes on each domain controller, and ensure that all firewalls are configured to pass traffic on the selected port. For additional port numbers that you should open on your firewalls, refer to “Active Directory Replication over Firewalls” in the “Suggested Readings and Resources” section. Note that you can also secure RPC-based replication by using IP Security (IPSec) and configuring the firewalls to pass IPSec traffic. Refer to the same reference for additional details.

Configuring Replication Schedules Objective

Manage an Active Directory site . Configure replication schedules

We have already mentioned that all domain controllers act as peers and that most changes to Active Directory can be made at any domain controller. Active Directory uses the process of multimaster replication to propagate these changes to other domain controllers in the domain. In addition, the global catalog is replicated to all other global catalog servers in the forest. Application directory partitions are replicated to a subset of domain controllers in the forest, and the schema and configuration partitions of Active Directory are also replicated to all domain controllers in the forest. You can see that replication is an important process that must take place in a timely manner so that updates to Active Directory are synchronized properly among all domain controllers in the forest. The amount of replication that is necessary to maintain Active Directory could easily overwhelm network bandwidth, especially on slowspeed WAN links. In this section, you learn how to manage replication in Active Directory by configuring replication schedules within and between sites. But before we look at managing replication, we provide an overview of how it operates.

What Does Active Directory Replicate? The following is an overview of the types of information that Active Directory must replicate on a timely basis. These types are based on the Active Directory partitions you learned about in Chapter 1. . Schema data—We discussed schema modification earlier in this chapter. Recall that

this information contains definitions for all objects and their attributes in the Active Directory forest and is common to all domain controllers in the forest. It must be kept up-to-date so that Active Directory can function properly.

172

Chapter 3: Managing an Active Directory Infrastructure . Configuration data—This data includes information related to the design of the

Active Directory forest, including sites, trees, and domains, and their organization within the hierarchy. All domain controllers in the forest require this information to function properly. . Application data—This data includes application-specific data and DNS information

for Active Directory–integrated DNS zones that need to be replicated throughout the forest. Some of this information might have to be replicated to only a subset of the domain controllers in the forest. . Domain data—This data includes information about all objects in an individual

domain, such as users, groups, computers, printers, shared folders, and so on. Active Directory replicates all this information to every domain controller in the domain. In addition, a read-only subset of this information is contained in the global catalog and replicated to all global catalog servers in the forest.

How Does Active Directory Replication Work? Active Directory replicates data between domain controllers using the following two standard networking protocols: . Remote Procedure Call (RPC) over Internet Protocol (IP)—Used for both intra-

site and intersite replication, RPC over IP uses remote procedure calls for replication. It employs both Kerberos-based authentication and data encryption to keep data secure. . Simple Mail Transfer Protocol (SMTP)—This email protocol is used only for inter-

site replication when a direct or reliable IP-based path is unavailable. It is used for replication only between two domain controllers that are located in different domains as well as different sites. It requires an enterprise certification authority (CA) to operate. The CA signs SMTP messages as they are exchanged between domain controllers, ensuring their authenticity. SMTP does not replicate the domain partition of Active Directory; it replicates only the schema, configuration, and application partitions. In addition, SMTP replication ignores schedules. Active Directory uses a numerical sequencing method called the update sequence number (USN) to keep track of replicated updates. This method is more reliable than using time stamps because the latter method depends on exact synchronization of the clocks on all domain controllers, which is hard to maintain. However, Active Directory also uses a time stamp to resolve conflicting changes. A USN is a 64-bit number that is maintained at each domain controller in the forest. Whenever an update is initiated, the originating domain controller issues what is known as an

173

Active Directory Site Topology

originating update, which determines the kind of update being made to the Active Directory database. At the same time, the domain controller increments the USN by one and associates the updated USN with the originating update. Other domain controllers use the USN to determine what updates they need to receive. We discuss the use of the USN to track replication and troubleshoot problems in Chapter 4. Active Directory replication works by a pull process. In other words, individual domain controllers request updates from their replication partners at a known interval, which is five minutes by default. It checks the USNs for each replication partner and uses them to request any required updates. If a domain controller is offline for any reason, it can use the USN to get up to date properly. This process is in contrast to a push process in which domain controllers send updates immediately to their replication partners rather than wait for requests. An offline domain controller would miss pushed updates and not be up to date. In addition, a domain controller might receive the same update from more than one source, which translates to a waste of bandwidth. In the event that two different administrators happen to modify the same attribute of the same object at the same time on different domain controllers, a conflict could occur. In this case, Active Directory uses the timestamp to resolve the conflict, and the latest update wins. If the changes take place at the exact same millisecond, the change with the higher globally unique ID wins.

Intrasite Replication We previously discussed how the KCC automatically creates and adjusts the intrasite replication topology. The KCC ensures that each domain controller replicates with at least two others, so that if one is temporarily unavailable, no domain controller will miss an update. KCC uses a default bidirectional ring topology, with additional connections as needed to keep the number of hops between replication partners to three or fewer.

NOTE Multiple Replication Topologies Active Directory uses one topology for the schema and configuration partitions and another one for the domain partition. In some cases, a third replication topology could exist for the application partition because data stored in this partition might not need to be replicated to all domain controllers. An administrator can explicitly route application partition data to selected domain controllers within a forest or to all domain controllers in a domain.

Replication to the first replication partner takes place automatically on the basis of change notification after the administrator has configured an update. After waiting for 15 seconds, the source domain controller sends an update notification to its closest replication partner and sends additional notifications to other partners at 3-second intervals. After receiving the notifi-

174

Chapter 3: Managing an Active Directory Infrastructure

cation, the replication partners send update requests to the source domain controller, which then replicates the change to the partners. However, some updates such as password changes and account lockouts are replicated immediately. Because it is assumed that high LAN bandwidth is available for intrasite replication, data is not compressed during the replication process. Intrasite replication is completely automatic and requires no additional configuration after you have created and validated your sites, although you can modify intrasite replication if necessary, as we described previously in the section “Configuring Connection Objects.” However, intersite replication can be configured and managed; we now turn our attention to managing intersite replication schedules.

Intersite Replication One important use of sites is to control replication traffic between network segments located across WAN links. The high frequency of intrasite replication requires a high-speed LAN link (10Mbps or faster) to work properly. Table 3.1 compares several characteristics of intersite versus intrasite replication. TABLE 3.1 Comparison of Intersite and Intrasite Replication Characteristic

Intersite

Intrasite

Compression

Compressed

Uncompressed

Interval

Scheduled, configured

Frequent, automatic

Transport Protocol

SMTP, RPC over IP

RPC over IP

Connection Type

According to site link cost

Between all DCs in ring topology

Active Directory allows you to schedule intersite replication so that you can control how much bandwidth it consumes. This capability is important because bandwidth affects the efficiency of replication. Replication frequency is a trade-off between keeping Active Directory on remote domain controllers up to date and using a high amount of bandwidth on a slow link. By default, replication takes place every 180 minutes (3 hours), and can take place 24 hours a day, 7 days a week. You can configure the replication process to take place at times of low bandwidth usage, such as late at night. Step by Step 3.24 shows you how to configure intersite replication.

NOTE Intersite Replication Is Compressed To further conserve bandwidth, Active Directory compresses all updates to Active Directory above 50KB in size when they are replicated. Because the compression ratio can be as high as 10:1, this can save a lot of bandwidth. Should you have bandwidth to spare but are limited in processing power, you can configure Active Directory to shut off compression. In addition, you might be able to increase replication latency to use less bandwidth in the long run. This is true because compression takes place only above 50KB.

175

Active Directory Site Topology

STEP BY STEP 3.24 Configuring Intersite Replication Intervals 1. Click Start, Administrative Tools, Active Directory Sites and Services. 2. If necessary, expand the Sites folder in the console tree to locate the Inter-Site Transports folder. 3. Expand this folder and click either IP or SMTP, whichever contains the site link whose replication schedule you want to modify (see Figure 3.51).

FIGURE 3.51 You can configure site link properties from the IP or SMTP folder of Inter-Site Transports in Active Directory Sites and Services.

4. In the details pane, right-click the site link and choose Properties to display the General tab of the Properties dialog box for the site link (see Figure 3.52).

FIGURE 3.52 You can modify the intersite replication schedule in the Properties dialog box for the site link of concern.

176

Chapter 3: Managing an Active Directory Infrastructure 5. In the text box labeled Replicate Every, type the number of minutes between replications and then click OK.

Active Directory processes the interval you enter as the nearest multiple of 15 minutes, up to a maximum of 10,080 minutes (one week). Notice that the Properties dialog box for the site link contains two additional tabs: Object and Security. These tabs also exist for the Properties dialog box of most objects in the Active Directory Sites and Services snap-in. Their functions are the same as described previously for Active Directory connection objects. If you need to specify that replication not take place during certain times of the day (such as business hours when other WAN traffic must be able to proceed without delay), you can restrict the times that replication takes place. To do so, follow Step by Step 3.25.

STEP BY STEP 3.25 Restricting Intersite Replication Times 1. Follow steps 1–4 of Step by Step 3.24 to access the Properties dialog box for the site link whose replication times you want to modify. 2. Click Change Schedule, and in the Schedule for link name dialog box, select the time block for which you want to deny replication, as shown in Figure 3.53.

FIGURE 3.53 You can configure a time when replication is not available in the Schedule for link name dialog box.

3. Select Replication Not Available and then click OK twice to return to Active Directory Sites and Services.

177

Active Directory Site Topology

NOTE Shortcut Link If you have recently accessed Active Directory Sites and Services (as in performing Step by Step 3.24), a shortcut link will appear on the left side of the Windows Server 2003 Start menu.

You might have to ignore the replication schedule so that replication can take place at any time of day or night. This is useful if you need to force replication of a large number of changes. To ignore replication schedules, follow Step by Step 3.26.

STEP BY STEP 3.26 Ignoring Replication Schedules 1. Follow steps 1–3 of Step by Step 3.24 to access the IP or SMTP folders in the Inter-Site Transports folder. 2. In the console tree, right-click the replication method you want to modify and choose Properties. 3. In the Properties dialog box for the replication method, select the Ignore Schedules check box, as shown in Figure 3.54, and then click OK.

FIGURE 3.54

You can choose to ignore replication schedules from the IP or SMTP Properties dialog box.

178

Chapter 3: Managing an Active Directory Infrastructure

Performing this procedure causes Active Directory to ignore availability schedules and replicate changes to Active Directory at the configured interval. Site links are always available for replication. Clear the Ignore Schedules check box to re-enable the replication schedules. Notice that this is the same dialog box from which you can choose whether to bridge all site links, as we discussed in the “Active Directory Site Topology” section of this chapter.

EXAM ALERT Remember the Different Options Available for Scheduling Replication If you need replication to occur more or less frequently than the default 3-hour interval, specify the desired interval. This interval should not be less than the 15-minute maximum intrasite replication interval. If you do not want replication to occur at certain times of the day, specify the appropriate replication schedule. If you need replication to take place when it is not scheduled, select the Ignore Schedules option.

Challenge Creating and Configuring Sites The Widgets company you have been working with has a head office and a factory location connected by a T-1 with 1.544Mbps bandwidth line. The server that was the Windows NT PDC (Server01) is located at the head office, whereas the former BDC (Server02) is located at the factory. There is also a warehouse that does not currently have a domain controller, and is connected to the head office with an ISDN line. There is no direct connection between the factory and the warehouse. This exercise requires you to create and configure sites for the three locations. You also need to create the appropriate site links and bridges. The head office site is on the 172.22.0.0 subnet with a subnet mask of 255.255.248.0, the factory site is on the 172.22.8.0 network with the same subnet mask, and the warehouse site is on the 172.22.16.0 network with the same subnet mask. After you have created the site links and bridges, you must configure replication between the sites. The company wants replication to take place between the head office and the factory every four hours, day and night. Between the head office and the warehouse, the company wants replication to take place every six hours outside the 8 a.m. to 5 p.m. business day only. Try to work through the steps on your own, working from the two domain controllers. If you need to see a possible solution, follow these steps, and refer to the Step by Step exercises for more details: 1. Open Active Directory Sites and Services at the Server01 computer. 2. Select the Default-First-Site-Name and rename this site Office. 3. Create a new site named Factory and a third site named Warehouse. Use the default site link. 4. Expand the Office site to locate the two servers and move Server02 to the Factory site. (continues)

179

Active Directory Site Topology (continued)

5. To add a subnet, right-click the Subnets container and choose New Subnet. Type 172.22.0.0 as the subnet and 255.255.248.0 as the mask, select the Office site, and then click OK. 6. Repeat step 5 to add subnets for the factory and the warehouse. 7. Expand the Inter-Site Transports folder and click IP. 8. Rename the default site link Office to Factory. 9. Right-click this link and choose Properties. On the Properties dialog box, remove the Warehouse site from this link. 10. Create a new site link named Office to Warehouse. For this link, include the Office and Warehouse sites. 11. Right-click the IP transport and select Properties; then clear the Bridge All Site Links check box. 12. Right-click the IP transport and select New Site Link Bridge. Name this bridge Factory to Warehouse, ensure that the two site links you have configured are in this site link bridge, and then click OK. 13. Right-click the Office to Factory site link and choose Properties. In the Replicate Every spin box, type 240 and then click OK. 14. Right-click the Office to Warehouse site link and choose Properties. In the Replicate Every spin box, type 360. Click Change Schedule, and in the Schedule for Office to Warehouse dialog box, specify that replication is not available between 8 a.m. and 5 p.m. (white areas).

Manually Forcing Replication Sometimes you might need to have Active Directory replication occur immediately, such as after the addition of new users or groups for a branch office. You can easily force replication from Active Directory Sites and Services. Step by Step 3.27 shows you how.

STEP BY STEP 3.27 Manually Forcing Replication 1. In the console tree of Active Directory Sites and Services, expand the server to which you want to force replication, to locate the NTDS Settings folder. 2. Select this folder to display the connection objects in the details pane. 3. Right-click the desired connection object and choose Replicate Now (see Figure 3.55).

180

Chapter 3: Managing an Active Directory Infrastructure

FIGURE 3.55

You can force replication from the NTDS Settings folder in Active Directory Sites and Services.

NOTE Forced Replication Is One-Way Only When you manually force replication using this procedure, this forces replication to occur to the selected object only. To ensure that the replication occurs immediately, you should perform this procedure on both sides of the link. Use the Connect To option to connect to the other domain controller and initiate a manually forced replication in the other direction.

Keeping Replication at Bay A few months ago, a major newspaper with branch offices across the country was covering a breaking news story. A couple of photographers using digital cameras were trying to upload photos to the newspaper’s main office several hundred miles away. However, transmitting a single photo over the paper’s dedicated ISDN connection was taking almost an hour. Consequently, only a few photos were transmitted before the deadline, and the paper went to press without the desired coverage. The resulting news story was inferior to that provided by a competing paper. Management contacted the network administration staff to determine what went wrong and ensure this situation did not happen again. At first, the administrators were puzzled that it had taken place. They had prided themselves on setting up Active Directory to keep information at the branch office domain controllers current, but had not taken into consideration the amount of traffic that could be generated. In addition, a lot of other network traffic is transmitted over the ISDN line in the course of everyday business. Analyzing traffic when branch office staff uploaded a few more photos, the administrators discovered the line was 100% utilized for a period of time every 30 minutes. The administrators then remembered that they had configured a 30-minute intersite replication interval in Active Directory. Changing this interval to 3 hours resulted in reduced utilization of the line and much improved capability to transmit photos and other important data.

181

Active Directory Site Topology

Configuring Site Link Costs Objective

Manage an Active Directory site . Configure site link costs

In some cases, you might have more than one physical link between two sites. For example, you might have a dedicated T1 line connecting your head office to the branch office. Because of occasional downtime on the T1 link, you might also have set up a dial-up link over regular phone lines to the branch office. Obviously, you want replication to use the T1 link at all times when it is available. Active Directory allows you to provide additional information about the cost of the various site links. The KCC uses this information to determine the optimum link to be used during replication. KCC will use the other link (in this case, the dial-up link) when the optimum one is unavailable. Although the site link cost factor can include the monetary cost, it is much more than just a monetary cost; it includes variables such as bandwidth, reliability, and availability of a given line. When available, the KCC always chooses the lowest cost link for replication. By default, when you first create a site link, it is assigned a cost of 100. In the example used here, you might want to set the cost of the T1 link at 50 and keep the cost of the dial-up link at 100. You can extend this example to cover more complex networks. Consider the five-site network shown in Figure 3.56. This network provides two replication paths between domain controllers located in sites A and E. As shown in Figure 3.56, you should configure site link costs according to bandwidth, availability, and reliability.

B

B-C ISDN Cost = 100

C

A-B T1 Cost = 50

C-E 33 K Dialup Cost = 200

A

E

A-D 56 K Dialup Cost = 150

D

D-E 56 K Dialup Cost = 150

FIGURE 3.56 An example of site links and costs in a multisite network.

182

Chapter 3: Managing an Active Directory Infrastructure

For replication between sites A and E, the total site link cost is the sum of the costs of all links crossed by packets transmitted between the sites. Going by way of sites B and C, the cost is (50 + 100 + 200) = 350, whereas going by way of site D, the cost is (150 + 150) = 300. Consequently, the preferred replication path is through site D. If it is not acceptable for the replication path to utilize two dial-up links, you should adjust the costs so that the path using two dedicated plus one dial-up links becomes the preferred one.

NOTE Site Link Bridge Costs You can extend the principle of site link costs to site link bridges. The cost of a site link bridge is merely the sum of the costs of all site links contained within the bridge.

As Step by Step 3.28 shows, modifying the site link cost is a simple procedure.

STEP BY STEP 3.28 Configuring the Site Link Cost 1. Follow steps 1–3 of Step by Step 3.24 to access the IP or SMTP folder in the Inter-Site Transports folder. 2. Open the folder containing the site link whose cost you want to modify. The details pane displays information about the site link (refer to Figure 3.51). 3. Right-click the link and choose Properties. This opens the Properties dialog box for the site link (refer to Figure 3.52). 4. Type a new value in the Cost box or use the up/down arrows to select the desired value. Then click OK.

183

Chapter Summary

Chapter Summary In this chapter, you continued to build on the basics of Active Directory that you learned about in Chapter 2. You began by exploring the various types of trust relationships available in Active Directory. Should your organization employ a multiple forest design, you need to create trust relationships manually so that users in one forest can access resources in other forests. Two types of crossforest trust relationships are available: external trusts, which are trusts that are set up between two specific domains, and forest trusts, which are trusts that involve complete two-way trust relationships between all domains in the forests involved. In addition, you can set up shortcut trusts, which are specific trusts between two subdomains in the same forest. This type of trust relationship speeds up authentication and data access by allowing the trust path to proceed directly between the domains rather than through the parent domains. Having set up these trust relationships, you can now manage them in several ways. We showed you how to validate trust relationships to ensure that the trusts have been properly created, change the authentication scope of a trust, and configure name suffix routing in forest trusts. Finally, you learned how to remove a crossforest trust. Next, you learned about the classes of objects and their attributes that make up the Active Directory schema. Because the schema is vital to the function of Active Directory, Microsoft has implemented safeguards to help ensure only authorized schema modifications are performed. These safeguards include registering and installing the Schema snap-in before it can be used and being a member of the Schema Admins group. Microsoft recommends that you add users to this group only when schema modifications are required and remove them after they are completed. You also learned what a UPN suffix is and how to add or remove one. The UPN suffix is an additional suffix that can be used to facilitate user logons throughout a forest and to conceal the true domain structure of the enterprise. It is especially useful for users who have long child domain names. You also learned about creating and configuring sites in Active Directory. You learned about adding domain controllers to sites; configuring site links, site link bridges, and connection objects; and designating preferred bridgehead servers. You also learned what the ISTG and KCC do. Finally, you learned about Active Directory replication. Whereas intrasite replication is essentially automatic because it is determined by the KCC, you can configure intersite replication according to the bandwidth and availability of WAN links connecting the sites. You can modify replication intervals and restrict replication to certain times of the day when other WAN traffic is low. You can also specify cost values for site links that determine which link is given priority during replication.

184

Chapter 3: Managing an Active Directory Infrastructure

Key Terms . Active Directory Federation Services (ADFS) . attribute . authentication scope . class . connection object . crossforest trust . external trust . Inter-Site Topology Generator . Knowledge Consistency Checker . name suffix . object identifier (OID) . one-way trust . Remote Procedure Call (RPC) . replication . Schema Admins group . shortcut trust . Simple Mail Transfer Protocol (SMTP) . site . site link . site link bridge . site link cost . SMTP . subnet . transitive trust . trust relationship . two-way trust . update sequence number (USN) . UPN suffix

185

Apply Your Knowledge

Apply Your Knowledge The 70-294 exam tests your knowledge of the various situations that you may encounter when installing and configuring Active Directory. You need to be aware of the implications involved in modifying the schema, creating and modifying trust relationships, and employing alternate UPN suffixes. You should also know how to create and configure sites and their associated subnets, site links, and site link bridges. Finally, you should know how to create and modify intersite replication. The exercises and exam questions presented here serve to reinforce these requirements. Note that you may encounter drag-and-drop or hot-spot questions on the exam. Due to the limitations of the printed page, we are unable to include questions of these types in the exam questions section. However, the explanations suggest the possibility of these question types where appropriate.

Exercises To perform these exercises, you should have at least three computers, on two of which you have installed the root domain of an Active Directory forest named domain1.com, and a third domain controller on which you have installed the root domain of a second forest named domain2.com. If you have only two computers available, you can complete exercises 3.1–3.2 and 3.4–3.8 first and then demote the domain2.com domain controller and reinstall Active Directory on this computer as a second domain controller in the domain1.com domain. Then create a second site and place this domain controller in this site, according to the exercises in Chapter 2. You can then complete exercise 3.3.

3.1 Registering and Installing the Schema Snap-In The first two exercises involve modifying the Active Directory Schema. This exercise shows you how to register and install the Active Directory Schema snap-in. You can do this from either forest root domain controller. By default, these computers hold the role of schema master for their respective forests. Estimated Time: 5 minutes 1. Click Start, Command Prompt. 2. Type regsvr32 schmmgmt.dll and press Enter. 3. You should receive a message informing you that the registration succeeded. Click OK and close the Command Prompt window. 4. Click Start, Run, type mmc, and then click OK.

186

Chapter 3: Managing an Active Directory Infrastructure 5. Click File, Add/Remove Snap-In. 6. In the Add/Remove Snap-In dialog box, click Add. 7. In the Add Standalone Snap-In dialog box, select Active Directory Schema and then click Add. 8. Click Close to return to the Add/Remove Snap-In dialog box. 9. Click OK to add the Active Directory Schema snap-in to the blank MMC. 10. Click File, Save, and on the Save As dialog box, type Schema.msc. Click Save to save the Active Directory Schema MMC in the Administrative Tools folder.

3.2 Creating Classes and Attributes In this exercise, you create a new attribute named Salary Level. Then you create a new class named Human Resources and add the Salary Level attribute to the Human Resources class. Estimated Time: 10 minutes 1. The Active Directory Schema snap-in should still be open from Exercise 3.1. If not, click Start, Administrative Tools, Schema.msc. 2. In the console tree, expand Active Directory Schema to reveal the Classes and Attributes folders. 3. Right-click Attributes and select Create Attribute. 4. The Schema Object Creation dialog box warns you that creating schema objects is a permanent operation. Click Continue to create the attribute. 5. In the Create New Attribute dialog box, type the information in the following table: In This Field

Type the Following

Common Name

SalaryLevel

LDAP Display Name

SalaryLevel

Unique X.500 Object ID

1.2.840.113556.1.4.7000.141

Description

Salary Level

Syntax

(Select Integer)

Minimum and Maximum

(Leave blank)

6. Click OK. 7. Right-click Classes and select Create Class. 8. The Schema Object Creation dialog box warns you that creating schema objects is a permanent operation. Click Continue to create the class.

187

Apply Your Knowledge 9. In the Create New Schema Class dialog box, type the information in the following table: In This Field

Type the Following

Common Name

HumanResources

LDAP Display Name

HumanResources

Unique X.500 Object ID

1.2.840.113556.1.4.7000.17

Description

Human Resources

Parent Class

(Leave blank)

Class Type

(Select Auxiliary)

10. Click Next. 11. In the next page of the Create New Schema Class dialog box, click Add under Optional. 12. In the Select Schema Object dialog box, scroll down to the SalaryLevel attribute you just created and then click OK. 13. This attribute is displayed in the Optional field of the Create New Schema Object dialog box. Click Finish. 14. To verify creation of this class and attribute, expand Classes in the details pane of the Active Directory Schema console and scroll down to locate the HumanResources class. The SalaryLevel attribute should be displayed at the top of the details pane, along with several other attributes that were automatically assigned to this class when it was created. 15. Close the Active Directory Schema console.

3.3 Creating a Forest Trust This exercise demonstrates how to create a two-way forest trust between the two domains. It assumes that both forests are operating at the Windows Server 2003 forest functional level. You should perform this exercise from the domain1.com root domain controller. Estimated Time: 10 minutes 1. Click Start, Administrative Tools, Active Directory Domains and Trusts. 2. In the console tree of Active Directory Domains and Trusts, right-click domain1.com and choose Properties. 3. Select the Trusts tab of the Domain1.com Properties dialog box and then click New Trust to start the New Trust Wizard. 4. On the Welcome to the New Trust Wizard page, click Next. 5. On the Trust Name page, type domain2.com and then click Next. 6. On the Trust Type page, select Forest Trust and then click Next.

188

Chapter 3: Managing an Active Directory Infrastructure 7. On the Direction of Trust page, select Two-Way and then click Next. 8. On the Sides of Trust page, select Both This Domain and the Specified Domain and then click Next. 9. On the User Name and Password page, type the name and password of an account that is a member of the Domain Admins group in the domain2.com forest. Unless you have changed it, this is the original administrator account created when installing Active Directory. 10. On the Outgoing Trust Authentication Level—Local Domain page, choose Selective Authentication and then click Next. 11. On the Outgoing Trust Authentication Level—Specified Domain page, choose Selective Authentication and then click Next. 12. On the Trust Selections Complete page, review the choices you have made to make sure they are correct. If necessary, click Back and make any needed corrections. When the choices are correct, click Next to create the trust. 13. On the Trust Creation Complete Page, click Next. 14. On the Confirm Outgoing Trust page, click Yes, Confirm the Outgoing Trust and then click Next. 15. On the Confirm Incoming Trust page, click Yes, Confirm the Incoming Trust and then click Next. 16. When the Completing the New Trust Wizard page appears, click Finish to return to the Trusts tab of the domain1.com domain’s Properties dialog box. The trust with the domain2.com domain should appear as both outgoing and incoming, with a trust type of External and a transitivity of No.

3.4 Validating a Forest Trust In this exercise, you validate the trust you just completed in Exercise 3.3. You should perform this exercise from the domain2.com root domain controller. Estimated Time: 5 minutes 1. Click Start, Administrative Tools, Active Directory Domains and Trusts. 2. In the console tree, right-click domain2.com and choose Properties. 3. Select the Trusts tab of the Domain2.com Properties dialog box. domain1.com should appear in the two fields of this dialog box. 4. Under Domains Trusted by This Domain (Outgoing Trusts), select domain1.com and click Properties. 5. On the Domain1.com Properties dialog box, click Validate. 6. You are asked whether you want to validate the incoming direction of trust. Click Yes, Validate the Incoming Trust, type the username and password of an account that is a member of the Domain Admins group for domain1.com, and then click OK. 7. You should receive a confirmation message. Click OK.

189

Apply Your Knowledge 8. Click OK to close the Domain1.com Properties dialog box. 9. Back in the Domain2.com Properties dialog box, select domain1.com under Domains That Trust This Domain (Incoming Trusts). 10. Repeat steps 5–8 to validate the incoming trust.

3.5 Testing a Forest Trust In this exercise, you attempt to access the domain2.com forest from the domain1.com forest. You should perform this exercise from the domain1.com root domain controller. Estimated Time: 5 minutes 1. Click Start, Run, type \\server (where server is the name of the domain2.com domain controller), and press Enter. 2. Were you able to reach the other server? Why or why not? _____________________________________________________ _____________________________________________________ _____________________________________________________ 3. Click OK to close the message box.

3.6 Changing the Authentication Scope In this exercise, you change the authentication scope of the trust relationship you just created. You can perform this exercise from either domain controller. Estimated Time: 5 minutes 1. If the Properties dialog box for your domain is not visible, right-click the domain name in the console tree of Active Directory Domains and Trusts and choose Properties. 2. In the Domains Trusted by This Domain (Outgoing Trusts) field, select the name of the other domain and click Properties. 3. Select the Authentication tab of the Properties dialog box. 4. Select Domain-Wide Authentication and then click OK. 5. Repeat steps 2 and 3 for the Domains That Trust This Domain (Incoming Trusts) field. Note that the authentication level has already changed to domainwide. 6. Click OK to close the domain’s Properties dialog box.

190

Chapter 3: Managing an Active Directory Infrastructure

3.7 Testing a Forest Trust In this exercise, you repeat exercise 3.6 to attempt access to the other forest. You should perform this exercise from the domain1.com root domain controller. Estimated Time: 5 minutes 1. Click Start, Run, type \\server (where server is the name of the domain2.com domain controller), and press Enter. 2. Were you able to reach the other server? Why or why not? _____________________________________________________ _____________________________________________________ _____________________________________________________ 3. Click OK to close the message box.

3.8 Creating and Configuring Sites In this exercise, you rename the default site and create a second site. You then move a domain controller and add subnets to the site. Estimated Time: 15 minutes 1. Log on as an administrator. 2. Click Start, Administrative Tools, Active Directory Sites and Services. 3. In the console tree, expand the Sites folder. 4. Right-click Default-First-Site-Name and click Rename. 5. Type Head Office as the name of this site. 6. Right-click Sites and choose New Site. 7. Type Factory as the name of this site, select the default site link, and then click OK. 8. Repeat steps 6 and 7, specifying Branch Office as the name of this site. 9. Expand the Inter-Site Transports folder, right-click IP, and choose New Site Link. 10. Type Remote as the name of this site link, add Head Office and Branch Office to this link, and then click OK. 11. Expand the Head Office site and then expand the Servers folder. 12. Right-click the Server2 server and choose Move. 13. In the Move Server dialog box, select the Branch Office site and then click OK. 14. Right-click the Subnets folder and choose New Subnet.

191

Apply Your Knowledge 15. In the New Object—Subnet dialog box, type 192.168.1.0 in the Address box and 255.255.255.0 in the Mask box. Select Head Office as the site object for the subnet and then click OK. 16. Repeat step 15, specifying an address and subnet mask of 192.168.2.0 and 255.255.255.0 for the Factory site. 17. Repeat step 15 again, this time specifying an address and mask of 192.168.3.0 and 255.255.255.0 for the Branch Office site. 18. In the Inter-Site Transports folder, right-click IP and choose Properties. 19. In the IP Properties dialog box, clear the Bridge All Site Links check box and then click OK. 20. Back in the Inter-Site Transports folder, right-click IP and choose New Site Link Bridge. 21. In the New Site Link Bridge dialog box, type Branch Office as the name of the site link bridge. Select the default link and the Remote link and then click OK. 22. In the console tree, right-click Server1 and choose Properties. 23. In the Server1 Properties dialog box, click IP, click Add, and then click OK. This makes Server1 a preferred bridgehead server for the IP transport protocol. 24. Repeat steps 22 and 23 with the Server2 server. 25. Close Active Directory Sites and Services.

3.9 Configuring Intersite Replication Properties Because intersite replication can take up a large fraction of bandwidth on a slow link, you can modify certain properties of intersite replication. In this exercise, you configure a two-hour interval for IP intersite replication and then specify that intersite replication will not take place during daytime (8 a.m. to 6 p.m.) hours. You also set the site link cost to 25. Estimated Time: 5 minutes 1. Click Start, Administrative Tools, Active Directory Sites and Services. 2. If necessary, expand the Sites folder in the console tree to locate the Inter-Site Transports folder. 3. Expand this folder and click IP. The details pane displays a site link named DEFAULTIPSITELINK. 4. Right-click this link and choose Properties. 5. On the General tab of the site link’s Properties dialog box, type 120 in the text box labeled Replicate Every and then click Apply. 6. Click Change Schedule to display the Schedule for DEFAULTIPSITELINK dialog box. 7. Select the time interval of Monday 8:00 a.m. to Friday 6:00 p.m., select Replication Not Available, and then click OK.

192

Chapter 3: Managing an Active Directory Infrastructure 8. Back on the General tab of the site link’s Properties dialog box, type 25 in the Cost text box and then click OK. 9. The cost and replication values you configured are displayed in the details pane of the Active Directory Sites and Services snap-in. Close this snap-in.

Exam Questions 1. Evan has upgraded his company’s Windows NT 4.0 domains to Windows Server 2003 and has consolidated two previous domains into a single domain that contains all 900 users and their computers. The previous domains represented two offices that have an ISDN link between them. Evan sets up two sites, one for each office, and configures a site link to use SMTP for replicating between the offices. However, the domain controllers in the two offices are unable to replicate with each other. What does Evan need to do?

❍

A. Install Internet Information Services (IIS) on a domain controller at each site, and configure IIS as an SMTP server.

❍

B. Install an enterprise certification authority (CA).

❍

C. Install a faster link such as a T1.

❍ D. Use IP replication rather than SMTP replication. 2. Dorothy is a domain administrator for a large engineering company that operates a Windows Server 2003 forest with three domains. Her company has just acquired a Canadian subsidiary, which operates a single domain Windows 2000 forest. The two companies will be working together on future projects involving continentwide locations, so she recommended to management that a forest trust be created between the companies’ forests. Working from a domain controller in her company, Dorothy accesses the New Trust Wizard and enters the name of the Canadian company’s domain. She discovers that the option to create a forest trust is unavailable. What needs to be done so that she can create a forest trust?

❍

A. Ask an administrator of the Canadian company to provide her with a user account in that company’s domain.

❍

B. Ask an administrator of the Canadian company to add her domain user account to that company’s Enterprise Admins group.

❍

C. Ask an administrator of the Canadian company to upgrade its domain to the Windows Server 2003 functional level.

❍ D. Dorothy should create a shortcut trust instead.

193

Apply Your Knowledge 3. John is creating a new site in his company’s network; this site represents a branch office that the company is setting up. He opens the Active Directory Sites and Services console and accesses the New Object—Site dialog box. What additional piece of information does he need to specify?

❍

A. He needs to specify one or more subnets in the site.

❍

B. He needs to specify the name of a domain controller to be placed in the site.

❍

C. He needs to specify the licensing computer for the site.

❍ D. He needs to specify the site link to which the site will belong. 4. Peter is configuring replication for his company, which operates two offices, one in Dallas and the other in Atlanta. The company has a 1.5Mbps T1 link, a 128Kbps ISDN link, and a 56Kbps dial-up link between the two sites. Which of the following site link cost values should he configure for the three links?

❍

A. 50 for the T1 link, 100 for the ISDN link, and 200 for the dial-up link.

❍

B. 50 for the T1 link, 100 for the dial-up link, and 200 for the ISDN link.

❍

C. 50 for the dial-up link, 100 for the ISDN link, and 200 for the T1 link.

❍ D. 50 for the ISDN link, 100 for the dial-up link, and 200 for the T1 link. 5. Paul works for a state department of transportation that has just awarded a contract to a construction company to build a new highway linking the two largest cities in the state. The state government operates an Active Directory forest, within which the department of transportation operates a single child domain. The construction company operates a single domain Windows 2000 network. To build the highway, engineers at the construction company need access to resources at the department of transportation. What should Paul do to grant this access?

❍

A. Create a one-way external trust in which the department of transportation domain trusts the construction company domain.

❍

B. Create a one-way external trust in which the construction company domain trusts the department of transportation domain.

❍

C. Create a two-way external trust in which the two domains involved trust each other.

❍ D. Create a forest trust in which the construction company domain trusts the department of transportation domain. 6. Kristin is a domain administrator for a company that has a Manhattan head office and two upstate remote offices. Users in the remote offices are complaining that the links are slow, so she checks the utilization of the links and discovers that they are running at 100% capacity. Checking further, Kristin discovers that nearly all the traffic on the links is Active Directory replication.

194

Chapter 3: Managing an Active Directory Infrastructure On checking the replication schedule, Kristin discovers that replication should be taking place only once every six hours. What else should she be checking?

❍

A. The Ignore Schedule option

❍

B. The Replication Not Available option

❍

C. The Force Replication option

❍ D. How many new users have been added at the various sites in the past few days 7. Mark is the senior network administrator of a high-tech company whose head office is in Boston. The company also operates branch offices in Dallas, Rio de Janeiro, Paris, and Winnipeg. Previously, the company operated five separate domains, one for each city in which it has an office. When Mark upgraded the network to Windows Server 2003, he consolidated the entire network into a single domain and created sites for each city. Each office has its own domain controllers and separate subnet configurations. After receiving several complaints about slow data transfer rates, Mark realized there was an extreme amount of replication traffic, so he checked Active Directory Sites and Services. Which of the following is the most likely reason for this amount of replication traffic?

❍

A. The branch office sites are missing bridgehead servers.

❍

B. All domain controllers are located in the Default-First-Site-Name site. Mark needs to move them to their respective sites.

❍

C. The site links are using RPC over IP for replication. Mark needs to reconfigure them to use SMTP.

❍ D. The replication topology is improperly configured. Mark needs to run the Knowledge Consistency Checker to alleviate this problem. 8. Fred is a network administrator for a large company that has just acquired a smaller company. Both companies have operated their own Active Directory domains. Senior management has decided that they want to combine the two domains into a single domain with a series of OUs and several sites. The Active Directory schema in the smaller company contains several definitions that are not present in the schema of the large company, and Fred needs to extend the schema to include attributes taken from the old schema. Which of the following needs must Fred define for attributes being added to the schema?

❍

A. He can add new attributes only at installation time. An attribute definition includes a name, a unique object identifier (OID), a unique security ID (SID), a syntax that defines the type of data the attribute can hold, and optional range limits.

❍

B. He can add new attributes only during replication. An attribute definition includes a name, a unique OID, a syntax that defines the type of data the attribute can hold, and optional range limits.

195

Apply Your Knowledge

❍

C. He can add new attributes at any time. An attribute definition includes a name, a unique OID, a syntax that defines the type of data the attribute can hold, and optional range limits.

❍ D. He can add new attributes at any time. An attribute definition includes a name, a nonunique OID, a unique SID, a syntax that defines the type of data the attribute can hold, and optional range limits. 9. Maria is an enterprise administrator for an East Coast manufacturing company that has just merged with a similar company operating on the West Coast. She has configured external trusts between several domains in each forest, for which employees need access. These trusts all used domainwide authentication. Because management in her company wanted to keep the domain structure confidential, she had configured a UPN suffix of corp and configured all user accounts to use this suffix. An administrator in the other forest also configured a UPN suffix of corp for users in that forest. However, users were unable to access resources in the other forest, although they could access other domains in their own forest. Which two of the following would enable users to access resources to both forests?

❏

A. Maria needs to re-create the trust relationship as a forest trust.

❏

B. Maria needs to change the domainwide authentication scope to selective authentication.

❏

C. Users need to specify the domain in the other forest to which they want to log on.

❏ D. Maria should change the UPN suffix in use in her forest. 10. Gwen’s company has just merged operations with a former competitor. Both companies operate Windows Server 2003 Active Directory forests, each of which has three domains in a single tree. Managers at the second company would like to keep their operations as separate as possible; however, employees whose user accounts are in various domains of both forests need access to resources in all domains. What should Gwen do to enable access to the other forest with the least amount of effort?

❍

A. She should create a shortcut trust between child domains of the two forests.

❍

B. She should create a forest trust between the two forests.

❍

C. She should create an external trust between child domains of the two forests.

❍ D. She should inform her manager that the other company’s forest should be reconfigured as a second tree in her company’s forest.

196

Chapter 3: Managing an Active Directory Infrastructure 11. Roberta works for a company that has just opened a branch office in a neighboring city that is connected with a 128Kbps ISDN link. Her manager has requested that replication take place at least once a day during the daytime. However, the line is expected to be close to 90% utilized during the day, but only about 40% utilized during night hours. She needs to ensure that replication does not use too much bandwidth during the day, but that at night it will provide sufficient bandwidth to complete any synchronization. Which of the following should Roberta do to complete this request with the least amount of effort?

❍

A. Create two site links: one available only at night with the default replication interval and the other available only during the day with a replication interval of 6 hours.

❍

B. Create two site links: one available only at night with the default replication interval and the other available only from noon to 1 p.m. also with the default replication interval.

❍

C. Create two site links: one available only at night with the default cost and replication interval and one available only during the day with a site link cost of 500.

❍ D. Create one site link, available only at night with the default cost and replication interval. Once a day, force replication manually.

❍

E. Create one site link with the default cost and replication interval. Configure this link to be available from noon to 1 p.m. and also during the nighttime hours.

12. Nancy is the network administrator for a company that operates a single domain Active Directory network encompassing three sites located in Cleveland, Nashville, and Columbus. The Cleveland and Nashville sites have three domain controllers, and Columbus has one domain controller. If the domain controller at Columbus were to fail, Nancy would like Active Directory traffic from this site to be processed at the Cleveland site rather than the Nashville site. Which of the following is the best method for Nancy to accomplish this task?

❍

A. She should eliminate the site link between Columbus and Nashville.

❍

B. She should create a site link bridge between Columbus and Cleveland.

❍

C. She should place the domain controller at Columbus in the same site as the Cleveland domain controllers.

❍ D. She should configure the site link cost of the link between Columbus and Cleveland to be lower than that of the link between Columbus and Nashville. 13. A junior administrator in your company named Rick has just created a new one-way outgoing trust relationship between your company’s domain and a supplier’s domain. The purpose of this trust is to enable sales associates to place orders online with the suppliers so that they do not have to fax the orders. However, sales associates complain that they cannot access the supplier’s domain. What should you do to enable access, while keeping resources in your company’s domain secure?

197

Apply Your Knowledge

❍

A. In the trust’s Properties dialog box, change the authentication scope of the trust from selective authentication to domainwide.

❍

B. In the trust’s Properties dialog box, change the direction of the trust from outgoing to incoming.

❍

C. Remove the trust relationship and create a new one-way incoming trust relationship.

❍ D. Remove the trust relationship and create a new two-way trust relationship. 14. Linda works for a company that operates an Active Directory forest consisting of a single domain named examcram.com. The domain contains four sites representing the cities in which the company does business. Linda is training a junior administrator named Julio, who will be responsible for ensuring that the site links are properly bridged. To which container in the Active Directory Sites and Services snapin should Linda assign permissions for Julio?

❍

A. Sites

❍

B. Inter-Site Transports

❍

C. Subnets

❍ D. Each of the sites to be contained in the bridge 15. In the past few weeks, your company’s help desk has been receiving complaints from users whose accounts are in the USA.marketing.quepublishing.com domain; they complain that it is difficult to remember the appropriate domain name when logging on. In response to this problem, you create a new UPN suffix named quepublishing so that users should be able to log on with a name like user@quepublishing. However, users complain that they are unable to log on with this type of name. What do you need to do?

❍

A. Enable name suffix routing for the USA.marketing.quepublishing.com domain.

❍

B. In the properties of each affected user account, specify quepublishing as the UPN suffix in use.

❍

C. In the properties of each affected user account, append @quepublishing to the user’s logon name.

❍ D. Delete and re-create each user’s account, specifying quepublishing as the UPN suffix to be used. 16. Phil’s company has just merged with a competitor. Both companies operate Windows Server 2003 forests, each consisting of a single domain. Phil configures a two-way external trust relationship between the two domains so that users in each domain can access shared folders in the other domain, which is managed by Gertrude. He creates a group in his domain and adds users who

198

Chapter 3: Managing an Active Directory Infrastructure need access to Gertrude’s domain to this group. Gertrude also creates a group in her domain and adds users who need access to Phil’s domain to this group. Both administrators configure the appropriate NTFS permissions for files and folders that need to be accessed. The next week, users in Phil’s domain start calling the help desk, wondering why they cannot access the shared information in Gertrude’s domain. Users in Gertrude’s domain have no problems accessing resources in Phil’s domain. Which of the following is the most likely reason for this access failure?

❍

A. The authentication scope of Phil’s domain is set to domainwide authentication. Phil should set the scope to selective authentication.

❍

B. The authentication scope of Phil’s domain is set to selective authentication. Phil should set the scope to domainwide authentication.

❍

C. The authentication scope of Gertrude’s domain is set to domainwide authentication. Gertrude should set the scope to selective authentication.

❍ D. The authentication scope of Gertrude’s domain is set to selective authentication. Gertrude should set the scope to domainwide authentication. 17. Barry’s company is expanding its North American operations to Europe. To accommodate the new operations, he needs to add several objects and attributes to the schema. His manager has added his user account to the Schema Admins group for this purpose. Working from a branch office domain controller, Barry attempts to locate the Active Directory Schema snap-in. He calls the help desk and asks to be given the appropriate permission to access this snap-in, but is told that this is not a permissions issue. Which two of the following does Barry need to do to access this snap-in?

❏

A. He must first register the Schema snap-in by using the regsvr32 command from the Run dialog box.

❏

B. He should contact the help desk manager because he has received incorrect advice from the support technician. He needs to belong to both the Schema Admins and Enterprise Admins groups to access this snap-in.

❏

C. He needs to install the Active Directory Schema snap-in to a new MMC console.

❏ D. He needs to go to the schema master computer to modify the schema. Because the domain controller he is working from does not have this snap-in, it must not be the schema master. 18. In the process of upgrading their network from Windows NT 4.0 to Windows Server 2003, administrators at a western clothing outfitters company consolidated two domains representing office locations in Denver and Billings into a single domain. The two locations are connected with a dedicated ISDN line. Joanne, a junior administrator, created sites for both locations and assigned the domain controllers to their respective sites while working from the Denver location. The next week,

199

Apply Your Knowledge users at Billings started complaining about slow logon and resource access. What should Joanne do to speed up access?

❍

A. Configure replication between Denver and Billings to take place only at off-peak times.

❍

B. Assign the subnet containing computers located in Billings to the Billings site.

❍

C. Add an explicit UPN suffix for the users in the Billings site.

❍ D. Obtain approval from management to upgrade the ISDN line to a T1 line.

Answers to Exercises 3.5 Testing a Forest Trust No. You cannot reach the other server because you configured the authentication scope as selective authentication. This setting requires a specific granting of access to the required server, which you did not configure.

3.7 Testing a Forest Trust Yes. You are now able to reach the other server because the authentication scope is now set to domainwide. This setting allows access to all resources according to NTFS permissions that may have been configured for specific files and folders.

Answers to Exam Questions 1. D. The problem with SMTP replication in this instance is that SMTP cannot be used to replicate the domain partition between domain controllers in the same domain, only the schema, configuration, and application partitions. To replicate the domain partition, Evan must configure replication to use RPC over IP. It is true that SMTP replication requires an enterprise CA to work; however, just installing the CA would not allow replication of the domain partition. Therefore, answer B is incorrect (however, it would be correct if the two sites were in different domains). The SMTP packets can be sent directly between the domain controllers without the need for mail servers; therefore, answer A is incorrect. Installing a faster link such as a T1 will not help; therefore, answer C is incorrect. See the section “Configuring Replication Schedules.” 2. C. To create a forest trust, both forests must be operating at the Windows Server 2003 functional level. Therefore, the Canadian company needs to upgrade its domain controllers to Windows Server 2003 and then raise the domain and forest functional levels. This is not an issue of domain accounts or membership in the Enterprise Admins group. Therefore, answers A and B are wrong. A shortcut trust connects two child domains in the same forest, not different forests. Therefore, answer D is wrong. Note that Dorothy could instead create external trusts between the domains involved; however, this option was not offered. See the section “Establishing Trust Relationships.”

200

Chapter 3: Managing an Active Directory Infrastructure 3. D. The New Object—Site dialog box asks for the name of the site and the site link object. John should perform all the other tasks later; however, he cannot specify these tasks from this dialog box. Therefore, answers A, B, and C are wrong. See the section “Creating Sites.” 4. A. The site link cost is a value that determines which link will be given priority in replication. The KCC uses this information to determine the optimum link to be used during replication. When available, it uses the link with the lowest cost. Therefore, Peter should assign the lowest cost to the T1 line, the next higher cost to the ISDN line, and the highest cost to the dial-up link. Consequently answers, B, C, and D are incorrect. Note that a question similar to this may appear as a drag-and-drop question in which you must drag the correct costs to the various site links on a network diagram. See the section “Configuring Site Link Costs.” 5. A. In this scenario, engineers at the construction company need access to resources at the department of transportation domain. Therefore, the department of transportation domain needs to trust the construction company domain. Employees of the department of transportation do not need access to the construction company domain. Therefore, the construction company domain does not need to trust the department of transportation domain, and answers B and C are wrong. Other domains in the government do not need to participate in the trust relationship; therefore, answer D is wrong. See the section “Interforest Trust Relationships.” 6. A. If the Ignore Schedules check box is selected, replication can take place at any time of the day or night, and the configured schedule is ignored. Kristin needs to clear this check box so that the schedule is followed. She can use the Replication Not Available option if she does not want replication to take place at certain times. Because she does want replication to take place at six-hour intervals, she does not need this option, and answer B is incorrect. There is no Force Replication option. Therefore, answer C is incorrect. Even if a large number of users have been added recently, the replication traffic should not tie up the link to that extent. Therefore, answer D is incorrect. See the section “Configuring Replication Schedules.” 7. B. By default, all the domain controllers are placed in the Default-First-Site-Name site, and Mark needs to move them to the proper sites. The process of merely creating the sites and assigning the subnets to the sites is insufficient. When new sites are established, the Inter-site Topology Generator (ISTG) automatically creates bridgehead servers, so answer A is wrong. SMTP is used to replicate schema and configuration partitions only between domains, and is not used within domains, so answer C is wrong. The Knowledge Consistency Checker (KCC) automatically creates and manages the intersite replication topology and does not need to be manually run, so answer D is wrong. See the section “Active Directory Site Topology.” 8. C. After registering and installing the Schema snap-in, a member of the Schema Admins group can add new attributes to the schema at any time, not just when it is installed or during replication. Therefore, answers A and B are wrong. Attributes are used to define the properties of objects—for example, the “last name” property of a user object. The attribute requires a unique OID, a descriptive name, a syntax that defines the type of data the attribute can hold including a minimum and maximum value, and optional range limits. The attribute definition does not include a unique SID. Therefore, answer D is wrong. See the section “Managing Schema Modifications.” 9. C and D. When more than one forest uses the same UPN suffix, users can use it only to log on to a domain in the same forest. Therefore, they were unable to log on to a domain in the other forest. As it stands, users can log on to the other forest if the domain name is selected in the Log On to

201

Apply Your Knowledge Windows dialog box. Alternately, one of the administrators can change the UPN suffix in use. It does not matter whether an external or forest trust relationship is in use if the UPN suffix is the same; therefore, answer A is incorrect. This is not a matter of authentication scope; domainwide authentication should work here. Therefore, answer B is incorrect. See the section “Adding or Removing a UPN Suffix.” 10. B. The purpose of a forest trust is to create transitive trust relationships between all domains of the forests involved. In this scenario, because employees need access to more than one domain in the other company’s forest, it is best to create a forest trust. Gwen could create external trusts between various child domains; however, this approach would take far more administrative effort. Therefore, answer C is wrong. A shortcut trust is a shortened path between two child domains in the same forest and is not used between domains in different forests. Therefore, answer A is wrong. There is no need to reconfigure the other company’s forest as a second tree in her company’s forest. Therefore, answer D is wrong. See the section “Interforest Trust Relationships.” 11. E. Roberta needs only to configure one site link. She should click the Change Schedule button on the Properties dialog box, and specify that replication be available from noon to 1 p.m. and also during nighttime hours. This enables her to meet both the requirement for at least one replication during the day and the need for complete overnight synchronization. By allowing the daytime link to replicate only between noon and 1 p.m., she has selected a time when traffic would likely be lower. If she were to set a six-hour daytime replication interval, replication would take place sometime during the day; however, she does not need more than one daytime replication. Therefore, answer A is wrong. Roberta could also configure two site links with two distinct replication schedules. However, this would take more effort than creating a single link, so answer B is wrong. Site link costs do not influence replication intervals; they only enable the KCC to select the optimum link. Therefore, answer C is wrong. Roberta could manually force replication once a day; however, doing so takes daily effort. Therefore, answer D is wrong. See the section “Configuring Replication Schedules.” 12. D. The site link cost determines the preferential replication path (in this case, Columbus to Cleveland). Replication traffic proceeds over this link if possible, and over the higher cost link (in this case, Nashville) if a server at the other link cannot satisfy the request that has been made. It is important for intersite replication traffic to have all possible links available so that any queries or other traffic can proceed optimally. Therefore, answer A is wrong. A site link bridge consists of two or more links with one site in common, across which intersite replication traffic can take place. The cost of the site link bridge is equal to the sum of the costs of the individual links in the bridge. This would not help with the current scenario. Therefore, answer B is wrong. Placing the Columbus domain controller in the same site as the Cleveland domain controller would direct preferential replication between these two cities, but unless a very high speed link were available, the high replication frequency could overwhelm the link. Therefore, answer C is wrong. See the section “Configuring Site Link Costs.” 13. C. In this scenario, Rick created a trust relationship in the wrong direction. You have to delete and re-create the trust because it is not possible to reverse the direction of the trust relationship from the Properties dialog box of the trust. Therefore, answer B is wrong. Changing the authentication scope of the trust does not help. Therefore, answer A is wrong. Creating a two-way trust is not necessary; doing so reduces security because employees of the supplier company could then access your domain. Therefore, answer D is wrong. For more information, see the section “Managing Trust Relationships.”

202

Chapter 3: Managing an Active Directory Infrastructure 14. B. Linda needs to assign Julio permissions on the Inter-Site Transports container. This container is the location from which you can manage all aspects of intersite transport, including use of the IP and SMTP transport protocols, site links, site link bridges, replication schedules, and so on. None of the other locations provide an option for creating site link bridges, so answers A, C, and D are incorrect. Note that on the exam, a question similar to this might be presented in the form of a hot-spot graphic in which you must select the required location from the Active Directory Sites and Services snap-in. See the section “Site Link Bridges.” 15. B. By adding a UPN suffix, you can simplify logon procedures for all users in the forest. It is helpful for users with long child domain names, such as in this example. However, for the users to log on with the added UPN suffix, you need to specify the UPN suffix in the Account tab of the user’s Properties dialog box in Active Directory Users and Computers. Name suffix routing is used in routing authentication requests between forests connected by a forest trust. Therefore, answer A is wrong. You cannot simply add the UPN suffix to the user’s logon name; therefore, answer C is wrong. You do not need to delete and re-create any user accounts. Therefore, answer D is wrong. See the section “Adding or Removing a UPN Suffix.” 16. D. The authentication scope controls how access is granted to resources in the trusting domain. Domainwide authentication allows users from the trusted domain to access all resources in the local domain. Selective authentication does not create any default access to resources; you must grant access to each server that users need to access. In this case, Gertrude’s domain is the trusting domain, and because its authentication scope was set to selective, users from Phil’s domain were unable to reach her domain. She needs either to grant specific access to required resources or to reset the authentication scope to domainwide. If Phil’s domain were set to selective authentication, users in Gertrude’s domain would be unable to access resources in Phil’s domain. Therefore, answer B is incorrect. Because domainwide authentication allows users to access all resources, answers A and C are incorrect. See the section “Managing Trust Relationships.” 17. A and C. By default, the Active Directory Schema snap-in is not present when a domain controller is installed, so Barry has to install it. First, he needs to register the Schema snap-in by using the regsvr32 command from the Run dialog box. He cannot install this snap-in until he performs this step. This extra step is an additional security measure because of the importance of schema modifications. Barry does not need to belong to the Enterprise Admins group to access the Schema snap-in. Therefore, answer B is wrong. He does not need to be at the schema master because he can connect to it from another computer. Therefore, answer D is wrong. See the section “Managing Schema Modifications.” 18. B. When Joanne upgraded the domains to Windows Server 2003 and Active Directory, creating a single domain from the two domains that previously existed, initially all objects in the directory from both locations were assigned to the first site. When she created a site for the Billings location, by default no subnets were assigned to it; consequently, client computers and member servers in Billings thought they were in the Denver site, and all authentication and resource access traffic went across the ISDN link to Denver. If Joanne assigns the Billings subnet to its site, this traffic is handled locally for all resources in its site. This is not a replication issue; therefore, answer A is incorrect. Explicit UPNs are used to simplify logon procedures in a multidomain forest. They are not needed in a single-domain operation; therefore, answer C is incorrect. Because this is an issue of traffic unnecessarily routed over the slow link, there is no need for a faster link such as a T1. Therefore, answer D is incorrect. See the section “Configuring Site Boundaries.”

203

Apply Your Knowledge

Suggested Readings and Resources 1. Microsoft Corporation. “Active Directory Collection” http://technet2.microsoft.com/

WindowsServer/en/library/6f8a7c80-45fc-4916-80d9-16e6d46241f91033.mspx?mfr =true. 2. Microsoft Corporation. “Active Directory Replication over Firewalls.” http://

www.microsoft.com/technet/prodtechnol/windows2000serv/technologies/activedirectory/ deploy/confeat/adrepfir.mspx. 3. Microsoft Corporation. “How Active Directory Replication Works.” http://

technet2.microsoft.com/WindowsServer/en/library/c238f32b-4400-4a0c-b4fb7b0febecfc731033.mspx?mfr=true. 4. Microsoft Corporation. “Multiple Forest Considerations.” http://

download.microsoft.com/download/0/2/6/026ee2e2-e06d-4660-b9db-6926fd200ed9/ Multiforest_White_Paper.doc. 5. Microsoft Corporation. “Overview of Active Directory Federation Services in

Windows Server 2003 R2.” http://download.microsoft.com/download/d/8/2/ d827e89e-760a-40e5-a69a-4e75723998c5/ADFS_Overview.doc. 6. Microsoft Corporation. “Step-by-Step Guide to Using Active Directory Schema and

Display Specifiers.” http://www.microsoft.com/technet/prodtechnol/windows2000serv/ technologies/activedirectory/howto/adschema.mspx. 7. Microsoft Corporation. “Trust Types.” http://technet2.microsoft.com/WindowsServer/

en/Library/116d34e5-5615-4fb8-a8ef-47b94c294b581033.mspx?mfr=true.

This page intentionally left blank

4

CHAPTER 4

Maintaining an Active Directory Infrastructure Objectives This chapter covers the following Microsoft-specified objectives for the Managing and Maintaining an Active Directory Infrastructure section of the Windows Server 2003 Active Directory Infrastructure exam: Monitor Active Directory replication failures. Tools might include Replication Monitor, Event Viewer, and support tools. . Monitor Active Directory replication . Monitor File Replication Service (FRS) replication . This objective is included because Active Directory replication is essential for the network to function properly. You need to know how to use the various monitoring tools in various situations that can occur in the day-to-day operation of the network and which tool can be used to track what kind of activity. FRS replication (and its R2 successor, Distributed File System [DFS] Replication) is important because the SYSVOL folder uses this means to replicate among the various domain controllers.

Restore Active Directory directory services . Perform an authoritative restore operation . Perform a nonauthoritative restore operation . Restore operations are very important in keeping a network running properly. If disaster were to strike, being able to restore Active Directory could make the difference between staying in business or struggling to remain competitive. You will be tested on the different types of restore operations and when to use each one.

Troubleshoot Active Directory . Diagnose and resolve issues related to Active Directory replication . Diagnose and resolve issues related to operations master role failure . Diagnose and resolve issues related to the Active Directory database . This objective is intended to make sure that you know how to troubleshoot the more common problems that can occur in an Active Directory implementation. You need to know how to monitor and troubleshoot replication problems, such as slow or nonexistent replication, so that users have proper access to the directory. You need to know which operations master failure can cause what problems and what to do when they occur. You need to know how to troubleshoot database problems such as those related to Active Directory installation and removal, database corruption, and so on.

Outline Introduction

208

Managing and Monitoring Active Directory

208

Active Directory Support Tools ntdsutil

Replication Monitor repadmin dcdiag

Event Viewer Windows Server 2003 Performance Console Windows Server 2003 Support Tools Active Directory Support Tools Review Monitoring Active Directory Replication Monitoring FRS Replication Using Performance Console and Event Viewer to Monitor FRS FRS Log Files

208 211 212 220 223 225 230 238 243 243 244 245 247

Restoring Active Directory Services

248

Backing Up Active Directory Backup Types Backup Permissions Performing a Backup of Active Directory Specifying Advanced Backup Operations Restoring Active Directory Nonauthoritative Restore Authoritative Restore Primary Restore Managing the Active Directory Database Moving the Active Directory Database Defragmenting the Active Directory Database Restoring Active Directory Review

248 248 249

Troubleshooting Active Directory Diagnosing Issues Related to Active Directory Replication

250 253 256 257 262 264 264 264 265 267 267 267

Replication Has Stopped Replication Is Proceeding Slowly Slow Response to Clients Requesting Service RPC Server Is Unavailable Directory Service Log Reports Error 1311 Directory Service Log Reports Error 1265 Access Denied Errors in Active Directory Sites and Services After Manual Replication Attempt Diagnosing Issues Related to Operations Master Role Failures Schema Master Failure Domain Naming Master Failure RID Master Failure Infrastructure Master Failure PDC Emulator Failure Summary of Operations Master Failure Symptoms Working with the Operations Master Roles Diagnosing Issues Related to the Active Directory Database Files Required for Active Directory Functionality Issues Related to Installation or Removal of Active Directory Errors Related to DNS Issues Related to an Authoritative Restore Issues Related to Database Corruption Chapter Summary Key Terms Apply Your Knowledge Exercises Exam Questions Answers to Exam Questions Suggested Readings and Resources

268 269 269 269 270 271

272 272 273 273 273 274 274 274 275 276 276 277 279 280 281 282 282 283 283 289 294 297

Study Strategies This chapter continues to build on your knowledge of Active Directory by addressing what can go wrong with the directory service and how to keep track of directory service operations. As you read this chapter and perform the exercises, you should pay particular attention to the following: . Understand the various tools available for monitoring all aspects of Active Directory functionality. Know when and how to use replmon, repadmin, ntdsutil, Event Viewer, and the Performance console. Practice with these tools until using them becomes second nature. . Understand the differences between authoritative and nonauthoritative restores, and when to use each type of restore. In particular, know what happens if you perform a simple nonauthoritative restore of deleted objects that you want back. Also, know when and how to do a primary restore. . Know what you should do when replication slows or stops or when database issues arise. Understand the various tools and the messages they provide; these are clues that point you toward the procedure you should follow to get the network back to normal. Know the symptoms of operations masters failures and the consequence of seizing operations master roles.

208

Chapter 4: Maintaining an Active Directory Infrastructure

Introduction In previous chapters, you learned how Active Directory replicates its database among all domain controllers in the forest. You also learned how Active Directory uses a multimaster model for replication of most information, except for tasks handled by the operations masters (FSMOs). In Chapter 3, “Managing an Active Directory Infrastructure,” you learned how to manage and configure intersite replication. We now turn our attention to Active Directory monitoring and troubleshooting. Things can and do go wrong, often in very subtle ways. You need to know the signs and symptoms that something is amiss, and how to monitor your servers and directory service to determine where the problem lies. Servers can and do fail completely—and humans make errors from time to time. Being able to restore Active Directory from backup is often the fastest way to undo these kinds of damage. You need to know the ways in which you can restore Active Directory and the uses and limitations of each method.

Managing and Monitoring Active Directory Microsoft provides a wealth of support tools to assist you in managing and monitoring Active Directory. Each has its own purpose, although there is a large extent of overlap between certain tools such as the Replication Monitor and Replication Diagnostics tool. We look in detail at the most commonly used tools and provide introductory information on the other support tools that Microsoft has made available.

Active Directory Support Tools Objective

Monitor Active Directory replication failures. Tools might include Replication Monitor, Event Viewer, and support tools. . Monitor Active Directory replication

Windows Server 2003 contains a large number of support tools that assist you in the task of monitoring and troubleshooting Active Directory and its replication. Of the tools we discuss in this section, only ntdsutil, Event Viewer, and System Monitor are installed when you first install Windows Server 2003. The remaining tools are available from the Support\Tools folder of the Windows Server 2003 CD-ROM. You can also download the support tools from the Microsoft website. Step by Step 4.1 shows you how to install these tools.

209

Managing and Monitoring Active Directory

STEP BY STEP 4.1 Installing Windows Server 2003 Support Tools 1.

R2 Insert the Windows Server 2003 R2 Disk 1 CD-ROM.

2. If the Welcome to the Microsoft Windows Server 2003 Family page appears, select Perform Additional Tasks and then select Browse This CD. Otherwise, use My Computer or Windows Explorer to navigate to the CD-ROM drive. 3. Double-click the Support folder and then double-click the Tools folder. 4. Double-click Suptools.msi to start the Windows Support Tools Setup Wizard, as shown in Figure 4.1.

FIGURE 4.1 You can use the Windows Support Tools Setup Wizard to install Active Directory support tools.

5. On the End User License Agreement page, select I Agree and then click Next. 6. On the User Information page, if your name and organization do not appear, type them in. Then click Next. 7. The wizard displays a Destination Directory page, as shown in Figure 4.2. Accept the destination folder that it displays or type an alternative folder path. Then click Install Now.

FIGURE 4.2 The Destination Directory page allows you to specify the folder in which you want the support tools installed.

210

Chapter 4: Maintaining an Active Directory Infrastructure 8. The Installation Progress page displays the progress of installation, as shown in Figure 4.3. When the completion page appears, click Finish.

FIGURE 4.3 The Installation Progress page displays the progress of support tools installation.

9. You can access the support tools via a Windows Support Tools folder installed in the Start, All Programs menu, as shown in Figure 4.4.

After you have installed the support tools, a Windows Support Tools folder is present in the Start, All Programs menu. FIGURE 4.4

EXAM ALERT Active Directory Support Tools Make sure that you know how to install the Active Directory support tools, what each tool does, and which tool to use in a given troubleshooting situation.

211

Managing and Monitoring Active Directory

ntdsutil ntdsutil is a command-line utility that enables you to perform several Active Directory

management and maintenance tasks. Available tasks include the following: . Authoritative restoration of the Active Directory database—You can restore objects

you have deleted from the Active Directory database that you want to keep. See the “Restoring Active Directory Services” section later in this chapter. . Offline defragmentation of the Active Directory database—Online defragmentation

of the Active Directory database reorganizes its data but cannot change the location of the files on the disk or reduce the amount of disk space occupied by the database. You can perform an offline defragmentation by using the ntdsutil command while running in Directory Services Restore Mode. See the “Defragmenting the Active Directory Database” section later in this chapter. . Domain management—You can perform several management tasks, including the

creation of application directory partitions and replicas. Refer to Chapter 2, “Planning and Implementing an Active Directory Infrastructure,” for more information. . Management of the Active Directory database and log files—You can perform

such tasks as moving database and log files and compacting database files. You can also analyze and report the free space available on the domain controller’s disks, perform integrity checks on database files, perform soft recovery of the database, and so on. . Metadata cleanup—You can remove outdated Active Directory information that can

accumulate in Active Directory—for example, information pertaining to a domain controller that has crashed and cannot be restored to operating condition. . Transfer and seizure of operations master roles—You can transfer or seize opera-

tions master roles. We discussed this topic in Chapter 2. . Management of the security account data—You can check for and remove dupli-

cate security identifiers (SIDs). Although SIDs should be unique within the forest, they might become duplicated for reasons such as seizing the relative identifier (RID) master when the original RID master has become temporarily unavailable. . Reset of the Directory Services Restore Mode password—New to Windows

Server 2003, you can change the password used by the local Administrator account when you start the server in Directory Services Restore Mode. To use this utility, type ntdsutil at a command prompt. Refer to Chapter 2 and see later sections in this chapter for examples of its use.

212

Chapter 4: Maintaining an Active Directory Infrastructure

Replication Monitor The Replication Monitor tool, replmon, is a GUI-based tool available from the Windows Server 2003 and Windows XP Support Tools folder. It is installed when you execute the procedure already outlined in Step by Step 4.1. Using replmon, you can perform such tasks as monitoring the status of Active Directory replication, forcing synchronization between domain controllers, and displaying Active Directory topology in a graphical format. Starting Replication Monitor and Monitoring Active Directory Replication Step by Step 4.2 shows you how to start Replication Monitor, monitor the status of Active Directory replication, and create a log file that records a server’s replication events.

STEP BY STEP 4.2 Using Replmon to Monitor Active Directory Replication 1. Click Start, Run, type replmon, and then press Enter to start the Replication Monitor GUI tool. 2. Right-click Monitored Servers and choose Add Monitored Server. This action starts the Add Monitored Server Wizard, as shown in Figure 4.5.

FIGURE 4.5 You can use the Add Monitored Server Wizard to select a server to be monitored.

3. To add a server by name, ensure that Add the Server Explicitly by Name is selected and then click Next. 4. On the Add Server to Monitor page, ensure that Enter the Name of the Server to Monitor Explicitly is selected. Type the name of the server you want to monitor and then click Finish (see Figure 4.6).

213

Managing and Monitoring Active Directory

FIGURE 4.6 You can enter the name of the server to be monitored from the Add Server to Monitor page.

5. The domain controller you added appears in the left pane along with the Active Directory partitions it hosts. Repeat steps 3 and 4 to add additional domain controllers as needed. Additional domain controllers appear listed under the sites in which they are located, as shown in Figure 4.7.

replmon lists domain controllers according to the sites in which they are located.

FIGURE 4.7

6. To configure replmon to update its information automatically, click the Update Automatically button and then type the number of minutes to wait between monitoring intervals. After you do this, the Update Automatically button changes to Cancel Auto Update. 7. Right-click the server for which you want to create a status report and choose Generate Status Report, as shown in Figure 4.8.

214

Chapter 4: Maintaining an Active Directory Infrastructure

FIGURE 4.8 The Generate Status Report option allows you to create a replication status report for a monitored server.

8. In the Save As dialog box that appears, type a name for the log file you want to create and then click Save. 9. In the Report Options dialog box, select the type of information you want to have logged, as shown in Figure 4.9. Then click OK. 10. The Report Status dialog box tracks progress of report creation, and displays a Report Complete message when finished. Click OK.

FIGURE 4.9

its log files.

The Report Options dialog box enables you to specify which information replmon will save in

215

Managing and Monitoring Active Directory

NOTE A Faster Way to Add Servers to replmon You can also add monitored servers to replmon from a script file by selecting File, Open Script. The script file should have the .ini extension and contain the names of the servers to be monitored in ASCII text format. You can also create this file in replmon by selecting Save Monitored List As from the File menu. For more information, see the Windows Server 2003 Help and Support Center.

Displaying Pending Replication Changes In Chapter 3, you learned about intrasite and intersite replication, and the time intervals in which these types of replication occur. When you make changes to any component of Active Directory, changes are considered pending until replication has propagated these changes to all other domain controllers. You can use replmon to show what objects have changed and not yet replicated to other domain controllers. Step by Step 4.3 shows you how.

STEP BY STEP 4.3 Using replmon to Display Pending Changes 1. Follow steps 1 through 4 of Step by Step 4.2 to start replmon and add the required server to the monitoring list. 2. Expand the server’s directory partition in which you want to show what objects have pending replication events. This action displays the direct replication partners for the selected partition. 3. Right-click the desired replication partner and choose Check Current USN and Un-Replicated Objects. 4. On the Specify Credentials to Be Used dialog box, leave the default of Use Credentials Already Supplied for Server selected unless you need to provide alternative credentials, and then click OK. 5. If you receive a message box informing you that the last replicated object could not be determined, select View, Options, and select the Show Transitive Replication Partners and Extended Data check box (as shown in Figure 4.10) and then click OK. You might also have to click View, Refresh to refresh the Replication Monitor display.

216

Chapter 4: Maintaining an Active Directory Infrastructure

FIGURE 4.10 You might have to enable the display of transitive replication partners from the Active Directory Replication Monitor Options dialog box.

6. This action displays the Un-Replicated Objects dialog box, showing a list of pending changes (see Figure 4.11). Note that you might have to select Refresh from the View menu first. If no pending changes exist, a message box informs you that all changes have been replicated to this server (see Figure 4.12).

FIGURE 4.11 The Un-Replicated Objects dialog box provides a list of created or changed objects that are awaiting replication.

replmon informs you that all objects from the selected partition have been replicated.

FIGURE 4.12

7. If you want to save a log file containing these changes, click Save As, specify a name for the log file, and click Save. Otherwise, click OK to close the Un-Replicated Objects dialog box.

217

Managing and Monitoring Active Directory

NOTE Required Permissions To manually force replication, you must have the Replication Synchronization permission assigned to your user account. This special permission is assigned to members of the Domain Admins and Enterprise Admins groups by default. If you don’t have this permission, you will receive an Access Denied message.

Using replmon to Synchronize Directory Partitions Intrasite Active Directory replication takes place at five-minute intervals with a maximum of three hops between domain controllers. Consequently, directory partitions are never out of date for more than 15 minutes. Intersite replication takes place according to the schedule you have configured, as you learned in Chapter 3; consequently, domain controllers might be out of date for a longer period of time. In cases where a server or its network connections have been down for a period of time, you might have to synchronize directory partitions manually. You can use replmon to accomplish this task, as Step by Step 4.4 shows.

STEP BY STEP 4.4 Using replmon to Manually Synchronize Directory Partitions 1. Follow steps 1 through 4 of Step by Step 4.2 to start replmon and add the required server to the monitoring list. 2. Expand the server’s directory partition in which you want to show what objects have pending replication events. This action displays the direct replication partners for the selected partition. 3. To synchronize the directory partition with all replication partners, right-click the required partition and select Synchronize This Directory Partition with All Servers. This action displays the Synchronizing Naming Context with Replication Partners dialog box, as shown in Figure 4.13.

FIGURE 4.13 The Synchronizing Naming Context with Replication Partners dialog box provides three options for synchronizing directory partition data.

4. Select one or more of the three following options: . Disables Transitive Replication—Synchronizes data only with adjacent servers.

218

Chapter 4: Maintaining an Active Directory Infrastructure . Push Mode—Replicates data by pushing changes to replication partners, as opposed to the usual pull mode of replication. . Cross Site Boundaries—Replicates data to all servers in any site of the enterprise that are connected by a site link using RPC over IP as an intersite transport protocol. Click OK to continue. 5. A message box confirms that you want to initiate this replication. Click Yes to proceed. 6. To synchronize with a single replication partner, right-click the replication partner that needs manual synchronization and select Synchronize with This Replication Partner. 7. With either type of replication, a message box informs you that synchronization was queued successfully (see Figure 4.14). Click OK.

FIGURE 4.14 replmon informs you that manual synchronization has been queued.

8. On the View menu, choose Refresh to refresh the replication statistics and confirm that synchronization did indeed take place properly. The details pane displays replication statistics with the selected replication partner.

Additional Options Available with replmon You can select View, Options in the replmon toolbar to configure a series of options that pertain to all servers being monitored. This action displays the Active Directory Replication Monitor Options dialog box, already shown in Figure 4.10. The following options are available: . Show Retired Replication Partners—This option displays servers that are no longer

replication partners in the replication topology. . Show Transitive Replication Partners and Extended Data—As mentioned in Step

by Step 4.3, this option logs replication events from transitive partners. . Notify When Replication Fails After This Number of Attempts—This option

enables you to specify the number of attempts after which failed replication is reported. When selected, you can choose to write notification events to the application log or send mail to an address you specify. . Auto Generate File Names for Log Files—By default, replmon automatically creates

log file names.

219

Managing and Monitoring Active Directory . Default Path for Replication Status Logs—This option enables you to specify the

path to which replication log files are saved. . Enable Debug Logging—This option creates a separate log file that you can use to

troubleshoot replmon errors. You can log replmon errors to the Windows event log or to a file path that you specify in the text box provided. . Status Logging tab—From this tab, you can enable Group Policy object (GPO) log-

ging, System Monitor performance counter logging, and changes in attributes and their associated update sequence numbers (USNs). . Cache tab—From this tab, you can flush the cache that holds Replication Monitor

data that rarely changes. replmon provides a large number of server options that enable you to obtain additional infor-

mation about the status of Active Directory replication. You can access these options by rightclicking a server in the left pane of the Replication Monitor display, as described in Step by Step 4.2 for creating status reports. The following options are available from the context menu shown previously in Figure 4.8: . Update Status (Only for This Server)—This option forces an immediate update for

the selected server. It also logs and displays the time for this update. . Check Replication Topology—This option forces the Knowledge Consistency

Checker (KCC) to recalculate the replication topology for this server. . Synchronize Each Directory Partition with All Servers—This option forces repli-

cation for this server’s directory partitions with their replication partners. . Show Domain Controllers in Domain—This option displays a dialog box that lists

all domain controllers in the domain, together with the name of the site in which each is located and the LDAP distinguished names (DNs) of the associated computer and server objects. . Show Replication Topologies—This option displays a graphical view of all replica-

tion partners for every directory partition on the selected server. . Show Group Policy Object Status—This option displays a list of all GPOs on any

domain controller in your network. The list includes their Globally Unique Identifiers (GUIDs), and their version numbers in the Group Policy Container (GPC) and Group Policy Template (GPT). It also indicates whether the GPC and GPT versions of the GPO are out of synchronization. . Show Current Performance Data—This option displays System Monitor perform-

ance counters that pertain to Active Directory replication. You must first select counters from the View, Options menu.

220

Chapter 4: Maintaining an Active Directory Infrastructure . Show Global Catalog Servers in Enterprise—This option displays a list of global

catalog servers in this server’s forest. . Show Bridgehead Servers—From this option, you can choose to display a list of

bridgehead servers in the site to which this server belongs or the entire Active Directory enterprise. . Show Trust Relationships—This option displays a list of trust relationships within

the enterprise (including multiple forests) to which this server belongs. . Show Attribute Meta-Data for Active Directory Object—This option displays the

attribute metadata for an object whose DN you specify in the Object dialog box that appears when you select this option. . Clear Log—This option clears the contents of the replmon log file. . Delete—This option deletes the current server from the replmon display. . Properties—This option displays a Properties dialog box for the selected server, includ-

ing information such as FSMO roles in the server’s domain, TCP/IP configuration properties, inbound replication connection data, and so on.

repadmin The Replication Diagnostics tool, repadmin, is a command-line tool that performs most of the functions of the GUI-based replmon tool discussed in the preceding sections. This includes tasks such as viewing the domain controller’s replication topology, forcing replication between domain controllers, and viewing replication metadata. You can also monitor Active Directory for replication problems. repadmin comes with a comprehensive set of parameters, which you can view by typing repadmin /? at a command prompt. Here we discuss only the parameters you would be most

likely to use while using this tool to monitor and troubleshoot Active Directory replication. Step by Step 4.5 shows you how to use repadmin.

STEP BY STEP 4.5 Using repadmin 1. Open a command prompt. 2. Type repadmin together with the desired parameter and any other information as required, and then press Enter.

221

Managing and Monitoring Active Directory

The following sections discuss the most commonly used repadmin parameters. replicate The /replicate parameter forces replication between two replication partners. You need to specify the fully qualified domain names (FQDNs) of the two replication partners and the naming context (the distinguished name of the directory partition being replicated). For example, the following command replicates the configuration directory partition from Server1 to Server3 in the quepublishing.com domain: Repadmin /replicate server1.quepublishing.com server3.quepublishing.com ➥ cn=configuration,dc=quepublishing,dc=com

showmeta The /showmeta parameter displays the stamp value associated with each update to object attributes in Active Directory. The stamp contains identifying information for each replicated attribute. The stamp value contains the updated attribute’s USN and determines whether an update needs to be replicated. If the stamp of a replicated value is higher than that of a current value, replication takes place; otherwise, the current value is left alone. You need to include the DN of the object such as the domain controller for which you want to display the USNs. You can use ADSI Edit to obtain the DN, as mentioned later in this chapter. For example, the following command displays all USNs for the domain controller named Server1 in the quepublishing.com domain: Repadmin /showmeta cn=server1,ou=”domain controllers”,dc=quepublishing,dc=com

Output to this command contains the following information: . Loc.USN—The local USN value of the update at the domain controller where the

update was created. . Originating domain controller (DC)—The server at which the update was created,

displayed as site\server. This object is actually recorded as a GUID value. . Org.USN—The originating USN, which is a value that travels with the updated

attribute as it is replicated. This number is assigned at the originating DC. . Org.Time/Date—The date and time of the update, according to the system clock of

the DC where the update was created. . Ver—A version number that is incremented each time an attribute is updated. If this

value is 1, the attribute has never been overwritten. . Attribute—The name of the updated attribute.

222

Chapter 4: Maintaining an Active Directory Infrastructure

showreps The /showreps parameter displays the replication partners for each Active Directory partition being replicated. It also displays the GUID for the replicated partition, the time and date of the most recent replication attempt, and whether the last attempt was successful. When a failure occurs, it provides a reason for the failure. In addition, it displays the GUID for the server on which it was run and whether this server is a global catalog server. The /showrepl parameter performs the same tasks. The output of this command is useful when you are troubleshooting replication problems, as we will discuss later in this chapter in the “Diagnosing Issues Related to Active Directory Replication” section. add The /add parameter manually creates a replication link between domain controllers for the Active Directory partition you specify. For example, the following command creates a replication link between server3 and server4 in the quepublishing.com domain for the Active Directory configuration partition: Repadmin /add cn=configuration,dc=quepublishing,dc=com ➥ server3.quepublishing.com server4.quepublishing.com

Note that you can specify the server names either as their GUID or as the DNS fully qualified domain name. sync The /sync parameter manually forces a replication cycle to occur between domain controllers for the specified Active Directory partition. Using this parameter is tricky because you must specify the originating domain controller by its GUID value and the destination domain controller by its FQDN. For example, the following command forces replication to take place from server2.quepublishing.com (which has the indicated GUID) to server3.quepublishing.com: Repadmin /sync cn=configuration,dc=quepublishing,dc=com ➥ server3.quepublishing.com a68b5cbd-1a6d-448b-9643-22213479d408

If replication is successful, you will receive the message Sync from to <server> completed successfully. You can locate the required GUID by running repadmin /showreps <server>, where <server> is the name of the server whose GUID you need (such as server2

in this example). The following are optional switches that you can use with this parameter: . /async—Starts the replication, without waiting for the replication event to be

completed. . /force—Overrides the normal schedule of replication.

223

Managing and Monitoring Active Directory . /full—Forces a full synchronization of all objects from the destination directory

database. Ordinarily, only objects that have been changed are replicated. syncall The /syncall parameter manually forces replication of the specified Active Directory partition to all replication partners in the domain (for the domain partition), forest (for the configuration or schema partitions), or all partners that contain replicas of an application partition. You can specify the FQDN of a domain controller with this parameter to force the specified domain controller to replicate with its partners. showconn The /showconn parameter displays information related to intersite replication on the domain controller on which the command is run. You can determine whether the domain controller is replicating with the current bridgehead servers in its site. You can also verify that connections are enabled, the transport protocol is in use, and the time at which connections were completed or changed. replsummary The /replsummary (or /replsum) parameter displays a summary table of the most recent replication activities and problems that have occurred. It has several subparameters, including the following: . /bysrc—Displays servers that are replication sources, the last time of outbound

replication, and any errors . /bydest—Displays servers that are replication destinations, the last time of inbound

replication, and any errors . /sort:delta—Sorts output according to time since last successful replication, with the

longest time displayed first.

EXAM ALERT Using repadmin and replmon Make sure that you know what the most important parameters of repadmin are and how you would use them. Know how you would perform these tasks using either replmon or repadmin. The exam might ask you for two ways of performing a task.

dcdiag Also called the Domain Controller Diagnostic Tool, the dcdiag command-line tool analyzes the condition of domain controllers. The output of this tool informs you of any problems, thereby

224

Chapter 4: Maintaining an Active Directory Infrastructure

assisting you in troubleshooting domain controllers. It performs a series of tests that verify different functional areas of the domain controller, including connectivity, replication, topology integrity, trust verification, replication latency, replication of trust objects, and so on. You can select the domain controllers to be checked according to site, domain, enterprise, or single server. The syntax of the dcdiag tool is as follows: dcdiag.exe /s: [/u:\<Username> /p:*|<Password>|””] ➥ [/hqv] [/n:] [/f:] [/ferr:<Errlog>] [/skip:] ➥ [/test:] [/c]

Table 4.1 describes the dcdiag parameters: TABLE 4.1 dcdiag Command Parameters Parameter

Description

/s

Specifies the domain controller to be tested.

/u

Specifies the username credential under which the test will be run.

/p

Specifies the password for the username specified with /u.

/h

Displays help information.

/q

Displays error messages only (Quiet mode).

/v

Displays comprehensive information (Verbose mode).

/n

Identifies the naming context (directory partition) to be tested. You can specify this parameter as a NetBIOS or DNS name, or as the distinguished name.

/f:

Specifies that all output will be redirected to the specified log file.

/ferr:<Errlog>

Redirects only the fatal error output to the specified log file.

/skip

Skips the specified tests.

/test

Performs the specified tests.

/c

Comprehensive, runs all available tests except dcpromo and registerindns.

If you do not specify either the /skip or /test parameter, dcdiag runs a default set of tests. You should not use both the /skip and /test parameters at the same time. You can use the /skip and /c parameters together to specify a large number of tests while omitting others. The following are default tests: . Replications—Checks for timely replication between DCs. . NCSecDesc—Checks that the security descriptors on the naming context heads have

appropriate permissions for replication. . NetLogons—Checks that the appropriate logon privileges allow replication to proceed.

225

Managing and Monitoring Active Directory . Advertising—Checks whether each DC is advertising itself, and whether it is advertis-

ing itself as having the capabilities of a DC. . KnowsOfRoleHolders—Checks whether the DC knows the role holders. . RidManager—Checks whether the RID master is accessible and whether it contains

the proper information. . MachineAccount—Checks whether the Machine Account has the proper information. . Services—Checks whether appropriate DC services are running. . ObjectsReplicated—Checks for complete replication of the Machine Account and

Directory System Agent (DSA) objects. . Freesysvol—Checks that the SYSVOL folder is ready to replicate using FRS. . Frsevent—Checks whether any FRS operation errors have occurred. If replication of

the SYSVOL share fails, problems in applying Group Policy can occur. . Kccevent—Checks that the KCC is completing without errors. . Systemlog—Checks that the system is running without errors. . VerifyReferences—Verifies that certain system references are intact for the FRS and

replication infrastructure. For additional descriptions of available tests, refer to the Windows Support Tools Help and to articles in the Microsoft Knowledge Base.

Event Viewer You can use Event Viewer to obtain information about errors, warnings, and the success or failure of tasks in Active Directory replication as well as more general server operations. Event Viewer is one of the first places you should check when you are experiencing problems related to Active Directory, and indeed, with respect to any facet of server operations. Event Viewer is an MMC snap-in that is included as a standalone snap-in in the Administrative Tools folder or as a component of the Computer Management MMC console and the Component Services MMC console. On domain controllers, it contains six logs with the following functions: . Application—System applications, as well as applications written to Microsoft standards,

including programs such as email or antivirus applications, can record events in this log. . Security—Results of audited actions as configured in Group Policy are recorded

here. We discuss the types of actions you can audit in Chapter 7, “Planning and Implementing Group Policy.” Note that when you enable auditing of object access, you need to configure NTFS auditing options on the files and folders you need to audit.

226

Chapter 4: Maintaining an Active Directory Infrastructure . System—Events logged by Windows kernel and device drivers are recorded here,

including reasons for the failure of services to start and the cause of Stop (blue screen) errors. This log also records events related to network connectivity problems. . Directory Service—Found on domain controllers only, the Directory Service log

records events related to actions taken on the directory service database, such as online defragmentation. This log also records errors related to directory access problems such as LDAP access problems. . DNS Server—Found on DNS servers only, this log records events related to the

operation of the DNS server service. . File Replication Service—Found on domain controllers only, the File Replication

Service log records events related to the File Replication Service, including problems related to replication of Active Directory files such as the SYSVOL share. If you have created an Active Directory Application Mode (ADAM) instance, an additional log for each ADAM instance, labeled with the name of the instance, is also included. For general information on configuring and using Event Viewer together with the Application, Security, and System logs, refer to MCSA/MCSE 70-290 Exam Prep: Managing and Maintaining a Microsoft Windows Server 2003 Environment, mentioned in the “Suggested Readings and Resources” section at the end of the chapter. Obtaining information about directory service events from Event Viewer is simple. Step by Step 4.6 shows you how.

STEP BY STEP 4.6 Using Event Viewer to Obtain Directory Service Logging Information 1. Click Start, Administrative Tools, Event Viewer to open Event Viewer. You can also right-click My Computer, select Manage, and then double-click Event Viewer in the console tree of the Computer Management snap-in, or type eventvwr.msc from the Run dialog box. 2. In the console tree, select Directory Service to display Directory Service log information in the details pane. As shown in Figure 4.15, events displayed fall into three categories: information, warning, and error.

227

Managing and Monitoring Active Directory

FIGURE 4.15 The Directory Service log in Event Viewer displays information related to Active Directory replication events.

3. Double-click an event to open its Properties dialog box. This dialog box displays detailed information about the event, as shown in Figure 4.16.

FIGURE 4.16 Double-clicking an event provides detailed information about it.

4. Use the up and down arrows in the event’s Properties dialog box to view the properties of other events. These arrows are useful in tracking the progress of an incident that has recorded multiple events. 5. Repeat steps 2–4, selecting the appropriate log, to view events related to the other Event Viewer logs.

228

Chapter 4: Maintaining an Active Directory Infrastructure

Customizing Event Viewer When you have been running a domain controller for a considerable period of time, a large number of events accumulate in the event logs. This accumulation can make it difficult for you to locate the types of events that you want to find. Event Viewer enables you to customize its view so that you can locate these events more easily. To filter the view of events, follow Step by Step 4.7.

STEP BY STEP 4.7 Filtering the View of Events in Event Viewer 1. Click View, Filter to display the Filter tab of the Properties dialog box of the log you want to filter (see Figure 4.17).

FIGURE 4.17 Event Viewer provides several filtering options to assist you in locating events of the type you want.

2. Select the types of events you want to display. Also select one or more of the additional categories available on this dialog box, as follows: . Event Source—The service, program, or driver that logged the event. . Category—The type of event recorded, such as replication. . Event ID—A number that uniquely defines the type of event that was recorded. These numbers are useful in troubleshooting all types of problems. . User—The user account name associated with an event.

229

Managing and Monitoring Active Directory . Computer—The computer name associated with an event. . From and To—You can specify a range of dates and times for viewable events. 3. Click OK to return to Event Viewer and display the events associated with your selections. 4. If you subsequently need to view all events, repeat step 1 and then click Restore Defaults on the Filter tab of the log’s Properties dialog box.

Customizing Event Viewer Detail You can increase the level of detail that various Active Directory processes record in the Directory Service log. This procedure involves modifying Registry values, as shown in Step by Step 4.8.

STEP BY STEP 4.8 Configuring the Level of Detail Recorded by Event Viewer 1. Click Start, Run, type regedit, and then press Enter. 2. In the Registry Editor, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ NTDS\Diagnostics. 3. As shown in Figure 4.18, this Registry key contains a series of values related to the types of events logged in the Directory Service log. By default, they are all set to zero.

FIGURE 4.18 You can customize the extent of logging of a series of events by editing the Registry.

4. To increase the level of detail for a particular type of event, double-click the associated value to display the Edit DWORD Value dialog box (see Figure 4.19). Enter a number between 1 and 5 for the value data (the higher the number, the more information is recorded) and then click OK.

230

Chapter 4: Maintaining an Active Directory Infrastructure

FIGURE 4.19

Specifying the detail of logging for a particular type of event.

NOTE Understand the Problem You Are Looking for Before Raising the Logging Level You should check the event logs first and not raise the logging level until you are fully aware of the problem and the information you are seeking.

WARNING Be Careful When Editing the Registry You can do serious harm to your computer if you are careless when editing the Registry. You should back up the Registry before editing it and then perform only the edits you are certain will not cause harm.

We present several uses of Event Viewer to diagnose problems related to Active Directory replication and File Replication Service replication later in this chapter.

Windows Server 2003 Performance Console All editions of Windows Server 2003 include the Performance console, which is accessible from the Administrative Tools folder. This console contains two extension snap-ins: System Monitor and Performance Logs and Alerts. System Monitor is a powerful monitoring tool that monitors almost all aspects of a server’s performance. Performance Logs and Alerts logs server performance data to files and generates alerts when unexpected performance levels occur. These tools encompass the same functionality that was formerly located in the Windows NT 4.0 Performance Monitor. Objects and Counters The Performance console uses a system of objects and counters to display its data. An object is a system component that possesses a set of measurable properties. Objects represent individual processes, shared memory sections, and physical devices, such as memory and the processor. A counter is a statistical measurement associated with an object. Each object possesses a unique set of counters that produce statistical data.

231

Managing and Monitoring Active Directory

Additional information about these counters is found in the Windows Server 2003 Help and Support Center. Detailed information on running System Monitor to monitor general functions of the server can be found in MCSA/MCSE 70-290 Exam Prep: Managing and Maintaining a Microsoft Windows Server 2003 Environment, listed in the “Suggested Readings and Resources” section of this chapter. Using System Monitor You can use System Monitor to perform tasks such as the following: . Identify performance problems such as bottlenecks . Track trends over time . Measure resource use . Monitor the effects of system configuration changes . Predict capacity planning . Generate alerts

Follow Step by Step 4.9 to run System Monitor.

STEP BY STEP 4.9 Working with System Monitor 1. Click Start, Administrative Tools, Performance. 2. Select System Monitor to display a real-time graph of computer performance. 3. System Monitor appears in the details pane, containing the graphs of three default counters as shown in Figure 4.20: Memory\Pages/sec, Physical Disk\Avg. Disk Queue Length, and Processor\% Processor Time.

FIGURE 4.20 The System Monitor snap-in displays a real-time graph of activity for selected objects and counters.

232

Chapter 4: Maintaining an Active Directory Infrastructure 4. To add counters to the graph, click the + icon in the toolbar. This action displays the Add Counters dialog box. 5. On the Performance Object drop-down list, select the object you want to monitor. The counters for the selected object appear in the list, as shown in Figure 4.21. The most commonly monitored object for the selected counter appears highlighted.

FIGURE 4.21 You use the Add Counters dialog box to add performance counters to the System Monitor graph.

6. To add this counter, click Add. To add other counters, scroll to select them and then click Add. To see an explanation of what a counter measures, click Explain. You can use the Ctrl key to select more than one noncontiguous counter or the Shift key to select more than one contiguous counter from the list. 7. When you are finished adding counters, click Close. The performance graph includes the added counters.

Monitoring of Active Directory replication involves mainly the NT Directory Services (NTDS) performance object. This object is automatically added to the series of objects available with System Monitor when you install Active Directory. It includes more than 120 counters that monitor Active Directory functions, including the following: . Address Book (identified in the counter list as AB) . Asynchronous Thread Queue (ATQ) . Directory Replication Agent (DRA) . Directory Services (DS) . Key Distribution Center (KDC) . Kerberos Authentications . Lightweight Directory Access Protocol (LDAP)

233

Managing and Monitoring Active Directory . NT LAN Manager (NTLM) . Security Accounts Manager (SAM)

You can also monitor another computer on the network. To do so, in the Add Counters dialog box, shown previously in Figure 4.21, select the Select Counters from Computer option and type or locate the required computer (by name or IP address) in the drop-down list provided. System Monitor Properties You can customize the appearance of the System Monitor graph or select a histogram or report view. Right-click in the graph area and choose Properties to display the System Monitor Properties dialog box, as shown in Figure 4.22. From this dialog box, you can configure several properties of the System monitor display, as follows:

FIGURE 4.22 The System Monitor Properties dialog box enables you to customize the appearance of the System Monitor output.

. View—You can choose between Graph, Histogram, or Report view. Graph view is the

default. . Display Elements—These options affect which components of the default graphical

display appear. . Report and Histogram Data—These options determine the type of data displayed

when using the report or histogram view. . Appearance and Border—These options determine how histogram bars appear on the

histogram view.

234

Chapter 4: Maintaining an Active Directory Infrastructure . Sample Automatically Every—You can choose the interval in seconds at which

System Monitor samples the displayed counters. The default is one second. Increase this value if you are planning to monitor the counters for an extended period of time. . Source tab—This tab determines the source of the data being displayed on the graph.

The default is Current Activity, which shows the graph of current computer performance. You can select Log files to display information logged by the Performance Logs and Alerts snap-in also included with the Performance console. . Data tab—This tab lists the counters currently monitored and allows you to add or

remove counters. You can access the Add Counters dialog box previously shown in Figure 4.21 by clicking Add on this tab. . Graph tab—This tab allows you to modify the appearance of the graph by adding a

title and vertical axis. You can also add grids and modify the range of the vertical scale. . Appearance tab—This tab allows you to modify the appearance of any display by

changing the color of various display elements and the font of the text.

Performance Logs and Alerts Performance Logs and Alerts is an extension snap-in that is included in the Performance console and Computer Management console. You can use this snap-in to log performance counters over a period of time. You can also create trace logs and alerts from this snap-in. Logs are comma- or tab-delimited text files that you can easily import to spreadsheet or database programs. You can also specify a binary log file format (.blg) that can be viewed with System Monitor or an SQL database file. The Performance Logs and Alerts snap-in enables you to view counter data during and after collection; define start and stop times, filenames and sizes, and other log collection parameters; manage multiple logging sessions from a single instance of the snap-in; and send alerts or messages, or run a program when a specific event takes place. Similar to System Monitor, Performance Logs and Alerts enables you to define objects, counters, and instances, and set sampling intervals or other data collection parameters. Follow Step by Step 4.10 to create counter logs.

STEP BY STEP 4.10 Creating Counter Logs 1. Click Start, Administrative Tools, Performance. 2. Double-click Performance Logs and Alerts and then select Counter Logs. Any existing logs will be listed in the details pane. A green icon indicates that a log is running; a red icon indicates that it is stopped. 3. Right-click a blank area of the details pane and click New Log Settings.

235

Managing and Monitoring Active Directory 4. In Name, type a name for the log and then click OK. As shown in Figure 4.23, a dialog box appears, labeled with the name you entered.

FIGURE 4.23 The dialog box reflecting the name of your log enables you to configure all properties of the log.

5. To add performance objects, click Add Objects. In the Add Objects dialog box that appears, select one or more objects, click Add and then click Close (see Figure 4.24). This action adds all counters for the selected object.

FIGURE 4.24 You can use the Add Objects dialog box to add all counters of a selected object to your log.

6. To add selected counters from one or more performance objects, click Add Counters. This displays the same Add Counters dialog box shown previously in Figure 4.21.

236

Chapter 4: Maintaining an Active Directory Infrastructure 7. Specify an interval at which the selected counters will be logged in seconds, minutes, hours, or days and then click OK or Apply to begin logging. 8. The log appears in the details pane of the Performance console with a green icon that indicates the log is collecting data (unless you have scheduled it to start later). 9. To manually start and stop a log, simply right-click it and choose Start or Stop, as needed.

NOTE Scheduling Logging You can schedule starting and ending times for logging by configuring options on the Schedule tab of the log’s Properties dialog box. If you want to log different frequencies for different time periods, you can configure and schedule additional logs—for example, to log at a high frequency during peak times and a low frequency at night.

The Performance Logs and Alerts console also allows you to create trace logs and alerts. You can use trace logs to monitor specific event occurrences related to items such as processor, disk or file I/O, TCP/IP, and page faults. When the event occurs, it sends data to the log service. Trace logs differ from counter logs in that they log data only when a specific activity takes place; counter logs track data continuously for the time period they are set up for. Creating trace logs is similar to creating counter logs as described in Step by Step 4.10. You can display an alert when a selected counter exceeds or drops below a prespecified value. You can also trigger other actions such as running a program when an alert event occurs. Use alerts to monitor a critical resource such as free disk space. Configuring alerts is also similar to configuring counter logs. You have to specify the alert threshold on the alert’s Properties dialog box. Displaying Data Logged by Performance Logs and Alerts To display logged data, you can export the log files to a spreadsheet or database program, or use System Monitor to display the logged data, as described in Step by Step 4.11.

STEP BY STEP 4.11 Displaying Logged Data in System Monitor 1. In System Monitor, select the Log Files toolbar button (the fourth button from the left, with a cylinder icon). 2. On the Source tab of the System Monitor Properties dialog box, select Log Files and then click Add.

237

Managing and Monitoring Active Directory 3. On the Select Log File dialog box that appears, browse to the folder containing your log files, select the required file, and click Open. This displays the log filename in the System Monitor Properties dialog box, as shown in Figure 4.25.

FIGURE 4.25 Specifying the source of logged data to be displayed by System Monitor.

4. If you need to limit the time range displayed, drag the sliders at each end of the Time Range bar at the bottom of the System Monitor Properties dialog box. Then click OK and the logged data is displayed in the System Monitor graph.

Best Practices for Performance Monitoring and Logging You should have a good performance-logging program in place to have a baseline record showing how your domain controllers are performing under normal load conditions. Such a program helps you to be prepared in the event that something unusual occurs. In particular, pay attention to the following best practices: . Create a baseline by logging server performance at 10- to 15-minute intervals for a

week or two, and archive the logs that are created. . While logging server performance, turn off services that are not essential to day-to-day

server operation and logging. . Do not run unnecessary programs, including screen savers, while logging perform-

ance data. . During periods of especially high server use, log server performance at one- or two-

minute intervals.

238

Chapter 4: Maintaining an Active Directory Infrastructure . Try to minimize file and disk overhead because it can affect logging results. You should

log to a disk other than the one on which most activity is taking place. If you have a high-bandwidth network, log to another computer such as a Windows XP Professional desktop computer.

TIP Performance Monitoring and Logging The Performance console in Windows Server 2003 performs monitoring and logging. Remember that you must use the Performance Logs and Alerts snap-in within this console if you want to retain a permanent record of performance data from any computer.

Windows Server 2003 Support Tools In addition to repadmin and replmon, the Windows Server 2003 Support Tools package includes a number of other tools that are valuable in managing and monitoring Active Directory. The following are several of the more useful tools: . ADSI Edit—The Active Directory Services Interface tool (ADSI Edit) is an MMC

snap-in that enables you to view information about any Active Directory object, including schema and configuration data. Installed with the Windows Server 2003 Support Tools, you can start it from the Run dialog box by typing adsiedit.msc. It is an object-oriented interface that allows developers to create programs that utilize directory services functions. One useful function of this tool is to modify the tombstone lifetime of objects deleted from Active Directory, which is the amount of time that a deleted object is retained in a hidden Deleted Objects container. Another is to display the class and DN of objects found in any container within Active Directory. You may need this information for purposes such as using repadmin with the /showmeta parameter. See Figure 4.26 for an example.

FIGURE 4.26 The ADSI Edit tool displays the contents of the major Active Directory partitions and their subcontainers.

239

Managing and Monitoring Active Directory

NOTE R2 ADAM ADSI Edit When you install ADAM on a Windows Server 2003 R2 server, an ADAM ADSI Edit MMC snap-in is included. You can access this snap-in by clicking Start, All Programs, ADAM, ADAM ADSI Edit. This snap-in enables you to perform the same actions as the ADSI Edit tool described here. For more information, refer to ADAM ADSI Edit in Active Directory Application Mode Help.

WARNING Be Careful When Using ADSI Edit ADSI Edit is a low-level Active Directory editor. As such, you can do serious harm to the Active Directory database if you use ADSI Edit improperly. Be sure that you have an up-to-date backup of Active Directory before you start.

. Movetree—This command-line tool enables you to move Active Directory objects

between domains of the Active Directory forest. It includes a check function that tests the ability to move objects before the move actually takes place. . Ldp—This GUI-based LDAP tool enables you to perform several types of operations

against an LDAP-compatible directory such as Active Directory. You can view objects in Active Directory along with their metadata. You can also perform several operations such as adding, deleting, and modifying objects. . Ldifde—This command-line tool enables you to perform batch actions with Active

Directory’s LDAP data interchange format (LDIF). You can import data to and export data from Active Directory, or create, modify, move, and delete objects. You can also perform search operations against the directory as a whole, or specific portions of the directory subtree. For more information, refer to “Using LDIFDE to Import and Export Directory Objects to Active Directory” in the “Suggested Readings and Resources” section. . Dsacls—Also called the Directory Services ACL Editor, this command-line tool displays

access control entries (ACEs) of objects in Active Directory. You can also perform lowlevel editing of permissions on these objects. . Dsadd—This command-line tool enables you to add certain objects to the directory.

Objects you can add include computers, contacts, groups, OUs, users, and quota specifications. For each type of object available, you can specify the object’s LDAP distinguished name (DN) as well as a comprehensive range of attributes. For further information on the available dsadd commands including the required and available keywords, refer to the Windows Server 2003 Help and Support Center. . Dsmod—This command-line tool enables you to modify the attributes of objects in

the directory. You can modify the same types of objects that the dsadd tool enables you to add.

240

Chapter 4: Maintaining an Active Directory Infrastructure . Dsrm—This command-line tool enables you to delete objects from the directory. You

can delete the same types of objects that the Dsadd tool enables you to add. For further information on the available dsmod and dsrm commands including the required and available keywords, refer to the Windows Server 2003 Help and Support Center. . Dsastat—Also called the Directory Services Utility, this command-line tool enables you

to compare and detect differences between naming contexts on domain controllers. You can compare two directory trees across replicas within the same domain, including attributes of replicated objects. In the case of global catalog servers, you can also make comparisons across domains of the same forest. Statistics generated by this tool include megabytes per server, objects per server, and megabytes per object class. . Sdcheck—Also called the Security Descriptor Check Utility, this command-line

tool displays the security descriptor for an Active Directory object. This descriptor contains ACLs that define permissions on the object. . Netdiag—Also called the Network Connectivity Tester, the Netdiag command-line tool

tests the condition and functionality of network clients, and verifies DNS name registrations. The output of this tool assists you in isolating and troubleshooting network and connectivity problems. You can even fix some DNS configuration problems automatically with this tool’s /fix parameter. . FRSDiag—Also called the File Replication Services Diagnostics Tool, this GUI-based tool

assists you in diagnosing and troubleshooting FRS problems. Using this tool, you can also force replication on target servers, create a test file in SYSVOL for checking replication to target servers, and modify the level of debug logging for FRSDiag events. You can download this tool from the Microsoft website. Details of these tools, including their syntax and examples, can be found in the Windows Server 2003 Help and Support Center.

Challenge Logging Active Directory Performance The widgets.com organization you have been working with has been growing very rapidly in recent months. The network has been expanded considerably and a large number of new objects have been added to Active Directory. Consequently, users are often experiencing slow performance when searching for resources on the network. In this exercise, you will obtain performance logging data and create a real-time graph of performance statistics for the LDAP Searches/Sec counter, which provides data on the rate of search operations performed by computers in the Active Directory domain. You will then export the data to Excel to create an (continues)

241

Managing and Monitoring Active Directory (continued)

improved graphical display of the collected data. If you do not have Excel available, you might be able to do the second part of the exercise on another spreadsheet program including the Microsoft Works spreadsheet. Try to work through the steps of this exercise on your own. If you have difficulty, refer to the following steps (and, if necessary, to the exercises in Chapter 2): 1. Click Start, Administrative Tools, Performance. 2. Expand the console tree to reveal the Counter Logs, Trace Logs, and Alerts applications under Performance Logs and Alerts. 3. Right-click Counter Logs and choose New Log Settings. 4. In the New Log Settings dialog box, provide a descriptive name for the log and then click OK. 5. In the dialog box that appears, click Add Counters. 6. In the Add Counters dialog box, select the NTDS Performance object, and then select the LDAP Searches/Sec counter. Click Add and then click Close. 7. Back in the previous dialog box, change the sampling interval to one second. 8. Select the Log Files tab, and in the Log File type drop down list, select Text File (Comma delimited). Then click OK. 9. Click Yes to create the log folder. The log you created should appear in the details pane of the Performance console, and the icon should appear green in color, indicating it has started. If the icon is red, right-click it and choose Start. 10. Open Active Directory Users and Computers. Create several new OUs, users, and groups, and then move these objects to different containers within your domain. Keep performing several of these actions for two or three minutes. 11. When finished, close Active Directory Users and Computers, and return to the Performance console. 12. Right-click your log and choose Stop. 13. In the console tree, select System Monitor. 14. Select the Log Files toolbar button to display the Source tab of the System Monitor Properties dialog box. 15. Select the Log Files radio button and then click Add. 16. In the Select Log File dialog box, scroll to the location of the log file you just created, select it, click Open, and then click OK. 17. Select the Add Counters toolbar button to display the Add Counter dialog box. This dialog box should display the NTDS\LDAP Searches/sec counter. (continues)

242

Chapter 4: Maintaining an Active Directory Infrastructure (continued)

18. Click Add and then click Close. The Performance snap-in should display a graph similar to that in Figure 4.27 showing activity for this counter.

FIGURE 4.27 Typical performance data for the NTDS\LDAP Searches/Sec counter.

19. Click Start, All Programs, Microsoft Excel. 20. Click File, Open. In the Open dialog box, scroll to the location of your performance log, and then click OK. This displays your performance data in two columns: the time and the counter value. 21. To display a simple graph, press F11. You should see a graph that is similar to that displayed in step 18. The horizontal axis will show time in minutes and seconds. 22. To modify the horizontal axis format, right-click it and choose Format Axis. 23. On the Format Axis dialog box, select the Number tab. Ensure that Time is selected under Category. Then select an appropriate format under Type (such as 1:30:55 PM) and then click OK. 24. If the graph shows many small values near the bottom and only a few large values, you can improve readability by creating a logarithmic graph. To do this, right-click the vertical axis and choose Format Axis. 25. On the Scale tab of the Format Axis dialog box, select the Logarithmic Scale check box and then click OK. This format is useful for displaying many performance counters (not including those that display percentage activity of any type). 26. Excel warns you that negative or zero values cannot be plotted. Click OK to accept this warning and note the change in the appearance of the graph. 27. If you want to do so, experiment with other options for modifying the format of the graph. When you are finished, save your graph and close Excel.

243

Managing and Monitoring Active Directory

Active Directory Support Tools Review Remember these key points regarding Active Directory support tools: . Support tools available when Windows Server 2003 is installed include ntdsutil,

Event Viewer, and the Performance console. . You can use ntdsutil to perform a variety of Active Directory administration tasks. . You can install the full suite of Active Directory support tools from Suptools.msi,

located in the Support\Tools folder of the Windows Server 2003 CD-ROM. . The Active Directory Replication Monitor, or replmon, provides a GUI interface from

which you can monitor most aspects of Active Directory replication. . You can use repadmin for command-line replication monitoring. . Event Viewer reports events related to Active Directory replication in the Directory

Service log. . You can use the NTDS object in Performance console to monitor Active Directory

replication.

Monitoring Active Directory Replication Objective

Monitor Active Directory replication failures. Tools might include Replication Monitor, Event Viewer, and support tools. . Monitor Active Directory replication

In Chapter 3, you learned about the update sequence number Active Directory uses to keep track of replicated updates. Recall that the USN is a 64-bit number that is maintained at each domain controller in the forest. Every time an update takes place, the domain controller at which the update occurs increments the USN by one. Other domain controllers check the USN to determine what updates they need. The act of monitoring Active Directory replication uses one or more of the tools we have already discussed: replmon, repadmin, dsastat, and the Performance console. Two particularly useful features of replmon are Generate Status Report and Show Replication Topologies, discussed earlier in this chapter and in Step by Step 4.2. The /showreps and /showconn parameters of repadmin are also very useful. Refer to the sections on these tools for their description and use in monitoring Active Directory replication.

244

Chapter 4: Maintaining an Active Directory Infrastructure

The counters in the NTDS object of System Monitor and Performance Logs and Alerts are particularly useful when you need to obtain details indicating how Active Directory replication affects overall server performance. The following are several counters that should show activity over time if replication is taking place properly. If they do not, this usually indicates that hardware or network problems are occurring. . DRA Inbound Bytes Total/Sec—The total number of bytes per second received

through replication . DRA Outbound Bytes Total/Sec—The total number of bytes per second sent

through replication . DS Threads in Use—The number of processor threads used by the directory service . Kerberos Authentication/Sec and NTLM Authentications/Sec—The number of

authentications using the given protocol being serviced by the domain controller . LDAP Client Sessions—The number of connected LDAP client sessions

In addition, the following counters should show low values if replication is taking place properly: . DRA Pending Replication Synchronizations—The number of directory synchro-

nizations that are queued for the server but not yet processed. A high number indicates that server hardware is slowing replication. . LDAP Bind Time—The time in milliseconds required for the last successful LDAP

binding. A high value indicates hardware or network problems.

Monitoring FRS Replication Objective

Monitor Active Directory replication failures. Tools might include Replication Monitor, Event Viewer, and support tools. . Monitor File Replication Service (FRS) replication

FRS is a multimaster file replication service that is used to replicate data between servers running Windows 2000 or Windows Server 2003. In particular, Active Directory uses FRS to replicate changes in the SYSVOL folder between domain controllers in the domain. FRS is also used for replicating domain-based Distributed File System (DFS) shares. Because SYSVOL is an important component of Active Directory, you should be monitoring FRS replication as part of your overall Active Directory performance monitoring program. In particular, if problems

245

Managing and Monitoring Active Directory

occur with FRS replication, changes in Group Policy will not be replicated to other domain controllers.

NOTE R2 DFS Replication New to Windows Server 2003 R2, DFS Replication supports enhanced replication features, including bandwidth throttling and scheduling of replication events. However, Windows Server 2003 R2 still uses FRS replication to replicate the SYSVOL folder. Microsoft is considering using DFS replication to replicate SYSVOL in the next version of Windows Server.

Using Performance Console and Event Viewer to Monitor FRS The Performance console includes two objects, each with a large number of counters for monitoring FRS replication. You can monitor or log these objects by following the procedures already outlined in Step by Steps 4.9 and 4.10. Following are the Performance console objects: . FileReplicaConn—Contains counters pertaining to FRS replication across a connec-

tion with a specific replication partner, including replica connections to Distributed File System roots. The Instances field (right panel in Figure 4.21) displays instances that relate to each connection the monitored domain controller has with a replication partner. Select the connection to monitor or select the All Instances radio button to monitor all connections. The following are several important counters for this object: . Packets Sent in Bytes—The total number of data and control bytes that FRS has

sent to its replication partner . Authentications—The number of successful authentication verifications on

packets received by FRS from its replication partner . Communication Timeouts—The accumulated number of times a request for

communication with the replication partner has timed out . Joins—The number of successful connections with the replication partner . FileReplicaSet—A replica set is a series of one or more folders that participate together

in replication. Replicas of DFS roots are included. This object monitors activity associated with a given replica set that you select from the Instances field. The following are several important counters for this object: . Change Orders Received and Change Orders Sent—The number of change

notifications received from and sent to replication partners. . Files Installed—The number of replicated files installed on the monitored server. . Packets Received and Packets Sent—The amount of data received and sent by

the monitored server.

246

Chapter 4: Maintaining an Active Directory Infrastructure . USN Records Accepted—The number of records accepted for replication.

Replication is triggered by entries written to the NTFS change journal. FRS reads each file record from this journal and determines whether the file should be replicated. A high value of this counter (about one every five seconds) suggests a lot of replication traffic and possible replication latency. . KB of Staging Space Free and KB of Staging Space in Use—These counters

indicate the number of kilobytes in the staging folder available to replicate and the amount of space in the staging folder currently in use. The staging folder is a temporary storage location for files that replicate to downstream partners of SYSVOL or DFS replica sets. If this directory runs out of space, replication stops. Event Viewer on domain controllers includes the File Replication Service log, which is a place you should look to obtain information on error or warning events that indicate problems with FRS. Figure 4.28 provides an example of the type of information you might encounter when using Event Viewer to monitor and troubleshoot FRS. We covered the procedures for using Event Viewer earlier in this chapter.

FIGURE 4.28 Problems with FRS can appear as error or warning messages in the File Replication Service log in Event Viewer.

247

Managing and Monitoring Active Directory

FRS Log Files FRS creates log files in the %systemroot%\Debug folder that can help you debug problems with FRS. By default, these files are named ntfrs_001.log through ntfrs_005.log. The most recent events are found in the log file with the highest number. You can increase the number of files saved by FRS to facilitate their use in locating problem information by going to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters Registry key and adding a value of type REG_DWORD named DebugLogFiles. Assign this value the maximum number of log files to be created. Stop and restart the File Replication Service from the Services node in the Computer Management console to make this change take effect. These files are complex and not easy to analyze. However, you should look for words such as success and fail when searching through them. Look at the highest-numbered file available and search from the bottom up. For detailed information on analyzing the log files, refer to Chapter 6, “Monitoring Active Directory in a Branch Office Environment,” in the “Windows Server 2003 Active Directory Branch Office Guide.” For further information, see the “Suggested Readings and Resources” section at the end of this chapter.

A Tricky Replication Problem An investment firm with 65 offices throughout the Northeast had implemented a single-domain Active Directory solution to replace single Windows NT 4.0 domains that formerly existed in each of the firm’s offices. Administrators had configured each office as its own site in Active Directory, with a single domain controller at each office replacing the primary domain controller (PDC) and backup domain controller (BDC) that had previously existed. Several months later, after three user accounts in different offices had been hacked, administrators implemented a strong user account policy that required users to supply complex passwords and change them monthly. A week after the policy was implemented, another user account in a small office in Binghamton, New York, was hacked. The head network administrator talked to the individual whose account was hacked and found out that she was using password as her password. Apparently, the account policy had not reached her site. So, the administrator started checking replication among the sites. The administrator checked the FRS logs and found several errors indicating that FRS replication had not reached the Binghamton site. He used replmon to gather information about intersite replication involving Binghamton for a couple of days. No sign of replication to the Binghamton site appeared. He tried repadmin with the /replicate parameter to replicate the domain directory partition from the Syracuse office to the Binghamton office but received an error that the Binghamton office server was not available. So he checked replication topology from replmon and discovered that the Binghamton site did not appear. Next, he went to Active Directory Sites and Services and discovered that the Binghamton site was not included in any site links. After adding a site link with the Syracuse office, he repeated the repadmin /replicate command and it worked. Users in the Binghamton office now had to change their passwords and specify complex passwords as dictated by the policy.

248

Chapter 4: Maintaining an Active Directory Infrastructure

Restoring Active Directory Services You never like to think that domain controllers will fail. But, alas, sooner or later you will have problems that require you to recover data that was lost or destroyed by accidental deletion or system failure of some type. Without a good backup and recovery strategy, loss of critical data could threaten an organization’s very existence. At the very least, it can make a computer unusable. This is just as true for the Active Directory database as it is for your critical production files. There are three types of Active Directory restores: nonauthoritative, authoritative, and primary. Before we discuss how to restore Active Directory, you must have something to restore from. So, we will begin coverage of restoring Active Directory Services by showing you how to back up Active Directory. The backup program organizes both backups and restores into backup sets. A backup set is a collection of files and folders from a single volume (or System State) backed up in a single operation.

Backing Up Active Directory Windows Server 2003 includes backup and recovery tools that enable you to protect against all types of data loss for reasons ranging from hardware or storage media failure to accidental deletion of objects or the entire directory database. You can use these tools to perform the following tasks: . Back up files and folders . Back up System State data, including Active Directory . Schedule a backup . Create an Automated System Recovery (ASR) disk . Restore files, folders, and System State data . Restore Active Directory Services

For general information on backup and restore, including advanced options and scheduling backup, refer to MCSA/MCSE 70-290 Exam Prep: Managing and Maintaining a Microsoft Windows Server 2003 Environment, mentioned in the “Suggested Readings and Resources” section at the end of the chapter.

Backup Types Windows Server 2003 provides five standard backup types, which are distinguished by the quantity of data backed up and how they handle the archive bit on each file and folder that is

249

Restoring Active Directory Services

backed up. This archive bit acts as a marker that states whether the file or folder has been modified since the previous backup. The following are the five backup types: . Normal—Backs up all selected files and folders, and removes the archive marker,

thereby indicating that the files have been backed up. This type of backup is the foundation of a backup strategy. . Copy—Backs up all selected files and folders, but does not remove the archive marker.

This backup type is useful when you need to store backup media offsite or to produce a snapshot of a computer at a particular point in time. . Incremental—Backs up only those files that have changed since the last normal or

incremental backup. It removes the archive marker, indicating that the files have been backed up. If you are restoring after a series of incremental backups, you must restore the normal backup plus all incremental backups in turn. . Differential—Backs up all files and folders that have changed since the last normal

backup. However, it does not remove the archive marker. Although each successive differential backup is longer than the previous one, a restore from a normal plus differential backup scheme requires restoring only two files: the normal plus one differential backup. . Daily—Backs up all selected files and folders that have changed during the day the

backup was made. Files and folders are not marked. It is useful for backing up files that have been created or that have changed on a given date. It is also useful for performing a quick backup prior to running certain server utilities that might corrupt your data.

Backup Permissions Not just anybody has the right to back up and restore data on any files and folders. If this weren’t true, anyone could grab data from a computer and make off with it to a competitor’s or other unauthorized location. You must have the appropriate permissions and user rights for the data that you want to back up. On a Windows Server 2003 domain controller, this means belonging to the Administrators, Server Operators, or Backup Operators built-in groups by default. You can modify the default backup rights by using Group Policy. The three groups mentioned here by default have the Backup Files and Directories and Restore Files and Directories rights assigned to them. It is good practice to separate these rights so that any one individual does not possess both of them. Some companies remove the Restore Files and Directories right from the Backup Operators group. They then create a Restore Operators group and assign this group the Restore Files and Directories right. We discuss the assigning of user rights in Chapter 7, “Planning and Implementing Group Policy.”

250

Chapter 4: Maintaining an Active Directory Infrastructure

Performing a Backup of Active Directory You cannot back up Active Directory by itself. Active Directory is included in what is called the System State, which is a group of files and databases that define the way a particular computer is configured. The System State for a Windows Server 2003 domain controller includes the following components: . Registry . Component Services Class (COM+) Registration database . Boot files, including the system startup files . Files protected by Windows File Protection (WFP) . Active Directory service database . SYSVOL shared folder . Certificate Services database for domain controllers that act as certificate servers

NOTE Only Local Backups The native Windows Server 2003 backup tool allows only the local backup of a domain controller’s System State data. Available third-party utilities such as Backup Exec allow the backup of System State data across the network.

Remember that you cannot select individual components of the System State data for backing up. System State data can comprise several gigabytes of data, or even more in the case of a domain controller in a large domain or a global catalog server in a large multiple-domain forest. Step by Step 4.12 covers the procedure involved in backing up the System State.

STEP BY STEP 4.12 Backing Up System State Data 1. Click Start, All Programs, Accessories, System Tools, Backup. You can also click Start, Run, type ntbackup, and then press Enter. Either of these actions starts the Backup or Restore Wizard with a welcome page. 2. Click Next to display the Backup or Restore page. This page asks you if you want to back up files and settings, or restore them from a previous backup. Click Back Up Files and Settings and then click Next.

251

Restoring Active Directory Services 3. On the What to Back Up page, shown in Figure 4.29, select Let Me Choose What to Back Up and then click Next.

FIGURE 4.29 The What to Back Up page allows you to choose what you want to back up.

4. On the Items to Back Up page, expand My Computer if necessary to reveal its components, as shown in Figure 4.30. Select System State and then click Next.

FIGURE 4.30

Choosing to back up the System State.

5. On the Backup Type, Destination, and Name page, select Browse to choose a location to save your backup, as shown in Figure 4.31. You should consider saving your backup to a tape drive or a network location such as a Storage Area Network (SAN) server or Network Attached Storage (NAS). Type an identifying name for the backup (a good practice is to include the date as part of the backup name, such as SysState20060608) and then click Next.

252

Chapter 4: Maintaining an Active Directory Infrastructure

FIGURE 4.31

Choosing a name and location for your

backup.

6. The Completing the Backup or Restore Wizard page appears, as shown in Figure 4.32. Click Finish to start the backup immediately or click Advanced to configure additional backup options such as scheduling. (See Step by Step 4.13.)

FIGURE 4.32 From the completion page, you receive an option to select advanced backup options.

7. The Backup Progress dialog box charts the progress of the backup. This page informs you when the backup is completed, as shown in Figure 4.33.

253

Restoring Active Directory Services

FIGURE 4.33 The Backup Progress page informs you when your backup is completed.

8. To see additional information about your backup, including the names of files that have been skipped, click Report. This displays a text-based report file, as shown in Figure 4.34.

FIGURE 4.34 The log file created by the backup program provides additional information on the backup.

9. Close the report and then click Close to close the Backup Progress dialog box.

TIP Installing Active Directory from Backup Remember that you can install Active Directory from the backup files created using Step by Step 4.12 by using dcpromo /adv. Refer to Chapter 2 for more information.

Specifying Advanced Backup Operations When you click the Advanced button shown in Figure 4.32, the Backup Wizard provides you with a series of additional options. See Step by Step 4.13.

254

Chapter 4: Maintaining an Active Directory Infrastructure

STEP BY STEP 4.13 Specifying Advanced Backup Options 1. After you click the Advanced button, the Type of Backup page prompts you to select a backup type, as shown in Figure 4.35.

FIGURE 4.35 You can specify the type of backup and migration of Remote Storage data from the Type of Backup page.

2. Click Next to display the How to Back Up page, shown in Figure 4.36. This page enables you to specify verification and compression options, as follows:

FIGURE 4.36 The How to Back Up page enables you to specify data verification and hardware compression.

. Verify Data After Backup—This option verifies that the backed-up data is the same as the original data. This increases the time needed to perform a backup. Microsoft recommends that you choose this option. . Use Hardware Compression If Available—This option compresses data that you are backing up so that you can store more data on a tape. Typically, only tape drives use data compression. If this option is unavailable, you do not have a tape drive that supports data compression.

255

Restoring Active Directory Services . Disable Volume Shadow Copy—You might want to select this option if you want to back up only a few files or folders, to speed up the backup process. If this option is selected, Windows Backup skips any open files. This option is not available when backing up only the System State data on a domain controller. 3. Click Next to display the Backup Options page, as shown in Figure 4.37. This page provides the following options that specify what to do if the backup medium already contains data: . Append This Backup to the Existing Backups—Permits multiple backup jobs to be stored on a storage device. . Replace the Existing Backups—Saves only the current backup jobs and replaces existing backups on a storage device. . Allow Only the Owner and the Administrator Access to the Backup Data and to Any Backups Appended to This Medium—Permits the current backup job to be restricted via permissions. Applies only to fresh backups, not to appended jobs. Recommended for Active Directory and Registry backups.

FIGURE 4.37 The Backup Options page specifies what to do if the backup medium already contains data.

4. Click Next to display the When to Back Up page, as shown in Figure 4.38. Select Now to display the completion page and start the backup, or select Later to schedule the backup task.

FIGURE 4.38

Selecting when to perform the backup.

256

Chapter 4: Maintaining an Active Directory Infrastructure 5. If you select Later, type a name for the backup and then click Set Schedule to schedule a time for the backup. 6. The Schedule Job dialog box presents you with several options for specifying a date and time for the backup. Click the drop-down list to choose an option to schedule the task to occur repeatedly, or click the Run On drop-down list to display a calendar for selecting a date for the backup to occur (see Figure 4.39). Then click OK.

FIGURE 4.39 Using the Schedule Job dialog box to select a backup date and time.

7. On the Set Account Information page, use the specified account or type another user account as required. Then type and confirm the account password, and click OK. 8. The Completing the Backup or Restore Wizard page appears, providing information on the backup options selected. Click Back to change any of the options or click Finish to schedule the backup.

Restoring Active Directory As mentioned previously, Microsoft provides three methods of restoring Active Directory: nonauthoritative, authoritative, and primary. The default restore type is nonauthoritative, also called a normal restore. The whole idea behind planning, organizing, and undertaking a backup job is that data will be easy to restore in case of a major or minor disaster. You should be familiar enough with the Windows Server 2003 restore options to be able to restore a single file or an entire volume as

257

Restoring Active Directory Services

required. The Backup or Restore Wizard provides several options to facilitate your task of performing a restore operation. In all restore operations, you begin by accessing the Directory Services Restore mode at startup and restoring the latest System State data. As in the backup process, you restore Active Directory by restoring the System State data. We look first at the nonauthoritative restore, followed by the authoritative restore, and then the primary restore.

EXAM ALERT Restoring Active Directory You need to know in which cases you should perform a nonauthoritative, authoritative, or primary restore operation.

Nonauthoritative Restore Objective

Restore Active Directory directory services . Perform a nonauthoritative restore operation

An example in which you would use a nonauthoritative restore would be after repairing a hardware failure on a domain controller. When you restore Active Directory in nonauthoritative mode, you bring the System State of the restored domain controller up to the time of the last backup. Then replication from another domain controller brings the Active Directory service up to the present time.

NOTE Using Replication to Restore Active Directory You can restore a domain controller simply by reinstalling Active Directory on the server to be restored and then allowing Active Directory replication to take place. However, this process could take a very long time and use considerable network bandwidth in a large domain.

To perform any type of restore, you must restart the domain controller in a special mode called Directory Services Restore Mode. This is a special version of Safe Mode that takes the domain controller offline and makes it function as a standalone server, unable to service requests of any kind across the network. You also must log on as a local administrator using the Directory Services Restore Mode password that you specified when you first installed the domain controller. After you have completed the restore operation, you can then restart the domain controller in normal mode.

258

Chapter 4: Maintaining an Active Directory Infrastructure

WARNING Ensure That Your Backups Are Not Outdated You should not attempt to restore from a System State backup that is older than the tombstone lifetime, or Active Directory might become corrupted. By default, the tombstone lifetime is 60 days; however, Windows Server 2003 SP1 increases this to 180 days under certain circumstances. You can modify this value using ADSI Edit. See “Useful shelf life of a system-state backup in Active Directory” in “Suggested Readings and Resources” for more information.

Step by Step 4.14 outlines the procedure for undertaking a nonauthoritative restore.

STEP BY STEP 4.14 Performing a Nonauthoritative Restore 1. If the computer is running, click Start, Shut Down. In the Shut Down Windows dialog box, select Restart. Select an option from the Shutdown Event Tracker drop-down list, such as Operating System: Reconfiguration (Planned), and then click OK. 2. When the computer restarts, press F8 to access the Windows Advanced Options Menu. Select Directory Services Restore Mode (Windows Domain Controllers Only), as shown in Figure 4.40, and then press Enter.

FIGURE 4.40 Selecting Directory Services Restore Mode.

3. Press Enter again to start the computer in Directory Services Restore Mode.

259

Restoring Active Directory Services 4. When the logon dialog box appears, log on as Administrator using the Directory Services Restore Mode administrator password you specified when installing Active Directory.

NOTE Directory Services Restore Mode Password If you have forgotten the Directory Services Restore Mode password you entered when installing Active Directory, all is not lost. You can use ntdsutil to reset this password. For more details, refer to Microsoft Knowledge Base article 322672, available at http://support.microsoft.com/default.aspx?scid=kb;en-us;322672.

5. You receive a message box informing you that Windows is running in Safe Mode (see Figure 4.41). Click OK.

FIGURE 4.41 This message informs you that you are running in Safe Mode.

6. Click Start, All Programs, Accessories, System Tools, Backup to start the Backup or Restore Wizard. 7. Click Next to display the Backup or Restore page. Select Restore Files and Settings and then click Next to display the What to Restore page. 8. Under Items to Restore, expand the list to locate System State, select the check box, as shown in Figure 4.42, and then click Next.

FIGURE 4.42 Choosing to restore the System State from the What to Restore page.

260

Chapter 4: Maintaining an Active Directory Infrastructure 9. To restore System State now with default settings, click Finish. If you want to specify additional options, click Advanced. Doing so enables you to choose from the following options: . Where to Restore—You can choose from the following three options that specify the restore target: . Original Location—Restores files to the locations from which they were backed up. . Alternate Location—Restores files to an alternative location. You need to use the Alternate Location text box or browse for the restore location on your computer. . Single Folder—Restores files to a single folder. A single folder you specify ends up containing all the files you choose to restore. You must use the Alternate Location text box or browse for the restore location on your computer. . How to Restore—Click Next to display the How to Restore page. You can select one of the following three options, shown in Figure 4.43, for restoring files that already exist on your computer: . Leave Existing Files (Recommended)—Does not restore a file if the file being copied from the backup set already resides on the computer . Replace Existing Files If They Are Older Than the Backup Files—Replaces the file residing on the computer with the copy from the backup set only if the copy on the computer is older . Replace Existing Files—Always replaces the file residing on the computer with the copy being restored from a backup, regardless of the date stamps on either file

FIGURE 4.43 The How to Restore page presents three options governing how to restore files that are already present on the computer.

. Advanced Restore Options—Click Next to display the Advanced Restore Options page. This page allows you to select one or more of the following options, as shown in Figure 4.44: . Restore Security Settings—Restores security settings such as permissions, auditing entries, and ownership. Selected by default, this option is available only if you are restoring to an NTFS-formatted volume.

261

Restoring Active Directory Services . Restore Junction Points, But Not the Folders and File Data They Reference—Restores data located on a mounted drive. You must select this option when restoring mounted drives, or else only the folder containing the mounted drive will be restored. A junction point is a physical location on the disk that points to data located elsewhere on the disk or another storage device. You create junction points when you create a mounted drive. For more information on mounted drives, refer to MCSA/MCSE 70-290 Exam Prep: Managing and Maintaining a Microsoft Windows Server 2003 Environment, mentioned in the “Suggested Readings and Resources” section at the end of the chapter. . Preserve Existing Volume Mount Points—Prevents the restore operation from overwriting existing volume mount points. This option is selected by default. . Restore the Cluster Registry to the Quorum Disk and All Other Nodes—Restores the cluster quorum database on a server cluster. This option is available only when operating a cluster using Windows Server 2003 Enterprise or Datacenter Edition. . When Restoring Replicated Data Sets, Mark the Restored Data As the Primary Data for All Replicas—Performs a primary restore. See the “Primary Restore” section later in this chapter.

FIGURE 4.44 The Advanced Restore Options page presents additional restore options.

10. If you have configured advanced backup options, click Next to return to the completion page and then click Finish to start the backup. 11. After you click Finish, the Restore Progress dialog box charts the progress of the restore (see Figure 4.45). When the restore is complete, this dialog box informs you. Click Close to close the dialog box or Report to view a report that displays information about the restore.

262

Chapter 4: Maintaining an Active Directory Infrastructure

FIGURE 4.45 The Restore Progress dialog box charts the progress of restoring the System State.

12. Restart your computer in normal mode.

TIP The LostAndFound Container Active Directory includes a special folder named LostAndFound. If an administrator were to delete a container such as an OU and a second administrator were to add user accounts to the deleted OU at a second domain controller before replication had removed the OU, the user accounts would move to the LostAndFound container. You can move these accounts to a new location using the Active Directory Move tool without the need for re-creating or restoring them. To view this container, select Advanced Features from the View menu in Active Directory Users and Computers.

Authoritative Restore Objective

Restore Active Directory directory services . Perform an authoritative restore operation

An authoritative restore is a special Restore Mode that does not replicate changes made to the Active Directory database since the last backup. Usually, you perform an authoritative restore when you have inadvertently deleted users, OUs, or other objects from Active Directory, and the deletion has been replicated to other domain controllers. You need to perform an authoritative restore to get these objects back. If you were to simply restore the deleted objects using the procedure outlined in Step by Step 4.14, you would get the deleted information back—but only temporarily. Active Directory

263

Restoring Active Directory Services

replication would replicate the most recent copy back to the restored server, resulting in loss of the deleted information. This situation occurs because each time Active Directory is updated, it increments the USN by one. The highest value of the USN is always considered the current value. During replication, the USN values are checked, and any server whose USN is not current receives the current value of Active Directory. But when you perform an authoritative restore, the USN of the restored domain controller is increased by 100,000, making it more current than any other versions. This version is then replicated to all other domain controllers. To perform an authoritative restore, use the ntdsutil command from Directory Services Restore Mode immediately after performing the nonauthoritative restore, as described in Step by Step 4.15.

STEP BY STEP 4.15 Performing an Authoritative Restore 1. Perform steps 1–11 of Step by Step 4.14 to nonauthoritatively restore Active Directory on the domain controller. Do not reboot the server. 2. At a command prompt, type ntdsutil and press Enter. 3. At the ntdsutil prompt, type authoritative restore and press Enter. 4. At the authoritative restore prompt, type restore subtree verinc , where is the distinguished name of the object you want to restore (for example, ou=accounting,dc=quepublishing,dc=com), and is the increment by which you want to increase the USN. If you omit the increment, it defaults to 100,000, as already noted. 5. As shown in Figure 4.46, a message box asks whether you are sure you want to perform the authoritative restore.

FIGURE 4.46 This message box confirms your intention to perform an authoritative restore.

6. Click Yes. After the authoritative restore has been completed, you should receive the message Authoritative Restore completed successfully. 7. Type quit to exit the authoritative restore prompt and then type quit again to exit ntdsutil. Close the command prompt and restart the server in normal mode. Active Directory will replicate the restored changes to other domain controllers after you restart the server.

264

Chapter 4: Maintaining an Active Directory Infrastructure

WARNING Take Care When Performing an Authoritative Restore Be careful when using the authoritative restore command. You will lose any updates to the indicated subtree that have been applied since the backup was performed. If you do not specify the subtree properly, you could lose additional updates to Active Directory as well.

Primary Restore A primary restore is a special type of nonauthoritative restore that marks the restored data as being primary for all the replicas within the domain. You should use a primary restore when the domain controller you are restoring is the only functional server in the domain. In other words, you would use this type of restore only in a situation in which none of the domain controllers in the domain are functioning and you are attempting to rebuild the domain from the most recent backup. Follow Step by Step 4.16 to perform a primary restore.

STEP BY STEP 4.16 Performing a Primary Restore 1. Perform steps 1–8 of Step by Step 4.14 to begin a nonauthoritative restore of Active Directory. 2. At step 9 of this procedure, click Advanced to access the advanced options. 3. Click Next until you reach the Advanced Restore Options page (refer to Figure 4.44 shown previously). 4. Select the check box labeled When Restoring Replicated Data Sets, Mark the Restored Data As the Primary Data for All Replicas and then click Next. 5. Click Finish. When the restore operation completes, close all dialog boxes and restart the server in normal mode.

Managing the Active Directory Database We have already discussed use of Active Directory support tools for managing and monitoring Active Directory and its database. We then turned our attention to backing up and restoring the Active Directory database. Two additional directory database management tasks that you need to be familiar with are moving and defragmenting the Active Directory database.

Moving the Active Directory Database As your Active Directory implementation grows and evolves, it might become necessary to move the Active Directory database (ntds.dit) to another disk. This can happen if the disk

265

Restoring Active Directory Services

holding the database and log files has very little free space, or if maintenance of the server hardware is required. You can move the database files using the Ntdsutil.exe tool. Besides moving the database files, this procedure updates the Registry to refer to the new path of the files. Step by Step 4.17 shows you how:

STEP BY STEP 4.17 Moving the Active Directory Database 1. If the computer is running, click Start, Shut Down. In the Shut Down Windows dialog box, select Restart. Select an option from the Shutdown Event Tracker drop-down list, such as Operating System: Reconfiguration (Planned), and then click OK. 2. When the computer restarts, press F8 to access the Windows Advanced Options Menu. Select Directory Services Restore Mode (Windows Domain Controllers Only), as previously shown in Figure 4.40, and then press Enter. 3. Press Enter again to start the computer in Directory Services Restore Mode. 4. When the logon dialog box appears, log on as Administrator using the Directory Services Restore Mode administrator password you specified when installing Active Directory. 5. At a command prompt, type ntdsutil and press Enter. 6. At the ntdsutil prompt, type files and press Enter. 7. At the File Maintenance prompt, type move db to [drive:folder], where [drive:folder] is the drive and folder to which you want to move the database. If the folder does not exist, it is automatically created. 8. At the File Maintenance prompt, type integrity and press Enter. This verifies the integrity of the database file at its new location. 9. Type quit twice to exit ntdsutil. 10. Restart the domain controller in normal mode.

You can move the Active Directory log files at the same time you move the database or separately. Follow the same procedure outlined in Step by Step 4.17, and at step 7, type move logs to [drive:folder]. After you have completed this procedure, perform a new backup of the System State data because the previous backup will refer to the old path to the Active Directory database and log files.

Defragmenting the Active Directory Database As objects in the Active Directory database are created, moved, deleted, or otherwise managed, the size of the database grows and becomes fragmented, just as happens with any other files

266

Chapter 4: Maintaining an Active Directory Infrastructure

you work with on an ongoing basis. Active Directory performs an online defragmentation of this database every 12 hours on an ongoing basis; however, recovered space is retained within the database and not released to the file system. In cases where the database size has been reduced through deletion of objects or removal of the global catalog, you have to perform an offline defragmentation of the database to release free disk space to the file system for use by other applications. Follow Step by Step 4.18 to perform an offline defragmentation:

STEP BY STEP 4.18 Defragmenting the Active Directory Database 1. Perform steps 1–4 of Step by Step 4.17 to restart the domain controller in Directory Services Restore Mode. 2. At a command prompt, type ntdsutil and press Enter. 3. At the ntdsutil prompt, type files and press Enter. 4. At the File Maintenance prompt, type info and press Enter. Make a note of the current path and size of the Active Directory database and log files. 5. At the File Maintenance prompt, type compact to [drive:folder], where [drive:folder] is the path to a location for the defragmented files. This compacts the database files and creates a new database named Ntds.dit in the location specified. It also informs you of the need to copy the compacted database back to the original location and delete the old log files. 6. At the File Maintenance prompt, type integrity and press Enter. This verifies the integrity of the database file at its new location. 7. Type quit twice to exit ntdsutil. 8. As informed at step 5, copy the new Ntds.dit file over the previous one at the path you noted in step 4, and delete the old log files. 9. Restart the domain controller in normal mode.

EXAM ALERT Directory Services Restore Mode Don’t forget that you have to restart the domain controller in Directory Services Restore Mode when performing any type of System State restore—authoritative, nonauthoritative, or primary. You also have to use Directory Services Restore Mode when moving or defragmenting the Active Directory database or log files.

267

Troubleshooting Active Directory

Restoring Active Directory Review Remember these key points regarding backing up and restoring Active Directory: . To back up Active Directory, you need to choose the System State option from the

Backup or Restore Wizard. . You must start the computer in Active Directory Restore Mode to perform any type of

Active Directory restore. . To restore a portion of Active Directory to an earlier time to retain objects deleted in

error, you need to perform an authoritative restore. . If all domain controllers in a domain have to be restored, you must perform a primary

restore on the first domain controller.

Troubleshooting Active Directory As much as in other aspects of computer and network management, troubleshooting is a large part of the work you will be doing with your Active Directory installation. Troubleshooting is as much an art as a science, one that you will learn much about by on-the-job experience as you encounter new situations and problems that demand your immediate attention. The 70-294 exam will present you with situations that require your insight into what is going on that prevents you from performing some Active Directory activity properly, why something is not starting or installing properly, or what is preventing users from logging on or accessing a resource on the network. We look at replication and database issues and operations master failures in this section.

Diagnosing Issues Related to Active Directory Replication Objective

Troubleshoot Active Directory . Diagnose and resolve issues related to Active Directory replication

It is obvious that you would be in serious trouble if domain controllers were not replicating Active Directory information as expected. Users would have trouble logging on or accessing shared resources over the network, or access might become intolerably slow. How would you diagnose such problems, and how would you restore Active Directory replication to its normal

268

Chapter 4: Maintaining an Active Directory Infrastructure

behavior? We now turn our attention to monitoring and troubleshooting problems related to Active Directory replication. Symptoms of replication problems can at times be vague or affect only certain users; they might manifest themselves as slow logons or searches that at first might be disregarded by the user thinking, “My computer is rather slow today; I hope it will be faster tomorrow.” We have looked at several Active Directory monitoring tools and discussed their use in general terms. In this section, we look at some replication problems you might encounter on the job (or in the 70-294 exam). This list is not intended to be exhaustive; if you receive an error other than one that is mentioned here or the suggested solution fails to work, search the Knowledge Base or one of the many Internet support sites. Although originally written for Windows 2000, Knowledge Base article 249256 might provide useful information on troubleshooting intrasite replication problems.

Replication Has Stopped If replication within a site has stopped entirely, check network connections and availability of domain controllers. Check the Event Viewer Directory Service log for DNS errors. Ping other servers by name and IP address and use the nslookup command to check the status of DNS. If replication has stopped entirely and a domain controller in another site has not received updates, it is probable that the sites are not connected by site links. Without at least one site link, it is impossible for domain controllers in the sites of concern to replicate with each other. Event Viewer might report a 1311 error; see the description of this error later in this chapter. Use replmon to check for unreplicated objects as previously described in Step by Step 4.3. Use repadmin /add to add a replication link between the domain controller that has not received updates and a properly replicating domain controller, and then use repadmin /sync to manually force replication across this link. Use Active Directory Sites and Services to check site link configuration and create a site link from the site of concern to another site on the network. We discussed all site management procedures in Chapter 3.

EXAM ALERT Replication Problems You should have a general knowledge of all tools mentioned in this section and when to apply them. Know the symptoms of Active Directory and FRS replication problems and which tools to use to monitor or troubleshoot these problems.

269

Troubleshooting Active Directory

Replication Is Proceeding Slowly In a network containing many sites, the intersite replication structure might be incomplete. Either there are insufficient site links, or no site link bridges exist. This can result in unacceptably long intersite replication times. Use Active Directory Sites and Services or the Show Replication Topologies option in replmon to check your intersite replication topology, and add additional site links or create site link bridges to increase the efficiency of replication. Network resources or replication intervals might be insufficient to provide timely replication. In Active Directory Sites and Services, try reducing the replication interval or increasing the time range during which replication can take place. Modify the site cost structure to ensure that the fastest, most efficient links are given preference for intersite replication. You might also need to add additional site links or site link bridges.

Slow Response to Clients Requesting Service If client computers are receiving slow response to services such as authentication and resource location, they could be attempting to connect to a domain controller over a low-bandwidth connection. It is possible that these clients are located on a subnet that is not associated with any site or is associated with the incorrect site. Use Active Directory Sites and Services to associate the subnet to which the clients belong with a site with a high-bandwidth connection. Create a new site for these clients, if necessary, and add a new or existing domain controller to the site. You might need to install a connection with higher bandwidth.

RPC Server Is Unavailable The RPC Server Is Unavailable message might appear for various reasons. One reason for this message is that a replication partner has gone offline and is consequently unavailable for replication. When this situation occurs, replmon returns the error shown in Figure 4.47. repadmin returns the same message when you attempt to force replication or perform several other tasks involving the offline replication partner.

FIGURE 4.47 replmon reports a replication failure with the reason The RPC server is unavailable when a server has gone offline.

270

Chapter 4: Maintaining an Active Directory Infrastructure

Another common reason for receiving this message is a DNS configuration problem. Several configuration items in DNS must be correct for Active Directory replication to take place properly: . Every domain controller in the forest must have a registered CNAME record for the

name . _msdcs.. refers to the GUID of the domain controller’s NTDS Settings object, which is visible in Active Directory Sites and Services. . Each domain controller in the forest must register its A (address) resource record in

the appropriate zone for each domain in the forest. . This A record must be associated with the domain controller’s correct IP address. . Each DNS zone must have the proper delegations to any existing child zones. . Dynamic updates should be enabled on the DNS server. Check the Properties dialog

box of the Forward Lookup Zones folder in the DNS console. . Correct references to preferred and alternative DNS servers must appear in the

TCP/IP configuration properties of all domain controllers. You should verify the CNAME and A records using the dcdiag utility. Type the following at a command prompt: dcdiag /test:connectivity

If this test reports that these records are missing, restart the NetLogon service by typing net start netlogon and then repeat the dcdiag command. In addition, check the TCP/IP configuration for the correct preferred and alternative DNS servers. If you can ping the replication partner by IP address but not by name, further DNS troubleshooting is needed.

Directory Service Log Reports Error 1311 The 1311 event indicates some type of site connectivity problem (see Figure 4.48). One or more domain controllers might be offline or contained in sites that are not associated with any site links, or the site links are not all bridged. Preferred bridgehead servers defined by an administrator are offline; or are online, but do not host one or more of the directory partitions and are unable to replicate these partitions between sites as a result.

271

Troubleshooting Active Directory

FIGURE 4.48 Site connectivity problems can result in error 1311 being logged to the Directory Service log.

The error text in the Event Properties dialog box informs you which partition(s) are experiencing the problem and suggests possible causes and solutions for this error. Use Active Directory Sites and Services to check the network’s site connectivity status. Provide additional site connectivity information in the form of additional site links that ensure complete site interconnectivity. If site links are not all bridged, add site link bridges or select the Bridge All Site Links option. If you have manually assigned preferred bridgehead servers, ensure that they are all online.

Directory Service Log Reports Error 1265 Similar to the 1311 error, the Event Properties dialog box provides additional information concerning the source of the error, which can originate from either DNS configuration errors or access denied problems. If the 1265 error is accompanied by a DNS lookup failure or RPC server is unavailable message, DNS configuration problems are most likely occurring. See the suggestions earlier in this section for correcting DNS configuration errors. If the 1265 error is accompanied by an Access denied message from the Directory Service log, this message suggests that the local domain controller was unable to authenticate with its replication partner when creating the replication or attempting to replicate over the existing link. The message indicates which directory partition is causing the problem and which computer is the replication partner. This situation typically occurs when the domain controller reconnects to the network after having been disconnected for a long time. Its computer

272

Chapter 4: Maintaining an Active Directory Infrastructure

account password no longer corresponds with the computer account password stored in the directory of its replication partner. To correct this problem, perform the following steps: 1. On the domain controller of concern, type net stop KDC to stop the Key Distribution Center (KDC) service. 2. Purge the ticket cache at the local domain controller. 3. At the PDC emulator computer, type netdom /resetpwd to reset the domain controller’s computer account password. 4. Synchronize the domain directory partition of the replication partner with the PDC emulator computer and then manually force replication between these two servers. 5. On the domain controller of concern, type net start KDC to start the KCC.

Access Denied Errors in Active Directory Sites and Services After Manual Replication Attempt If you do not have the Replication Synchronization permission when you attempt to force manual replication between replication partners from Active Directory Sites and Services, you will receive an Access denied error and replication of the directory partitions will fail. You should be able to complete the manual replication by using the replmon or repadmin tools as described earlier in this chapter.

Diagnosing Issues Related to Operations Master Role Failures Objective

Troubleshoot Active Directory . Diagnose and resolve issues related to operations master role failure

In Chapter 2, we introduced the five operations master roles (flexible single-master operations [FSMO] roles) and showed you how to configure, transfer, and seize these roles. You will recall that these special roles can be held by only one domain controller in the forest (domain naming master, schema master) or the domain (RID master, infrastructure master, PDC emulator), and changes performed on these computers are replicated in a single-master fashion as opposed to the multimaster replication used for all other Active Directory functions. Because each of these roles is held by only a single domain controller at any given time, failure of the domain controller holding one or more of the roles results in that role becoming unavailable. The consequences of such a failure depend on which operation master has failed and on

273

Troubleshooting Active Directory

what types of operations users or administrators are attempting to perform. You might have to seize operations masters should the role holder be unavailable for a period of time when its use is required. We look at some consequences of failure of each operations master here.

Schema Master Failure Failure of the schema master is not visible to regular users at any time because this role is not involved in normal user activities. Only when an administrator needs to modify the schema or install an application (such as Exchange Server) that adds attributes or classes to the schema does its failure come into play. Should you have to seize the schema master role, you should not bring the original holder of this role back online except by formatting its hard disk and reinstalling Windows Server 2003 as a new server. In addition, you will need to remove metadata belonging to the original schema master from Active Directory using ntdsutil. See Step by Step 4.20 later in this chapter.

Domain Naming Master Failure Failure of the domain naming master, like the schema master, is not visible to users at any time. It comes into play only when administrators need to create a new domain or rename or remove an existing domain. Recall also that Microsoft recommends that the schema master and domain naming master roles be kept on the same domain controller. Should you seize this role, you should reformat the hard disk and reinstall Windows Server 2003 on the original role holder.

RID Master Failure Temporary failure of the RID master is not usually visible to users. Administrators who create new Active Directory objects may not immediately notice its failure, until the domain controller at which they are working runs out of relative identifiers (RIDs). At such a time, you would receive the following message: Windows cannot create the object because the Directory Service was unable to allocate a relative identifier.

An error would also be logged to the Event Viewer Directory Service log. Should you need to seize the RID master role to enable the creation of new Active Directory objects, you should not return the original RID master server to the network, or problems could occur. However, Microsoft has published a procedure that allows you to return the original RID master to the network without the need for reformatting the disk and reinstalling Windows Server 2003. This procedure involves isolating both the original and seized servers from the production network, restoring the original RID master from backup, placing both servers on a temporary network, and initiating replication between the servers from Active Directory Sites and Services. See Microsoft Knowledge Base article 822053 for more information.

274

Chapter 4: Maintaining an Active Directory Infrastructure

Infrastructure Master Failure Temporary failure of infrastructure master is not generally visible to users. Only when administrators need to rename or move a large number of accounts will its absence create a problem. In such a case, you should seize its role to a domain controller that is not a global catalog server but is ideally on the same site as a global catalog server. It is possible to transfer the infrastructure master role back to the original holder after you have restored it and brought it back online without the need to rebuild its operating system completely.

PDC Emulator Failure If your network contains users with pre-Windows 2000 computers, users of these computers will be unable to change their passwords. If their passwords expire, they will be unable to log on until the PDC emulator is brought back online. Any Windows NT backup domain controllers will not be updated while the PDC emulator is unavailable. The absence of the PDC emulator can also cause inconsistencies in the time settings on other domain controllers because it also acts as a time synchronization master for the domain. You can seize the PDC emulator role to another domain controller to return your network to service. It is possible to transfer the PDC emulator role back to the original holder after you have restored it and brought it back online without the need to rebuild its operating system completely.

Summary of Operations Master Failure Symptoms Table 4.2 summarizes the information we have presented about operations master failures that you should be familiar with before attempting the 70-294 exam: TABLE 4.2 Operations Master Failures Operations Master

Failure Symptoms

Schema master

Unable to add classes or attributes to the schema. Unable to install applications (such as Exchange Server) that make modifications to the schema.

Domain naming master

Unable to create new child domains or domain trees. Unable to rename domains.

RID master

Infrastructure master

No symptoms until another domain controller runs out of relative IDs. At that point, an error informs you that the domain controller was unable to allocate a relative identifier. References to objects in other domains are not updated. Unable to move or rename a large number of accounts.

PDC emulator

Users with pre-Windows 2000 computers are unable to change their passwords. If passwords have expired, these users are unable to log on. Time settings on domain controllers become out of sync.

275

Troubleshooting Active Directory

EXAM ALERT Operations Master Failures The exam will present you with scenarios in which some symptom of an operations master failure has occurred. Know which operations master needs to be checked in each scenario. Also know whether you can transfer the role and when you should seize the role.

Working with the Operations Master Roles In Chapter 2, we introduced the procedures for locating, transferring, and seizing operations master roles. Briefly, you can use Active Directory Users and Computers to locate and transfer the PDC emulator, RID master, and infrastructure master roles. You can use Active Directory Domains and Trusts to locate and transfer the domain naming master role, and you can use the Active Directory Schema console to locate and transfer the schema master role. You can also use the ntdsutil command-line role to transfer any FSMO role. To seize any FSMO role, use the ntdsutil command. As outlined in Chapter 2, ntdsutil first attempts to locate the current holder of the role you are attempting to seize. If it is successful, it transfers the role; otherwise, it seizes the role. You can also use ntdsutil to determine the roles for all five operations master roles, as described in Step by Step 4.19.

STEP BY STEP 4.19 Using ntdsutil to Determine the FSMO Role Holders 1. Open a command prompt and type ntdsutil. 2. At the ntdsutil command prompt, type domain management. 3. At the domain management prompt, type connections. 4. At the server connections prompt, type connect to server <domain_controller>, where <domain_controller> is the name of the server to which you want to connect. 5. At the server connections command prompt, type quit. 6. At the domain management prompt, type select operation target. 7. At the select operation target prompt, type list roles for connected server. 8. The output of this command displays the distinguished names of the servers holding the five operations master roles, as shown in Figure 4.49.

276

Chapter 4: Maintaining an Active Directory Infrastructure

FIGURE 4.49

You can use the

ntdsutil command to determine the

current holders of all five operations master roles. 9. Quit the ntdsutil utility and then close the command prompt.

TIP Unable to Connect to a Remote Domain Controller? If you are unable to connect to a domain controller for any Active Directory administrative purpose, but are able to administer Active Directory locally at the domain controller of concern, the Net Logon service might be the problem. The solution is to restart Net Logon at this server.

Diagnosing Issues Related to the Active Directory Database Objective

Troubleshoot Active Directory . Diagnose and resolve issues related to the Active Directory database

Numerous problems related to the Active Directory database can occur during installation, removal, or day-to-day use of Active Directory. We look at several problems and their solutions in the following sections.

Files Required for Active Directory Functionality Active Directory requires several files for proper functionality, and errors can occur if any of these files is missing or corrupted. Following is a brief description of these files: . ntds.dit—This file contains the Active Directory database, and is replicated among

all domain controllers on the network. It includes domain data, configuration data, schema data, and application data. If this file is corrupted or missing, Active Directory will be unable to start, and you will have to perform a nonauthoritative restore as described earlier in this chapter.

277

Troubleshooting Active Directory . edb.log—This file records changes made to the Active Directory database. When the

file becomes full, it is renamed to edbxxxxx.log, where xxxxx is an incremental hexadecimal counter. These log files contain information required for proper restoration of the database following a crash. . edb.chk—This file contains the database checkpoint, which indicates the point from

which the database engine must replay the transaction log files after a crash. . res1.log and res2.log—These are reserved transaction logs. They permit a graceful

shutdown of the domain controller in case all other disk space is exhausted. If these files are not present, database operations may fail for lack of disk space.

Issues Related to Installation or Removal of Active Directory Active Directory installation is not always the smooth process you might expect to encounter. When you are installing an additional domain controller for an existing domain, dcpromo needs to contact a domain controller to authenticate the new domain controller and verify the credentials you supplied. When you are installing a child domain, dcpromo needs to contact a domain controller in a parent domain. dcpromo creates several log files that help you troubleshoot Active Directory installation problems. The Directory Service log and several of the tools you studied in this chapter are also useful in troubleshooting Active Directory problems. dcpromo Log Files dcpromo creates the following log files in the %systemroot%\Debug folder when you install Active Directory: . dcpromo.log—This file records information related to Active Directory promotion

or demotion, such as paths to the database, log, and SYSVOL files; the site name; the starting, stopping, adding, and removing of services; the securing of Windows files; and the initial replication process on additional domain controllers. . dcpromoui.log—This file records the progress of Active Directory installation or

removal, providing positive confirmation of installation or removal. It includes additional information such as the name of the source domain controller used for replications, the directory partitions that were replicated including the number of items in each partition, the services configured on the target domain controller, the SYSVOL folders, and the ACEs configured for the Registry and files. If a problem occurs, dcpromoui.log provides detailed information about the step that caused the failure. . dcpromos.log—Similar to the dcpromoui.log file, this file is created during the

promotion of a Windows NT 4.0 domain controller to Windows 2000 or Windows Server 2003.

278

Chapter 4: Maintaining an Active Directory Infrastructure

Use of ntdsutil to Troubleshoot Active Directory Removal If you remove a domain controller from the network without proper uninstallation (for example, after a total hard disk failure or a disaster such as a fire), an NTDS settings object containing configuration metadata is left behind in the Active Directory configuration partition. You can use the metadata cleanup option in ntdsutil to remove such orphaned metadata, as described in Step by Step 4.20.

STEP BY STEP 4.20 Using ntdsutil to Remove Orphaned Metadata 1. Open a command prompt and type ntdsutil. 2. At the ntdsutil command prompt, type metadata cleanup. 3. At the metadata cleanup command prompt, type connection. 4. At the server connections command prompt, type connect to server <server>, where <server> is the name of the server being used for the deletion (not the server to be deleted). 5. At the server connections command prompt, type quit. 6. At the metadata cleanup command prompt, type select operation target. 7. At the select operation target command prompt, type list domains. This displays a numbered list of the domains in the forest. 8. Type select domain , where is the number displayed for the domain in which you want to remove a server. 9. Type list sites. This displays a numbered list of the sites in the domain. 10. Type select site , where is the number displayed for the site in which you want to remove a server. 11. Type list servers in site. This displays a numbered list of the servers in the site. 12. Type select server , where is the number displayed for the server you want to remove. This displays a confirmation message listing the selected server, its DNS hostname, and the location of its computer account. 13. Type quit. 14. At the metadata cleanup prompt, type remove selected server. If removal is successful, you should receive a confirmation message. 15. At the metadata cleanup prompt, type quit and repeat until you have exited ntdsutil.

279

Troubleshooting Active Directory 16. After you have completed this procedure, you can remove the deleted domain controller in Active Directory Sites and Services by going to the Servers folder in the site to which it belonged, locating the server, and deleting it.

NOTE Forced Domain Controller Demotion You might occasionally encounter a situation in which dcpromo fails to demote a domain controller properly because of failure of a required operation or dependency. You can force demotion by typing dcpromo /forceremoval. After demotion is complete, you will have to use the procedure of Step by Step 4.20 to remove metadata. See Knowledge Base article 332199, included in the “Suggested Readings and Resources” section, for more information.

Errors Related to DNS During Active Directory installation, you might receive one of several errors described in Table 4.3 if DNS is not properly configured: TABLE 4.3 Possible DNS Errors During Active Directory Installation Error

Cause

Troubleshooting Hints

A server you are attempting to promote was unable to locate a domain controller for the domain to which it is being installed.

The A resource records that map the name of a domain controller to its IP address do not exist.

Verify the existence of the A resource record and add it if required.

Domain not found, Server not found, or RPC server is unavailable

Name registration or name resolution is not functioning properly.

Verify that the server you are trying to reach is connected to the network. Use the dcdiag or netdiag tool to verify network connectivity, NetBIOS, and DNS registration.

DNS SRV resource record is not registered in DNS.

Use nslookup on a domain controller in the domain you are trying to join to verify the existence of SRV resource records in that domain.

message.

Computer could not locate a domain controller for the domain mentioned in the error message.

280

Chapter 4: Maintaining an Active Directory Infrastructure

Issues Related to an Authoritative Restore You need to be aware of the fact that an authoritative restore can impact trust relationships and computer accounts located in the naming context of an Active Directory installation you have restored. The following are several things that might happen following an authoritative restore: . The authoritative restore process restores computer account passwords to their values

that existed when Active Directory was last backed up. Computers attempting to authenticate with domain controllers might receive an error similar to that shown in Figure 4.50. You have to reset any passwords using the Netdom /resetpwd command that have changed to avoid receiving this error. For more information on resetting computer passwords, refer to the Help and Support Center.

FIGURE 4.50 The System log in Event Viewer records an error similar to this if the computer account is unable to authenticate to the domain controller.

. If you perform an authoritative restore on an entire domain directory partition, trust

relationship passwords are restored to their values as of the last backup. This can result in domain controllers being unable to communicate with domain controllers in other domains, thereby invalidating their trust relationships. You have to reset these passwords. . The greater the portion of the domain hierarchy you restore, the greater the chance

of authentication problems of this type. Therefore, you should perform authoritative restores only on the portions of the directory that absolutely must be restored to their previous condition.

281

Troubleshooting Active Directory

The best way to avoid authentication problems following an authoritative restore is to ensure that you back up Active Directory frequently. Doing so minimizes any adverse impact of an authoritative restore.

Issues Related to Database Corruption Like other files and folders, the Active Directory database can become corrupted. Such corruption might be related to replication problems or other causes. You can use the dcdiag utility described earlier in this chapter to confirm the consistency of a domain controller’s computer account and directory service objects. This utility has an ObjectsReplicated test that checks that these objects have replicated properly. The VerifyEnterpriseReferences test verifies that system references are intact for FRS and replication infrastructure across all objects on each domain controller in the Active Directory forest. For more information, see the Windows Help and Support Center.

282

Chapter 4: Maintaining an Active Directory Infrastructure

Chapter Summary In this chapter, you learned about the Active Directory monitoring and troubleshooting tools that help you keep your network in top operating condition. You can use either the GUI-based replmon tool or the command-line–based repadmin tool to monitor Active Directory replication. These tools perform similar tasks and differ mainly in their mode of presentation. dcdiag analyzes the condition of domain controllers and informs you of many problems that can occur. Some general Windows monitoring tools are useful in monitoring and troubleshooting Active Directory. Event Viewer contains a Directory Service log that logs events related to directory functions. The Performance console includes the NTDS object that contains a large number of directory-related counters. This console also includes objects related to FRS monitoring. We next discussed Active Directory backup and restore. You back up Active Directory as part of the System State backup set. We compared and contrasted the three types of Active Directory restores: nonauthoritative restore, which is a simple restore that is updated to the current time by the replication process; authoritative restore, which restores specific objects that have been deleted in error and is used to restore deleted objects; and primary restore, which is used only if all domain controllers in a domain have been lost. We concluded our discussion with troubleshooting of Active Directory. You can use many of the monitoring tools we have already discussed to obtain information about what is causing various problems to occur. We looked at several problems that you can encounter with Active Directory and FRS replication and the Active Directory database, and presented some ways in which you can deal with these problems. We also looked at the consequences of operations master failures and the consequences of seizing these roles.

Key Terms . Authoritative restore . dcdiag . Directory Service log . Directory Services Restore Mode . Event Viewer . File Replication Service (FRS) . netdiag . Nonauthoritative restore

283

Apply Your Knowledge . ntdsutil . Performance counters . Performance Logs and Alerts . Performance objects . Primary restore . repadmin . Replication . replmon . System Monitor

Apply Your Knowledge The 70-294 exam tests your knowledge of the various situations that can be encountered when managing and maintaining Active Directory. You need to be aware of the various tools used in managing and monitoring Active Directory and when you should use each tool. You also need to know how to restore Active Directory and when to use the various restoration methods. Finally, you must know how to diagnose problems related to Active Directory components such as operations masters, Active Directory replication, and the Active Directory database. The exercises and exam questions presented here serve to reinforce these requirements. Note that you may encounter drag-and-drop or hot-spot questions on the exam. Due to the limitations of the printed page, we are unable to include questions of these types in the exam questions section. However, the explanations suggest the possibility of these question types where appropriate.

Exercises 4.1 Installing Active Directory Support Tools Many of the support tools used with Active Directory are not installed when you first install Windows Server 2003 and Active Directory. In this exercise, you install the support tools from the Windows Server 2003 CD-ROM. You then perform some simple tests on the server using the netdiag and dcdiag utilities. Do this exercise on server1. You also create an OU with a user to demonstrate the authoritative backup of Active Directory in the next exercise. Estimated Time: 5 minutes

284

Chapter 4: Maintaining an Active Directory Infrastructure 1. Insert the Windows Server 2003 CD-ROM. 2. Click Start, Run and type d:\support\tools\suptools.msi. If necessary, substitute your proper CD-ROM drive letter. 3. The Windows Support Tools Setup Wizard starts with a Welcome page. Click Next. 4. On the End User License Agreement page, ensure that I Agree is selected and then click Next. 5. Verify your user information, click Next, and then click Install Now. 6. Click Finish when the completion page appears. 7. Click Start, Command Prompt. Type netdiag and then press Enter. After a minute or so, the netdiag utility displays network connectivity and domain membership test information. 8. At the command prompt, type dcdiag /s:server1 /test:connectivity and then press Enter. This utility runs tests on DNS zones and directory partitions present on this server and displays any errors it finds. 9. Open Active Directory Users and Computers. 10. In the console tree, right-click your domain and choose New, Organizational Unit. Type Marketing as the name of the new OU. 11. Right-click Marketing and choose New, User. Type Top as the first name, Marketer as the last name, and TopMarketer as the user logon name. Then click Next. 12. Type P@ssword in the Password and Confirm Password dialog boxes, clear the User Must Change Password at Next Logon check box, and then click Finish.

4.2 Backing Up Active Directory This exercise demonstrates how to back up Active Directory on a domain controller. In this exercise, you simply back up to a location on your hard drive. In the real world, you would use separate hardware such as a tape drive or CD-R discs to perform your backups. Perform this exercise from either server. Estimated Time: 10 minutes 1. Open My Computer, navigate to a drive with at least 500MB of free space, and create a new folder. Name the folder Backup. 2. Click Start, All Programs, Accessories, System Tools, Backup. The Backup or Restore Wizard starts with a welcome page. 3. Click Next. On the Back Up or Restore page, select Back Up Files and Settings and then click Next. 4. On the What to Back Up page, select Let Me Choose What to Back Up and then click Next. 5. On the Items to Back Up page, expand My Computer, select System State, and then click Next. 6. On the Backup Type, Destination, and Name page, select Browse and browse to the folder you created in step 1. Accept the name backup.bkf as a name for the backup file and then click Next.

285

Apply Your Knowledge 7. On the Completing the Backup or Restore Wizard page, review the options and then click Finish. Note that in the real world, you would generally click Advanced and schedule the operation to occur at a time when the domain controller activity is minimal, such as late at night. 8. The backup job starts, and progress is displayed in the Backup Progress dialog box. This process takes several minutes. When backup is complete, the verification progress is displayed in the same dialog box. This takes an additional period of time similar in length to the backup. 9. When the Backup Progress page indicates that backup and verification are complete, click Report. A report page opens in Notepad. 10. Look over the information on the report page and then close it. If an error occurs during backup or verification, information is displayed on this page. 11. Click Close to close the Backup Progress page. 12. Close the Backup dialog box.

4.3 Deleting Some Information In this exercise, you delete an OU to verify that you can restore it from the backup you just performed. You should perform this exercise from the same computer that you used in Exercise 4.2. Estimated Time: 5 minutes 1. Open Active Directory Users and Computers. 2. If necessary, expand the domain1.com domain to locate the Marketing OU. 3. Delete this OU and confirm your actions when requested. 4. Close Active Directory Users and Computers.

4.4 Performing an Authoritative Restore In this exercise, you perform an authoritative restore to get the Marketing OU back. This procedure is necessary should you delete an object in error so that Active Directory replication does not delete this object again after you have restored it. Estimated Time: 20 minutes 1. Shut down and restart your computer. 2. When the boot loader menu appears, press F8 to choose the Advanced Options menu. 3. Use the down arrow to highlight Directory Services Restore Mode (Windows Domain Controllers Only) and then press Enter. 4. Ensure that Windows Server 2003 is selected and then press Enter. 5. When the Logon dialog box appears, type the password you specified when installing Active Directory in Chapter 2 and then press Enter.

286

Chapter 4: Maintaining an Active Directory Infrastructure 6. You receive a message that the system is running in Safe Mode. Click OK. 7. Click Start, All Programs, Accessories, System Tools, Backup. 8. Click Next to display the Backup or Restore page. Select Restore Files and Settings and then click Next. 9. Under Items to Restore, expand the list to locate System State, select the check box, and then click Next. 10. On the Completing the Backup or Restore Wizard page, click Finish. The Restore Progress dialog box appears and charts the progress as System State data is restored. This process takes several minutes. 11. When the Restore Progress dialog box indicates that the restore is complete, click Close. 12. A message box informs you that you must shut down and restart your computer. Click No because you now need to make the restore authoritative. 13. Open a command prompt, type ntdsutil, and press Enter. 14. From the ntdsutil prompt, type authoritative restore, and press Enter. 15. From the authoritative restore prompt, type restore subtree OU=marketing,DC=quepublishing,DC=com, and then press Enter. 16. A message box asks whether you want to perform the authoritative restore. Click Yes. 17. You receive messages that records are being updated, and the authoritative restore is completed successfully. If you receive an error, check your syntax and try again. 18. Type quit to exit the authoritative restore prompt, type quit again to exit ntdsutil, and then exit the command prompt. 19. Shut down and restart your computer in normal mode. 20. Log on as Administrator. 21. Open Active Directory Users and Computers. 22. Expand the domain if necessary and note that the Marketing OU has been restored. Also, note that the TopMarketer user in this OU has been restored. 23. Close Active Directory Users and Computers.

4.5 Logging Active Directory Performance Keeping a baseline log of domain controller performance is valuable when you need to troubleshoot sluggish performance at a later time. In this exercise, you log the performance of a domain controller while doing a few maintenance tasks. Then you display the results in System Monitor. Estimated Time: 25 minutes

287

Apply Your Knowledge 1. Click Start, Administrative Tools, Performance. The Performance console starts, with System Monitor highlighted and three common counters logging data. 2. Select Performance Logs and Alerts and then double-click Counter Logs. The details pane displays a default sample log. 3. Right-click a blank area of the details pane and choose New Log Settings. 4. Type AD Performance Log as the name of the log to be created and then click OK. 5. Click Add Counters. This displays the Add Counter dialog box with the Processor performance object counters appearing. 6. Click Add to add the % Processor Time counter. This is always a valuable counter to monitor in any situation. 7. From the Performance Object drop-down list, select NTDS. Scroll to add the following counters: DS Search Sub-Operations/Sec, DS Name Cache Hit Rate, LDAP Client Sessions, and LDAP Searches/Sec. Click Close after you have finished adding counters. 8. In the AD Performance Log dialog box, specify a time interval for sampling data. For a short test as done in this exercise, select 1 or 2 seconds. You would select a longer interval for a longer monitoring period as when monitoring a production server. 9. Select the Log Files tab and note the options available. For a log file type, select either Text File (Comma Delimited) or Text File (Tab Delimited). Either of these formats is suitable for importing into a program such as Excel for later analysis. 10. Select the Scheduled tab and note the options available. 11. For Start Log, select a time about two or three minutes into the future. For Stop Log, select After 3 Minutes. Then click OK. 12. If you receive a message asking you to create a performance log folder, click Yes to create it now. 13. Your newly configured log appears in the details pane of the Performance Logs and Alerts snap-in. 14. Wait until the start time you specified. Note that the cylinder icon turns green. 15. When logging starts, open Active Directory Users and Computers. Perform some operations such as creating OUs, creating and deleting users, moving them to other OUs, and so on. 16. When logging stops, close Active Directory Users and Computers. 17. In the console tree of the Performance console, select System Monitor. 18. On the System Monitor toolbar, right-click in the graph area and choose Properties. 19. On the Source tab of the System Monitor Properties dialog box, select Log Files and then click Add. 20. In the Select Log File, navigate to and open the performance log file you just created. This file should have a name like AD Performance Log_00001.csv.

288

Chapter 4: Maintaining an Active Directory Infrastructure 21. Right-click in the graph area again and choose Add Counters. 22. In the Add Counters dialog box, the NTDS performance object should appear in the Performance Object drop-down list, and the counters you logged should appear in the Select Counters from List text box. Select All Counters, click Add, and then click Close. 23. Note the display of the logged counters in the graph. 24. To highlight a counter, click the yellow light bulb icon in the toolbar. Select the various counters in turn and note their behavior. 25. If a counter displays values near zero, decrease its range by right-clicking it and choosing Properties. Select a lower value in the Scale drop-down list and then click OK. Experiment with the other settings. 26. When you are finished, close the Performance console.

4.6 Compacting the Active Directory Database When a domain controller has been running for a long period of time, the database tends to become fragmented and cluttered with a lot of extraneous material. Online fragmentation using the Windows Disk Defragmenter does not reduce the size of the database significantly. You need to compact the database by using ntdsutil from the Directory Services Restore Mode to improve Active Directory performance. Perform this exercise from Server1. Estimated Time: 15 minutes 1. Perform steps 1 through 6 of Exercise 4.4 to restart your computer in Directory Services Restore Mode. 2. Open a command prompt and type ntdsutil. 3. At the ntdsutil prompt, type file maintenance. 4. At the file maintenance prompt, type info. This command displays information about the drive and the Active Directory database, backup, and log files. 5. To perform an offline compaction of the database, type compact to c:\. (If your system root drive is not C:, specify the appropriate letter in this command and others in this procedure.) This command displays a running status of defragmentation and information on replacing the current database. 6. Type quit to exit the file maintenance prompt and type quit again to exit ntdsutil utility. 7. Type dir %systemroot%\ntds\ntds.dit. Note the size of this file. 8. Type move c:\ntds.dit %systemroot%\ntds\ntds.dit. 9. When asked whether to overwrite this file, type y. The file is moved and overwrites the current database file.

289

Apply Your Knowledge 10. Type dir %systemroot%\ntds\ntds.dit. Note how much this file has decreased in size. You have successfully compacted the Active Directory database file. 11. Close the command prompt and restart the server in normal mode.

Exam Questions 1. You have noticed that users have not received Group Policy modifications you configured a couple of days ago and suspect that the SYSVOL folder has not replicated to other domain controllers. You open Event Viewer to look for any errors related to SYSVOL replication. In which log should you look?

❍

A. System

❍

B. Application

❍

C. Directory Service

❍ D. File Replication Service 2. Working at one of the five domain controllers in her company’s network, Rachel accidentally deleted her company’s Management OU. Realizing that none of the managers would be able to log on the next morning, Rachel knew she must restore this OU as rapidly as possible. Fortunately, a backup tape created the day before was available. Which of the following actions does Rachel need to perform? Each answer represents part of the solution. Choose two answers.

❏

A. Restore System State data from backup while running the domain controller in normal mode.

❏

B. Start the domain controller in Safe Mode and restore System State data from backup.

❏

C. Start the domain controller in Directory Services Restore Mode and restore System State data from backup.

❏ D. During the restore operation, select the Always Replace the File on My Computer option from the How to Restore page.

❏

E. During the restore operation, select the advanced restore options and then select the When Restoring Replicated Data Sets, Mark the Restored Data As the Primary Data for All Replicas option.

❏

F. Use the ntdsutil program to mark the restored Management OU as authoritative by specifying the LDAP DN of the Management OU.

290

Chapter 4: Maintaining an Active Directory Infrastructure 3. Wendy is a network administrator for a large automotive manufacturer that operates an Active Directory network with four domains in a single tree. Because of poor sales, management has eliminated the production of one model and laid off several hundred workers. Wendy deleted a considerable number of objects, including both user and computer accounts, as a result of this downsizing. A couple of months later, she checked the size of the Active Directory database file on the child domain containing this production group and discovered it had not decreased in size. Which of the following reasons could explain why the database file did not decrease in size?

❍

A. Someone else has added other entries to Active Directory since the time Wendy deleted the user and computer accounts from the database.

❍

B. Wendy needs to wait an additional period of time for Active Directory replication to remove all records pertaining to the deleted objects from every domain controller. At this time, Active Directory will automatically defragment the database.

❍

C. Wendy should have checked the size of the SYSVOL shared folder instead. Deleting these objects will result in a decrease in this folder’s size.

❍ D. Simply deleting these objects does not reduce the size of the database file. Wendy needs to perform an offline defragmentation of the database for this to take place. 4. Norman has configured the System Monitor snap-in in the Performance console to track several NTDS performance objects on his domain controller so that he can have a performance baseline against which he can compare future domain controller performance. After viewing the graph for several minutes, he realizes he needs to save the data logged in the graph for future reference. What should he do to save all monitoring data, including the points that are no longer visible?

❍

A. He needs to export the graph to an Excel database by selecting Export from the File menu.

❍

B. He needs to right-click the graph and then choose Save As. In the dialog box that appears, he needs to specify the name of a tab-delimited file to which the Performance console will save all data.

❍

C. He needs to open the Properties dialog box for his graph and specify the entire time range for which he has monitored these counters.

❍ D. He has used the wrong tool. He needs to use Performance Logs and Alerts to configure logging so that he can save all his performance data. 5. Phil’s company operates a single-domain Active Directory network that operates at the Windows 2000 mixed functional level because there are still two domain controllers running Windows NT 4.0 and budget for upgrading these servers to Windows Server 2003 will not be available until next fiscal year. A user named Sharon with a Windows 2000 Professional computer changed her password five minutes ago, and then the power in her office failed. Her computer is on a network segment with a Windows NT BDC, and the nearest Windows Server 2003 domain controller is on another network segment 10 floors above her office.

291

Apply Your Knowledge Sharon needs to log on as soon as possible so that she can receive an important document from the branch director. What should Phil do?

❍

A. Use Active Directory Sites and Services to force replication across site links to the site containing Sharon’s computer.

❍

B. Use Active Directory Sites and Services to force replication across the entire domain.

❍ C. Use repadmin to force replication between the Windows NT BDC and the PDC emulator.

❍ D. Use repadmin to force replication between the Windows NT BDC and the nearest global catalog server. 6. You have opened the Counter Logs node of the Performance Logs and Alerts snap-in and want to monitor the effect of Active Directory replication on server performance. Which performance object should you select to obtain statistics on Active Directory replication data?

❍

A. FileReplicaConn

❍

B. FileReplicaSet

❍

C. NTDS

❍ D. Redirector 7. You are a systems administrator for a company that operates a single-domain Active Directory forest with a single site in Jacksonville. A major hurricane has gone through Jacksonville, leaving your server room with a foot of water and all domain controllers ruined. The insurance company responded rapidly with new server hardware, and you have installed Windows Server 2003 on the new servers. You now need to re-create your domain. What should you do?

❍

A. Perform a primary restore of all domain controllers.

❍

B. Perform a primary restore of the first domain controller and then perform a nonauthoritative restore of the remaining domain controllers.

❍

C. Perform a primary restore of the first domain controller and then perform an authoritative restore of the remaining domain controllers.

❍ D. Perform a nonauthoritative restore of all domain controllers. 8. Adam is a systems administrator for a large manufacturing company that operates a single-domain network with 60 domain controllers and 17 sites. Although the network has run very efficiently since being upgraded from Windows NT 4.0 a couple of years ago, Adam has recently noticed that several offices have not received updates in a timely fashion.

292

Chapter 4: Maintaining an Active Directory Infrastructure Adam monitors replication and notices that replication takes much longer, as much as 48 hours, to update changes at these sites. Which of the following tools should Adam use to determine the problem? Choose all that apply.

❏

A. netdiag

❏

B. Event Viewer

❏

C. repadmin

❏ D. replmon ❏

E. Active Directory Sites and Services

9. You are monitoring Active Directory replication and need to know the update sequence number (USN) of the most recent changes to the directory database at a server named Server4. Which of the following should you do?

❍

A. In replmon, right-click Server4 and choose Update Status.

❍

B. Use repadmin with the /showmeta parameter.

❍

C. Use the Performance console and add counters for the NTDS object.

❍ D. Search the Directory Service log in Event Viewer for informational messages related to USNs. 10. Leanne has been given the responsibility of creating a new domain in her company’s Active Directory forest. She has installed Windows Server 2003 on a brand-new computer and has started the Active Directory Installation Wizard. Everything goes well until she enters the name of the new domain. At this point, the wizard hangs. She checks all network and computer settings and tries the wizard again, but the same thing happens. Which of the following should she check next?

❍

A. Whether the DNS server is configured for dynamic updates

❍

B. Whether the domain naming master is available

❍

C. Whether Active Directory replication is working properly

❍ D. Whether the infrastructure master is available 11. Stephen is a network administrator for a company that operates a Windows Server 2003 network that contains two domains in a single tree. One of the hard disks on a domain controller failed and had to be replaced. As a result, he had to restore the ntds.dit file from backup.

293

Apply Your Knowledge When Stephen restarted the domain controller in Directory Services Restore Mode, he entered his administrator password but was denied access. Which of the following explains why he was denied access to Directory Services Restore Mode?

❍

A. Stephen entered the password to the domain rather than the password he specified when installing Active Directory.

❍

B. Stephen is not a member of the Enterprise Administrators group. Only members of the Enterprise Administrators group are allowed access to the Directory Services Restore Mode in a forest that contains more than one domain.

❍

C. A domain-based Group Policy setting denies Stephen the right to log on locally to the domain controller.

❍ D. Stephen changed his password a few days ago. Because this domain controller had failed beforehand, Active Directory did not replicate the password change. Stephen needs to use his old password. 12. Maria is a systems administrator for an accounting company and is in charge of several servers at the company’s New York head office. She notices that some changes she has made to Active Directory from a domain controller named DC8 are not reflected in the Active Directory Users and Computers console at another domain controller named DC6 located in the company’s Pittsburgh branch office. Using Event Viewer on DC6, Maria notices several events with the 1311 event ID are present in the Directory Service event log. Which of the following is the most likely reason that changes have not replicated to DC6?

❍

A. DC6 is no longer connected to the LAN in the New York office.

❍

B. The A record for DC8 in DNS is missing.

❍

C. The site link object connecting the Pittsburgh and New York offices has become corrupted and needs to be re-created.

❍ D. DC8 was unable to authenticate with DC6 during attempts at replication across the site link. 13. You are a systems administrator for a company that is in the process of upgrading its Windows NT 4.0 domain to Windows Server 2003. One morning, several users at Windows NT 4.0 Workstation computers are unable to log on because they need to change their passwords and the new passwords are not being accepted. What should you check first?

❍

A. Ensure that the PDC emulator is online and functioning properly.

❍

B. Ensure that the infrastructure master is online and functioning properly.

❍

C. Ensure that the RID master is online and functioning properly.

❍ D. Use replmon to check the network’s replication topology.

294

Chapter 4: Maintaining an Active Directory Infrastructure 14. Vince is in charge of upgrading his company’s Windows NT 4.0 network to Windows Server 2003. He has upgraded all the domain controllers to Windows Server 2003 and is now upgrading a Windows NT 4.0 member server running Exchange Server 5.5 to Windows Server 2003 and Exchange Server 2003. However, the installation of Exchange Server fails with a message informing him that the server could not create several necessary classes. Which of the following servers should Vince check first?

❍

A. Infrastructure master

❍

B. Domain naming master

❍

C. RID master

❍ D. Schema master 15. Kristin has installed Windows Server 2003 on a new computer and needs to promote the server to be a domain controller in her company’s domain, which is named examcram.com. She starts the Active Directory Installation Wizard and selects the Additional Domain Controller for an Existing Domain option. However, she receives an error message stating that An Active Directory domain controller for the domain examcram.com could not be contacted. Detailed information in the error message identified the names of existing domain controllers in the domain. Which of the following actions should she perform to complete the domain controller installation?

❍

A. Kristin should ensure that the domain naming master is available and functioning.

❍

B. Kristin should ensure that the RID master is available and functioning.

❍

C. Kristin should use nslookup on another domain controller to verify the existence of SRV resource records for the domain.

❍ D. Kristin should use dcdiag or netdiag to verify network connectivity to other domain controllers in her domain.

❍

E. Kristin should obtain a backup tape for another domain controller and rerun the Active Directory Installation Wizard with the /adv parameter.

Answers to Exam Questions 1. D. You should select the File Replication Service log. SYSVOL uses the File Replication Service (FRS) to replicate its information between domain controllers, so the File Replication Service log is where SYSVOL replication errors will be found. The system log records events related to general system operation, so answer A is incorrect. The application log records events related to applications running on the computer, so answer B is incorrect. The Directory Service log records events related to Active Directory, including Active Directory database replication but not FRS replication, so answer C is incorrect. Note that on the exam, a question similar to this may appear as a hotspot question, in which you receive a copy of the Event Viewer snap-in and are required to select the correct log from the available choices.

295

Apply Your Knowledge See the sections “Event Viewer” and “Monitoring FRS Replication.” 2. C, F. To restore the Management OU properly, Rachel needs to do an authoritative restore. She needs to first start the domain controller in Directory Services Restore Mode and restore the System State data from backup. Then she needs to mark the restore of the Management OU as authoritative, which she can do with the ntdsutil tool. She cannot restore from normal or Safe Mode, so answers A and B are incorrect. The Always Replace the File on My Computer option does not accomplish the task, so answer D is incorrect. The When Restoring Replicated Data Sets, Mark the Restored Data As the Primary Data for All Replicas option performs a primary restore, which Rachel would do only if all domain controllers in the domain had been lost. See the section “Restoring Active Directory.” 3. D. Simply deleting objects from Active Directory does not reduce the size of the database file. Active Directory marks deleted objects as being tombstoned to ensure their proper deletion from all replication partners. After the tombstone period has expired (60 days by default), Active Directory removes these objects permanently. Active Directory cannot compact the database while it is active. Consequently, Wendy needs to reboot the server in Directory Services Restore Mode and use ntdsutil to compact the database. This behavior is a consequence of Active Directory’s need to continually service requests from the network and not because another administrator has added objects, so answer A is incorrect. Wendy has waited for enough time already for the deleted objects to be removed, so answer B is incorrect. The deleted objects are in the database and not in SYSVOL, so answer C is incorrect. See the section “Defragmenting the Active Directory Database.” 4. D. Norman needs to use Performance Logs and Alerts to log data over a period of time so that he can obtain a performance baseline for his server. System Monitor does not have an export function, so answer A is incorrect. A Save As function enables Norman to save the graph data; however, it saves only the data currently visible on the graph, so answer B is incorrect. The Properties dialog box does not have a function that allows him to save the entire time range, so answer C is incorrect. See the section “Windows Server 2003 Performance Console.” 5. C. In this case, the Windows NT 4.0 BDC has not received Sharon’s updated password. The PDC emulator handles password changes and updates them to any Windows NT BDCs still on the network, so Phil needs to force replication between the PDC emulator and the Windows NT BDC. Using Active Directory Sites and Services to force replication across site links would help with Windows 2000 or 2003 domain controllers but would not be the best solution in this case, so answer A is incorrect. There is no need to force replication across the entire domain, so answer B is incorrect. The global catalog server does not play a role in this problem, so answer D is incorrect. See the section “Active Directory Support Tools Review.” 6. C. You should select the NTDS performance object. The counters in this object provide detailed statistics that indicate how Active Directory replication affects domain controller performance. Note that the FileReplicaConn and FileReplicaSet objects provide information on FRS replication, which is used for replicating SYSVOL but not Active Directory; therefore, answers A and B are incorrect. The Redirector object monitors network connections from the local server and has no relationship to Active Directory performance; therefore, answer D is incorrect. See the section “Monitoring Active Directory Replication.”

296

Chapter 4: Maintaining an Active Directory Infrastructure 7. B. When a disaster of this type destroys all domain controllers, you should perform a primary restore of the first domain controller and then perform a nonauthoritative restore of the other domain controllers. You do not perform a primary restore of all domain controllers, so answer A is incorrect. You would perform an authoritative restore only if you needed to restore a deleted object, so answer C is incorrect. You need to perform a primary restore on one of the domain controllers first, so answer D is incorrect. Note that a question similar to this may appear as a dragand-drop question in which you must select the appropriate steps in the correct order from a list. See the section “Restoring Active Directory Services.” 8. B, C, D. Event Viewer can display errors in the Directory Service and FRS logs, which are useful in locating problems with replication. Adam can use repadmin and replmon to monitor replication and check for problems. Netdiag diagnoses network connectivity problems but not replication problems, so answer A is incorrect. Active Directory Sites and Services does not supply replication-related data, so answer E is incorrect. See the sections “Monitoring Active Directory Replication” and “Active Directory Support Tools Review.” 9. B. repadmin with the /showmeta parameter displays a list of updated attributes in the directory database. You can obtain a similar list from replmon, but you have to right-click the server and choose Properties. The Update Status command merely updates the date and time of the most recent replication, so answer A is incorrect. This information is not available from the NTDS performance counters or the Directory Service log, so answers C and D are incorrect. See the sections “Monitoring Active Directory Replication” and “Active Directory Support Tools Review.” 10. B. If the domain naming master is unavailable, the network will not be affected in any manner until an administrator attempts to add or remove a domain, in which case a problem similar to that presented here will occur. Although the DNS server should be configured for dynamic updates, it will not cause this problem, so answer A is incorrect. This problem is not a function of Active Directory replication, so answer C is incorrect. The server Leanne is installing will become the infrastructure master in the new domain, so answer D is incorrect. See the section “Diagnosing Issues Related to Operations Master Role Failures.” 11. A. When Stephen first promoted this computer to the role of domain controller, he had to enter a Directory Services Restore Mode administrator password. This password is stored locally in the SAM and is not stored in Active Directory. When the computer is started in Directory Services Restore Mode, it is acting as a standalone server and is not connected to Active Directory. Consequently, user accounts and passwords that are stored in Active Directory are unavailable. Stephen does not need to belong to the Enterprise Admins group to use the Directory Services Restore Mode, so answer B is wrong. It would be possible for a Group Policy setting to deny the Log On Locally right, but this would prevent any administrator from accessing the server, so answer C is wrong. He needs to use the Directory Services Restore Mode password, so answer D is wrong. See the section “Restoring Active Directory.” 12. C. Active Directory replication logs event 1311 to the Directory Service log when there is some type of site connectivity problem such as a missing site link or a site link that is not bridged. If DC6 were no longer connected to the LAN, Maria would not receive any message in Event Viewer, so answer A is incorrect. If the A record for DC8 were missing or if DC8 were unable to authenticate with DC6, she would receive a 1265 error in the Directory Service log, so answers B and D are incorrect. See the section “Diagnosing Issues Related to Active Directory Replication.”

297

Apply Your Knowledge 13. A. If users at pre-Windows 2000 computers are unable to change their passwords, the PDC emulator is most likely not functioning properly. This server is responsible for updating passwords and other account changes for users at these computers. The infrastructure master updates references to objects in other domains but is not involved in password changes. Therefore, answer B is incorrect. The RID master allocates sequences of relative identifiers to other domain controllers. It also is not involved in password changes, so answer C is incorrect. You might have to check that the replication topology includes all domain controllers, including the PDC emulator. However, you should first check that the PDC emulator is functioning properly, so answer D is incorrect. See the section “Diagnosing Issues Related to Operations Master Role Failures.” 14. D. Vince should check the schema master. Exchange Server 2003 installs several new attributes and classes to the Active Directory schema when it is installed; consequently, the schema master needs to be online and available, or installation will fail. The infrastructure master updates references to objects in other domains. The domain naming master ensures that names of child domains and new domain trees are unique and properly specified. The RID master allocates sequences of relative identifiers to other domain controllers. None of these servers are involved in installing schema attributes, so answers A, B, and C are incorrect. See the section “Diagnosing Issues Related to Operations Master Role Failures.” 15. D. Kristin needs to verify that another domain controller is alive and connected to the network. She can use the dcdiag or netdiag tool to verify network connectivity, NetBIOS, and DNS registration. The domain naming master is required when creating a new domain in an existing forest but not when creating another domain controller in the same domain, so answer A is incorrect. The RID master assigns relative identifiers to new objects in the domain, but is not involved in domain controller creation, so answer B is incorrect. Because the details in the error message displayed the names of existing domain controllers, DNS SRV resource records are properly registered, so answer C is incorrect. Kristin could use dcpromo /adv to promote the server; however, it would still need to successfully contact another domain controller in the domain; therefore, answer E is incorrect. See the section “Diagnosing Issues Related to the Active Directory Database.”

Suggested Readings and Resources 1. Microsoft Corporation. “Domain controllers do not demote gracefully when you use

the Active Directory Installation Wizard to force demotion in Windows Server 2003 and Windows 2000 Server.” http://support.microsoft.com/default.aspx?scid=kb; en-us;332199. 2. Microsoft Corporation. “How to Reset the Directory Services Restore Mode

Administrator Account Password in Windows Server 2003.” http://support.microsoft.com/default.aspx?scid=kb;en-us;322672. 3. Microsoft Corporation. “How to Troubleshoot the File Replication Service in

Windows Server 2003.” http://support.microsoft.com/default.aspx?scid=kb; en-us;327341.

298

Chapter 4: Maintaining an Active Directory Infrastructure 4. Microsoft Corporation. “How to Use Ntdsutil to Manage Active Directory Files

from the Command Line in Windows Server 2003.” http://support.microsoft.com/ default.aspx?scid=kb;en-us;816120. 5. Microsoft Corporation. “HOW TO: Troubleshoot Intra-Site Replication Failures.”

http://support.microsoft.com/default.aspx?scid=kb;en-us;249256. 6. Microsoft Corporation. “Overview of the Distributed File System Solution in

Windows Server 2003 R2.” http://technet2.microsoft.com/WindowsServer/ en/Library/d3afe6ee-3083-4950-a093-8ab748651b761033.mspx?mfr=true. 7. Microsoft Corporation. “Useful shelf life of a system-state backup in Active Directory.”

http://support.microsoft.com/default.aspx?scid=kb;en-us;216993. 8. Microsoft Corporation. “Using LDIFDE to Import and Export Directory Objects to

Active Directory.” http://support.microsoft.com/default.aspx?scid=kb;en-us;237677. 9. Microsoft Corporation. “Verify Successful Replication to a Domain Controller.”

http://technet2.microsoft.com/WindowsServer/en/Library/00e7f86b-ccd3-4cb8-9a01bf747241b5001033.mspx?mfr=true. 10. Microsoft Corporation. “Windows Server 2003 Active Directory Diagnostics,

Troubleshooting, and Recovery.” http://www.microsoft.com/technet/community/ events/windows2003srv/tnt1-80.mspx?frame=true. 11. Microsoft Corporation. “Windows Server 2003 Active Directory Branch Office

Guide.” http://www.microsoft.com/downloads/details.aspx?familyid=9353A4F6-A8A840BB-9FA7-3A95C9540112&displaylang=en. 12. Scales, L. 2006. MCSA/MCSE 70-290 Exam Prep: Managing and Maintaining a

Microsoft Windows Server 2003 Environment. Indianapolis: Que Publishing.

5

CHAPTER 5

Planning User, Computer, and Group Strategies Objectives This chapter covers the following Microsoft-specified objectives for the Planning and Implementing User, Computer, and Group Strategies section of the Windows Server 2003 Active Directory Infrastructure exam: Plan a security group strategy . It is essential that you understand the uses of the different security groups that Microsoft has made available. Proper use of security groups simplifies the process of granting access to all types of resources on the network. In this manner, you can ensure that users are able to access only those resources required for their tasks, thereby making important information secure from malicious access.

Plan a user authentication strategy . Plan a smart card authentication strategy . Create a password policy for domain users . This objective is key because it tests two areas of knowledge that you must know about to keep your network secure from intruders. Use of smart cards helps to secure your network because the user must have both the card and their personal identification number (PIN) to gain access. In the absence of smart cards, strong passwords are vital to a network’s security. This objective ensures that you know how to implement secure passwords that help to keep your network secure from unauthorized access.

Outline Introduction

302

Security Groups

302

Planning the Use of Smart Cards

318

303

Implementing the Use of Smart Cards

319

User Authentication Strategy Smart Cards

Functional Levels

317 318

Windows 2000 Mixed Functional Level

304

Windows 2000 Native Functional Level

305

Using Group Policy to Configure Password Policy Settings

335

306

Using Group Policy to Configure Account Lockout Settings

338

Using Security Configuration and Analysis to Configure Password Policy

340

Windows Server 2003 Functional Level

Planning a Distribution Group Strategy 306 Planning a Security Group Strategy

307

A Simple Strategy for Using Group Nesting

307

An Additional Strategy for Using Group Nesting

308

Group Nesting in Multiple Forest Environments

309

User and Group Creation Strategies

Domain Password Policy

Chapter Summary Key Terms Apply Your Knowledge

335

349 349 350

312

Exercises

Csvde

313

Exam Questions

358

Ldifde

314

Answers to Exercises

362

Dsadd

315

Answers to Exam Questions

363

Scripts

316

Suggested Readings and Resources

365

Group Nesting Review

317

350

Study Strategies Although this chapter appears to cover several somewhat diverse topics, they all have a common theme: network security. Use these strategies when studying this chapter: . You need to be familiar with the various security group scopes available with Windows Server 2003, the times to use certain security group scopes, and the ways to nest these groups. . Pay attention to how the group nesting capabilities vary according to the domain’s functional level in use. Practice creating different groups and trying to nest them until you know the capabilities and limitations involved. . Know the steps that are necessary to implement the use of smart cards on your network. . Know the importance and limitations of password policy and make sure you understand how to configure it properly.

302

Chapter 5: Planning User, Computer, and Group Strategies

Introduction Not a week goes by without some news story detailing how an intruder has managed to access some company’s network and inflict damage ranging from trivial to catastrophic. You must understand the measures you can take to keep your network secure both from external and internal threats. This chapter deals with several aspects of network security. First, we look at ways to plan and use security groups to facilitate granting resource access to users. On a network with hundreds or even thousands of users with varying requirements, administering resource access would be impossible without some means of lumping together users with similar needs. This is exactly what security groups do. These same hundreds to thousands of users need to be authenticated to the network so that the systems can be sure they are who they claim to be. We show you how to ensure users create secure passwords to reduce the chances of outsiders successfully guessing a simple password and using it to access the network. We also show you how to plan and implement smart cards to provide an even higher level of secure access. This technique requires that a user possess both the physical card and its corresponding PIN to gain access.

Security Groups Objective

Plan a security group strategy Effective use of security groups requires that you know how they function and their capabilities according to the functional level at which your domain is operating. This chapter deals with planning security group strategies with respect to their uses in domains operating at different functional levels. Windows Server 2003 makes available the following two group types: . Security groups—These groups can be used to categorize users for purposes such

as assigning rights and permissions. They can also be used for distribution purposes. The group types available in Windows NT 4.0 (global and local groups) were both security groups because they were intended for the same purposes as security groups in Windows 2000 and Windows Server 2003. These group types have security information, such as unique security identifiers (SIDs), assigned to them. . Distribution groups—As suggested by their name, these groups can be used for dis-

tribution purposes such as email lists. Because they do not have security information like an SID attached to them, they cannot be used for security purposes. Microsoft introduced this group type with Windows 2000.

303

Security Groups

Within each group type, Windows Server 2003 makes available three group scopes: . Global—These groups are used to contain users, computers, and other global groups

from the same domain. They are generally employed to organize users who have similar functions and therefore similar needs on the network. For example, you might include all help desk staff in one global group, all accounting staff in another global group, and so on. . Domain local—These groups can contain users, computers, and groups from any

domain in the forest. They are most often used for granting permissions for resources, and as such may be employed to grant access to any resource in the domain in which they are created. Therefore, it is logical for a domain local group to include global groups that contain all users who have a common need for a given resource. . Universal—Similar to the way you use domain local groups, you can employ these

groups to grant permissions to resources. However, this group scope enables you to grant access to any resource in the Active Directory forest, rather than just a single domain. A universal group can include users, computers, and global groups from any domain.

NOTE Domain Local Versus Local Groups What was known as a local group in Windows NT 4.0 is now referred to as a domain local group. Microsoft uses the term local group to refer to a group created on a member server or client computer for access to resources on that machine only. This group is also sometimes called a machine local group. You should note that domain local groups in Windows 2000 or Windows Server 2003 are available to member servers in the domain to apply security permissions. In Windows NT 4.0, local groups at the domain level were available only to domain controllers because they shared an account database.

For general information on security and distribution groups, refer to MCSA/MCSE 70-290 Exam Prep: Managing and Maintaining a Microsoft Windows Server 2003 Environment, mentioned in the “Suggested Readings and Resources” section at the end of the chapter.

Functional Levels Recall from Chapter 2, “Planning and Implementing an Active Directory Infrastructure,” that three domain functional levels are available in Windows Server 2003: Windows 2000 mixed, Windows 2000 native, and Windows Server 2003 native. The following sections discuss the use of security groups as they apply to each of these three functional levels.

304

Chapter 5: Planning User, Computer, and Group Strategies

Windows 2000 Mixed Functional Level Recall that a domain containing any or all of Windows NT 4.0, Windows 2000, or Windows Server 2003 domain controllers operates at the Windows 2000 mixed functional level. It is also the default functional level when a new Windows Server 2003 domain is created, and operates in the same fashion as Windows 2000 mixed mode. When a domain is operating at the Windows 2000 mixed functional level, it is not possible to create universal security groups (see Figure 5.1). Only a limited extent of group nesting is available, as follows:

Figure 5.1 Universal security groups are not available in the Windows 2000 mixed functional level. . You can add global groups to domain local groups in any domain. You cannot add

global groups to other global groups or domain local groups to any other group. . A global group can contain any number of user accounts from the local domain. It

cannot contain user accounts from other domains or any type of group account. If you attempt to add such an account, you receive an error similar to that shown in Figure 5.2.

Figure 5.2 If you attempt to add a global group to another global group in the Windows 2000 mixed functional level, you receive an error.

305

Security Groups . You can use a global group to assign permissions to resources in any domain. . A domain local group can contain any number of user accounts or global groups from

any domain. . You can use a domain local group to assign permissions to resources in the local

domain only. . You cannot change the scope of any group when operating in the Windows 2000 mixed

functional level. These rules are identical to those that existed with groups in Windows NT 4.0.

NOTE Mixed Functional Level Distribution Groups You can use universal distribution groups in a domain operating at the Windows 2000 mixed functional level.

Windows 2000 Native Functional Level Recall that a domain containing only Windows 2000 and Windows Server 2003 domain controllers can operate at the Windows 2000 native functional level. When a Windows 2000 domain operating at the Windows 2000 native mode is upgraded to Windows Server 2003, this is the default functional level. The Windows 2000 native functional level allows enhanced group membership and nesting, as follows: . Universal security groups are now available. They can contain user accounts, global

groups, and universal groups from any domain. . Global groups can contain user accounts and other global groups from the same

domain only. . You can add a universal group or a global group to other groups of any scope in

any domain, even to a machine local group for access to resources on that specific computer. . You can grant permissions to resources in any domain to universal groups or global

groups. . Domain local groups can contain user accounts, global groups, and universal groups

from any domain. They can also contain domain local groups from the same domain. . You can add a domain local group to another domain local group in the same

domain only. . You can grant domain local groups permission to resources in the same domain only.

306

Chapter 5: Planning User, Computer, and Group Strategies

Another interesting fact about groups in the Windows 2000 native (and above) functional level is that you can put computer accounts into them. This capability can be useful in assigning group policies to specific computers. We discuss this issue further in Chapter 7, “Planning and Implementing Group Policy.”

Windows Server 2003 Functional Level Recall that this functional level allows only Windows Server 2003 domain controllers. Rules and suggestions for use of groups at this functional level are identical to those at the Windows 2000 native functional level. Upgrading your domains to Windows Server 2003 functional level enables the following added features: We covered many of these features in Chapters 2 and 3. . You can rename domains and domain controllers without the need to demote domain

controllers and decommission domains. . Updates to the logon timestamp attribute are enabled and replicated throughout the

domain. . You can set the UserPassword attribute as the effective password on users as well as

inetOrgPerson objects. . You can redirect the Users and Computers containers to new locations for user and

computer accounts. . The authorization manager can store its authorization policies in Active Directory. . You can enable constrained delegation, which extends the security of the Kerberos

authentication protocol to applications written to support this feature. . Selective authentication of users from trusted forests is supported. With this feature,

you can specify which users and groups in a trusted forest are permitted to authenticate on resource servers in a trusting forest.

Planning a Distribution Group Strategy As already mentioned, distribution groups do not contain security information such as SIDs and cannot be used for controlling access to files, folders, and other resources. If a situation arises where you need a group for purposes of sending email messages to user accounts throughout your domain or forest and want to keep Active Directory replication and the size of the Active Directory database from increasing, consider using distribution groups. You can use a global distribution group for sending messages within a domain and a universal distribution group for sending messages to more than one domain within your forest. In the latter case, you should follow the strategy outlined in the next section of adding users to global distribution groups and adding these to a universal distribution group.

307

Security Groups

TIP Remember That Distribution Groups Do Not Have a SID The only scenario in which a distribution group is useful is for a scenario such as an email list where the group members do not require access permissions to resources. Remember that you can use a security group for distribution purposes as well as resource access control.

Planning a Security Group Strategy You can use security groups for any purpose in which access control to objects such as files, folders, printers, Group Policy Objects (GPOs), and so on, is required. You can also use security groups for email distribution purposes should you need to use the same group membership for both security and distribution purposes. In this section, we look at several strategies for group nesting. More than one group nesting strategy is possible. In this section we present three possible strategies for group nesting. You can use the first strategy in either single-domain or multipledomain forests, whereas the second strategy is most useful in multiple-domain forests. The third strategy is essentially an extension of the second one to multiple-forest environments.

A Simple Strategy for Using Group Nesting The strategy that Microsoft recommended for use with Windows NT 4.0 groups is still completely valid for Windows Server 2003 domains operating at the Windows 2000 mixed functional level. In fact, it is a good strategy for use at any functional level. The following list outlines the strategy: 1. Place accounts (A) into global groups (G). 2. Add the global groups to domain local groups (DL).

3. Finally, assign permissions (P) to the domain local groups. This strategy can be summarized as follows: A, G, DL, P.

NOTE Simple Nesting of Groups Is Best Minimize levels of nesting as just stated (A, G, DL, P). This strategy simplifies the process of keeping track of permissions and troubleshooting resource access. In addition, it is useful to base your global groups on job functions. When another person takes over a job, you need only change the person’s group membership, and not all the associated permissions.

308

Chapter 5: Planning User, Computer, and Group Strategies

You can follow the same strategy in a multiple-domain environment. Add users from each child domain to a global group in the same domain. Then add these global groups to a domain local group in the parent domain and grant permissions to the domain local group. Figure 5.3 provides an example of users in two child domains, who require access to resources located in the parent domain.

User1 User2

Global Developer 1

west.quepublishing.com

Domain Local Group with Access Permissions to the Developmental Applications

Developmental Applications

quepublishing.com User3 User4

Global Developer 2

east.quepublishing.com

Figure 5.3 You can use the A, G, DL, P rule in multiple-domain situations at any functional level.

EXAM ALERT Know What Groups Can Be Nested at Each of the Functional Levels The exam provides scenarios that can trick you into trying to do impossible actions, such as creating a universal group or nesting global groups in each other at the Windows 2000 mixed functional level. Make sure that you know the group nesting limitations and how they vary with each functional level.

An Additional Strategy for Using Group Nesting The enhanced group nesting available with the Windows 2000 native (and above) functional levels enables an additional strategy of using universal groups in addition to domain local groups to grant access permissions. In fact, this strategy gives you the option of granting access to resources located on any domain, not just the parent domain, as shown in Figure 5.4. This figure shows two child domains, west.quepublishing.com and east.quepublishing.com, each of which contains users that require access to developmental applications located in the quepublishing.com domain. By employing a universal group, you can grant access to these applications to users in both domains by employing just a single group (the universal group). Although you can grant access directly to the universal group, Microsoft recommends that you secure access to these applications by creating a domain local group in the domain in which these applications are located and adding the universal group to this domain local group. Then grant the appropriate permissions to the domain local group. If necessary, you can extend this strategy to domain local groups located in additional domains containing application to which you must grant access. However, the use of universal groups results in a higher level of network traffic between domain controllers at replication time because any membership changes must be propagated to all global catalog servers in the forest.

309

Security Groups

User1 User2

Global Developer 1

west.quepublishing.com

User3 User4

Global Developer 2

Universal Group with Access Permissions to the Developmental Applications

Domain Local Group with Access Permissions to the Developmental Applications

quepublishing.com west.quepublishing.com east.quepublishing.com

quepublishing.com

Developmental Applications

east.quepublishing.com

Figure 5.4 At the Windows 2000 native functional level, you can use a universal group to grant access to resources in more than one domain.

Following are several suggestions for using universal groups: . Use universal groups sparingly and use them only when their membership is relatively

static. The reason for this suggestion is the replication traffic just discussed. . Use universal groups when you need to assign permissions to resources located in sev-

eral domains. In this case, place users from each domain into a global group and add the global groups to a single universal group. Create domain local groups in each domain containing resources and add the universal group to these groups. Then grant the appropriate permissions to the domain local groups. Use of this strategy simplifies the allocation of permissions and reduces the amount of interdomain traffic that must be replicated across slow links to global catalog servers in other domains. . If you have only a single domain, you do not need to use universal groups. Use the A,

G, DL, P strategy already discussed.

Things Can Easily Go Wrong in Group Nesting A few years ago, I heard of a situation in which student interns at a company where a friend worked were able to access confidential corporate documents and obtain information they could have passed on to a competitor. One network administrator at that company had assigned the interns to one global group. Another administrator then added this group to a second global group, which was included in a domain local group with permissions to confidential corporate documents. As a result, the interns had access to the confidential documents. Several of them used information in writing term papers at school the following semester. In such an instance, the administrators should have created a global group specifically for the interns. Then they could have added this group to only the groups containing the required privileges or assigned these privileges directly to the group.

Group Nesting in Multiple Forest Environments The strategy you can employ to enable cross-forest access is similar to those we have already mentioned for access to resources within a single forest. The major additional need is that you must first set up the appropriate trust relationship. We discussed trust relationships in Chapter 3, “Managing an Active Directory Infrastructure.”

310

Chapter 5: Planning User, Computer, and Group Strategies

After you’ve created the appropriate trusts, you can create global groups in each domain and add these global groups to a universal group in each forest. Next, you can create resourcebased domain local groups in every domain where a need exists for cross-forest access. Finally, you can add universal groups from all required forests to each domain local group and use these domain local groups to assign the appropriate access permissions. For example, consider the situation depicted in Figure 5.5. In this case, users in domains A.A.com and B.A.com of forest A require access to a resource in domain A.B.com of forest B. The suggested strategy is as follows:

A.com

B.com

A.A.com

B.A.com

A.B.com

User1 User2

User3 User4

DLG-B

GGA

GGB

UnivG-A

Forest A

Forest B

Figure 5.5 You can use a similar strategy for granting access to resources in a trusted forest.

1. Add the users to global groups GGA and GGB in the A.A.com and B.A.com domains,

respectively. 2. Then add these global groups to a universal group named UnivG-A. 3. Then add this universal group directly to the domain local group DLG-B operating

in domain A.B.com. 4. Finally, assign permissions for the resources in this domain to the domain local

group DLG-B.

311

Security Groups

Challenge Functional Levels and Group Nesting As a result of continuing business expansions, administrators at the Widgets company you have been working with have created two new domains called north.widgets.com and south.widgets.com. The root domain of widgets.com still contains files, printers, and applications to which accountants in the new child domains need access. The object of this exercise is to create a group nesting strategy that enables accountants in the two child domains to access resources in the widgets.com domain. To do this exercise completely, you should have three computers on which you have installed Windows Server 2003 as a domain controller, one for each of the three domains. If you have only two computers, you can also do this exercise by creating a dual-boot configuration on the second server so that it hosts both child domains. Reboot this computer to the appropriate installation of Windows Server 2003 as required. There could be more than one valid way to complete this exercise. Try to work through the exercise on your own. The following steps present one possible solution to this problem: 1. Log on to the north.widgets.com domain controller as an administrator. 2. Open Active Directory Users and Computers. 3. In the console tree, right-click north.widgets.com and select Raise Domain Functional Level. In the Raise Domain Functional Level dialog box, select either Windows 2000 Native or Windows Server 2003, and then click Raise. 4. Click OK to accept the warning that appears, and then click OK to close the message box that informs you that the functional level was raised successfully. 5. Right-click the Users container and select New, Group. Type northaccts as the name of the group. Select Global as the group scope and Security as the group type, and then click OK. 6. Repeat steps 1–5 at the domain controller for the south.widgets.com domain. Use Southaccts as the name of the global security group. 7. Repeat steps 1–4 at the widgets.com domain controller. 8. Right-click the Users container in the widgets.com domain and select New, Group. Type Accts as the name of the group. Select Universal as the group scope and Security as the group type, and then click OK. 9. In the details pane, right-click the Accts group and choose Properties. 10. Select the Members tab and then click Add. 11. In the Select Users, Contacts, Computers, or Groups dialog box, click the Locations command button. From the Locations dialog box that appears, select the north.widgets.com domain and then click OK. (continues)

312

Chapter 5: Planning User, Computer, and Group Strategies (continued)

12. In the Enter the Object Names to Select field, type northaccts and then click OK. This group appears in the list on the Members tab of the Accts Properties dialog box. 13. Click Add, and then repeat steps 11–12, typing the southaccts group name. This group is added to the list on the Members tab of the Accts Properties dialog box. 14. Click Start, My Computer, and create a shared folder in an appropriate location on this computer. 15. Create a text file in the newly created folder and type some information into it. 16. Right-click Active Directory Users and Computers and select Connect to Domain. In the dialog box that appears, type north.widgets.com and then click OK. 17. Add the required users to the northaccts group. 18. Repeat steps 16–17, connecting to the south.widgets.com domain and adding users to the southaccts group. 19. Log on to the north.widgets.com domain controller as a user in this domain that you added to the northaccts group. 20. Use My Network Places or the Run dialog box to navigate to the shared folder on the widgets.com domain controller and locate the text file. You should be able to open this file. Note that you cannot modify the file unless you have changed the default shared folder and NTFS permissions for the shared folder. 21. Repeat steps 19–20 at the south.widgets.com domain controller.

User and Group Creation Strategies As you already know, the Active Directory Users and Computers console enables you to create new user and group accounts in your domain or any OU it contains. If you have forgotten how to perform these tasks, refer to MCSA/MCSE 70-290 Exam Prep: Managing and Maintaining a Microsoft Windows Server 2003 Environment, mentioned in the “Suggested Readings and Resources” section at the end of the chapter. What if you have to create hundreds, or even thousands, of new user or group accounts? Microsoft has provided several tools you can use to automate the creation of user and group accounts, as follows: . Csvde—Enables you to import data to Active Directory from files containing informa-

tion in the comma-separated value (CSV) format. You can also export Active Directory data to CSV-formatted files. . Ldifde—The LDAP Data Interchange Format Data Exchange (Ldifde) tool enables

you to create, modify, and delete directory objects. You can also extend the schema, export Active Directory user and group data, and add data to Active Directory from other directory sources.

313

Security Groups . Dsadd—Enables you to add object types including computers, contacts, groups, users,

OUs, and quotas to Active Directory. . Scripts—You can use scripts and batch files with tools such as Dsadd to automate the

creation of large numbers of objects. You can also use Windows Script Host to automate account creation.

Csvde The Csvde (Comma Separated Value Data Exchange) tool works with comma-separated text files that have a .csv extension—in other words, values are separated from each other by commas. This is a format that is supported by numerous other applications including Microsoft Excel and Exchange Server. Because Microsoft Excel supports this format, it is a convenient tool for preparing the .csv file. The .csv file begins with a line that is called the attribute line and specifies the name of each attribute that you want to define for each new user account. The attribute names are defined in the Active Directory schema. They can be placed in any order but must be separated by commas; the order in which they are placed on the attribute line defines the order in which the attributes will appear on each data line. After the attribute line, you can specify the attributes of each user account in the same sequence. If an attribute is missing, leave it blank but make sure all commas are present. If an attribute contains one or more commas (for example the LDAP distinguished name), enclose it in quotation marks. You can use Excel to create the .csv file; it handles the formatting and comma sequencing automatically. The following are examples of lines in a .csv file: Dn,cn,objectClass,sAMAccountName,userPrincipalName,telephoneNumber, ➥ userAccountControl “cn=Judy Gale,OU=accounting,dc=quepublishing,dc=com”, Judy Gale,user, ➥ JudyG,[email protected],555-678-1234,512 “cn=Rodney Logan,OU=receivable,OU=accounting,dc=quepublishing,dc=com”, ➥ Rodney Logan,user,RodL,[email protected],555-678-1245,514 “cn=Computer1,OU=accounting,dc=quepublishing,dc=com”,Computer1,computer, ➥ Computer1,,,

The variable called userAccountControl determines the account’s Enabled status; a value of 512 enables the user account and a value of 514 disables it. The last object is an example of a computer object (objectClass=computer), with no values defined for userPrincipalName, telephoneNumber, and userAccountControl. You would normally import this object to the Computers container that is defined by default; however, you can import it to any container you desire.

314

Chapter 5: Planning User, Computer, and Group Strategies

After you have created your .csv file and ensured that it is properly formatted, it is simple to import the information to Active Directory. Run the following command from the command prompt: Csvde –i –f filename.csv

In this command, -i specifies import mode (the default mode is export mode) and –f filename.csv specifies the name of the file to be imported. After you press Enter, this command provides status information as it proceeds. This includes information on the success or failure of the command and the name of the file containing detailed error information. Once the command has completed, you should verify its proper completion by checking some of the user accounts that it created.

Ldifde The Ldifde tool works in exactly the same way as Csvde except that it uses the LDIF file format, which is a line-separated format. Each record describes either a single directory entry or a set of modifications to a single entry. Each attribute is contained on a single line and specifies the name of the attribute (as defined in the schema) followed by its value. Records are separated with blank lines. A line beginning with # is a comment line. A sample set of information for a user follows: # These are the user attributes for Judy Gale. DN: cn=Judy Gale,OU=accounting,dc=quepublishing,dc=com CN: Judy Gale DisplayName: Judy Gale GivenName: Judy Sn: Gale ObjectClass: user sAMAccountName: JudyG UserPrincipalName: [email protected] TelephoneNumber:555-678-1234 physicalDeliveryOfficeName: 5th Floor, NE Corner

To use Ldifde, run the following command from the command prompt: Ldifde –i –f filename.ldf

As with Csvde, -i specifies import mode and filename.ldf specifies the name of the file containing data to be imported. Using Ldifde, you can also modify or delete accounts, extend the schema, export Active Directory data to other applications or services, and add information from other directory services to Active Directory. Both Csvde and Ldifde use the same parameters. Table 5.1 describes the more common parameters used by these commands.

315

Security Groups

TABLE 5.1 Common Parameters Used by Csvde and Ldifde Parameter

Meaning

-i

Specifies import mode. The default is export mode if this is not included.

-f filename

Specifies the import or export file name.

-s servername

Specifies the domain controller to be used during import or export.

-c string1 string2

Replaces occurrences of “string1” with “string2”. This is useful if you have to import data from one domain to another and need to modify the distinguished names accordingly.

-j directory path

Specifies the path to the log file. By default this is the current directory path.

-b username domain password

Allows you to run the command using the credentials of another user account. Specify the username, domain, and password of the account to be used.

For additional parameters used with Csvde and Ldifde, refer to the Windows Server 2003 Help and Support Center. You can also find additional information on Ldifde from Microsoft Knowledge Base article 555634.

Dsadd The Dsadd tool enables you to add objects of a specific type to Active Directory. Supported objects include users, groups, computers, OUs, contacts, and quotas. To add a user, run the following command from the command prompt: dsadd user UserDN –fn FirstName –ln LastName –display DisplayName ➥ –pwd {password | *} –samid SAMName –tel PhoneNumber –disabled {yes | no}

In this command, userDN refers to the distinguished name of the user to be added, FirstName and LastName are the user’s first and last names, DisplayName is the display name, password is the password to be assigned to the user account (if you specify *, you are prompted for the password), SAMName is the unique SAM account name, PhoneNumber is the user’s telephone number, and disabled refers to the enabled/disabled status (if you specify yes, the account is disabled; if you specify no, the account is enabled). An example follows: dsadd user “cn=Judy Gale,OU=accounting,dc=quepublishing,dc=com” –fn Judy –ln Gale ➥ –display “Judy Gale” –pwd P@ssword –samid JudyG –tel 555-678-1234 ➥ –disabled {yes | no}

To add a group, run the following command from the command prompt: dsadd group GroupDN –fn FirstName –secgrp {yes | no} –scope {l |g |u} ➥ –samid SAMName –memberof Group … –members member …

316

Chapter 5: Planning User, Computer, and Group Strategies

In this command, GroupDN refers to the distinguished name of the group to be added, secgrp specifies whether the group is a security group (yes) or distribution group (no), scope refers to the group scope (l for domain local, g for global, u for universal), memberof specifies the groups to which the new group is to be added, and members specifies the members to add to the new group. By default, a new group is created as a global security group. A large number of additional parameters are available. We discuss the use of Dsadd for creating OUs in Chapter 6. For further information as well as information on creating contacts, computers, or quotas, consult the Windows Server 2003 Help and Support Center.

Scripts You can utilize the power of the preceding commands fully by creating scripts that enable you to automate the creation, modification, or deletion of multiple objects in Active Directory. The following two scripting environments are available: . Batch files—The command processor enables you to run batch files that utilize tools

such as the dsadd, dsmod, or dsrm commands. While limited in capability, batch files do enable the rapid processing of command-line tools for managing multiple Active Directory objects. . Windows Script Host (WSH)—WSH runs files containing commands written in the

Microsoft Visual Basic Scripting Edition (VBScript) of Java Script (Jscript) languages. These scripts utilize Active Directory Services Interfaces (ADSI) to manage Active Directory objects. WSH provides the most powerful scripting environment, including the capability of creating, modifying, and deleting directory objects. You can configure any user or group property available to you from Active Directory Users and Computers, including passwords, UPN suffixes, and enabled status. You can use Notepad to create VBScript files with the .vbs extension and run them by typing the following command at the command prompt: wscript scriptname.vbs

In this command, scriptname is the name of the script. For an example script that creates a user, group, and OU, assigns a password to the user account, and adds the user to the group, refer to “Creating administrative scripts” in the Windows Server 2003 Help and Support Center.

317

User Authentication Strategy

Group Nesting Review Table 5.2 provides a summary of group nesting capabilities in domains operating at the Windows 2000 native or Windows Server 2003 functional levels. TABLE 5.2 Comparing the Three Group Scopes When Operating in Windows 2000 Native or Windows Server 2003 Functional Levels Universal

Global

Domain Local

Users who can be a member of this group

Users from any domain

Only users who belong to the domain in which the group resides

Users from any domain

Groups that can be nested into this group

Global groups from any domain and other universal groups

Only global groups in the same domain

Universal and global groups from any domain and domain local groups from the same domain

Allowed resource access

Resources located in any domain in the forest

Resources located in any domain in the forest

Only resources located in the domain in which it is located

Groups into which this group can be nested

Other universal groups in the forest and domain local groups in any domain

Universal groups and domain local groups from any domain and global groups from the same domain

Only domain local groups from the same domain

User Authentication Strategy To use the network, a user must prove to Active Directory that she is who she says she is. This is what authentication is all about. Here we look at using smart cards for authentication. To prove her identity, the user must be in possession of both the smart card and the corresponding PIN. Lacking either of these, she cannot access the network. Maybe your company does not feel it needs the expense of a smart card system. In this case, it is essential that users employ passwords that outsiders cannot easily guess. Later in this chapter, we look at means of ensuring that users create effective passwords and change them according to a defined schedule.

318

Chapter 5: Planning User, Computer, and Group Strategies

Smart Cards Objective

Plan a user authentication strategy . Plan a smart card authentication strategy

A smart card is a credit card–sized electronic device that contains an integrated electronic circuit and stores public and private keys that provide for secure, tamperproof identification and authentication. It works with a smart card reader that attaches to a standard peripheral interface such as a USB port. Smart cards provide a secure means to authenticate clients logging on to a Windows Server 2003 domain, as well as remote access logon. With the more usual logon name/password combinations, if a malicious individual were to crack the username and password, she could assume the legitimate user’s identity and obtain that user’s access to domain resources. If that user were an administrator, the malicious user would be able to do considerable damage to the entire network. When smart card authentication is in use, the malicious user would have to obtain the smart card and the user’s PIN to gain access. Should the malicious user obtain the card without the PIN and attempt some type of guessing algorithm, the smart card will lock out after several unsuccessful attempts. Also known as dual-factor authentication, this combination uses cryptography-based identification, thereby permitting a higher level of secured access to your network.

NOTE PINs Can Use Alphanumeric Characters—A PIN used with a smart card does not need to contain only numerals; it can contain other alphanumeric characters.

Planning the Use of Smart Cards Use of smart cards on a domainwide or forestwide basis is a considerable undertaking, especially in large companies. You need to consider the hardware needs, plus the need for a public key infrastructure (PKI) and certification authority (CA) to handle the required certificates: . Smart card hardware—A large number of manufacturers produce Plug-and-Play smart

card readers that have been tested by the Microsoft Windows Hardware Quality Labs and are certified for use on computers running Windows XP Professional and Windows Server 2003. Some of the newest portable computers, such as the Acer TravelMate C100 Tablet PC, even feature built-in smart card readers. Several manufacturers of smart cards are also supported. You will also need one or more smart card writers for use during the enrollment process. For further details on supported smart cards and readers, consult the Windows XP or Windows Server 2003 Help and Support Center.

319

User Authentication Strategy . Public key infrastructure—The PKI technology enables a series of features relating

to authentication and encryption. It is based on a system of certificates, which are digitally signed statements that contain a public key and the name of the subject. . Digital certificates and certification authorities—These certificates are issued by

the CA, whose business it is to verify identities of individuals and companies using Secure Sockets Layer (SSL) to transmit secure information over the Internet. For complete details about PKIs and CAs, refer to MCSE 70-293 Exam Prep: Planning and Maintaining a Microsoft Windows Server 2003 Network Infrastructure, mentioned in the “Suggested Readings and Resources” section at the end of the chapter.

Implementing the Use of Smart Cards A smart card authenticates the user by means of the certificate installed on it. Consequently, you need a means of obtaining a certificate. You can use a certificate service provider such as VeriSign or you can install Microsoft Certificate Services yourself. After you have done so, you can create and enroll certificates to be written to the smart cards. Certificate Services is a Microsoft Management Console (MMC) snap-in that manages the generation, processing, and revocation of certificates. When installed on a domain controller as an enterprise CA, it includes a smart card enrollment station that an administrator or smart card issuer can use to enroll domain users for smart card–based certificates. Step by Step 5.1 explains how to install this snap-in.

STEP BY STEP 5.1 Installing Certificate Services 1. Ensure that you are logged on as an administrator. If you are installing an enterprise CA, you should be logged on to a domain controller. 2. Click Start, Control Panel, Add or Remove Programs to start the Add or Remove Programs applet. 3. Click Add/Remove Windows Components to start the Windows Components Wizard, as shown in Figure 5.6.

320

Chapter 5: Planning User, Computer, and Group Strategies

Figure 5.6 The Windows Components Wizard is the place where you install additional Windows components such as Certificate Services.

4. From the list displayed, select Certificate Services. You are warned that changing the machine name or domain membership will invalidate certificates installed by the CA (see Figure 5.7). Click Yes to install the CA.

Figure 5.7 Certificate Services warns you that you should not change the machine name or domain membership, or certificates installed by the CA will become invalidated.

5. Click Next to display the CA Type page, as shown in Figure 5.8. On this page, you have four choices:

Figure 5.8 The Windows Components Wizard offers you four CA types.

321

User Authentication Strategy . Enterprise Root CA—This is the most trusted CA within the domain and usually issues certificates only to enterprise subordinate CAs located within the same domain. Its information is stored in Active Directory, and all computers in the domain automatically trust the enterprise root CA. . Enterprise Subordinate CA—This type of CA is subordinate to the enterprise Root CA and requests its certificates from that CA. You can use different enterprise subordinate CAs for different segments of your organization; each can be managed on its own without affecting other CAs in your organization if a security breach occurs. . Stand-alone Root CA—This is also the most trusted CA within its hierarchy, but it is not associated with Active Directory. This type of CA could be used to issue certificates to your customers to access your website and enable them to use SSL to transmit information such as credit card numbers securely, without requiring them to have user accounts in Active Directory. . Stand-alone Subordinate CA—This type of CA is subordinate to the stand-alone root CA and serves a similar purpose outside Active Directory to that of the enterprise subordinate CA. 6. For the first CA in a Windows Server 2003 domain, you should choose Enterprise Root CA. Otherwise, you should choose Enterprise Subordinate CA. Then click Next. 7. On the CA Identifying Information page, type a descriptive common name for the CA. This name forms part of the LDAP distinguished name (DN) for the CA, as shown in Figure 5.9. This common name is typically the server name. Then click Next.

Figure 5.9 The CA Identifying Information page allows you to provide a descriptive common name for the CA.

8. Confirm the locations shown on the Certificate Database Settings page (see Figure 5.10). If you want, you can store this information in a shared folder by selecting the check box provided and typing the name of the folder. Then click Next.

322

Chapter 5: Planning User, Computer, and Group Strategies

Figure 5.10 The Certificate Database Settings page allows you to confirm or modify the locations for the certificate database and log files.

9. If Internet Information Services (IIS) is installed on the computer, you receive a message box informing you that Certificate Services must temporarily stop IIS. Click Yes to proceed. 10. The Configuring Components page appears as the CA is installed. The installation could take several minutes. If you are asked for the Windows Server 2003 Service Pack 1 CD-ROM, insert it and then click OK. 11. If IIS is not installed on the computer, you receive a message box informing you that Certificate Services Web Enrollment will not be available until IIS is installed, as shown in Figure 5.11. Click OK to continue. If IIS is installed but Active Server Pages (ASPs) are not enabled, you are asked to enable ASPs. Click Yes to continue.

Figure 5.11 You are warned that Certificate Services Web Enrollment will not be available until IIS is installed.

11. When Certificate Services installation is complete, the Completing the Windows Components Wizard page appears. Click Finish. 12. Close the Add or Remove Programs applet.

After you’ve installed Certificate Services, the next step is to configure the CA to issue the proper certificates. Follow the procedure outlined in Step by Step 5.2.

323

User Authentication Strategy

STEP BY STEP 5.2 Requesting Certificates from Certificate Services 1. Log on as an administrator to the CA server you just installed. 2. Click Start, Administrative Tools, Certification Authority to start the Certification Authority snap-in. 3. Expand your CA name to reveal the folders contained therein. 4. Right-click Certificate Templates and choose New, Certificate Template to Issue. This displays the Enable Certificate Templates dialog box, as shown in Figure 5.12.

Figure 5.12 The Enable Certificate Templates dialog box allows you to select one or more certificate templates to enable on the CA.

5. Select Enrollment Agent. Then scroll down to select either Smartcard Logon or Smartcard User (or both) and then click OK. 6. The selected certificate templates appear in the details pane, along with several other certificate templates that are installed by default.

NOTE Smartcard Logon Versus Smartcard User Smartcard Logon is used for logging on to Windows only, whereas Smartcard User is for securing email and logging on to Windows.

By default, only members of the Domain Admins and Enterprise Admins groups are granted permission to request a certificate based on the Enrollment Agent template. You can grant other users permission to enroll for an Enrollment Agent certificate by means of Active Directory Sites and Services.

324

Chapter 5: Planning User, Computer, and Group Strategies

NOTE Take Care in Granting Users Permission for an Enrollment Agent Certificate You should maintain a high level of control over who receives this permission. A user with an Enrollment Agent certificate can enroll for a certificate and generate a smart card on behalf of anyone in the organization. A malicious user could use the resulting smart card to log on to the network and impersonate the actual user.

Members of the Domain Admins and Enterprise Admins groups have the Read and Enroll permissions configured by default. However, you can create a separate group if required. You can easily create a group with the appropriate permissions for issuing the certificates. Follow Step by Step 5.3 to grant these permissions. This procedure assumes that you have created a group named Certificate Issuers in Active Directory.

STEP BY STEP 5.3 Configuring Access Control Lists (ACLs) for the Certificate Templates 1. Click Start, Administrative Tools, Active Directory Sites and Services to open the Active Directory Sites and Services console. 2. To display the Services node, highlight Active Directory Sites and Services at the top of the console tree and then click View, Show Services Node. 3. Expand this node and expand the Public Key Services node. 4. Click Certificate Templates. The list of available certificate templates appears in the details pane, as shown in Figure 5.13.

Figure 5.13 The Active Directory Sites and Services console expanded to show the list of certificate templates.

5. In the details pane, right-click Enrollment Agent and choose Properties. This displays the Enrollment Agent Properties dialog box.

325

User Authentication Strategy 6. Select the Security tab to display the default ACL, as shown in Figure 5.14.

Figure 5.14 The Security tab of the Enrollment Agent Properties dialog box displays the default ACL for this template.

7. Click Add. In the Select Users, Computers, or Groups dialog box, type or browse to the Certificate Issuers group, as shown in Figure 5.15, and then click OK.

Figure 5.15 Adding the Certificate Issuers group to the ACL for the Enrollment Agent template.

8. This group appears in the ACL with the default Read permission. In addition, add the Enroll permission, as shown in Figure 5.16, and then click OK.

326

Chapter 5: Planning User, Computer, and Group Strategies

Figure 5.16 Configuring the Enroll permission for the Certificate Issuers group.

9. Back in the Active Directory Sites and Services console, repeat steps 5–8 with the Machine Enrollment Agent, Smartcard User, and Smartcard Logon templates. 10. Close the Active Directory Sites and Services console.

To use the Smart Card Enrollment station, the smart card issuer needs to request a signing certificate based on the Enrollment Agent certificate template. This certificate signs the certificate request for each smart card recipient. Follow Step by Step 5.4 to obtain this signing certificate.

STEP BY STEP 5.4 Obtaining a Signing Certificate 1. Click Start, Run, type certmgr.msc, and then press Enter to start the Certificates console. 2. Expand the Personal folder and then click Certificates. Any issued certificates appear in the details pane. 3. Right-click Certificates and choose All Tasks, Request New Certificate. This starts the Certificate Request Wizard. 4. Click Next, and on the Certificate Types page, select Enrollment Agent, as shown in Figure 5.17.

327

User Authentication Strategy

Figure 5.17 The Certificate Types page enables you to select a certificate type.

5. To select a cryptographic service provider (CSP) and key length, click Advanced and then click Next. 6. On the Cryptographic Service Provider page, select the desired CSP and key length. Available key lengths range from 384 to 16,384 bytes; a longer key provides more security but requires more processor resources. The default key length is 1,024 bytes (see Figure 5.18). Click Next.

Figure 5.18 The Cryptographic Service Provider page enables you to select a CSP and key length for the requested certificate.

7. If you have more than one CA available, make a selection on the Certification Authority page and then click Next. 8. On the Certificate Friendly Name and Description page, type a certificate name and optional description, as shown in Figure 5.19, and then click Next.

328

Chapter 5: Planning User, Computer, and Group Strategies

Figure 5.19 You can specify a name and description for your certificate on the Certificate Friendly Name and Description page.

9. Review the information provided on the Completing the Certificate Request Wizard page. If any information is incorrect, click Back to modify it. Then click Finish to create the certificate. 10. A message box informs you the request was successful. Click OK. 11. The requested certificate appears in the details pane of the Certificates console (see Figure 5.20).

Figure 5.20 After the certificate is created, it appears in the details pane of the Certificates console.

Follow Step by Step 5.5 to enroll every user who requires a smart card. This procedure includes security enhancements added to Internet Explorer 6 in Windows Server 2003 Service Pack 1 (SP1).

329

User Authentication Strategy

STEP BY STEP 5.5 Enrolling Users for Smart Cards 1. At the enrollment station computer, type http:///certsrv, where is the name of the certificate server computer. 2. If you receive a message informing you that content is being blocked by the Internet Explorer Enhanced Security Configuration, click Add. If the check box labeled Require Server Verification (https:) for All Sites in This Zone is selected, deselect it and then click OK to close the Internet Options dialog box. Click Add again and then click Close to add the website to the Trusted sites zone. 3. The Microsoft Certificate Services web page opens, as shown in Figure 5.21. Select the Request a Certificate link.

Figure 5.21 The Certificate Services web page is the location from which you can request all types of certificates.

4. On the Request a Certificate page, select the Advanced Certificate Request link. 5. On the Advanced Certificate Request page, shown in Figure 5.22, select the link labeled Request a Certificate for a Smart Card on Behalf of Another User by Using the Smart Card Certificate Enrollment Station.

330

Chapter 5: Planning User, Computer, and Group Strategies

Figure 5.22 The Advanced Certificate Request web page enables you to select several certificate types including smart card certificates.

6. If the Smart Card Certificate Enrollment Station page informs you that the site might require an ActiveX control, click the message and select Install ActiveX Control, as shown in Figure 5.23. Then click Install in the Internet Explorer–Security Warning dialog box that appears.

Figure 5.23 Installing an ActiveX control.

7. If you receive a message informing you that the proper version of the ActiveX control failed to download and install, and you might not have sufficient permissions, click Tools, Internet Options and select the Security tab of the Internet Options dialog box. Ensure that Trusted Sites is highlighted, and click Custom Level. In the Security Settings dialog box, scroll down to the Initialize and Script ActiveX Controls Not Marked As Safe setting. As shown in Figure 5.24, click Enable and then click OK. Click Yes to accept the warning that appears, and then click OK to close the Internet Options dialog box.

331

User Authentication Strategy

Figure 5.24 Enabling the scripting of ActiveX controls.

8. On the Smart Card Certificate Enrollment Station page, shown in Figure 5.25, configure the following options as required according to the message displayed under Status:

Figure 5.25 Specifying smart card certificate options from the Smart Card Certificate Enrollment Station page. . Certificate Template—Select either Smartcard Logon or Smartcard User, according to the certificate template required. . Certification Authority—If you are running more than one CA, select the required CA from this list. . Cryptographic Service Provider—Select the CSP that matches the brand of smart card you are using.

332

Chapter 5: Planning User, Computer, and Group Strategies . Administrator Signing Certificate—Click Select Certificate to locate the enrollment agent certificate you want to use. . User to Enroll—Click Select User. In the Select User dialog box, type the username or click Advanced to browse the Directory for the required name (see Figure 5.26). . Status—This feature informs you of any actions that you need to perform to complete the smart card enrollment process.

Figure 5.26 Selecting the user to be enrolled.

9. Insert the blank smart card into the writer attached to the enrollment computer and then click Enroll. 10. When prompted, specify a PIN for the smart card and select the option to force the user to change the PIN when he uses it for the first time. 11. After the smart card has been written, click New User to enroll another user if required. You can also click View Certificate to check the certificate.

In addition to the messages mentioned in Step by Step 5.5, you could receive several other error messages. For additional information on these errors and how to correct them, refer to the Microsoft article “ActiveX Error Messages Using Certificate Enrollment Web Pages to Enroll a Smart Card in Internet Explorer” in the “Suggested Readings and Resources” section. After you have generated smart cards for all users who require them, you can configure Active Directory to require smart cards for logon. You can specify this requirement for multiple users in a domain or OU at a single time by following the procedure outlined in Step by Step 5.6.

STEP BY STEP 5.6 Requiring the Use of Smart Cards for Logon 1. Click Start, Administrative Tools, Active Directory Users and Computers to open the Active Directory Users and Computers console. 2. Select the OU or container in which the user accounts reside to display the accounts in the details pane. 3. Use the Ctrl and Shift keys to select multiple users as required, right-click, and choose Properties.

333

User Authentication Strategy 4. On the Properties on Multiple Objects dialog box, scroll the Account Options list to locate the Smart Card Is Required for Interactive Logon option, select it, and then click OK (see Figure 5.27).

Figure 5.27 You can require multiple users to use smart cards from the Properties on Multiple Objects dialog box in Active Directory Users and Computers.

5. You return to Active Directory Users and Computers. These users now require a smart card and PIN to log on.

If you need to require that all users in a site, domain, or OU use smart cards for logon, you can configure a Group Policy setting. Step by Step 5.7 shows you how:

STEP BY STEP 5.7 Requiring That All Users Employ Smart Cards for Logon 1. Click Start, Administrative Tools, Active Directory Users and Computers to open the Active Directory Users and Computers console. 2. Right-click the domain or OU containing the required user accounts and choose Properties. 3. On the Group Policy tab of the Properties dialog box that appears, select an appropriate GPO (or create a new GPO) and click Edit to open the Group Policy Object Editor. 4. Navigate to Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options. 5 Right-click the policy labeled Interactive Logon: Require Smart Card and choose Properties. 6. On the Interactive Logon: Require Smart Card Properties dialog box, select Define This Policy Setting and select the Enabled option, and then click OK.

334

Chapter 5: Planning User, Computer, and Group Strategies 7. Right-click the policy labeled Smart Card Removal Behavior and choose Properties. 8. As shown in Figure 5.28, this policy provides several options for defining the behavior that occurs if a user removes her smart card: . No Action—The user can continue to work until she logs off. . Lock Workstation—Removal of the smart card locks the computer. The user can unlock the computer by selecting Log On Interactively or providing the smart card’s PIN. . Force Logoff—Removal of the smart card automatically logs the user off from the computer. . Disconnect If a Remote Terminal Services Session—Removal of the smart card automatically logs the user off from the Terminal Services session. The user remains logged on to the computer.

Figure 5.28 Group Policy defines four options for action taken when a user removes her smart card.

9. Select the appropriate option and click OK. 10. Close the Group Policy Object Editor.

EXAM ALERT Smart Cards and Remote Access Should a situation arise where you must require remote access users but not local users to use smart cards for logon, you can follow two procedures at the Routing and Remote Access (RRAS) server. In the RRAS MMC console, open the RRAS server’s Properties dialog box to the Security tab, select the Authentication Methods button, and then select Extensible Authentication Protocol (EAP). In the Local Security Policy console for the RRAS server, enable the Interactive Logon: Require Smart Card policy as described in Step by Step 5.7. In a scenario where an OU contains RRAS servers but not domain controllers, you can enable this policy setting in a GPO linked to the OU.

335

User Authentication Strategy

Domain Password Policy Objective

Plan a user authentication strategy . Create a password policy for domain users

Password policy is a portion of Group Policy’s account policies. In this chapter, we introduce you to the available account settings including password policy and account lockout policy. We discuss Group Policy as a whole in Chapter 7. Password policy controls how passwords are used and created. The more restrictive you make the password policy, the tighter the password security it provides. Common hacker strategies for discovering passwords include continually trying passwords until one works. This approach is not as futile as it might first seem. Hackers employ programs that use dictionaries to run through countless passwords until they discover a working password for a particular user account. In fact, dictionary attacks are only one means of password cracking, and hacker technology continues to improve along with all other technologies. Account lockout policy works with password policy to lock a user out of the computer if he enters an incorrect password a specified number of times. It is designed to thwart the password-cracking programs mentioned here.

Using Group Policy to Configure Password Policy Settings You can use domain-based Group Policy to configure password policy options designed to protect Windows 2000 and XP Professional computers and users. The options available in Windows Server 2003 are similar to those in Windows 2000 Server and replace Windows NT’s User Manager for Domains as the utility employed for this task. Password policies are generally intended to make passwords more difficult for intruders to discover.

EXAM ALERT Password Policy Can Be Set Only on a Domainwide Basis You might be asked to choose from setting a password policy at the site, domain, or OU level. Windows ignores password policies configured at the site or OU level; the only correct choice on such a question is at the domain level.

You can configure the following password policy settings: . Enforce Password History—This value determines the number of passwords to

retain in a password history for each user. Values range from 0 to 24. A user is not

336

Chapter 5: Planning User, Computer, and Group Strategies

allowed to reuse a password retained in the history list. And, of course, the oldest passwords are deleted from the list first. Setting this value to 0 means that no password history will be kept and a user will be allowed to reuse passwords at will. In Windows Server 2003, the default is 3. Windows Server 2003 with SP1 increases this default to the maximum of 24. . Maximum Password Age—This value determines the number of days to use a pass-

word before a user is required to specify a new password. Again, a value of 0 indicates that a user may manage his password in whatever way he chooses. The default value is 42 days. Values can range from 0 to 999 days. . Minimum Password Age—This value determines the minimum number of days a

password must be used before it can be altered. A value of 0 allows immediate change. If password history is being enforced, setting this value to 0 would allow a user to run through an entire history list of passwords in a short period of time (that is, repeatedly change a password). This would defeat the purpose of enforcing password history. The minimum password age must be less than or equal the maximum password age. Windows Server 2003 with SP1 sets the default to 1 day. . Minimum Password Length—This value determines the minimum number of char-

acters that can make up a password. A setting of 0 (which is the default value) permits a blank password. Use a setting of 10 or higher for increased security. Permitted values range from 0 to 14. Windows Server 2003 with SP1 sets the default to 7 characters. . Passwords Must Meet Complexity Requirements—Enabled by default in Windows

Server 2003 SP1, this policy requires that a password must meet certain password complexity criteria: It cannot contain the user account name or full name. It must contain at least three of the following four options: . English uppercase letters . English lowercase letters . Numerals . Nonalphanumeric characters such as | ; $ }{ ! . . Store Password Using Reversible Encryption—This option determines the level of

encryption used by Windows Server 2003 for storing passwords. It is a reduced level of security because it stores passwords in a format that is effectively the same as plain text. This option is disabled by default. You should use this option only for clients that are unable to use normal encryption, such as Macintosh computers or CHAP remote access authentication.

337

User Authentication Strategy

NOTE Default Password Filter The default password filter is defined in the file Scecli.dll in %systemroot%\ System32. This filter requires that passwords contain at least six characters, including at least three of the groups, lowercase letters, uppercase letters, numerals, and nonalphanumeric characters. In addition, the password cannot be based on the user’s account name. You can customize this filter by furnishing a different version of this file.

WARNING Don’t Require Too Strong a Password Policy If you require overly long and complex passwords, and make users change them too frequently, they will forget their passwords more often, resulting in a lot of help desk calls. Or they will write down the password on a sticky note attached to the monitor or keyboard for anyone else to find and copy. Balance your need for secure passwords against these risks.

Windows Server 2003 provides the Default Domain Security Settings MMC console from which you can configure default domain security policy settings, including password policy. Follow Step by Step 5.8 to configure these settings.

STEP BY STEP 5.8 Configuring Account Policy 1. Ensure you are logged on as an administrator. 2. Click Start, Administrative Tools, Domain Security Policy to open the Default Domain Security Settings console. 3. Expand the Security Settings\Account Policies node. Then select Password Policy to display the available policy settings in the details pane, as shown in Figure 5.29.

Figure 5.29 You can configure password policy from the Default Domain Security Settings console.

338

Chapter 5: Planning User, Computer, and Group Strategies 4. For each of the available settings, right-click it and choose Properties. 5. In the Properties dialog box for the selected setting, configure the appropriate value and then click OK. See Figure 5.30 for an example.

Figure 5.30 Configuring the password length policy.

NOTE Multiple Group Policy Objects Rather than edit the default domain policy as described here, you might want to create a separate GPO using Active Directory Users and Computers. You might also want to use the Group Policy Management Console. See Chapter 7 for more information.

Using Group Policy to Configure Account Lockout Settings If a password is cracked, the user account as well as the security of the entire network is in jeopardy. Account lockout policy is designed to prevent someone familiar with your organization or with Windows 2000/XP Professional default usernames from repeatedly trying to log on to a computer. An account policy sets a limit on logon attempts before a user (or potential intruder masquerading as a legitimate user) is locked out of the computer.

NOTE Local logons Domain account policies also apply when you log on to a member computer with a local user account.

339

User Authentication Strategy

The Account Lockout Policy options are available under the Password Policy options in the Group Policy Object Editor snap-in, as Figure 5.31 shows. Its settings are summarized as follows:

Figure 5.31 Account Policy options lock a user out of the system after a certain number of logon attempts have been tried and have failed.

. Account Lockout Duration—By default, accounts that have exceeded a certain num-

ber of failed logon attempts are locked out for 30 minutes. Every account except for the Administrator account can be locked out in this manner. The duration value is the length of time that an account is locked out, which you can set from 0 to 99999 minutes, about 69.4 days. In this case, a 0 value means that accounts that have exceeded a certain number of failed logon attempts are locked out indefinitely unless an administrator unlocks the account. . Account Lockout Threshold—This value is the number of acceptable failed logon

attempts before an account will be locked out. You can set it from 0 to 999 failed attempts. A 0 value means that no matter how many failed logon attempts are made, the account will never be locked out. The default value is 30 minutes. . Reset Account Lockout Counter After—This value specifies the number of minutes

to wait after which the lockout counter is reset to 0. Values can range from 1 to 99999. The default value is 30 minutes. New with SP1, Windows Server 2003 sets default values for the three account lockout policies. You can modify these if your security requirements dictate. Follow Step by Step 5.9 to configure account lockout settings.

340

Chapter 5: Planning User, Computer, and Group Strategies

STEP BY STEP 5.9 Configuring Account Lockout Policy 1. Access the Group Policy Object Editor snap-in for the default domain policy or any other GPO linked to the domain. 2. Expand the Computer Configuration\Windows Settings\Security Settings\Account Policies\Account Lockout Policy node. 3. In the details pane, right-click the required policy and choose Properties. 4. Specify a value for the policy setting and then click OK or Apply. 5. If you want to change an additional policy setting, right-click the appropriate policy, choose Properties, and then make the desired modification.

EXAM ALERT Remember That Account Policies Can Be Applied at the Domain Level Only Because these policies relate to the security of the domain, you can configure them at the domain level only. Although the policies always appear in the Group Policy Object Editor snap-in and can always be configured, they are processed only if the GPO is linked to the domain. If the GPO is linked to any other container, these policies are ignored.

Using Security Configuration and Analysis to Configure Password Policy Windows Server 2003, like Windows 2000, provides a series of security templates that you can use to configure a number of security settings including password policy. Using these templates, you can easily make modifications to domain security settings rather than configure these settings individually. You can use the Security Templates console to prepare a standard set of security configurations that you can import into Group Policy to configure security at the domain or OU level. You would also use these tools to modify local security settings that are not configured with Group Policy, for example in a workgroup environment. In addition, you can use Security Configuration and Analysis to compare existing security settings with those specified in policies. Working with security templates involves two snap-ins: Security Templates and Security Configuration and Analysis. Follow Step by Step 5.10 to create an MMC console containing these snap-ins.

341

User Authentication Strategy

STEP BY STEP 5.10 Creating a Security MMC Console 1. Ensure that you are logged on as an administrator. 2. Click Start, Run, type mmc, and then press Enter to display a blank MMC console. 3. Click File, Add/Remove Snap-In to display the Add/Remove Snap-In dialog box. 4. Click Add to display the Add Standalone Snap-In dialog box. 5. Select Security Configuration and Analysis and then click Add. 6. Select Security Templates and then click Add (see Figure 5.32).

Figure 5.32 Adding the Security Configuration and Analysis and Security Templates snap-ins to an MMC console.

7. Click Close to return to the Add/Remove Snap-In dialog box. The two snap-ins you selected are displayed in this dialog box. 8. Click OK. The two snap-ins appear in the console tree of the MMC console, as shown in Figure 5.33.

342

Chapter 5: Planning User, Computer, and Group Strategies

Figure 5.33 Clicking OK displays the two snap-ins in the MMC console.

9. Click File, Save As, type a descriptive name such as Security.msc, and then click Save. The console is saved in the Administrative Tools folder unless you select another location.

You now have a tool from which you can configure several aspects of domain security. In this chapter, we discuss the use of this tool for configuring password policy. We discuss other uses of this tool in Chapter 7. The default Security Templates snap-in in Windows Server 2003 SP1 contains nine prebuilt security templates that are .INF files stored in the C:\Windows\Security\Templates folder. You can use these templates directly to configure security options including password policy. If necessary, you can modify these templates; however, Microsoft recommends that you create a copy of the template and modify the copy. Doing so enables you to go back to the original template if required. For purposes of domain password policy, we look at three templates that control domain controller security. Table 5.3 outlines the default settings in each of these templates. TABLE 5.3 Default Password Policy Settings Available from the Security Templates Snap-In Setting

DC Security

Securedc

Hisecdc

Enforce password history

Not defined

24 passwords remembered

24 passwords remembered

Maximum password age

Not defined

42

42

Minimum password age

Not defined

2

2

Minimum password length

Not defined

8

8

Password must meet complexity requirements

Not defined

Enabled

Enabled

Store passwords using reversible encryption

Not defined

Disabled

Disabled

343

User Authentication Strategy

If these settings are not suitable for your security requirements, you can create a modified template before you apply them to your client computers. There are some advantages to creating new security templates and leaving the default ones intact. The main advantage is that the default template is still available, in case you want to go back to it should you discover later that your new settings are unsuitable. You might also want to copy the template in case you want to enforce settings in other nodes along with the password policy or use the template in another domain. In this case, working from a copy is faster than re-creating all settings from scratch. See Chapter 7 for more information on the various security settings. Follow Step by Step 5.11 to create a modified template:

STEP BY STEP 5.11 Modifying Security Template Settings 1. If the Security console you just created is not open, navigate to it from the Administrative Tools folder or double-click the desktop icon, according to where you saved the console. 2. In the console tree, expand Security Templates to display the C:\Windows\Security\Templates folder. If your system root drive is different, the path of the folder displayed will reflect this. 3. Expand this node to reveal the nine security templates contained therein, as shown in Figure 5.34.

FIGURE 5.34 Nine preconfigured security templates are available in the Security\Templates folder.

4. Right-click the security template whose settings are most similar to those you want to specify and choose Save As. Specify a name for the modified template (for example, mysecuredc) and then click Save. 5. Expand the security template that you just saved, to reveal the folders contained therein, as shown in Figure 5.35.

344

Chapter 5: Planning User, Computer, and Group Strategies

Figure 5.35 Expanding a security template reveals a hierarchy of folders inside it.

6. Expand the Account Policies folder to reveal the Password Policy subfolder. Then select this folder to display the available policies in the details pane, as shown in Figure 5.36.

Figure 5.36 The Password Policy subfolder in each security template contains the same policies as seen earlier in the Default Domain Security Settings console.

7. Right-click the policy you want to modify and choose Properties. 8. In the Properties dialog box for the selected setting, configure the appropriate value and then click OK. See Figure 5.37 for an example.

345

User Authentication Strategy

Figure 5.37 Modifying the minimum password age policy from the Security console.

9. Repeat this procedure for other policies you want to modify. 10. Save your changes by right-clicking the template and selecting Save. 11. Close the Security console.

After you’ve made the required modifications, you are ready to apply the security template, by importing it into Group Policy. By creating a template file and importing it into Group Policy, you can ensure that all settings (not just password policy settings) that you require to conform to a corporate security policy are properly applied to all computers in the domain. You can also use the template to test settings in a lab environment or with a single computer before deploying them to your domain. We discuss the use of the Security Configuration and Analysis console for testing settings on a single computer in Chapter 7. To apply the security template to a domain-based Group Policy, follow the procedure outlined in Step by Step 5.12.

NOTE Group Policy Management Console (GPMC) If you are using GPMC, the procedure for accessing the Group Policy Object Editor is slightly different. See Chapter 7 for more information.

STEP BY STEP 5.12 Applying Security Template Settings 1. Ensure that you are logged on to the domain as a member of the Domain Admins group. 2. Click Start, Administrative Tools, Active Directory Users and Computers. 3. In the console tree, right-click your domain and choose Properties. 4. Select the Group Policy tab of the domain’s Properties dialog box, as shown in Figure 5.38.

346

Chapter 5: Planning User, Computer, and Group Strategies

Figure 5.38 You can access domain-related GPOs from the Group Policy tab of the domain’s Properties dialog box.

5. Select the appropriate GPO and click Edit to display the Group Policy Object Editor console focused on this GPO. 6. Expand the Computer Configuration\Windows Settings\Security Settings node. 7. Right-click this node, and choose Import Policy. This displays the Import Policy From dialog box, as shown in Figure 5.39.

Figure 5.39 You can select the required security template from the Import Policy From dialog box.

8. Select (or navigate to) the desired security template and then click Open. Doing so imports the security template settings to Group Policy and returns you to the Group Policy Object Editor console. 9. Exit the console to save your changes. 10. Click OK to close the domain’s Properties dialog box and then close Active Directory Users and Computers.

347

User Authentication Strategy

TIP Always Test Your Password Policies Before you apply these or other security policy settings, make sure that you test them in a lab environment before deploying them to your production environment. Testing now will save user problems and help desk calls later.

After you’ve applied the template to your domain as outlined here, it will apply to all computers in the domain after it has propagated to all domain controllers via Active Directory replication. You can then use the Security Configuration and Analysis console to verify that the settings have been applied. We discuss the use of this console in Chapter 7.

Challenge Security Templates and Password Policies Managers at widgets.com are concerned that users have been employing easy-to-guess passwords that could provide a means of unauthorized access to their network. They have decided that a uniform password policy should be put in place across the entire network, which contains two child domains named north.widgets.com and south.widgets.com as well as the widgets.com root domain. They have decided that the password policy should include the following settings: . A history of 24 passwords remembered. . A maximum password age of 30 days. . A minimum password age of 5 days. . A minimum password length of 9 characters in the widgets.com domain and 10 characters in the north.widgets.com and south.widgets.com domains. . Passwords are to contain at least three of the groups, lowercase letters, uppercase letters, numerals, and special characters. Your task is to implement these policies for all users in the three domains that make up the widgets.com forest. Try to work through the steps on your own. There may be more than one way to

accomplish this task. If you have any difficulty, refer to the following steps: 1. Log on to the widgets.com domain controller as an administrator. 2. Create a custom MMC console containing the Security Templates snap-in. 3. In the custom console, expand the C:\WINDOWS\Security\Templates folder to locate the preinstalled security templates. 4. Right-click the securedc template and choose Save As. Save a copy of this template as Widgets.inf in the Templates folder. 5. Expand the Widgets.inf template to display the contents of the Account Policies\Password Policy node in the details pane. (continues)

348

Chapter 5: Planning User, Computer, and Group Strategies (continued)

6. Configure the appropriate values for password policy settings. Note that you do not need to modify every policy setting. 7. Right-click the Widgets.inf template and choose Save As. Save another copy of this template as Widgets2.inf in the Templates folder. 8. Expand the Widgets2.inf template to display the contents of the Account Policies\Password Policy node in the details pane. 9. Modify the minimum password length policy setting to reflect the 10-character minimum required in the two child domains. 10. Close the customized security console. 11. In the Save Security Templates dialog box, click Yes to save the changes you made to the Widgets.inf and Widgets2.inf templates. 12. Open Active Directory Users and Computers focused on the widgets.com domain. 13. Right-click the domain and choose Properties. 14. From the Group Policy tab, select the Default Domain Policy GPO and click Edit. 15. Expand the Windows Settings node to reveal Security Settings, right-click this node, and select Import Policy. 16. In the Import Policy From dialog box, choose Widgets.inf and then click Open. 17. Expand the Security Settings node to reveal Account Policies and then Password Policy. Note that the settings you configured in the template appear in the details pane. 18. Close the Group Policy Object Editor and close the widgets.com Properties dialog box. 19. Right-click Active Directory Users and Computers and choose Connect to Domain. 20. In the Connect to Domain dialog box, type north.widgets.com and click OK. 21. Repeat steps 13–18, selecting Widgets2.inf to apply this security template to the north.widgets.com domain. 22. Right-click Active Directory Users and Computers and choose Connect to Domain. 23. In the Connect to Domain dialog box, type south.widgets.com and click OK. 24. Repeat steps 13–18 again, selecting Widgets2.inf to apply this security template to the south.widgets.com domain.

349

Chapter Summary

Chapter Summary This chapter looked at several topics that are important to security in an Active Directory domain. You saw what types and scopes of groups are available in Active Directory, how and when you would use these groups, and how the capabilities for group nesting vary with the domain functional level. You next looked at the capabilities for creating multiple user and group accounts with Csvde, Ldifde, Dsadd, and scripts. You then looked at two aspects of secure user authentication: smart cards and passwords. Using smart cards requires that a user possess both the card and the corresponding PIN. In addition to installing the smart card hardware, you have to install a certificate server, request and issue the certificates, obtain a signing certificate, and enroll the users for smart cards. Finally, you have to modify the properties of the user accounts to require the use of smart cards for logon. You can also create a group with permissions to perform these tasks. Password policy specifies the properties of acceptable passwords on a domainwide basis. You can specify the minimum and maximum password age, minimum password length, complexity requirements, and password history. SP1 in Windows Server 2003 upgrades the defaults for several of these properties.

Key Terms . Certificate . Certification authority (CA) . Csvde . Distribution group . Domain local group . Dsadd . Global group . Group nesting . Group Policy Object (GPO) . Ldifde . Password complexity . Password policy

350

Chapter 5: Planning User, Computer, and Group Strategies . Public Key Infrastructure (PKI) . Security Configuration and Analysis . Security group . Security Template . Smart card . Universal group . Windows Script Host (WSH)

Apply Your Knowledge The 70-294 exam tests your knowledge of the various situations that can be encountered when planning user, computer, and group strategies. You need to be aware of the various group types and scopes, and when you would use each of these. You also need to know how to plan and implement smart cards and password policies. The exercises and exam questions presented here serve to reinforce these requirements. Note that you may encounter drag-and-drop or hot-spot questions on the exam. Due to the limitations of the printed page, we are unable to include questions of these types in the exam questions section. However, the explanations suggest the possibility of these question types where appropriate.

Exercises 5.1 Creating Organizational Units In this exercise, you create a couple of OUs that you will use in later exercises of this chapter. These exercises assume that you have a domain controller named Server1 for the domain1.com domain, running in Windows 2000 mixed functional level. If your domain controller is operating at a higher functional level, you need to demote it to a standalone server and then reinstall Active Directory as described in Chapter 2. Estimated Time: 5 minutes 1. Log on to Windows Server 2003 with the Administrator account. 2. Click Start, Administrative Tools, Active Directory Users and Computers.

351

Apply Your Knowledge 3. In the console tree, expand domain1.com to reveal the default containers included therein. 4. Right-click the Users container and choose New, Organizational Unit. 5. Type Sales as the name of the OU you are creating and then click OK. 6. Repeat steps 3 and 4 to create another OU. Type Legal as the name of this OU and then click OK. 7. Leave Active Directory Users and Computers open for the next exercise.

5.2 Creating Groups and Users In this exercise, you create several groups that you will later use to demonstrate the capabilities and limitations of group nesting in Windows Server 2003 Active Directory. At the same time, you will create a user to be employed in later exercises for smart cards and password policy. Estimated Time: 10 minutes 1. In the console tree of Active Directory Users and Computers, right-click the Sales OU and choose New, Group. 2. Under Group Scope, notice that the Universal option is unavailable. Why is this the case?

3. Type Associates as the name of the group and ensure that Global is selected for the Group Scope and Security is selected for the Group Type. Then click OK. 4. Repeat steps 1 and 3, specifying Operators as the name of another global group. 5. Repeat steps 1 and 3 again, specifying Distributors as the name of the group. This time, select Domain Local as the scope for this group. 6. Right-click the Sales OU and select New, User. 7. In the New Object—User dialog box, create a user named Joe Smart with a user logon name of JoeS and a password of P@ssword. Deselect the User Must Change Password at Next Logon check box. 8. Right-click this user and choose Add to a Group. 9. In the Select Group dialog box, browse to or type Server Operators and then click OK. This step is necessary to enable this user to log on to the server in later exercises. 10. Leave Active Directory Users and Computers open for the next exercise.

352

Chapter 5: Planning User, Computer, and Group Strategies

5.3 Nesting Groups In this exercise, you attempt to add one group to another to demonstrate the available nesting properties on the groups you just created. Estimated Time: 10 minutes 1. In the details pane of Active Directory Users and Computers, the three groups you just created should be visible. If not, click the Sales OU in the console tree. 2. Right-click the Associates group and choose Properties. 3. On the Associates Properties dialog box, click the Member Of tab. By specifying a group name in this tab, you are adding the Associates group to the group you specify. 4. Click Add. In the Add Groups dialog box, type Operators as the name of the group to be added to this group and then click OK. What happens?

5. Click Cancel. 6. Back in the Add Groups dialog box, type Distributors as the name of the group to be added. What happens?

7. Click OK. 8. Leave Active Directory Users and Computers open for the next exercise.

5.4 Raising the Domain Functional Level In this exercise, you raise the domain functional level so that you can receive all the capabilities of group nesting. Estimated Time: 5 minutes 1. In the console tree of Active Directory Users and Computers, right-click domain1.com and choose Raise Domain Functional Level. 2. In the Raise Domain Functional Level dialog box, select Windows Server 2003 as the domain functional level and then click Raise. 3. A message box informs you that the change cannot be reversed. Click OK.

353

Apply Your Knowledge 4. You are informed that the functional level was raised successfully and that the new functional level will now replicate to all domain controllers in the domain. Click OK. 5. Leave Active Directory Users and Computers open for the next exercise.

5.5 Nesting Groups In this exercise, you repeat the nesting of groups to demonstrate the capabilities of the current functional level. Estimated Time: 5 minutes 1. In the console tree of Active Directory Users and Computers, click the Sales OU to make its contents visible. 2. Right-click the Associates group and choose Properties. 3. On the Associates Properties dialog box, click the Member Of tab. 4. Click Add. In the Add Groups dialog box, type Operators as the name of the group to be added to this group and then click OK. What happens?

5. Click OK. 6. Close Active Directory Users and Computers.

5.6 Installing IIS To demonstrate several aspects of creating certificates for smart cards, you first install IIS on the domain controller in the domain1.com domain. This action is required to display the certificate enrollment web pages. Estimated Time: 15 minutes 1. Click Start, Administrative Tools, Manage Your Server. The Manage Your Server dialog box appears and informs you that your server has been configured with the Domain Controller and DNS Server roles. 2. Click Add or Remove a Role. The Configure Your Server Wizard displays a Preliminary Steps page, informing you of preliminary steps that should be completed. 3. Click Next. The Server Role page appears, listing the roles with which you can set up the server. 4. Click Application Server (IIS, ASP.NET) and then click Next. 5. On the Application Server Options page, select Enable ASP.NET, and then click Next.

354

Chapter 5: Planning User, Computer, and Group Strategies 6. Review the information provided on the Summary of Selections page and then click Next to start installing IIS. 7. The Windows Components Wizard page appears and then asks you for the Windows Server 2003 Service Pack 1 CD-ROM. Insert the CD-ROM and then click OK. 8. If the Welcome to the Windows Server 2003 Family page appears, click Exit to close it. 9. After several minutes, the Configure Your Server Wizard displays a page informing you that this server is now an application server. Click Finish to close the wizard. 10. The Manage Your Server application now displays the new role of application server in its list of roles. Close this application.

5.7 Installing Certificate Services In this exercise, you install the Certificate Services MMC snap-in so that you can issue smart card certificates. Estimated Time: 10 minutes 1. Click Start, Control Panel, Add or Remove Programs. 2. Click Add/Remove Windows Components to start the Windows Components Wizard. 3. On the list displayed by this wizard, click Certificate Services. 4. The wizard warns you that changing the machine name or domain membership will invalidate certificates installed by this CA. Click Yes to accept this warning and install Certificate Services, and then click Next. 5. Select Enterprise Root CA as the role of this certificate server and then click Next. 6. On the CA Identifying Information page, type Smart Card Issuing CA for the name of this CA and then click Next. 7. Accept the locations suggested for the certificate database and certificate database log and then click Next. 8. A message box informs you that IIS must be temporarily stopped to complete the Certificate Services installation. Click Yes. 9. If the Windows Server 2003 Service Pack 1 CD-ROM is not in the CD-ROM drive from the preceding exercise, you are asked to insert it. Click OK. 10. You are informed that Active Server Pages (ASPs) must be enabled to allow Certificate Services to provide enrollment services. Click Yes. 11. After a few minutes, the Completing the Windows Components Wizard page appears. Click Finish. 12. Close Control Panel and the Add or Remove Programs applet.

355

Apply Your Knowledge

5.8 Configuring Certificate Services In this exercise, you configure the Certificate Services MMC console to issue smart card certificates. Estimated Time: 5 minutes 1. Click Start, Administrative Tools, Certification Authority to open the Certification Authority console. 2. Expand your certificate server to reveal the folders contained therein. 3. Right-click Certificate Templates and choose New, Certificate Template to Issue. This displays the Enable Certificate Templates dialog box. 4. Select Enrollment Agent, scroll down and press Ctrl to select Smartcard Logon, and then click OK. 5. If the contents of the Certificate Templates folder do not appear in the details pane, click this folder. The templates you added should appear in the details pane. 6. Close the Certification Authority console.

5.9 Obtaining a Signing Certificate Before you can enroll users for smart cards, you must have the appropriate signing certificate. In this exercise, you request this certificate using the New Certificate Wizard. Estimated Time: 5 minutes 1. Click Start, Run. Type certmgr.msc and then press Enter. 2. In the Certificates console, expand the Personal folder and then click the Certificates console displayed therein. 3. Note that a default Administrator certificate is already present. Also, note that this certificate is intended only for file recovery. 4. Right-click Certificates and choose All Tasks, Request New Certificate to start the New Certificate Wizard. 5. Click Next. On the Certificate Types page, select Enrollment Agent. 6. On the Certificate Friendly Name and Description page, type Smart Card Enrollers for the certificate name. Leave the description blank and then click Next. 7. On the Completing the Certificate Request Wizard page, click Finish to complete the certificate request. 8. You are informed that the certificate request was successful. Click OK. The certificate you just created appears in the details pane. 9. Close the Certificates console.

356

Chapter 5: Planning User, Computer, and Group Strategies

5.10 Enrolling a User for a Smart Card Having obtained the appropriate signing certificate, you can now begin the process of enrolling a user for a smart card. Without smart card hardware attached to your computer, you cannot complete the exercise. However, you can do the first portion of the user enrollment to demonstrate the process. The exercise assumes that you are working from the Server1 computer (if not, type the correct computer name in the first step). Estimated Time: 10 minutes 1. Click Start, Run. Type http://server1/certsrv and then press Enter to display the Microsoft Certificate Services web page. 2. If you receive a logon dialog box, type the username and password of an administrative account and then click OK. 3. If you receive a message informing you that the Internet Explorer Enhanced Security Configuration is blocking content, click Add to add the site to the Trusted Sites zone. In the Trusted Sites dialog box that appears, click Add and then click Close. 4. In Internet Explorer, click Tools, Internet Options. 5. On the Security tab of the Internet Options dialog box, ensure that Trusted sites is selected and then click Custom Level. 6. On the Security Settings dialog box, scroll to locate the Initialize and Script ActiveX Controls Not Marked As Safe setting, select Enable for this setting, and then click OK. Refer back to Figure 5.24 if you have difficulty. 7. Click Yes to accept the warning and then click OK to close the Internet Options dialog box and return to the Certificate Services web page. 8. Click the Request a Certificate link. 9. On the next page, click the Advanced Certificate Request link. 10. On the Advanced Certificate Request page, click the Request a Certificate for a Smart Card on Behalf of Another User by Using the Smart Card Certificate Enrollment Station link. 11. If you receive a message box informing you that an ActiveX control on this page might be unsafe to interact with other parts of the page, click Yes to allow the interaction. 12. If you receive an ActiveX warning message, click Yes to close it. 13. Under Certificate Template, select Smartcard Logon. 14. Under User to Enroll, click the Select User command button. 15. In the Select User dialog box, type or browse to the JoeS user you created earlier. Then click OK. 16. The distinguished name (DN) of this user (JoeS@ domain1.com) appears. Click Enroll. 17. At this point, if you do not have a smart card reader, you receive an error message. Click OK and close the Smart Card Certificate Enrollment Station web page.

357

Apply Your Knowledge

5.11 Configuring a Password Policy In this exercise, you use the Default Domain Security Settings MMC to require that passwords must be at least 10 characters in length and meet the complexity requirements. Estimated Time: 10 minutes 1. Click Start, Administrative Tools, Active Directory Users and Computers. 2. Right-click the domain1.com domain. Then choose Properties to display the domain1.com Properties dialog box. 3. Select the Group Policy tab. Notice the Default Domain Policy GPO there. 4. Select this GPO and click Edit to display the Group Policy Object Editor console. 5. In the console tree, navigate to the Computer Configuration\Windows Settings\Security Settings\Account Policy\Password Policy node. 6. Right-click the Minimum Password Length Policy and choose Properties. 7. Change the setting to 10 characters and then click OK. 8. Right-click Password Must Meet Complexity Requirements and choose Properties. 9. Select Enabled and then click OK. 10. Close the Group Policy Object Editor dialog box. 11. Click OK to close the domain1.com Properties console. 12. Open a command prompt and type Gpupdate /force. This action ensures that modifications to Group Policy are immediately propagated throughout the domain. 13. Close Active Directory Users and Computers and then log off.

5.12 Testing the Password Policy In this exercise, you log on as the JoeS user you created earlier and test the password policy you just created. Estimated Time: 10 minutes 1. Log on to Windows Server 2003 as JoeS with a password of P@ssword. 2. Press Ctrl+Alt+Delete to display the Windows Security dialog box and then click Change Password. 3. On the Change Password dialog box, type P@ssword in the Old Password text box, type grapefruit in the New Password and Confirm New Password text boxes, and then click OK. What happens?

358

Chapter 5: Planning User, Computer, and Group Strategies 4. Type Grapefruit2 in the New Password and Confirm New Password text boxes and then click OK. What happens?

5. Log off.

Exam Questions 1. Sharon is attempting to request a smart card certificate from the Certificate Services console that she just installed on a Windows Server 2003 member server named server5. From the Run dialog box, she types http://server5/certsrv. However, Internet Explorer informs her that it cannot find the page. What does she need to do to receive this page?

❍

A. She needs to install IIS on the same computer.

❍

B. She needs to install the Certificate Services console on a domain controller rather than a member server.

❍

C. She needs to grant her user account the Read and Enroll permissions for smart card certificates.

❍ D. She needs to create an account with VeriSign or another certificate vendor. 2. David works for a company that has an Active Directory forest with four domains in a single tree. He needs to create a group containing 50 users who require access to resources in all four domains. The user accounts are all located in the forest root domain. Which group scope should he use?

❍

A. Universal

❍

B. Global

❍

C. Domain local

❍ D. Distribution 3. Chris is implementing a system of smart cards for his company’s Active Directory network. Technicians have installed smart card readers on every computer on the network, and Chris now needs to have smart cards created for all employees. Two junior administrators named Ethel and Simon will be assisting him in enrolling the users for smart cards. They are members of the Server Operators and Account Operators groups. However, when they access the enrollment pages, they receive an error message informing them that they are denied access. What does Chris need to do so that they can enroll users, without granting them excessive privileges?

❍

A. He needs to add their user accounts to the Administrators group.

❍

B. He needs to ask them to use the server on which Certificate Services is installed while enrolling the smart cards.

359

Apply Your Knowledge

❍

C. He needs to grant their user accounts the Read and Enroll permissions on the certificate templates.

❍ D. He needs to ask them to connect to the enterprise root CA when accessing the enrollment pages. 4. Debbie is a systems administrator who works for a worldwide shipping company. The company has operations on five continents and operates an Active Directory forest with five domains representing each continent. The forest includes a total of 28 sites, representing the various cities in which the company does business. Many users in the company need access to resources located on all the domains. For this reason, Debbie has created a large number of universal groups with several hundred users in each group. Later, she notices that a lot of network traffic is being replicated across the various slow links in the enterprise. Which of the following is the recommended method of handling universal groups that Debbie should employ?

❍

A. She should place the users into the universal groups and then place the universal groups into domain local groups.

❍

B. She should place the users into domain local groups and then place the domain local groups into universal groups.

❍

C. She should place the users into global groups and then place the global groups into universal groups.

❍ D. She has established the universal groups properly; the additional network traffic is being created from other network operations. 5. Rhonda is in charge of creating groups in a new domain that the senior administrators have created in her company’s Active Directory forest. The forest consists of a root domain named quepublishing.com and two child domains named manufacturing.quepublishing.com and sales.quepublishing.com. The forest functional level is Windows Server 2003. The company has 50 managers, some of whose user accounts are located in the manufacturing.quepublishing.com domain and others whose user accounts are located in the sales.quepublishing.com domain. These managers require access to resources in

both child domains. Rhonda needs to ensure that all managers have the appropriate access. She needs to accomplish this task while restricting administrators in the child domains to managing access needs for user accounts in their own domains. She must also ensure that global catalog replication is minimized. How should she proceed?

❍

A. Create a global group named Managers in each child domain, and add all user accounts for managers to the Managers group in their domain. Then create a domain local group in the quepublishing.com domain, and add both Managers groups to the domain local group.

❍

B. Create a global group named Managers in each child domain, and add all user accounts for managers to the Managers group in their domain. Create a universal group in the quepublishing.com domain, and add both Managers groups to the universal group. Then create a domain local group in each child domain and add the universal group to the domain local groups.

360

Chapter 5: Planning User, Computer, and Group Strategies

❍

C. Create a universal group in the quepublishing.com domain, and add all user accounts for managers to the universal group. Then create a domain local group in each child domain and add the universal group to the domain local groups.

❍ D. Create a domain local group in the quepublishing.com domain, and add all user accounts for managers to the universal group. Then create a domain local group in each child domain and add the universal group to the domain local groups. 6. Carolyn is a systems administrator for a company that operates an Active Directory network that includes a single domain. The domain functional level is set to Windows 2000 native. Carolyn’s manager has requested that she implement an account policy that requires all user accounts to be locked out if an incorrect password is entered three times within a one-quarter hour period. Such an account is to remain locked out until a help desk technician unlocks it. How should she configure the account policy? (Each answer represents part of the solution. Choose three answers.)

❏

A. She should set the account lockout duration to 0.

❏

B. She should set the account lockout duration to 1.

❏

C. She should set the account lockout threshold to 0.

❏ D. She should set the account lockout threshold to 1. ❏

E. She should set the account lockout threshold to 3.

❏

F. She should specify the reset account lockout counter setting as 0.25.

❏ G. She should specify the reset account lockout counter setting as 15. ❏ H. She should specify the reset account lockout counter setting as 900. 7. Keith is responsible for defining password policy throughout his company’s Active Directory forest, which contains a total of six domains in two domain trees. Management has specified that the password history contain 18 passwords, the maximum password age be 30 days, the minimum password age be 7 days, and the minimum password length be 8 characters. Complexity requirements are also to be enabled. What should Keith do to implement these policies with the minimum amount of effort?

❍

A. He needs to use the Security Templates console at each domain and apply the Securedc template to a GPO in each domain’s Properties dialog box in Group Policy Object Editor.

❍

B. He needs to use the Security Templates console at each domain and modify a security template to include all the stated requirements. He then needs to copy the modified template to each domain and apply it to a GPO in each domain’s Properties dialog box in Group Policy Object Editor.

361

Apply Your Knowledge

❍

C. He needs to use Group Policy Object Editor on a GPO to create a password policy in one domain that includes all the required settings. He then needs to copy this GPO and import it to each of the other domains.

❍ D. He needs to use Group Policy Object Editor on a GPO in every domain to create a password policy that includes all the required settings. 8. Sandra has configured a password policy for users in her company’s domain that specifies that passwords must be at least six characters long. The CIO has informed her that users in the legal department should have highly secure passwords. These users belong to the Legal OU. She configures a password policy in a GPO linked to this OU specifying that passwords be at least 10 characters long and meet complexity requirements. A few days later, she receives a call from the CIO asking her why she has not implemented the stricter password policy yet. What must Sandra do?

❍

A. She needs to configure the password requirement on a security group to which the legal users belong so that it will be accepted.

❍

B. She needs to manually replicate Group Policy to the other domain controllers so that the stronger password policies will come into effect.

❍

C. She needs to create a new site, place the legal users and their computers in this site, and then reapply the password policy to the site.

❍ D. She needs to create a new domain, place the legal users and their computers in this domain, and then reapply the password policy to the domain. 9. Tom’s company has trained a group of computer-savvy employees to be assistant operators who will receive additional permissions on the network to perform such tasks as resetting passwords, troubleshooting permissions, and so on. These employees will also be responsible for managing client computers whose accounts are located in a single OU in each of the company’s four domains. The computer-savvy employees are scattered among all these domains. Tom needs to create a single group that will accomplish all these requirements. Which group type and scope should he create?

❍

A. Universal and Security

❍

B. Global and Security

❍

C. Domain Local and Security

❍ D. Universal and Distribution ❍

E. Global and Distribution

❍

F. Domain Local and Distribution

362

Chapter 5: Planning User, Computer, and Group Strategies 10. Trevor is a systems administrator for a company that requires users to change their passwords once every two months. He realized that many employees are not changing their passwords every two months and decided that he should modify the company’s password policy. He goes to the Default Domain Policy GPO to make modifications that require the users to change their passwords once every two months. Which of the following policies should he configure to enforce this requirement fully? Choose three answers.

❏

A. Minimum password age

❏

B. Maximum password age

❏

C. Password complexity

❏ D. Password history

Answers to Exercises 5.2

Creating Groups and Users 2. The universal group scope is not available because the Windows 2000 mixed functional level does not support this group scope. The reason is that Windows NT 4.0 does not support this group scope; consequently, it is not available in this functional level, which supports Windows NT 4.0 backup domain controllers.

5.3

Nesting Groups 4. The Name Not Found message box informs you that the object named Operators could not be found. This problem occurred because you cannot add one global group to another while in the Windows 2000 mixed functional level. 6. The name of the Distributors group appears in the Member tab of the Properties dialog box, indicating that this group was successfully added. You achieved this result because you can add a global group to a domain local group at any functional level.

5.5

Nesting Groups 4. The name of the Operators group appears in the Member tab of the Properties dialog box, indicating that this group was successfully added. You achieved this result because you can add a global group to another global group in the same domain at the Windows 2000 native or Windows Server 2003 native functional levels.

363

Apply Your Knowledge

5.12

Testing the Password Policy 3. Windows did not accept the password change because the grapefruit password did not meet complexity requirements, although it was of sufficient length (10 characters). 4. Windows accepted the password change to Grapefruit2 because the password met the complexity requirements, containing three of the four types of characters as required.

Answers to Exam Questions 1. A. The certificate server uses IIS to serve the certificate enrollment pages, so Sharon needs to install IIS on this computer. In addition, if Certificate Services is installed on the computer before IIS is installed, she needs to open a command prompt and type the command certutil –vroot. This command registers and installs the enrollment pages. Sharon does not need to install Certificate Services on a domain controller, although doing so would enable her to use an enterprise root or enterprise subordinate CA. Therefore, answer B is wrong. Any user is able to access the certificate enrollment pages after they are available, so answer C is wrong. Because an enterprise or standalone root certificate server can act as the most trusted authority within its area of influence, an account with VeriSign is not necessary, so answer D is wrong. See the section “Smart Cards.” 2. B. David should create a Global group. He has a set of users who all belong to a single domain. He does not need to use a universal group because all users are located in a single domain, so answer A is wrong. A domain local group allows access to resources in a single domain only. Because the users need access to resources in all four domains, answer C is wrong. (Note, however, that David can and should add the global group to domain local groups in each domain for access to the resources.) A distribution group is for purposes such as email and does not grant access to resources, so answer D is wrong. Note that this question may be formulated as a “hot spot” question in which you must select the required group type and scope. See the section “Security groups.” 3. C. Anyone who is enrolling users for smart cards must have the Read and Enroll permissions on the certificate templates; otherwise, his requests will be denied. Only members of the Domain Admins and Enterprise Admins groups have these permissions by default. Chris could make Ethel and Simon members of the Administrators group; however, this would grant them excessive privileges, so answer A is incorrect. They can connect across the network to the certificate server, so answer B is incorrect. An enterprise subordinate or standalone subordinate certificate server can enroll certificates for smart cards, so answer D is incorrect. See the section “Smart Cards.” 4. C. Universal groups can contain user accounts from any domain in the forest and can be used to assign permissions to resources anywhere in the forest. The recommended strategy is to place users into global groups and then place the global groups into universal groups. By placing users directly into universal groups, every change in group membership must be replicated across slow links to global catalog servers in other domains, thus causing the increase in slow link traffic that Debbie observed. Placing the users into universal groups and adding these groups to domain local groups would cause the same increase in replication traffic, so answer A is wrong. Domain local groups cannot be nested into global or universal groups, so answer B is wrong. Because the strategy Debbie used caused the increase in replication traffic, answer D is wrong. See the section “Security Groups.”

364

Chapter 5: Planning User, Computer, and Group Strategies 5. B. Rhonda must create a global group named Managers in each child domain, and add all user accounts for managers to the Managers group in their domain. She should next create a universal group in the quepublishing.com domain, and add both Managers groups to the universal group. Then create a domain local group in each child domain and add the universal group to the domain local groups. This strategy conforms to the Microsoft best practice of group creation. If she were to create a domain local group in the quepublishing.com domain and add the global groups to this group, the managers would receive access to resources in the quepublishing.com domain but not the child domains, so answer A is incorrect. If she were to add the user accounts of the managers to the universal group without the use of global groups, global catalog replication would be increased whenever membership in the universal group changes, so answer C is incorrect. If she were to add the user accounts of the managers directly to the domain local group in the quepublishing.com domain, managers would again not receive access to resources in the child domains, so answer D is incorrect. See the section “Security Groups.” 6. A, E, G. Carolyn needs to specify an account lockout duration of 0, an account lockout threshold of 3 incorrect passwords, and 15 minutes for resetting the account lockout counter. The account lockout duration specifies the number of minutes that an account remains locked out. Carolyn can set this value for any interval from 0 to 99,999 minutes; a zero value specifies that the account remains locked out until an administrator unlocks it. Therefore she must set this value to 0. Setting this value to 1 would specify that the account is locked out for one minute, therefore answer B is incorrect. The account lockout threshold policy defines the number of incorrect passwords that a user enters before lockout occurs. She can set this value between 0 and 999; if she sets it to 0, the account will never be locked out and answer C is incorrect. Therefore she must set this value to 3. Setting this value to 1 would lock a user out after entering one incorrect password; therefore answer D is incorrect. The Reset Account Lockout Counter After setting defines the number of minutes after which the lockout counter resets to 0. She can set this value between 1 and 99,999 minutes. Carolyn must set this value to 15 minutes (and not 0.25 hours or 900 seconds). Therefore answers F and H are incorrect. Note that this question may be formulated as a drag-and-drop question in which you must select the correct settings from a series of values. See the section “Using Group Policy to Configure Account Lockout Settings.” 7. B. The simplest way to configure uniform password policies to more than one domain is to use security templates to configure the required policy settings and then copy them to the other domains. The required policy settings for some of the policies in this instance do not match those on the default Securedc template, so answer A is wrong. It is not possible to create a GPO on one domain and copy this GPO to another domain, so answer C is wrong. Keith could create the GPO separately for each domain, but doing so requires far more administrative effort, so answer D is wrong. See the section “Domain Password Policy.” 8. D. Password policies and other account policies are effective only if they are applied at the domain level. Because Sandra applied a default policy at the domain level and a stricter policy at the OU level, the stricter policy was ignored and the policy applied at the domain level was applied. The only way to implement a stricter policy for these users is to place them in their own domain. It is not possible to apply Group Policy to a security group, so answer A is wrong. Several days is plenty of time for policies to replicate to other domain controllers, so answer B is wrong. Password policies also cannot be applied to sites, so answer C is wrong. See the section “Domain Password Policy.”

365

Apply Your Knowledge 9. A. Because Tom has users in each of the four domains who need access to all four domains, he needs to create a universal security group. This is the only type and scope that will accomplish the required task within the use of a single group. A global group does not accomplish this task because each global group can contain members from the domain in which it is created only. Therefore answer B is incorrect. Note, however, that Tom should create a global group in each domain and add the global group to the universal group. He can use domain local groups to provide access in only a single domain, so answer C is wrong. A distribution group is for purposes such as email and does not grant access to resources, so this group type is wrong and answers D, E, and F are incorrect. Note that this question may be formulated as a “hot spot” question in which you must select the required group type and scope. See the section “Security Groups.” 10. A, B, D. In addition to setting the maximum password age to 60 days, Trevor should configure appropriate values for the minimum password age and password history so that users do not simply change their password and immediately change it back to the old one. The minimum password age specifies the minimum number of days before the user can change the password again, and the password history causes a list of passwords of the configured length to be remembered. A user cannot reuse a password while it is still on the password history list. Although configuring the complexity requirement is a good idea, it is not required for enforcing the need for users to change passwords; therefore, answer C is wrong. See the section “Domain Password Policy.”

Suggested Readings and Resources 1. Microsoft Corporation. “Active Directory Collection” http://technet2.microsoft.com/

WindowsServer/en/library/6f8a7c80-45fc-4916-80d9-16e6d46241f91033.mspx? mfr=true. 2. Microsoft Corporation. “ActiveX Error Messages Using Certificate Enrollment Web

Pages to Enroll a Smart Card in Internet Explorer.” http://support.microsoft.com/ ?id=330211. 3. Microsoft Corporation. “LDIFDE—Export / Import data from Active Directory.”

http://support.microsoft.com/kb/555634/en-us. 4. Microsoft Corporation. Microsoft Windows Server 2003 Deployment Kit, Designing and

Deploying Directory and Security Services. Chapter 5, “Enabling Advanced Windows Server 2003 Active Directory Features,” Chapter 14, “Designing an Authentication Strategy,” and Chapter 17, “Planning a Smart Card Deployment.” http:// www.microsoft.com/downloads/details.aspx?displaylang=en&familyid=6cde6ee75df1-4394-92ed-2147c3a9ebbe. 5. Microsoft Corporation. Windows Server 2003 Deployment Kit: Designing a Managed

Environment. Chapter 4, “Deploying Security Policy.” http://www.microsoft.com/ downloads/details.aspx?FamilyID=b671967b-ef65-4ccf-9d00-89d6ae428edc& DisplayLang=en.

366

Chapter 5: Planning User, Computer, and Group Strategies 6. Microsoft Corporation. “Windows Server 2003 Security Guide.” Chapter 3,

“The Domain Policy.” http://www.microsoft.com/technet/security/prodtech/ windowsserver2003/w2003hg/s3sgch03.mspx. 7. Scales, L. 2006. MCSA/MCSE 70-290 Exam Prep: Managing and Maintaining a

Microsoft Windows Server 2003 Environment. Indianapolis: Que Publishing. 8. Schmied, Will. 2006. MCSE 70-293 Exam Prep: Planning and Maintaining a

Microsoft Windows Server 2003 Network Infrastructure. Indianapolis: Que Publishing.

6

CHAPTER 6

Implementing User, Computer, and Group Strategies Objectives This chapter covers the following Microsoft-specified objectives for the Planning and Implementing User, Computer, and Group Strategies section of the Windows Server 2003 Active Directory Infrastructure exam: Plan an administrative delegation strategy . Plan an organizational unit (OU) structure based on delegation requirements . Plan a security group hierarchy based on delegation requirements . When you design the Active Directory OU structure, knowing how OUs and security groups can be used to support delegation of administrative privileges is essential. Planning OUs in a fashion that supports the administrative structure of the organization ensures that administrators are able to manage their own specific areas without being granted excess or unnecessary privileges.

Plan an OU structure . Analyze the administrative requirements for an OU . Analyze the Group Policy requirements for an OU structure . This objective tests how well you understand the process of analysis and planning for an OU design. You should understand the need to gather requirements and then test your proposed structure prior to implementation.

Implement an OU structure. . Create an OU . Delegate permissions for an OU to a user or to a security group . Move objects within an OU hierarchy . You should know how to change the OU structure to meet ongoing business objectives. You must understand the entire process to create an Active Directory structure that is optimized for the organization. You must also understand the process of delegating administrative privileges and modifying these privileges as circumstances dictate. The OU structure was developed to be dynamic so that it could change as an organization evolves over time.

Outline Introduction Administrative Delegation Strategies Planning an OU Structure Based on Delegation Requirements

370

Delegating Permissions for an OU to a User or Security Group

396

370

Moving Objects Within the OU Hierarchy

400

371

Moving Objects Between Domains 404 Implications of Moving Objects

Planning a Security Group Hierarchy Based on Delegation Requirements

378

Administrative Delegation Strategy Summary

383

Managing an OU Structure Chapter Summary Key Terms

OU Structure Administrative Requirements for an OU Structure

405 406 408 408

384 Apply Your Knowledge 385

Group Policy Requirements for an OU Structure

387

Implementing an OU Structure

391

Creating an OU

391

Using Command-Line Tools to Create OUs

395

409

Exercises

409

Exam Questions

414

Answers to Exercises

419

Answers to Exam Questions

419

Suggested Readings and Resources

421

Study Strategies This chapter focuses on the use of organizational units (OUs) and security groups within the Active Directory, from designing and planning to implementation and delegation of control. You must understand how to delegate control of an OU and its contents so that administrators have full or partial administrative rights to users, computers, and group objects. To prepare for the exam, you should be familiar with the following concepts: . Understand the logical nature of an OU and its relation to an Active Directory domain and objects contained therein such as users, groups, and computers. . Know the difference between an OU and a security group, as well as ways to use both of them for establishing administrative rights and privileges. . Be able to describe how to gather the requirements, analyze business objectives, and design an OU structure that meets an organization’s objectives for administration. . Use hands-on exercises to familiarize yourself with OUs, security groups, and administrative delegation. Practice creating OUs and security groups. Practice using the Delegation of Control Wizard to give test users partial administrative control over the domain or an OU. Then log on as this user and determine which administrative activities you can and cannot perform according to the security groups to which the user belongs. Troubleshoot problems arising from incomplete or improper delegation of administrative control.

370

Chapter 6: Implementing User, Computer, and Group Strategies

Introduction The structure of OUs within a domain speaks to the skills of both the network designer as well as the network administrator. Not only must the network designer understand the business objectives of an organization and plan the OU structure accordingly, but the administrator must also understand how changes to business objectives will shape the OU structure and its impact on administrative delegation in the future. In this chapter, we examine the necessary skills for planning and implementing OUs and security groups within Active Directory. We discuss how to use these two procedures to arrange objects in the domain structure and group them to provide optimal network access rights and privileges. User, computer, and group objects influence the way individuals interact with the network as soon as the computer starts up and the individual logs on. We also discuss strategies to establish administrative boundaries for managing objects in a way that works best for the organization. In Chapter 1, “Concepts of Windows Server 2003 Active Directory,” you learned how a forest in Active Directory can contain one or more domains, and each domain can contain hierarchies of OUs that can be arranged according to principles such as geographic division or departmental organization. The internal structure of a domain can influence how users are able to access resources within the domain and other domains in the forest, as well the capabilities that administrators have over defined portions of the network. You might have a situation where individuals in a department are required to have control over objects located within their department only and not elsewhere in the organization. Furthermore, such individuals might need only a subset of administrative capabilities and are not permitted to perform other actions. In this chapter, you learn about the ways you can accomplish these objectives within Active Directory. The goal is to create a balance between the permissions that users require to perform their jobs and the need for security on the network. When users are granted more rights than are essential, the network’s security can be put at risk. On the other hand, when users are granted fewer rights than they need, they might be unable to perform required job functions and overall productivity is jeopardized.

Administrative Delegation Strategies Objective

Plan an administrative delegation strategy . Plan an organizational unit (OU) structure based on delegation requirements

One of the major benefits of Active Directory is that you can split up administrative tasks among different individuals. Not only can you grant each administrator a different set of capabilities,

371

Administrative Delegation Strategies

but you can also limit the scope of the administrator’s reach. For example, you can give a help desk staff member the administrative right to change passwords for all users and at the same time grant a network technician in the New York office the right to have full access only to the users, computers, and groups that are located in the New York office. Delegation of administration allows you to dispense subsets of administrative tasks to users and groups. When you use delegation of administration, you can limit the memberships of powerful groups such as Domain Admins, Enterprise Admins, and Schema Admins. This is an important benefit because limiting the membership of these three groups can ensure a greater level of network security. Each forest contains one or more domains. Domains provide administrative boundaries as well as a container for organizing objects. You do not need to create multiple domains to organize objects because you can create the organizational units within domains. Remember that, unlike Windows NT domains, you can have millions of objects within a single Active Directory domain. In fact, when you use a single domain and delegate administration according to the OU hierarchy you design, you simplify administration overall. An OU is a logical container within an Active Directory domain. You can nest OUs to create a hierarchy and then delegate control of various OUs and their contents to users or groups. When you plan an OU structure, you need to consider how to make your design work with your organization’s departmental, regional, or other type of administrative structure.

NOTE Users Versus Groups Best practices dictate that you should delegate administrative tasks to groups rather than users. In doing so, you can manage and keep better track of the administrative rights that are granted. For example, when granting rights to individual users, you can easily lose track of who has been given which rights. However, if you grant administrative privileges only through security groups, you can manage those privileges very simply through group membership.

Planning an OU Structure Based on Delegation Requirements Your OUs must be meaningful to administrators for them to be able to navigate through the hierarchy and perform their functions. You can arrange OUs to be intuitive by using a model that combines the network administrative structure with the company’s organizational chart. You can design an OU structure that is wide and shallow, as shown in Figure 6.1, or one that is slim and deep, as shown in Figure 6.2. You can have as many OUs as you want at any level, although a wide and shallow structure tends to be easier to manage, easier to navigate, and somewhat faster when performing Lightweight Directory Access Protocol (LDAP) queries than a slim and deep structure.

372

Chapter 6: Implementing User, Computer, and Group Strategies

DomainDNS

Organizational Unit

Organizational Unit6

Organizational Unit2

Organizational Unit3

Organizational Organizational Unit8 Unit7

Organizational Unit9

Organizational Unit15

Organizational Unit14

Organizational Unit4

Organizational Unit10

Organizational Unit5

Organizational Unit11

Organizational Unit12

Organizational Unit13

An OU structure can be wide and shallow.

FIGURE 6.1

DomainDNS

Organizational Unit3

Organizational Unit5

Organizational Unit9

Organizational Unit10

Organizational Unit11

Organizational Unit12

Organizational Unit14

Organizational Unit16

Organizational Unit17

Organizational Unit13

Organizational Organizational Organizational Unit19 Unit20 Unit21

Organizational Organizational Organizational Unit22 Unit23 Unit24

Organizational Unit26

Organizational Organizational Organizational Unit27 Unit28 Unit32

You can design an OU structure to be slim and deep.

FIGURE 6.2 Organizational Organizational Organizational Unit29 Unit30 Unit31

Organizational Unit33

373

Administrative Delegation Strategies

Network designers often use OUs as a way of restructuring domains during an upgrade and migration project to provide an administrative boundary for delegated tasks. This is a convenient way to collapse a complicated Windows NT domain structure into a single Active Directory domain. When planning an OU structure for an organization, your first task should be to gather the business requirements. The types of information that you should collect include the following: . Organizational charts—Companies generally group persons within the same hierar-

chical structure when those persons must share the same physical location or production requirements. For example, it is often convenient to establish a hierarchy of OUs that mirrors a company’s departmental, subdepartmental, and work unit structure as outlined in the organizational chart. Although your OU structure might not end up mirroring the organizational charts, they can assist you in deciding where to place OUs and users. . Administrative configuration—The most useful information that you will gather for

planning your OUs to delegate control is the administrative configuration of the organization. You should find or develop a document that describes which administrators are assigned to manage which users, computers, and other network resources. In addition, you should document which powers of control the administrators have. For example, you might find that the help desk has control over changing passwords for all users, whereas an implementation team has the ability to create computer accounts and manage user accounts in the head office. Junior tech support staffers might have a need to modify access permissions to resources located on a specific group of servers. . Site map—Many businesses establish administrative boundaries based on the geo-

graphical locations of the users, computers, and resources that are managed. Even though an administrator might be given control over multiple locations, in the future, the administrator’s purview might be split or combined based on the geographic location. You can use site maps to plan OUs so that delegation of control can be easily changed. When you have these materials in hand, your next task is to diagram a set of OUs that meet the administrative objectives. This is best demonstrated with a scenario. Consider the following scenario: Bizzy Bs is a clothing manufacturer that has four sites: New York, Paris, Raleigh, and Atlanta. The majority of users are split between Raleigh and Atlanta, whereas New York and Paris are small sales offices with approximately 25 users in each location. There are several departments in both Raleigh and Atlanta. Bizzy Bs executives are given a dedicated administrative group for security purposes, regardless of where the executives are located. The help desk handles all password change requests for all users, including executives; however, the help desk cannot

374

Chapter 6: Implementing User, Computer, and Group Strategies

manage executive user or computer accounts, but it does have the right to make limited changes to user accounts for the rest of the company. A desk-side support team in Raleigh has the ability to manage all user accounts in Raleigh except executives, and it has full control of all computer accounts including those of executives. An administrator in Raleigh helps with escalation issues in Paris and New York and is given full control of those locations. Atlanta administrators manage only the users in Atlanta, except they have access only to executives’ computer accounts. Several OU designs can function well for Bizzy Bs. You could divide the OUs into the functional departments, such as “Executives,” “Accounting,” “Manufacturing,” and so on. Within these OUs, you could create child OUs representing the sites. Within the sites, you could nest OUs for user accounts and group accounts separately. Alternatively, you could create geographical OUs for New York, Paris, Atlanta, and Raleigh. Then within each geographical OU, you could create functional OUs for the departments and nest OUs to separate user objects from computer objects. You could also consider a hybrid of the two models. Although this design would work for the current administrative model, it might not grow well with company changes. Yet again, you could create OUs according to object type, such as “Users,” “Workstations,” “Servers,” and so on. In most cases, you would probably want to consider separating the OU that holds administrators from the rest of the OU hierarchy. This security measure helps to prevent accidentally delegating control of administrators to other users. Figure 6.3 demonstrates one of the viable options for Bizzy Bs’s OU structure.

BizzyBs.com

Policy for Atlanta Admins to Manage Executives

Group Policy for Raleigh Admins to Manage Users and Computers

Executives

Admins

Corp Users

Raleigh

Atlanta

Group Policy for Help Desk to Reset Passwords

Sales

New York

Policy to Manage NY and Paris

Paris

An OU structure can be designed to facilitate delegation of control.

FIGURE 6.3

375

Administrative Delegation Strategies

NOTE OU Design Factors Although you might be tempted to base your OU design on your company’s organizational chart (and many people would think this is the logical way to go), the best OU design takes into account the IT administrative structure, either as it currently exists or as proposed. In this way, the OU design will reflect the fact that permissions will flow down through the OU structure.

Active Directory supplies a variety of permissions that can be used in any combination to delegate control of a set of Active Directory objects or to limit access to a set (or subset) of objects based on their location in the OU hierarchy. The system is so flexible that you can define an appropriate administrative scope for any set of administrators even when their duties overlap in either scope or capabilities. To assign administrative rights to a user or a group, you use the Delegation of Control Wizard.

EXAM ALERT Know the Delegation of Control Wizard For the exam, you need to know when and how to use the Delegation of Control Wizard.

Each domain has the capability to contain a different OU hierarchy. The forest administrators, who are members of the Enterprise Admins group, are automatically granted the ability to create an OU hierarchy in any domain within the entire forest. Domain administrators, who are members of the Domain Admins group in each separate domain, by default are granted the right to create an OU hierarchy within their own domain. When you initially create your OU design, you should do so to enable administration. After that, you should create any additional OUs required for the application of Group Policy. You might also need to create OUs to limit the visibility of some objects. For example, if you have a business requirement for security purposes that restricts access to user accounts that are created for use solely with applications, such as a SQL Administrator account, you could create an OU that is outside the main OU hierarchy and limit access to that OU and its contents. You have the capability to assign a single user or group full control of the entire domain, of a single OU or limited rights to a set of OUs. When you delegate control, keep in mind that the default behavior of Active Directory is to make such permissions inheritable. For example, if your top-level OU is named Corp and it contains OUs named Users and Computers, as shown in Figure 6.4, and if you delegate full control of Corp to a user named Joe, he is able to make changes throughout all the Users and Computers child OUs, as well as the parent OU named Corp. However, if you delegate to another user named Jean the Reset Password right in Users, she will not be able to reset passwords for users in the Corp or Computer OUs.

376

Chapter 6: Implementing User, Computer, and Group Strategies

Domain.com

Corp If Joe is granted full control at this level, he will also have control over User A and Computers Computer A.

Users User B

Users

User A Computer A

If Jean is granted Reset Password rights at the Users OU level, she will be able to reset passwords for User A, but not be able to reset passwords for User B.

Delegated tasks flow down the tree from the OU where the rights are delegated.

FIGURE 6.4

Default containers are automatically created at the installation of the first domain controller in an Active Directory domain. These default containers are provided for default locations of various types of objects, as well as for backward compatibility with Windows NT 4.0 backup domain controllers. In-place upgrades of Windows NT primary domain controllers automatically upgrade the existing Windows NT objects into these containers. Service administrators are automatically granted control over these containers. These default containers are not intended to be used as part of an OU tree and cannot be used to create a hierarchy. To test this, you can right-click one of the default containers and check to see whether there is an option to create an OU. You should create your OU hierarchy separately from the default containers. The default containers include the following: . Builtin container—Contains the default service administrator objects. . Computers container—Provides the default location for newly created computer

objects, except domain controllers. . Foreign Security Principals container—Represents objects located in trusted

domains within another forest. . Users container—Contains new user and group objects.

377

Administrative Delegation Strategies

When you select Advanced Features from the View menu, additional default containers become visible, including the following: . LostAndFound container—Acts as a holding place in the event that one administra-

tor deletes an OU at the same time as an administrator elsewhere is adding objects to the same OU. These objects are moved to the LostAndFound container. . NTDS Quotas container—Contains object ownership quota information that limits

the amount of objects that a user, group, computer, or service is allowed to create in a directory partition. . Program Data container—Acts as a storage location for applications and services that

need to store data in the domain directory partition. . System container—Contains system settings for built-in objects and containers within

the domain. A large number of subcontainers hold information such as the default security policy, file link tracking, NetMeeting network meeting objects, objects representing trusted domains, and containers for remote procedure call (RPC) and Windows Sockets connection points. For more information on the default containers and their purposes, refer to “How the Data Store Works” in the Suggested Readings and Resources section. You will also see a default OU for Domain Controllers. This is the location where all newly installed domain controller objects are stored. As we have already discussed, an OU hierarchy can mirror the administrative or geographical organization of a company, or it may group objects of similar type. Keep in mind that whatever OU hierarchy you create must match the company’s administrative needs even if these do not mirror the organizational chart. Should the company reorganize, you might have to reorganize an OU chart, which is often a difficult and daunting task. Nevertheless, employees that share the same work needs typically require similar rights and privileges and are often located within the same department or work unit; therefore, the OU hierarchy often bears a similarity to the organizational chart. When you create your OU design, you should document the following: . A list of the OUs . A diagram of the OU tree that displays the relation of the OUs to each other . The reason that you created each OU, whether for administrative delegation, hidden

objects, application of Group Policy, or another function . A list of the user and group objects that are delegated control of the objects within the

OU, along with the various tasks that each user or group object has been granted over the OU’s contents

378

Chapter 6: Implementing User, Computer, and Group Strategies

Step by Step 6.1 demonstrates the process you should follow when preparing to delegate administration:

STEP BY STEP 6.1 Delegating Administration 1. Using the Active Directory Users and Computers console, create the OU hierarchy according to your design. 2. Create the user account that will be granted administrative authority. 3. Create a global group and place the user within it. 4. Create a domain local group and place the domain global group within it. 5. You are now ready to grant rights to the domain local group using the Delegation of Control Wizard from the OU where rights will be granted.

Planning a Security Group Hierarchy Based on Delegation Requirements Objective

Plan an administrative delegation strategy . Plan a security group hierarchy based on delegation requirements

Chapter 5, “Planning User, Computer, and Group Strategies,” introduced you to security groups and nesting. This section begins with a review of those concepts before delving into delegation of control to a security group hierarchy. Delegation of control requires two structures to be in place. You must have both the OU hierarchy and the security groups in place before you begin delegating control. Recall from Chapter 5 that you can create groups of universal, global, and domain local scope in a domain. In addition, you can create local groups on individual computers. Such a local group is used to grant rights to resources on a computer, whether it is a domain member or standalone computer, and can contain either a domain global group or a universal group. You can create local groups on member servers or client computers running Windows 2000 Professional or Windows XP Professional, but not on domain controllers. When you install the first domain controller of a domain, a set of default security groups is created automatically. These default groups are placed within the Builtin and Users containers. The default security groups are intended to be used as part of the security group strategy

379

Administrative Delegation Strategies

for a domain. You should consider using the default security groups in addition to the custom security groups that you create in your own strategy. Table 6.1 lists the default security groups. TABLE 6.1 The Default Security Groups in Windows Server 2003 Active Directory Group Name

Where Found

Usage

Account Operators

Builtin container

This group has the rights to create, modify, and delete user, computer, and group objects. It is denied access to manage administrator accounts and domain controllers.

Administrators

Builtin container

This group has full rights to manage the domain controller.

Backup Operators

Builtin container

This group provides the rights to files and domain controller resources so that the group can perform backups.

Cert Publishers

Users container

This group includes the rights to publish certificates.

DnsAdmins

Users container

This group is available only when the domain name system (DNS) is installed; it provides the rights required to manage DNS.

DnsUpdateProxy

Users container

This group is available only when DNS is installed, and it is used by Dynamic Host Configuration Protocol (DHCP) servers so that they can perform dynamic DNS updates on behalf of other client workstations.

Domain Admins

Users container

This group is granted full rights to manage the entire domain. It is automatically made a member of each member server’s, member computer’s, and domain controller’s Administrators local group.

Domain Computers

Users container

This group contains all member servers and computers in the domain.

Domain Controllers

Users container

This group contains all domain controllers.

Domain Guests

Users container

This group is automatically made a member of the Guests local group on each member server, member computer, and domain controller.

Domain Users

Users container

This group contains all users in the domain and is automatically made a member of the Users local group on each member server, member computer, and domain controller. (continues)

380

Chapter 6: Implementing User, Computer, and Group Strategies

TABLE 6.1 Continued Group Name

Where Found

Usage

Enterprise Admins

Users container

This group is only in the root domain of the forest. It is granted full control of all the domains in the forest.

Group Policy Creator Owners

Users container

This group provides the rights for managing Group Policy.

Guests

Builtin container

This group has no rights.

Help Services Group

Users container

This group enables administrators to set rights common to all support applications. Group membership is automatically managed by the Help and Support service, and you should not add users to this group.

Incoming Forest Trust Builders

Builtin container

This group is granted the rights to create incoming, one-way trusts from domains in external forests to this forest.

Network Configuration Operators

Builtin container

This group is granted the rights to manage the network configuration, such as TCP/IP,of domain controllers.

Performance Log Users

Builtin container

This group provides the rights to manage performance logs and alerts for Perfmon either locally or remotely.

Performance Monitor Users

Builtin container

This group provides the rights required to run Perfmon either locally or remotely.

Pre-Windows 2000 Compatible Access

Builtin container

This group provides backward compatibility to computers running Windows NT.

Print Operators

Builtin container

This group has the rights required for managing printers shared by domain controllers.

RAS and IAS Servers

Users container

This group contains servers running Remote Access Service (RAS) or Internet Authentication Service (IAS), and enables the servers to access users’ remote access properties. It is managed automatically, and you should not add users or computers to this group.

Remote Desktop Users

Builtin container

This group allows users the right to log on remotely to domain controllers and member servers. Rights are granted locally on the servers and domain controllers. No domain rights are granted to this group, by default.

381

Administrative Delegation Strategies

TABLE 6.1 Continued Group Name

Where Found

Usage

Replicator

Builtin container

Both the File Replication Service (FRS) and Active Directory replication use this group. It is not intended for users.

Schema Admins

Users container

This group is found only in the forest root domain. It provides the rights to manage the schema of the forest.

Server Operators

Builtin container

This group provides the rights to manage domain controllers, but not the rights to manage accounts.

Users

Builtin container

All user accounts are made members of this group.

Keep in mind that any user object that becomes a member of the Domain Admins or Enterprise Admins group has full rights throughout the domain or even the forest. Users who are made members of other default administrative security groups also have domainwide influence. You should always have at least one user who maintains full rights to the forest because that user might be called on to correct errors. As a best practice, though, you should limit the number of users who are made members of these groups, regardless of how the OU structure is instituted. As in all planning and design, you start by gathering the business requirements and objectives. From these needs and goals, you can organize users into cohesive groups. Depending on the rights requirements, you can nest the groups. For example, ExampleDomain.local has an administrative group in New York that is supposed to provide escalation to all the other sites and must have the same rights to resources as those groups do. You can create a group called NYAdmins and make that group a member of the administrators groups in all the other locations. If you want the NYAdmins to have full control over every domain in the forest, you can make the group a member of the Enterprise Admins default security group. For the purposes of delegation of control, you have to look at the groups that will be granted the rights to manage other users, computers, and groups. Many users will likely be members of multiple groups. As you apply rights, you should plan to do so in such a way that it reduces administration on an ongoing basis.

EXAM ALERT Know the Method of Nesting Groups and Applying Rights The exam describes scenarios that require you to know the best practices for groups. In Windows NT, you were taught to follow AGLP (Accounts are placed in Global groups, which are placed in Local groups, to which Permissions are then applied). Under Active Directory, there are additional Universal groups to consider, which changes AGLP to AGULP (or Accounts placed in Global groups, placed in Universal groups, placed in domain Local groups, to which Permissions are applied). Universal groups are extremely flexible because they can contain other universal groups and are seemingly interchangeable with global groups. However, for the exam you will need to know that universal groups are intended to group multiple global groups from different domains.

382

Chapter 6: Implementing User, Computer, and Group Strategies

Nesting groups is a way to decrease the number of users belonging to multiple groups. Instead, you can nest groups so that rights are added across the entire nested structure. Figure 6.5 demonstrates how rights can be additive through nesting of groups.

Reset Passwords Group

Manage Users Group

A member of Apply Group Policy Group can Apply Group Policy, Manage Users, and Reset Passwords.

A member of Reset Passwords Group can only Reset Passwords.

Manage Computers Group

Apply Group Policy Group

Rights are added as more groups are nested.

FIGURE 6.5

Nesting groups can become a problem if one or more of the groups have been explicitly denied access to something that other groups have been granted access. A user who belongs to these two groups in any fashion will be denied access because the denial overrides any other permission. Make certain that you document each group’s rights so that you can spot limited access rights that may result in unintentional access problems. You can nest groups as a way of handling regional delegation of control that overlaps. For example, an organization has an Accounting group that is split between New York and Atlanta. New York administrators are granted the rights to manage only the New York Accounting computers, as well as all the Accounting users. Atlanta administrators are granted the rights to manage only the Atlanta computer accounts, a special Atlanta Accounting group, and all the Accounting users. You can create three groups to which you assign rights. The Accounting Admins group would be granted the rights to manage all Accounting users. It would contain the ATL Acctg Admins Group as well as the NY Acctg Admins Group. The ATL and NY Admins groups would be granted their own specific rights. Because neither of these groups is nested in the other, they would not have any shared rights except that of their parent group, Accounting Admins.

383

Administrative Delegation Strategies

Be Careful with Default Security Groups for Administrators! Imagine consulting with a company that has gone through a lengthy predeployment testing of Active Directory before beginning its Active Directory rollout. The company’s managers call you in because of an emergency: The Active Directory database has become corrupted, and they need to fix the problems before completing the rollout to the company’s remaining users. The company had tested Active Directory by performing an in-place upgrade of an existing Windows NT 4.0 domain for a 200-user group of programmers. Many of these users had been made members of the former Windows NT Administrators group and were automatically upgraded as Domain Admins in the forest root domain. A little knowledge in the wrong hands, of course, was the source of the corruption. One of the programmers read up on Active Directory, figured out how to make his own Admin-level account a member of the Schema Admins group, and then went on to extend the schema. That led to the corruption of the database and the need to completely re-create Active Directory. As a result, you recommend cleaning up any Administrators groups before a migration is completed. You also recommend that default security groups be managed carefully. Having a nested group that is several levels down might result in a similar situation if the rights granted at higher levels are not understood. For example, you might add the Help Desk group to Password Admins so that they have the right to change users’ passwords. However, if the Password Admins group is a member of Enterprise Admins, you have accidentally blasted open a security hole.

Administrative Delegation Strategy Summary Table 6.2 provides a summary of the administrative delegation strategies for OU and group planning under Windows Server 2003 Active Directory. TABLE 6.2 Administrative Delegation Strategies Business Requirement

Delegation or Group Structure

OU Creation

Single administrator over entire Active Directory.

Make the administrator part of the Enterprise Admins group.

Create OUs to match requirements for subadministrators, to apply Group Policy, and to hide objects.

Help desk needs to change passwords.

Create a group called Password Admins. Add help desk staff to group. Grant the group the predefined task to change passwords.

Do not grant this right at the Domain level. Instead, create a top-level OU for all users and grant the right at that OU. Ensure security by creating another top-level OU for administrative users, to which the help desk has no access. (continues)

384

Chapter 6: Implementing User, Computer, and Group Strategies

TABLE 6.2 Continued Business Requirement

Delegation or Group Structure

OU Creation

Single domain with two main sites, each with an administrator who should be given full control locally.

Create a group for administrators at Site 1 and anothergroup for Site 2. Grant each group access to resources in its site only.

Create two top-level OUs for Site 1 and Site 2. Move user, computer, group, and domain controller objects into each respective OU. Create sub-OUs to meet additional business requirements.

Admin 1 needs to manage only user accounts in Accounting. Admin 2 needs to manage only computer accounts at Site 1. Admin 3 needs to be able to apply Group Policy throughout.

Create three groups: one for Accounting User Management, one for Site 1 Computer Management, and one for applying Group Policy. Place each admin in the appropriate group. Grant the appropriate rights to each group.

Create a top-level OU for all users and computers. Create second-level OUs that represent each site. Create third-level OUs for each department. Grant the Accounting User Management group the right to manage user accounts at the Accounting department OU on the third level under every Site location. Grant the Site 1 Computer Management group the right to manage computer objects at the Site 1 OU on the second level. Grant the Group Policy group the right to apply Group Policy at the top OU level.

Admin 1 needs to reset passwords throughout the domain and needs access to manage user accounts. Help desk needs to reset passwords only. Neither group should have access to Admin accounts.

Create two groups named Reset Passwords and User Management. Make User Management a member of Reset Passwords. Grant User Management rights to manage user accounts. Grant Reset Passwords rights to reset passwords.

Create a top-level OU for all users. Create a second top-level OU for all admins. Grant only the Reset Passwords and User Management groups their rights to the All Users OU, and deny access to the All Admins OU.

OU Structure An OU structure is typically created by the domain administrator. An example of an OU structure is shown in Figure 6.6. OUs are easily created and just as easily deleted. When an OU is deleted, all its contents are also deleted. The objects within the OUs can be moved to other locations within the OU hierarchy. When developing an OU structure, you should anticipate

385

OU Structure

business changes so that it is easy to evolve the OU structure as the organization changes. The types of changes that you should factor into your OU structure are physical moves, corporate reorganizations, mergers, spin-offs, and growth of the company.

An OU structure is placed within a domain container and consists of nested OUs.

FIGURE 6.6

Previously, we reviewed how to plan an OU structure according to delegation of control requirements. OUs provide a way to establish relative autonomy of administrative control within a single domain. Those who are delegated rights to an OU subtree do not have any additional rights to manage the Active Directory service. You should design your OU structure around the needs for administrative delegation and Group Policy deployment. You can then create additional OU subtrees to limit the visibility of objects.

Administrative Requirements for an OU Structure Objective

Plan an OU structure . Analyze the administrative requirements for an OU

Administrative requirements are basically the business requirements combined with a reason for a new OU. You should apply the following questions when deciding when to create new OUs: . Are you restructuring domains into an OU structure?—For each restructured

domain that requires a different administrative team, you should create a new OU at the top level.

386

Chapter 6: Implementing User, Computer, and Group Strategies . Will you need to hide objects or limit their visibility from others? —Hidden

objects should be placed in a new top-level OU that is outside the standard OU hierarchy. . Do you need to limit access to administrative accounts?—To ensure security for

administrative objects, create a new top-level OU that is outside the standard OU hierarchy. Deny access to all users except the appropriate administrators to this OU. For example, you would do this so that help desk technicians can reset passwords for all users except administrators. . Do you need to separate user account management tasks from computer man-

agement tasks?—When one administrative group is given the tasks solely to manage computers and another administrative group is granted the tasks to solely manage users, you can create OUs that separate users from computer objects and further separate other objects as needed into additional OUs. . Do you need to separate administrative tasks by group, location, or other logical

division?—For each administrative group that should be given a different scope of control that does not overlap with others, you should create a new OU. You should examine overlapping management requirements and determine where best to create a new OU subtree. . Will you need to establish a different set of Group Policies for users or comput-

ers?—For each different set of Group Policies that do not overlap, create a new OU at the same level. For each different set of Group Policies that do overlap, create a subOU for the additional Group Policy application. Administrative models can be centralized or decentralized, but in practice, they tend to be a hybrid between the two. Often, a company provides a centralized administrative group to handle certain tasks, such as a help desk to reset passwords. In addition, the company might provide local administrators at each site to help the local users with moves, adds, and changes. Whatever the administrative model used, you should ensure that any administrator who will be managing Active Directory objects can easily find her way through the OU structure. When an organization uses a centralized model, an OU structure that exactly matches the administrative model in its top levels will be the most useful for that organization. When a company uses a decentralized model, an OU structure that matches the locations of the company will be best suited. For example, domain.local has three locations: Los Angeles, Las Vegas, and Miami. An administrative group is dedicated to each location. In the domain.local domain, the top-level OUs would represent Los Angeles, Las Vegas, and Miami. If the administrative groups are prevented from accessing each other’s user objects, there would be an Admin OU and a Users OU below each of the top-level OUs, as shown in Figure 6.7.

387

OU Structure

Domain.local

Los Angeles

Las Vegas

Miami

OUs can be structured to match locations for administration.

FIGURE 6.7 LA Admins

LA Users

LV Admins

LV Users

Miami Admins

Miami Users

For a company that provides administrative support separately to its various divisions, the OU structure would be functional in nature. For example, if domain.local has an administrative unit assigned to the Accounting group and another to Executives and another to Manufacturing, with the final group assigned to all other groups, the top-level OUs would reflect the structure, having one each for Accounting, Executives, Manufacturing, and Corporate. This structure is displayed in Figure 6.8.

Domain.local

FIGURE 6.8 Accounting

Executives

Marketing

Corporate

OUs can be structured to match

functions.

Group Policy Requirements for an OU Structure Objective

Plan an OU structure . Analyze the Group Policy requirements for an OU structure

Group Policy is one of the strengths of Active Directory. You can use Group Policy as a tool to control the environment of computers and users when they access the network. Because

388

Chapter 6: Implementing User, Computer, and Group Strategies

Group Policy is integrated within Active Directory, it needs to be configured only in a central location and can then be used by every user and computer in the forest. For example, one of the uses of Group Policy is to deploy a standardized desktop environment. The controls available within Group Policy can facilitate and automate many network administration tasks, such as deploying software. Software deployment through Group Policy reduces the amount of time spent by support technicians because they no longer need to travel to each desk to install applications. Group Policy incorporates the ability to secure software from being deployed to unauthorized machines. This chapter looks at how Group Policy is designed and how it fits with designing an OU structure. We discuss the deployment of Group Policy in detail in Chapter 7, “Planning and Implementing Group Policy.” When you are developing Group Policy for an organization, it is easiest to start from scratch. The reason for this is that Group Policy is inherited as it travels down the tree of OUs. The order of inheritance is as follows: 1. Local policy is applied first. Logically, this makes sense because local policy is stored

on the local computer and is accessed before the network is available. 2. Site-attached Group Policy is applied next. 3. Domain Group Policy follows after that. 4. Group Policy for the top-level OU is applied next. This is followed by Group Policy

applied to each OU leading to the user or computer object. The order of application for Group Policy is essential to designing Group Policy, planning OUs for Group Policy application, and troubleshooting Group Policy. Group Policies are stored in Group Policy objects (GPOs). The last GPO that is applied to a user or computer may contain group policies that override earlier-applied group policies in other GPOs if they contain conflicting Group Policy settings. The only exception is the case in which inheritance is blocked or enforced. A GPO contains two nodes: . Computer configuration . User configuration

EXAM ALERT Know the Inheritance of Group Policy On the exam, you should be able to identify which GPOs will be inherited by a given user or computer object based on a scenario.

389

OU Structure

As you can probably guess, computer objects inherit the computer configuration, whereas user objects inherit the user configuration. This can cause some confusion, especially because several policy settings are duplicated in the two nodes. For example, UserA is in the domain.local domain in the Corp OU. ComputerA is in the domain.local domain in the PC OU. UserA normally uses ComputerB, which is also in the domain.local Corp OU. A GPO applied to the Corp OU states that any computers will receive Application C. When UserA logs on to ComputerA, the application will not be installed because the GPO is not applied to the PC OU where ComputerA is located. On the surface, it might appear that UserA should receive Application C regardless of where UserA logs on because UserA is in the OU that contains that GPO. However, because the software policy within that GPO was set within the computer configuration node, Application C would not be deployed.

NOTE Roaming Users When you use Group Policy to enable desktops to roam with users, you should set all Group Policies within the User Configuration node. Otherwise, the policies will not roam with the users.

When you do not have the luxury of starting with a clean slate, you can use the Resultant Set of Policy (RSoP) tool to query the Active Directory for existing Group Policy settings. This tool can assist with planning and modeling Group Policy. Given that Group Policy objects take advantage of the hierarchical nature of Active Directory and that GPOs can be secured, as well as their inheritance either enforced or blocked, RSoP can save a great deal of time and trouble. See Chapter 8, “Managing Group Policy” for details on using RSoP. Group Policy application can cause a performance problem, although not necessarily a large one, during computer startup and user logon. There are two reasons for a performance problem. Either Group Policy is configured to install applications, which slows performance considerably, or so many GPOs are attached at each level in the OU tree that it causes a delay in processing them all. When you plan your OUs for Group Policy application, try to use as few GPOs as possible to maintain optimal performance. Let’s look at how an organization can organize OUs to facilitate the application of Group Policy. domain.local is a business with two locations. Everyone at the company is supposed to have a basic desktop environment, although some exceptions exist. SiteA has several kiosk computers that are being deployed for public use. These computers require kiosk software and a locked-down desktop environment. SiteA also contains the Accounting department, which requires an application called Finance. SiteB contains several departments, although they require only the basic desktop environment but with a new desktop wallpaper. The OU structure that you should create for domain.local, then, is one that is divided by department. You can attach the SiteB Group Policy for the desktop wallpaper to the Site B object in Active

390

Chapter 6: Implementing User, Computer, and Group Strategies

Directory. This does not require a new OU. However, if administration was also separated between the two sites, it is likely that you would already have two top-level OUs representing the sites. You would then need to decide whether to attach the Group Policy to the site or to an OU. (You would use the site-attached method for a GPO when you required any user visiting the site to be given the SiteB Group Policy.) All other GPOs would be attached to their appropriate OUs. For example, the Accounting department OU would be given a GPO that deployed the Finance application, whereas the Kiosk OU would be given the GPO that locked down the desktop and deployed the kiosk software. A GPO can contain very restrictive policies, and for people who are accustomed to having full access to all the features of their computer’s operating system, the transition can be difficult if you deploy GPOs with a very restrictive set of policy settings. Users protest if they receive unnecessary restrictions or if their own productivity is impaired. It is best to deploy only those GPOs that have a true business or security requirement. In planning your OUs, you should list those GPOs that you plan to deploy along with the scope of the deployment. For example, you could start the list with a GPO for a standard desktop environment and a scope of all users except administrators. The next item on the list might be a GPO to deploy software to the Manufacturing computers in New York, but not in Los Angeles, and so on. From this list, you can see that you need to keep administrators separate from all the other users to deploy the standard desktop. You can do this by creating two toplevel OUs: one for Admins and the other for Users. In addition, you can see that you will need to separate Manufacturing in New York from Manufacturing in Los Angeles, so another OU is probably necessary. After you have finished planning GPOs, you should have the following items documented: . The GPOs to be applied . Each GPO’s Group Policy settings . Any changes to the Default Domain Password and Account Policies . The OU configuration and location of GPOs within the OU structure . Places in the OU structure where either blocked or enforced inheritance needs to be

applied . The GPOs that must be applied to all users in the domain . The GPOs that must be applied to all users in a site, and whether such a GPO should

be applied to visiting users as well as local users . Which users and computers should not be affected by a certain GPO . The rights that must be applied for users so that they can read and apply the GPO

during logon

391

OU Structure

You should test Group Policy configurations prior to implementation to observe the effect that your planned GPOs will have on various users and computers. To test Group Policy, you should begin with a set of duplicate OUs that mirrors your planned OU structure containing your proposed GPOs. Although you do not need to duplicate all user, group, and computer objects, you should include in this setup a test user account and a test computer object in each OU where the GPOs will be deployed. To test Group Policy, you should make certain that the same GPOs that a user in the production environment might have are also assigned to the test user in the same OU. You can link to existing GPOs to reduce human error. In addition to including all GPOs that can be applied, you should also incorporate any blocked or enforced inheritance of Group Policy settings. To validate your results, you should move a computer account into the test structure and then log on to the network from the test computer using the test user account. Document the results that you received during startup and logon. You can also use RSoP in planning mode to simulate the effect Group Policies have on a particular user or computer account.

Implementing an OU Structure When the planning and design process is completed, your next step is to put what you have on paper into action. The Active Directory Users and Computers console is the tool you employ to implement an OU structure.

Creating an OU Objective

Implement an OU structure . Create an OU

Most organizations are dynamic entities. As companies merge and spin-off, reorganize, and change locations, the network must make similar logical and physical changes. OUs will likely be created whenever a company reorganizes, whether on a small or large scale. Step by Step 6.2 walks you through the process of creating a top-level OU within an Active Directory domain.

STEP BY STEP 6.2 Creating an OU 1. Ensure that you are logged on as a member of the Domain Admins group. 2. Click Start, Administrative Tools, Active Directory Users and Computers. This starts the Active Directory Users and Computers console, as shown in Figure 6.9.

392

Chapter 6: Implementing User, Computer, and Group Strategies

You create OUs within the Active Directory Users and Computers console.

FIGURE 6.9

3. Navigate the tree in the left pane to the domain container. The name of the domain will be in its DNS form, such as quepublishing.com. In Figure 6.9, the domain is named quepublishing.com. 4. Right-click the domain and select New, Organizational Unit, as shown in Figure 6.10.

FIGURE 6.10 The domain container context menu includes the ability to create new objects, including OUs.

5. In the New Object–Organizational Unit dialog box that appears, type the name of the new OU and then click OK, as shown in Figure 6.11.

393

OU Structure

FIGURE 6.11

The only requirement for creating an OU is to give it a name.

TIP Permissions for Creating OUs Besides members of the Domain Admins and Enterprise Admins groups, any user with the Create Organizational Unit Objects permission can create OUs. This is a special permission accessed from the Advanced Security Settings dialog box for the domain or OU in which the OU is to be created.

After you’ve created an OU, you can then create child OUs on the next level. Merely rightclick this OU and select New, Organizational Unit, as already discussed. Depending on your design, you should complete the creation of your OUs before you begin moving user and computer objects into the new OUs within the tree.

WARNING Make Backups Before Deleting OUs Even when you have made certain that every object within an OU is no longer necessary, or has been moved or copied, you should back up the Active Directory store before deleting the OU. This ensures that you have a copy of the OU and its contained objects that can be restored authoritatively should someone decide that the object should not have been deleted. We discussed how to backup and restore Active Directory in Chapter 4.

After you have created an OU, you might decide to make changes to its properties. Properties of an OU include information about the manager of the OU, as well as the Group Policy objects that are applied to the OU. In large Active Directory implementations in which there are multiple administrators, and where many administrators have duties that overlap, a description of the person or group who is the primary administrator of an OU can be extremely helpful. Step by Step 6.3 describes the process of making changes.

394

Chapter 6: Implementing User, Computer, and Group Strategies

STEP BY STEP 6.3 Making Changes to Existing OUs 1. Click Start, Administrative Tools, Active Directory Users and Computers to open the Active Directory Users and Computers console. 2. In the left pane, expand the domain and then the upper-level OUs by clicking the plus sign (+) to the left of each of these until you have navigated to the OU that you want to change. 3. Right-click the OU to be configured and select Properties. 4. The Properties dialog box for the OU appears. As depicted in Figure 6.12, this dialog box has four tabs on which you can make changes to the OU’s general information, including description and location; assign a manager to the OU on the Managed By tab; add the OU to a member of a COM+ partition set; and create or attach new Group Policies.

The OU’s Properties dialog box enables you to configure the OU’s properties, including GPOs linked to the OU. FIGURE 6.12

NOTE Group Policy Management Console (GPMC) After you install GPMC, the Group Policy tab shown in Figure 6.12 becomes inactive and contains only a link for opening GPMC. We discuss the installation and use of GPMC for managing Group Policy in Chapter 7.

395

OU Structure

Using Command-Line Tools to Create OUs In Chapter 5, we looked at the use of Csvde, Ldifde, Dsadd, and scripts for creating users and groups. You can use the same tools for creating OUs. The Ldifde command-line tool enables you to create, modify, and delete OUs and OU hierarchies. The following is a sample input file: # These are the attributes for the Manufacturing OU. DN: ou=manufacturing,dc=quepublishing,dc=com changetype: add ObjectClass: organizationalUnit

In this file, changetype refers to the operation to be performed (add, modify, or delete). You can add additional OUs by including them in the input file (separate OUs from each other with a blank line). You can create OU hieararchies by specifying the appropriate distinguished name in the DN line. To use Ldifde, run the following command from the command prompt: Ldifde –i –f filename.ldf

In this command, -i specifies import mode and filename.ldf specifies the name of the file containing data to be imported. The use of Csvde to create an OU is similar to that of Ldifde, except that you use a commaseparated (.csv) file to import the required information. Refer back to Chapter 5 for additional details on using Csvde. To use dsadd to create an OU, open a command prompt and type the following: dsadd ou OrganizationalUnitDN –desc Description –d Domain –u UserName ➥ –p password

In this command, OrganizationalUnitDN is the distinguished name of the OU to be created (for example, ou=manufacturing, dc=quepublishing, dc=com), description is the description of the OU to be added, domain is the domain to connect to, UserName is the username used for logging on to a remote server, and password is the associated password. If the username and password are omitted, the credentials of the currently logged on user are used. You can also use dsmod to modify the attributes of an OU, or dsrm to delete an OU. As with users and groups, you can use scripts to create OUs. You can use Windows Script Host (WSH) to run VBScript files with the .vbs extension and run them by typing the following command at the command prompt: wscript scriptname.vbs

In this command, scriptname is the name of the script. For more information, refer to “Creating administrative scripts” in the Windows Server 2003 Help and Support Center.

396

Chapter 6: Implementing User, Computer, and Group Strategies

Delegating Permissions for an OU to a User or Security Group Objective

Implement an OU structure . Delegate permissions for an OU to a user or to a security group

Like the creation of OUs, the process of delegating control starts in the Active Directory Users and Computers console. You must first be logged in as a member of the Domain Admins or Enterprise Admins groups, or you must have already been granted the right to delegate control to other users and groups. Step by Step 6.4 shows you how to delegate control of an OU.

STEP BY STEP 6.4 Delegating Control of an OU to a User or Group 1. Open the Active Directory Users and Computers console by clicking Start, Administrative Tools, Active Directory Users and Computers. 2. In the left pane showing the console tree, right-click the OU to be delegated and select Delegate Control. The Delegation of Control Wizard starts. 3. Click Next to bypass the Welcome screen. 4. On the Users or Groups page, click Add to designate the user or group accounts to whom control of the OU will be granted. For example, if you are granting the help desk control of all the corporate users, you would add the Help Desk group here. 5. In the Select Users, Computers, or Groups dialog box shown in Figure 6.13, type the names of the users or groups, and then click OK. If you need to verify the correctness of the names entered, click Check Names. To locate users or groups whose names you are unsure of, click Advanced to open the advanced version of the Select Users, Computers, or Groups dialog box.

FIGURE 6.13 The Select Users, Computers, or Groups dialog box enables you to select the users or groups to whom control is to be delegated.

6. The group you added appears in the Users or Groups dialog box, as shown in Figure 6.14. Click Add to add additional users or groups if necessary. When you are finished, click Next.

397

OU Structure

FIGURE 6.14 The Users or Groups dialog box displays the names of the users and groups to whom control will be delegated.

7. From the Tasks to Delegate page shown in Figure 6.15, select the types of tasks that you will be delegating. Many common administrative privileges are listed. If necessary, select the Create a Custom Task to Delegate radio button to delegate a specific type of administrative task. When finished, click Next.

FIGURE 6.15 The Tasks to Delegate page enables you to either select from a list of predefined tasks or create a custom task.

8. If you have selected Create a Custom Task to Delegate, the Active Directory Object Type page shown in Figure 6.16 enables you to delegate control of a large number of Active Directory objects. Make the appropriate selections and then click Next. Then select the appropriate permissions from the Permissions page and click Next again.

398

Chapter 6: Implementing User, Computer, and Group Strategies

FIGURE 6.16 The Active Directory Object Type page enables you to delegate a large range of custom tasks.

9. Review the summary screen. If necessary, click Back to make changes. When finished, click the Finish button.

NOTE Permissions Accumulate If you run the Delegation of Control Wizard multiple times on the same user or group, permissions received accumulate.

Use of the Security Tab to View or Modify Delegated Permissions The Delegation of Control Wizard enables you to assign permissions, but it does not allow you to modify or remove delegated permissions. After you have used this wizard to assign permissions to a user or group, you can view, modify, or delete permissions from the Security tab of the user’s Properties dialog box. Use of this tab provides more options than those provided by the wizard. This tab also enables you to control whether you want the permissions to propagate to lower containers or apply only to that OU. Follow Step by Step 6.5 to use the Security tab:

STEP BY STEP 6.5 Viewing and Modifying Delegated Permissions 1. In Active Directory Users and Computers, select View and ensure that Advanced Features is selected. 2. Right-click the container (domain or OU) in which control was delegated and choose Properties.

399

OU Structure 3. Select the Security tab and then click Advanced. As shown in Figure 6.17, the Advanced Security Settings dialog box displays the delegated permissions.

FIGURE 6.17 The Advanced Security Settings dialog box displays delegated permissions.

4. To modify a permission entry, click Edit. This displays the Permission Entry dialog box shown in Figure 6.18. Here you can add, deny, or remove permissions, or change to another user or group.

FIGURE 6.18 The Permission Entry dialog box enables you to modify delegated permissions.

5. To add a permission entry, click Add. Specify the name of the group or user to be added and then add the required permission in the Permission Entry dialog box.

400

Chapter 6: Implementing User, Computer, and Group Strategies 6. To remove a permission entry, click Remove. The entry is removed without further confirmation. 7. To remove all delegated permissions, click Default. This replaces all permission entries with the default settings. 8. When you are finished, click OK to close the Permission Entry dialog box and click OK again to close the Advanced Security Settings dialog box.

Use of Dsrevoke to Remove Delegated Permissions You can also use the Dsrevoke utility to display or remove delegated permissions. This tool removes access control entries (ACEs) that have been applied to a security principal (user or group) on domains or OUs. To use Dsrevoke, open a command prompt and type the following: Dsrevoke /report | /remove [/domain:domainname] [/username:username] ➥ //password:password |*] [/root:domain/OU] securityprincipal

In this command, the /report parameter reports on the ACEs that are currently configured for the specified security principal and the /remove parameter removes these ACEs after first reporting them and asking for confirmation. Domainname refers to the DNS or NetBIOS name of the domain in which permissions will be removed. Username and password refer to the username of the user using this tool; they are required if the user is not an administrator or if he is removing ACEs from a domain other than the one he is logged on to. In the /root parameter, specify the root domain or OU from which the tool is to search for ACEs (if not specified, the tool searches from the current domain). Securityprincipal specifies the name of the user or group from which permissions are to be deleted.

Moving Objects Within the OU Hierarchy Objective

Implement an OU structure . Move objects within an OU hierarchy

To keep up with organizational changes, you should know how to move objects throughout the OU hierarchy. When you move an object, the GPOs that had been applied in the past change to match those in the new hierarchy. For example, if you have a user in the Corp\PCUsers\New York OU subtree, and you move the user to the Corp\LaptopUsers\Atlanta OU subtree, the user no longer has any GPOs applied that were in the PCUsers and New York OUs. Instead, the user has GPOs applied for both the LaptopUsers and Atlanta OUs. Likewise, delegation of control is affected when a user is moved from one OU to another. For example, Jan is a user in Boston. She moves to New York and takes on a new position in the IT department. Jan’s user object is moved to the IT Dept OU. Jan forgets her password and calls up the help desk to reset it. However, because the help desk is restricted from the IT Dept

401

OU Structure

OU, the help desk staff cannot reset Jan’s password. Instead, she has to find a person with reset password rights to the IT Dept OU. You can move an object between OUs by means of any of the following three procedures: . By dragging the object and dropping it to its new location . By right-clicking the object and choosing Move . By using the Dsmove command-line tool

EXAM ALERT Understand How Moving Objects Affects the Way Delegation of Control and Group Policies Are Applied The exam might describe a scenario in which you are asked to select what happens when an object is moved from one OU to another. You should understand how delegation of control is affected, as well as how Group Policy application is changed when you move an object to a new location in the OU hierarchy.

Follow Step by Step 6.6 to use the drag-and-drop method to move an object.

STEP BY STEP 6.6 Using Drag and Drop to Move Objects in the OU Hierarchy Within a Domain 1. Ensure that you are logged on as a member of the Domain Admins or Enterprise Admins group, or as a user who has been delegated the right to make changes to Active Directory objects. 2. Click Start, Administrative Tools, Active Directory Users and Computers to open the Active Directory Users and Computers console. 3. Select the OU in the console tree containing the object to be moved, so that it appears in the details pane. 4. Drag the object to the OU to which it is to be moved, and release the mouse button. 5. You receive the message box shown in Figure 6.19 warning you of possible effects from moving objects. Click Yes to move the object.

FIGURE 6.19 The Active Directory message box warns you of possible consequences from moving objects in Active Directory.

6. Close Active Directory Users and Computers.

402

Chapter 6: Implementing User, Computer, and Group Strategies

Follow Step by Step 6.7 to use the right-click method of moving objects:

STEP BY STEP 6.7 Using Right-Click to Move Objects in the OU Hierarchy Within a Domain 1. Follow steps 1–3 of Step by Step 6.6 to locate and select the object to be moved. 2. Right-click the object to be moved and select Move. 3. From the Move dialog box, shown in Figure 6.20, select the OU into which the object is to be moved. If necessary, expand the OU tree to locate the appropriate child OU. Click OK after selecting the OU.

FIGURE 6.20

You can navigate the OU hierarchy to find the place where you will be moving the object.

WARNING Make Backups Prior to Reconfiguring OUs and Objects Before you begin dragging and dropping objects throughout the Active Directory, you should make certain to have a backup of these objects in order to perform a restore.

The Dsmove command-line tool enables you to move or rename objects within the domain. Follow Step by Step 6.8 to use Dsmove:

403

OU Structure

STEP BY STEP 6.8 Using Dsmove to Move or Rename Objects in the OU Hierarchy Within a Domain 1. Ensure that you are logged on as a member of the Domain Admins or Enterprise Admins group, or as a user who has been delegated the right to make changes to Active Directory objects. 2. Click Start, Command Prompt. 3. Type the following command and then press Enter. dsmove ObjectDN [-newname NewRDN] [-newparent ParentDN] [{-s server | -d domain}] ➥ [–u username] [–p {password | *}] [-q]

Table 6.3 describes the available options. TABLE 6.3 Dsmove Command-Line Options Parameter

Description

ObjectDN

The distinguished name (DN) of the object to be moved or renamed.

-newname NewRDN

Renames the object to the specified relative distinguished name (RDN).

-newparent ParentDN

Specifies the DN of the parent node in the directory tree to which the object is to be moved.

-s server | -d domain

Connects to a specified remote server or domain. By default, you are connected to a domain controller in the domain where you are logged on.

-u username

Specifies a username under which you log on at the specified remote server.

-p password | *

Specifies the password for the username under which you log on to a remote server. If you specify *, you are prompted for a password.

-q

Quiet mode (suppresses all standard output).

Additional options for Unicode format are also available. Refer to the Windows Server 2003 Help and Support Center for details on these options.

NOTE Object Permissions When you move objects between OUs, they retain their explicitly assigned permissions. Any permissions inherited from their old OU are lost and replaced with permissions inherited from their new OU.

404

Chapter 6: Implementing User, Computer, and Group Strategies

Moving Objects Between Domains The methods described here enable you to move objects within a single domain only. If you need to move an object between domains within your Active Directory forest, you need to utilize other methods of moving objects. Microsoft provides the following two tools for this purpose: . Active Directory Migration Tool (ADMT)—This tool enables you to move users,

groups, computers, and other objects from a Windows NT 4.0 domain to an Active Directory domain or to move objects between Active Directory domains in the same or separate forests. This tool includes wizards that facilitate the performance of common migration tasks. You can run ADMT from its console or a command prompt, and you can include it in a script. Refer to “Active Directory Migration Tool” in the Suggested Readings and Resources section for more information. . Movetree—This command-line tool allows you to move objects including users,

groups, and OUs, between domains in a single forest. It does not allow you to move computers or certain types of data associated with users such as profiles, logon scripts, and personal data. Microsoft recommends that you use Movetree only in cases that involve objects such as contacts that ADMT cannot handle. Refer to the Windows Server 2003 Help and Support Center for more information.

EXAM ALERT Use of Scripts In a scenario where you have multiple user accounts with information stored in comma-separated (CSV) files, the use of a script is an efficient means of moving user accounts to the appropriate OUs.

Challenge Moving Objects within a Domain As the Widgets company you have been working with has expanded its operations, administrators in the south.widgets.com domain have created four top-level OUs with the names Sales, Marketing, Accounting, and Accounts Receivable. A user named Peter has an account that is currently located in the Users container. The administrators have also created three GPOs that are currently linked to the OUs as shown in the following table: GPO

Container to Which It Is Linked

GPO1

Sales

GPO2

Accounting

GPO3

Accounts Receivable

405

OU Structure

You need to make changes to the OU structure of the domain so that the following are accomplished: . GPO1 is applied to users in the Marketing OU. . GPO2 is applied to users in the Accounts Receivable OU. . Peter should receive the settings contained in GPO2 and GPO3. You do not have permission to add or modify GPO links. Your task is to reorganize the Active Directory structure to accomplish the stated tasks. Try to work through the required steps on your own, referring back to the Step by Step procedures in this section as appropriate. If you are stuck, refer to the steps that follow: 1. Log on to the south.widgets.com domain controller as an administrator. 2. Open Active Directory Users and Computers and expand the OU subtree to reveal the four stated OUs. 3. Right-click the Marketing OU and select Move. 4. In the Move dialog box, select Sales and then click OK. This makes Marketing a child OU of Sales; consequently GPO1 is applied to Marketing as well as Sales. 5. Right-click the Accounts Receivable OU and select Move. 6. In the Move dialog box, select Accounting and then click OK. This makes Accounts Receivable a child OU of Accounting; consequently, GPO2 as well as GPO3 are applied to the Accounts Receivable OU. 7. Select the Users container so that its contents appear in the details pane. 8. Right-click Peter and choose Move. 9. In the Move dialog box, select Accounts Receivable and then click OK. This causes both GPO2 and GPO3 to be applied to this user account. 10. Close Active Directory Users and Computers.

Implications of Moving Objects Moving objects within and between domains has several effects that you should be aware of. Recall that any Active Directory object includes a security identifier (SID) and a globally unique identifier (GUID). The following describes the effect of moving an object: . When you move an object from one OU to another within the same domain, the SID

and GUID are unchanged. . When you move an object from one domain to another in the same forest, the SID is

changed but the GUID remains unchanged. . When you move an object from one forest to another, both the SID and GUID are

changed.

406

Chapter 6: Implementing User, Computer, and Group Strategies

Active Directory provides an attribute known as the SID history to track changes in an object’s SID when it is moved. SID history stores previous values of an object’s SID, thereby allowing migrated users to access resources in their old domains. However, this comes with a security risk—users might be able to spoof access to other domains and thereby reach objects to which they would be otherwise denied. You can use Ldp.exe to view an object’s SID history; we introduced this tool in Chapter 4. You can use VBScript to remove SID history information from a user account; for further details, refer to Knowledge Base article 295758, referenced in the “Selected Readings and Resources” section.

NOTE SID History For SID history to be enabled, you must set the domain functional level to Windows 2000 native or higher. SID history is not enabled if the domain functional level is set to Windows 2000 mixed.

Managing an OU Structure The Active Directory Users and Computers console enables you to perform additional administrative tasks on your OU hierarchy. These include moving, renaming, and deleting OUs, and configuring OU properties. Step by Step 6.9 shows you how to perform these tasks:

STEP BY STEP 6.9 Performing Administrative Tasks on OUs 1. Ensure that you are logged on as a member of the Domain Admins or Enterprise Admins group, or as a user who has been delegated the right to make changes to Active Directory objects. 2. Open Active Directory Users and Computers and expand the console tree to locate the object(s) to be managed. 3. To move an OU, select it and drag it to its new location. Alternatively, you can right-click it and select Move. From the Move dialog box (refer back to Figure 6.20), select the appropriate destination and then click OK. 4. To rename an OU, right-click it and choose Rename. Type the new name and then press Enter. 5. To delete an OU, select it and press Delete, and then click Yes in the message box that appears. You receive the second message box shown in Figure 6.21, warning you that the operation could take a long time. Click Yes to proceed.

FIGURE 6.21 When you delete a container object, you are warned that the deletion could take a long time.

407

OU Structure 6. To modify the properties of an OU, right-click it and choose Properties. This displays the Properties dialog box shown in Figure 6.22. This dialog box includes the following tabs:

FIGURE 6.22 The Properties dialog box for an OU enables you to configure several properties for the OU.

. General—Enables you to specify a description and complete address for the OU. You can search for an OU by using information specified on this tab. . Managed By—Enables you to specify a user or group that is entitled to manage the OU. Searchable information is also contained on this tab. . Object—Provides the canonical name and several other properties of the OU. This tab does not contain any configurable options. This tab is visible only if you have selected Advanced Options from the View menu in Active Directory Users and Computers. . Security—Enables you to specify permissions for users, including the ability to create or delete child objects in the OU and generate RSoP queries in either planning or logging mode. This tab is visible only if you have selected Advanced Options from the View menu in Active Directory Users and Computers. . COM+—Specifies COM+ partition sets of which the OU is a member. . Group Policy—Enables you to link GPOs to the OU and open the Group Policy Object Editor to configure GPO properties. If you have installed GPMC, this tab contains only a command button for opening GPMC. See Chapters 7 and 8 for more information. 7. Click OK when finished or Apply to apply changes before configuring additional options.

408

Chapter 6: Implementing User, Computer, and Group Strategies

Chapter Summary In this chapter, we examined OU structures and security groups in relation to the business requirements for delegation of control. We discussed the valid reasons for creating OUs, ways to structure a set of OUs to organize objects into a meaningful system, and ways to use OUs to facilitate delegation of control. We reviewed the use of an administrative model, a functional model, and a location-oriented model when creating an OU structure. This chapter also looked at how to use default security groups in your security group structure and when to create custom security groups for administrative delegation. We also looked at the creation of OUs for the application of Group Policy and for limiting visibility of objects from other users. For security purposes, it is best to limit access to administrative objects. To do so, you should create separate OUs at the top level of the OU hierarchy. Group Policy application, however, should only prompt the creation of additional OUs below those already created for delegation of control. Finally, this chapter walked through the process of creating an OU, delegating control over the OU, modifying or removing delegated permissions, moving objects from one location in the OU structure to another or to other domains, and performing several other administrative tasks on OUs.

Key Terms . Blocked inheritance . Default security group . Delegation of control . Domain . Domain local group . Enforced inheritance . Forest . Global group . Group nesting . Group Policy . Inheritance . Lightweight Directory Access Protocol (LDAP) . Organizational unit (OU) . Rights

409

Apply Your Knowledge

Apply Your Knowledge The 70-294 exam tests your knowledge of the various situations that can be encountered when configuring and implementing OUs and administrative delegation strategies. You need to be aware of the various ways in which you can set up security groups and OUs, and delegate administrative authority. You also need to know how administrative and Group Policy requirements affect an OU structure, and how you would delegate permissions and move objects within the OU hierarchy. The exercises and exam questions presented here serve to reinforce these requirements. Note that you may encounter drag-and-drop or hot-spot questions on the exam. Due to the limitations of the printed page, we are unable to include questions of these types in the exam questions section. However, the explanations suggest the possibility of these question types where appropriate.

Exercises 6.1 Creating the Organizational Unit Structure In this exercise, you create OUs to be used in the following chapter exercises. It is assumed that you have a functioning domain controller for a single Active Directory domain named domain1.com and that you have the ability to log on as a member of the Domain Admin group. Estimated Time: 5 minutes 1. Log on to the domain controller as a member of the Domain Admins group. 2. Click Start, Administrative Tools, Active Directory Users and Computers. 3. In the console tree in the left pane, expand the domain1.com domain container by clicking the plus sign (+) to the left of it. 4. Right-click the domain1.com domain and select New, Organizational Unit from the subtopic menu. 5. Type Corp as the name of the OU you are creating and click OK. 6. Repeat steps 4 and 5 to create another OU named Admins. 7. Right-click the Corp OU and select New, Organizational Unit from the subtopic menu. Name this OU No Access. 8. Repeat step 7 to create another OU named Full Access. 9. Keep the Active Directory Users and Computers console open for the next exercise.

410

Chapter 6: Implementing User, Computer, and Group Strategies

6.2 Creating Security Groups and Users In this exercise, you create several groups and test users to use in examining delegation of control in the Windows Server 2003 Active Directory. Estimated Time: 10 minutes 1. In the left pane of Active Directory Users and Computers, navigate to the Admins OU and rightclick it; then choose New, Group from the subtopic menu. 2. Type Denied Access as the name of the group. Ensure that this group has Global under group scope and Security under group type. Click OK. 3. Repeat steps 1 and 2, except name the new global security group Full Access. 4. Repeat steps 1 and 2, except name the group Denied Local and specify Domain Local for the group scope. 5. Repeat steps 1 and 2, except name the group Full Access Local and specify Domain Local for the group scope. 6. Right-click the Admins OU and select New, User from the pop-up menu. 7. In the New Object—User dialog box, create a user named Grant G. Odd with a user logon name of ggodd and a password of P@ssword. Deselect the User Must Change Password at Next Logon check box. 8. Right-click this user and choose Add to a Group. 9. In the Select Group dialog box, browse to Full Access and then click OK. 10. You are informed that the user was added to the group. Click OK. 11. Leave Active Directory Users and Computers open for the next exercise.

6.3 Placing Global Groups As Members of Domain Local Groups In this exercise, you add one group to another to prepare for granting delegation of control. Estimated Time: 5 minutes 1. In the left pane of Active Directory Users and Computers, click the Admins OU to reveal the groups and user you created in the details pane. 2. Right-click the Denied Access group and select Properties. 3. On the Denied Access Properties dialog box, click the Member Of tab. 4. Click Add. In the Select Groups dialog box, type Denied Local as the name of the group to be added to this group and then click OK. 5. Click OK again to close the Denied Access Properties dialog box.

411

Apply Your Knowledge 6. Repeat steps 3–5 to add the Full Access group as a member of the Full Access Local group. 7. Leave Active Directory Users and Computers open for the next exercise.

6.4 Delegating Control In this exercise, you delegate control of one OU to one group and deny access to another OU by selecting a lower OU in the subtree. Estimated Time: 10 minutes 1. In the console tree of Active Directory Users and Computers, navigate to the Corp OU and rightclick it. Select Delegate Control from the pop-up menu. 2. Click Next at the welcome screen. 3. In the Users or Groups dialog box, click the Add button. Type Full Access Local as the group name to be delegated control and click OK. 4. This group appears in the Users or Groups dialog box. Click Next. 5. In the Tasks to Delegate dialog box, select Create a Custom Task to Delegate and then click Next. 6. In the Active Directory Object Type page, leave the default of This Folder, Existing Objects in This Folder, and Creation of New Objects in This Folder selected, and click Next. 7. In the Permissions dialog box, check the boxes for General, Property Specific, and Creation/Deletion of Specific Child Objects and select Full Control in the Permissions field to ensure that all the boxes in this field are selected. Click Next. 8. Click Finish on the summary screen. 9. Repeat steps 1–8 to delegate control for the Full Access OU the Denied Local group. 10. Leave Active Directory Users and Computers open for the next exercise.

6.5 Testing Delegation for Full Access In this exercise, you test the delegation results of the Full Access global group. Estimated Time: 5 minutes 1. In the console tree of Active Directory Users and Computers, click the Admins OU to make its contents visible in the details pane. 2. Right-click the Full Access global group and choose Properties. 3. On the Full Access Properties dialog box, click the Members tab. 4. Click Add. In the Add dialog box, type ggodd as the name of the user to be added to this group and then click OK. 5. Click OK.

412

Chapter 6: Implementing User, Computer, and Group Strategies 6. In the console tree, click the Builtin container to make its contents visible in the details pane. 7. Repeat steps 2–5 to make ggodd a member of the Print Operators group. This is necessary to provide this user with the right to log on locally to the domain controller. 8. Log off the domain controller and log on again as ggodd. 9. Open the Active Directory Users and Computers console by clicking Start, Run, typing dsa.msc, and pressing Enter. 10. Navigate in the left pane to the Corp\No Access OU. Right-click the OU and select New, Organizational Unit. Type the name WFA and click OK. 11. Verify that the OU was created and log off.

6.6 Testing Delegation for No Access In this exercise, you test the delegation results of the Denied Access global group. Estimated Time: 10 minutes 1. Log back on to the domain controller as a member of the Domain Admins group and open Active Directory Users and Computers. 2. In the console tree of Active Directory Users and Computers, click the Admins OU to make its contents visible in the details pane. 3. Right-click the Full Access global group and choose Properties. 4. On the Full Access Properties dialog box, click the Members tab. 5. Select the ggodd user and click the Remove button. 6. Click Yes to confirm removal of this user from the group, and then click OK to close the Full Access Properties dialog box. 7. Right-click the Denied Access global group and select Properties. 8. On the Denied Access Properties dialog box, click the Members tab. 9. Click Add. In the Add dialog box, type ggodd as the name of the user to be added to this group and then click OK. 10. Click OK to close the Denied Access Properties dialog box. 11. Log off the domain controller and log on again as ggodd. 12. Open the Active Directory Users and Computers console by clicking Start, Run, typing dsa.msc, and pressing Enter. 13. Navigate in the left pane to the Corp OU. Right-click the OU and select New, Organizational Unit. What happens? Why?

413

Apply Your Knowledge What do you see in the OU hierarchy? Is No Access visible? Can you create an OU in No Access?

14. Close Active Directory Users and Computers and log off.

6.7 Applying a Group Policy to an OU In this exercise, you apply a GPO to an OU at the middle of the OU tree to test how this type of Group Policy application affects users in other OUs. This exercise assumes that you have logged on as a member of the Domain Admins group and that you have not installed GPMC. If you have installed GPMC, see Chapter 7 for procedures that replace steps 1 to 4 of this procedure. Estimated Time: 15 minutes 1. Click Start, Administrative Tools, Active Directory Users and Computers. 2. Right-click the Corp OU and select Properties from the pop-up menu. 3. Click the Group Policy tab. 4. Click New and name the GPO Middle. Click the Edit button to make changes to the GPO. The Group Policy Editor will start. 5. Navigate to the User Configuration node, Administrative Templates, Start Menu and Taskbar. Double-click the Remove My Network Places icon from Start Menu policy to edit it. Select Enabled and click OK. 6. Close the Group Policy Object Editor console and close the Corp OU Properties dialog box. 7. Make certain that the user ggodd is still within the Admins OU. 8. Log on to a domain member computer (or on to the domain controller itself) as user ggodd. 9. Click Start, and look for the My Network Places icon. Is it on the Start menu? Why or why not?

10. Log off.

414

Chapter 6: Implementing User, Computer, and Group Strategies

6.8 Moving a User to a Different OU In this exercise, you move a user object from one OU to another. This procedure prepares you to test the application of inherited Group Policy. Estimated Time: 5 minutes 1. Log back on to the domain controller as a member of the Domain Admins group and open Active Directory Users and Computers. 2. Navigate to the Admins OU. 3. Right-click the user named ggodd and select Move from the pop-up menu. 4. Browse the dialog box to locate the Corp\Full Access OU. Click OK. 5. Verify that user ggodd is now within the Corp\Full Access OU.

Exam Questions 1. Roy is the network administrator for a company that operates an Active Directory network consisting of a single domain. Roy needs to decide how to structure the domain’s OUs to accommodate delegation of administration. The company has three main functional areas: Accounting, Sales, and Service. Together with three assistants, Roy handles all network duties at the two corporate locations. Each of the three assistants has separate duties. One handles computer management, one handles server management, and the final one handles user management. How should Roy structure the company’s OUs?

❍

A. He should create a single OU for Admins and a single OU for the rest of the company.

❍

B. He should create a location-oriented structure representing the two locations.

❍

C. He should create a function-oriented structure representing the three functional areas of Accounting, Sales, and Service.

❍ D. He should directly match the OUs to the delegation of control requirements and provide an OU for Corp, and within it three OUs representing Servers, Computers, and Users. 2. Karla is the senior administrator for Quepublishing, which operates an Active Directory network consisting of a single domain named Quepublishing.com. The company’s help desk analysts are responsible for resetting passwords for all company users except administrative users. An OU named Company Users contains a child OU named Employees and a second child OU named IT Users. User accounts for administrative users are located in the IT Users OU, and user accounts for other users are located in the Employees OU. An OU named Computers contains child OUs named Servers and Workstations. All computer accounts for

415

Apply Your Knowledge servers are located in the Servers OU and all computer accounts for desktop and laptop computers are located in the Workstations OU. Karla needs to design an administrative model that enables the help desk analysts to perform their duties without granting them excessive privileges. To which OU should she delegate control?

❍

A. Computers

❍

B. Servers

❍

C. Workstations

❍ D. Company Users ❍

E. Employees

❍

F. IT Users

3. Sandy is defining the OU structure for a company that has a single administrative group with control over everything. She finds that each department has a super-user, or person who helps with resetting passwords and installing applications in that department only. How should she incorporate the super-users in the company’s administrative model?

❍

A. Create a functional model below a centralized one and delegate the appropriate permissions for each department.

❍

B. Create a location-oriented model below the centralized one. Delegate the appropriate permissions for each super-user to their location.

❍

C. Change the administrative rights of the default security group for Domain Admins and add the super-users to that group.

❍ D. She should not incorporate the super-users into the delegation model because they do not really require those rights. 4. Ryan is the network administrator for Examcram.com, which operates an Active Directory network consisting of a single domain. The domain includes an OU named Manufacturing, which includes all user and group objects for the Manufacturing department. Two junior administrators named Janet and Karen are responsible for managing Manufacturing objects. Janet manages Manufacturing user objects, whereas Karen manages Manufacturing computer objects. Ryan needs to delegate control of the appropriate objects to Janet and Karen. What should he do?

❍

A. Grant Janet the right to manage user objects and grant Karen the right to manage computer objects in the Manufacturing OU.

❍

B. In the Manufacturing OU, create a child OU named Computers, and place computer objects in this OU. Grant Janet the right to manage the Manufacturing OU, and grant Karen the right to manage the Computers OU.

416

Chapter 6: Implementing User, Computer, and Group Strategies

❍

C. In the Manufacturing OU, create two new child OUs, one named Users and the second named Computers. Place user objects in the Users OU and computer objects in the Computers OU. Grant Janet the right to manage the Users OU and grant Karen the right to manage the Computers OU.

❍ D. In the Manufacturing OU, deny Karen the right to manage user objects and deny Janet the right to manage user objects. 5. You are the network administrator for Joe’s Java network. You plan to give a user temporary access to the domain to manage user accounts in your absence. Which should you do to ensure that the user receives the identical rights that you have?

❍

A. Create a new group for the user and delegate new controls that are identical to the ones that you have.

❍

B. Create two new groups: one domain local and one global. Grant the rights to manage the Corp OU to the domain local group, make the global group a member of the domain local group, and make the user a member of the global group.

❍

C. Add the user as a member of the groups that you are a member of.

❍ D. Make the user a member of the Enterprise Admins group. 6. You are the administrator of Books Galore, a bookseller’s network. Your network consists of a single domain, booksgalore.com, and three sites: Green Bay, Littleton, and Atlanta. Greg, a temporary administrator in Green Bay, will be taking on some administrative duties for that location. You do not want Greg to be able to manage users, computers, or groups in the Littleton and Atlanta locations. You also want to ensure that you can quickly grant Greg’s permissions to other users. Because Greg is a temporary worker, you also want to make certain that you can remove his rights at any point without having to re-create them if and when you hire a different administrator. Which of the following actions should you take?

❍

A. Create three OUs: Green Bay, Littleton, and Atlanta. Delegate control of the Green Bay OU to Greg.

❍

B. Create a single OU for all users and add users to three groups: Green Bay, Littleton, and Atlanta. Delegate control of the Green Bay group to Greg.

❍

C. Create a top-level OU named Corp. Create three OUs within that OU called Green Bay, Littleton, and Atlanta. Create a global security group called Green Bay Admins and add Greg to it. Create a domain local group called Green Bay Local Admins and make Green Bay Admins a member of it. Delegate control of the Green Bay OU to the Green Bay Local Admins group.

❍ D. Make Greg a member of the Domain Admins group.

417

Apply Your Knowledge 7. Heather is the network administrator for a company that operates a network consisting of a single domain named quepublishing.com. The functional level of the domain is Windows Server 2003. The company has created a new application that requires six servers. Heather creates an OU named Application and adds the servers and related resources to the OU. Heather has also created a global group named AppAccess that will administer access for company users on the application servers. This group should not have the capability of performing any other tasks on the servers. What should Heather do to grant the appropriate access to the AppAccess group without granting this group excessive privileges?

❍

A. Move the AppAccess global group into the Application OU.

❍

B. Create a domain local group for access to the application servers, and grant the domain local group the required permissions. Then grant the AppAccess group permissions to modify the membership of the domain local group.

❍

C. Add the AppAccess global group to the Power Users local group on each of the application servers.

❍ D. Grant the AppAccess group permissions to modify computer objects in the Application OU. 8. Harriet is the network administrator for Quepublishing, which operates an Active Directory network that consists of a single domain named quepublishing.com. The domain includes OUs named Sales, Service, Marketing, and Administration. The company acquires a second company named Examcram and Harriet creates a new domain named examcram.com as a second tree in the quepublishing.com forest. A user named Roger, whose user account is located in the default Users container needs to be able to administer computers in the examcram.com domain, so Harriet wants to move his user account to that domain. Harriet right-clicks Roger’s user account and selects Move. What should Harriet do next?

❍

A. From the dialog box that appears, select the ForeignSecurityPrincipals container.

❍

B. From the dialog box that appears, select the examcram.com domain.

❍

C. Leave Roger’s user account in its current location, and grant him permissions to the appropriate resources.

❍ D. Harriet cannot perform this move in this manner. She should use the dsmove command-line tool.

❍

E. Harriet cannot perform this move in this manner. She should use the ADMT tool.

418

Chapter 6: Implementing User, Computer, and Group Strategies 9. Sandra is the administrator of Trewdat Networks, which operates an Active Directory network consisting of a single domain with three sites representing the cities where the company does business. Sandra works at the San Francisco head office location. The other two locations are Toronto and Boca Raton. She hires two different administrators in each of the other locations to begin handling local administration. Joe is in Toronto, and Jack is in Boca Raton. She does not want Joe or Jack to be able to make changes to any objects in San Francisco. She also does not want Joe or Jack to be able to make changes to user accounts or computer accounts in each other’s locations. Neither Joe nor Jack should have access to the domain controllers. How should Sandra proceed? (Each answer represents part of the solution. Select two answers.)

❏

A. Create an OU at the top for all users; then place three OUs below that called San Francisco, Toronto, and Boca Raton.

❏

B. Create a single OU for all users.

❏

C. Delegate permissions to the Toronto and Boca Raton OUs to Joe and Jack, respectively.

❏ D. Create new security groups for Joe and Jack, respectively, and then delegate separate permissions to the Toronto and Boca Raton OUs to each.

❏

E. Delegate permissions to the domain controllers that are located in each site to Joe and Jack.

❏

F. Place Joe and Jack in the Domain Admins group.

10. Henry is the systems administrator for a company that operates an Active Directory network consisting of a single domain. There are three sites corresponding to the cities (Boston, Paris, and Cairo) in which the company does business. The local IT staff manages the resources for most of the company’s departments within their own city. The company’s departments are divided into three main divisions named Sales, Manufacturing, and Support. The Legal department has its own IT staff, which manages departmental resources for all three cities. Henry needs to plan a top-level organizational unit (OU) structure that enables delegation of control over all company activities to the appropriate IT staff. Which of the following should he use as top-level OUs? Choose all that apply.

❏

A. Sales

❏

B. Mfg

❏

C. Legal

❏ D. Support ❏

E. Paris

❏

F. Cairo

❏ G. Boston

419

Apply Your Knowledge

Answers to Exercises 6.6

Testing Delegation for No Access 13. The Organizational Unit option is not visible under New. This occurs because you will not be able to create any objects within any of the OUs that you are not specifically granted access to or that are child OUs of that OU. You will see only the OUs that you have been granted the rights to view. You should not be able to create a new OU within No Access. Delegation of control moves down only, not sideways or upward.

6.7

Applying a Group Policy to an OU 9. Because the user ggodd is still in the Admins OU, and because the Middle GPO was applied to an OU that is outside the Admins OU hierarchy, ggodd will still be able to see the My Network Places icon on the Start menu. If you do not see this icon, right-click Start and choose Properties. On the Start menu tab of the Start Menu Properties dialog box, click Customize, and on the Advanced tab of the Customize Start Menu dialog box, scroll to select My Network Places. Click OK twice to exit the dialog boxes and then click Start again. My Network Places should now be visible.

Answers to Exam Questions 1. D. Roy should create an administrative model that consists of a top-level OU where he, as overall network administrator, has control, and sub-OUs for the three assistants, representing Servers, Computers, and Users. This model serves the needs of the three assistants, each of which has responsibilities for servers, computers, and users, respectively. Answers A, B, and C are incorrect because none of these structures will facilitate administration. Delegating control would become difficult, and the OU structure would become increasingly complex as more OUs were added to allow for such delegation. See the section “Planning an OU Structure Based on Delegation Requirements.” 2. E. Karla should delegate control of the Employees OU to the group containing the help desk analysts. Only the Employees OU would give them the proper permissions. If she were to delegate control of the Company Users OU, the help desk analysts would receive permission to reset passwords belonging to administrative users, so answer D is incorrect. If she were to delegate control of the Computers, Servers, or Workstations OU, the help desk analysts would not receive any ability to reset passwords, so answers A, B, and C are incorrect. If she were to delegate control of the IT Users OU, the help desk analysts would receive permission to reset passwords belonging to administrative users but not to other employees, so answer F is incorrect. Note that this question may appear on the exam as a “hot-spot” question in which you must select the correct container on a diagram of the domain. See the section “Planning an OU Structure Based on Delegation Requirements.”

420

Chapter 6: Implementing User, Computer, and Group Strategies 3. A. Sandy should create a functional model below a centralized one, containing sub-OUs for each department. This enables her to delegate control to the super-users for their appropriate departmental OU. If she were to create a location-oriented model, super-users would be granted either more rights than they need for other departments at their location or fewer rights because their department spreads across two or more locations. Answer B is incorrect because the super-users are not located by site. Answer C is incorrect because she should limit the memberships within the Domain Admins group, and she should not change the default rights. Answer D is incorrect because it is a system that is already in place and working. See the section “Administrative Requirements for an OU Structure.” 4. A. Ryan should grant Janet the right to manage user objects and grant Karen the right to manage computer objects in the Manufacturing OU. The Delegation of Control Wizard enables Ryan to delegate control over the appropriate type of objects, so that he can accomplish the required task. Because Ryan can delegate control in this manner, it is not necessary to create additional OUs; therefore, answers B and C are incorrect. Ryan needs to assign the appropriate rights explicitly and cannot deny users the right to manage certain objects; therefore, answer D is incorrect. See the section “Delegating Permissions for an OU to a User or Security Group.” 5. C. If you make the user a member of the same groups that you are a member of, and assuming that you have followed best practices by always delegating control and assigning rights to groups rather than users, the user will have the same rights that you have. Answers A and B are incorrect because they require additional, unnecessary steps. Answer D is incorrect because it provides the user with greater rights than necessary; if you make the user a member of the Enterprise Admins group, the user will have access to more than just the corp.joesjava.com domain. See the section “Planning a Security Group Hierarchy Based on Delegation Requirements.” 6. C. To easily re-create and maintain the delegated control rights and permissions, you should use the system of a domain local group that is granted rights to the resources, make a global group a member of that domain local group, and finally make the user a member of the global group. Then you can delegate control of the appropriate container (in this case, the Green Bay OU) to the domain local group. If you ever need to change Greg’s rights, you can easily remove Greg from the global group. Answers A and B are incorrect because you should not grant users rights directly. Answer D is incorrect because making Greg a member of the Domain Admins group would grant him excessive privileges, including managing objects in the Littleton and Atlanta locations. See the section “Planning a Security Group Hierarchy Based on Delegation Requirements.” 7. B. Heather should create a domain local group for access to the application servers, and grant the domain local group the required permissions. She should then use the Delegation of Control Wizard to grant the AppAccess group permissions to modify the membership of the domain local group. In this way, the AppAccess group receives the appropriate permissions without being granted excessive privileges. Moving the AppAccess group into the Application OU would not grant this group the appropriate privileges, so answer A is incorrect. Adding the AppAccess group to the Power Users group on the application servers would grant this group more privileges than required for this scenario, so answer C is incorrect. Granting the AppAccess group permissions to modify computer objects would not provide them with the proper privileges, so answer D is incorrect. See the section “Delegating Permissions for an OU to a User or Security Group.”

421

Apply Your Knowledge 8. E. Harriet needs to use the ADMT command-line tool. Using this tool, she can move objects from one domain to another in the same or separate forests. The ForeignSecurityPrincipals container is used by Active Directory to hold security principals from trusted external domains, including domains in separate trees. Although this container does appear in the Move dialog box, administrators should never modify the contents of this container, so answer A is incorrect. The Move dialog box does not include other domains in its contents, so answer B is incorrect. Neither the Move dialog box nor the dsmove command-line tool includes the option to move an object to another domain, so answers C and D are incorrect. See the section “Moving Objects Between Domains.” 9. A, D. Sandra should create a layered OU structure that will separate the locations from each other. She can then use security groups for delegating permissions to each respective site. If Sandra were to create only a single OU for all users, Joe and Jack would be able to administer users in all locations, so answer B is incorrect. Delegation should be done through groups, not directly to users, so answer C is incorrect. Joe and Jack need to be able to administer users and not domain controllers, so answer E is incorrect. Joe and Jack should not be made members of the Domain Admins groups because that will defeat the purpose of maintaining separation between their locations, so answer F is incorrect. See the section “Delegating Permissions for an OU to a User or Security Group.” 10. C, E, F, G. Henry should create a top-level OU for each of the three locations—Boston, Paris, and Cairo—and another top-level OU for the Legal department. This OU structure enables local IT staff in each city to manage resources in their own office only, and also enables Legal IT staff to manage resources located in Legal departments located in all three cities. If he were to create top-level OUs for the other three departments, IT staff would be able to manage resources located in multiple cities but only one department at a time. This is in contradiction to the facts presented in the scenario; therefore answers A, B, and D are incorrect. Note that a question similar to this may appear as a drag-and-drop question in which you must drag the appropriate OUs to the correct locations on a diagram. See the section “Planning an OU Structure Based on Delegation Requirements.”

Suggested Readings and Resources 1. Microsoft Corporation. “Active Directory Collection.” http://technet2.microsoft.com/

WindowsServer/en/library/6f8a7c80-45fc-4916-80d9-16e6d46241f91033.mspx? mfr=true. 2. Microsoft Corporation. “Active Directory Migration Tool.” http://

technet2.microsoft.com/WindowsServer/en/library/0b62e2f1-f15f-46e3-8005901926c5da2f1033.mspx?mfr=true. 3. Microsoft Corporation. “Active Directory Services and Windows 2000 or Windows

Server 2003 Domains (Part 2).” http://support.microsoft.com/default.aspx?scid= kb%3Ben-us%3BQ310997.

422

Chapter 6: Implementing User, Computer, and Group Strategies 4. Microsoft Corporation. “Design Considerations for Organizational Unit Structure and

Use of Group Policy Objects.” http://technet2.microsoft.com/WindowsServer/ en/Library/2f8f18cf-a685-48db-a7be-c6401a8fb6341033.mspx?mfr=true. 5. Microsoft Corporation. “Dsmove.” http://technet2.microsoft.com/WindowsServer/

en/library/fa5b6cfb-bb58-480c-bfe5-a24b087a103d1033.mspx?mfr=true. 6. Microsoft Corporation. “How the Data Store Works.” http://technet2.microsoft.com/

WindowsServer/en/library/54094485-71f6-4be8-8ebf-faa45bc5db4c1033.mspx? mfr=true. 7. Microsoft Corporation. “How to Use Visual Basic Script to Clear Sid History.”

http://support.microsoft.com/default.aspx?scid=kb;en-us;295758.

7

CHAPTER 7

Planning and Implementing Group Policy Objectives This chapter covers the following Microsoft-specified objectives for the Planning and Implementing Group Policy section of the Windows Server 2003 Active Directory Infrastructure exam: Plan Group Policy strategy . Plan a strategy for configuring the user environment by using Group Policy . Plan a strategy for configuring the computer environment by using Group Policy . Group Policy is a powerful feature of Active Directory and has been enhanced in Windows Server 2003 by the addition of new policies and features. This objective measures your ability to plan the application of Group Policy to users and computers. This is important because you can have a series of Group Policy Objects (GPOs) that affect a given user working on a given computer, and you need to know exactly how these GPOs apply to each situation.

Configure the user environment by using Group Policy . Distribute software by using Group Policy . Automatically enroll user certificates by using Group Policy . Redirect folders by using Group Policy . Configure user security settings by using Group Policy . The purpose of this objective is to measure your ability to configure various aspects of user environments using Group Policy. You will be tested on the various means of distributing software, specifying user security settings, and configuring certificate autoenrollment. You need to know the various means of distributing software, including publishing and assigning. You also have to know how to distribute both transformations and patches, and the difference between them. This is important because the smooth functioning of any organization depends on users having available the software they need to do their jobs, regardless of which computer they log on to. Security settings and certificates are important in maintaining a secure environment and ensuring that others trust the actions of your organization. You also need to know how to redirect folders, such as My Documents, according to users’ membership in groups and Organizational Units (OUs). This is important because it helps you to keep track of all mission-critical data that users create and ensure that it is backed up in a timely manner.

Deploy a computer environment by using Group Policy . Distribute software by using Group Policy . Automatically enroll computer certificates by using Group Policy . Configure computer security settings by using Group Policy . This objective complements the previous one in ensuring that you know how to perform the same tasks from a computer-specific viewpoint. In most cases, the topics work together so closely that we have elected to discuss these objectives together.

Outline Introduction

426

The Concept of Group Policy

426

Components of Group Policy

427

Group Policy Containers (GPCs)

427

Group Policy Templates (GPTs)

428

Planning the Application of Group Policy Group Policy Inheritance

Deploying the User and Computer Environment with Group Policy

462

Software Installation Using Group Policy

462

Assigning and Publishing Software 464 Use of Group Policy to Deploy a Software Package

465

ZAP Files

467

429

Software Installation Properties

468

429

Software Package Properties

471

Software Redeployment

473

Using the Group Policy Management Console (GPMC)

431

Creating and Managing GPOs

434

New GPOs

434

Domain-Based GPOs

435

Site-Based GPOs

437

OU-Based GPOs

438

Managing GPO Links

438

Backing Up and Restoring GPOs

441

Importing GPOs

443

Managing GPOs in Other Domains 444 Group Policy for Users and Computers 445 Modifying Group Policy Inheritance 446

User and Computer Environment Review

473

Enrolling User and Computer Certificates with Group Policy

475

Enrolling User and Computer Certificates with Group Policy Review 481 Configuring Security Settings with Group Policy Settings Available to Both Computers and Users

481 482

Settings Available to Computers Only 488 Security Settings Review

496

Redirecting Folders with Group Policy 496 Benefits of Folder Redirection

497

Implementing Folder Redirection

498

Modifying the Sequence of GPO Application

449

Filtering the Effects of a GPO

450

Disabling Parts of GPOs

454

Windows Management Instrumentation (WMI)

455

Group Policy Loopback Processing Mode

509

Best Practices for Managing Group Policy

456

Review of Group Policy User Environment Settings

511

Some Strategies for Planning a Set of GPOs

456

Strategies for Planning GPOs

457

Delegation of Group Policy Administration

457

Group Policy Application Review

461

Offline Files and Folder Redirection Administrative Templates Settings

Chapter Summary Key Terms Apply Your Knowledge

501 504

512 513 514

Exercises

514

Exam Questions

521

Answers to Exercises

528

Answers to Exam Questions

529

Suggested Readings and Resources

532

Study Strategies . Group Policy makes up a major portion of the 70-294 exam. This topic is so involved that we have devoted two chapters to it. To pass this exam, you need to know thoroughly how Group Policy works and how to configure its various options. Take the time to work through the various exercises we have provided and make sure that you understand the material by understanding the review and exam questions we have presented in these chapters. Install and work with the Group Policy Management Console so that you understand its capabilities and how its use simplifies Group Policy administration. . Make sure that you understand the sequence in which GPOs are processed and how you can modify these sequences. This knowledge provides a foundation on which you will build in the next chapter, when you learn how to use Resultant Set of Policy (RSoP), as well as other tools to plan and troubleshoot the application of Group Policy. . You need to understand the various software deployment options available in Group Policy. In this chapter, we concentrate on the installation of software, whereas in the next chapter, we review the use of Group Policy in updating software applications and removing old ones that are no longer needed.

426

Chapter 7: Planning and Implementing Group Policy

Introduction Those of you who have worked on help desks and technical support groups know very well the large number of problems that users in a company of any size experience with their computers. It is human nature to explore what you can do with your computer, what the Control Panel components do, and so on. This exploration invariably leads to problems, especially when users make changes and then cannot get back to where they were as a result. Microsoft has long recognized this fact and has worked hard to create a secure means of limiting what users can do, while allowing them to do everything their job requires them to do. Windows NT 4.0 provided System Policy, which allowed administrators a means of configuring users’ desktops and limiting their ability to do certain things on their computers. This feature was a start in the right direction, but had only limited powers. Windows 2000 replaced System Policy with Group Policy, which added improved levels of functionality, flexibility, and granularity, thus giving administrators far more control over their users’ environments compared to Windows NT. Active Directory in Windows Server 2003 has improved on Group Policy and introduced new tools that ease the administrative burden of today’s large networks. This chapter introduces you to Group Policy and its most important aspects, including many of the new features.

R2 Windows Server 2003 R2 expands the list of features that you can configure with Group Policy. Included are new policy settings and security policy defaults (such as account policy settings). The Print Management Component introduced with R2 includes a series of new policy settings including the capability to deploy printers to users or computers.

The Concept of Group Policy Group Policy does far more than just define what users can and cannot do on the desktop. It is a set of configuration settings that can be applied to an object or group of objects in Active Directory to define the behavior of the object and its child objects. Group Policy works together with Active Directory and can be used to completely control a user’s environment in numerous contexts, including the following: . Folder redirection—You can use Group Policy settings to redirect local folders to

network shares. . Logon/logoff/startup/shutdown scripts—Group Policy enables you to assign scripts

on a computer or user basis for events such as startup, shutdown, logon, or logoff. . Application deployment—The software installation extension to Group Policy allows

you to assign, update, publish, repair, and remove applications. . Security options of all kinds—You can use various security settings in a Group Policy

to enforce restrictions and control access on user or computer properties.

427

Components of Group Policy

After you have defined the condition of a user’s work environment, Active Directory automatically enforces the Group Policy settings that you have configured without further intervention. You can configure policies that apply to all computers in a site or domain, or one or more OUs within the domain. You can also filter policies so that they apply to only certain security groups contained within a domain. Group Policy can be applied in both user-specific and computer-specific fashions. When a computer starts up, the computer-specific parts of Group Policy are applied even before the user sees the logon screen. As soon as a user logs on, the user-specific parts of Group Policy are applied before the desktop icons are displayed and the user is able to begin working. If a user logs off and a different user logs on to the same machine, the first set of user-specific policies is removed and the second user’s set of user-specific policies is applied. Therefore, the same computer can provide different desktop appearances to two users with different capabilities—for example, a data entry clerk versus a web page designer.

Components of Group Policy As its name implies, a group policy is a group of policies that are applied together. It is a set of configuration settings that can be applied to one or more Active Directory objects to define the behavior of the object and its child objects. In the preceding section, we introduced you to some of the things that it can do; now we introduce you to some of its components. Group Policy has a structure that provides a high degree of flexibility in managing users and computers. The policies are contained in sets known as Group Policy Objects (GPOs). In turn, the content of GPOs is stored in two different locations: Group Policy Containers (GPCs), which are Directory Services objects that include subcontainers for machine and user Group Policy information, and Group Policy Templates (GPTs), which are folder structures including a GPT folder and its subfolders that together contain all the Group Policy information for any particular GPO, including the actual policy settings. All GPOs are identified by their Globally Unique Identifier (GUID), which is a unique 128bit number assigned when the GPO is created. This number is stored as an attribute of the object and is used to identify it within the Active Directory hierarchy.

Group Policy Containers (GPCs) GPCs are objects that are defined within Active Directory and are used to store the properties of GPOs, including attributes and version information. They contain subcontainers for user and computer Group Policy data. Information as to whether the GPO is enabled or disabled is also stored here.

428

Chapter 7: Planning and Implementing Group Policy

Being stored in Active Directory, computers can access GPCs to locate GPTs, and domain controllers can access them to obtain version information, which verifies that they have the most recent edition of a GPO. If not, they can use Active Directory replication to obtain the latest version of the GPO from another domain controller. You can view GPCs in Active Directory Users and Computers by following the procedure outlined in Step by Step 7.1.

STEP BY STEP 7.1 Viewing Group Policy Containers 1. Click Start, Administrative Tools, Active Directory Users and Computers. 2. In the View menu of Active Directory Users and Computers, select Advanced Features. 3. Expand your domain name and then expand the System folder. 4. Select the Policies node. The GUIDs of existing GPCs appear in the details pane, as shown in Figure 7.1.

FIGURE 7.1

You can view GPCs in Active Directory Users and Computers.

Group Policy Templates (GPTs) A GPT is a folder hierarchy composed of the GPT folder at the top and subfolders under it. This structure holds all the information for a given GPO.

429

Planning the Application of Group Policy

Every domain has associated with it a folder hierarchy found in the domain controllers at the shared folder %systemroot%\SYSVOL\sysvol\<domain_name>\Policies. For example, the following shared folder: C:\WINDOWS\SYSVOL\Sysvol\Quepublishing.com\Policies\{31B2F340-016D-11D2-945F00C04FB984F9}

This container object holds policy settings for the various GPOs that have been created for that domain at any level. Subfolders are defined within this shared folder and named by the GUID of the GPO, as mentioned previously. Inside each GPT is a series of subfolders related to user and machine settings and administrative template files, and there are additional subfolders under them. In addition, a file named GPT.INI stores the version number of each GPT for replication purposes. Within the subfolders are text files named Registry.pol; these files are processed by Windows Server 2003 to apply changes to the Registry as a computer is started up and a user logs on. As with other components of SYSVOL, Windows Server 2003 uses File Replication Service (FRS) to replicate changes in the GPT to other domain controllers. The root of each GPT also contains a file called Gpt.ini. This file contains entries for the following parameters: . Version—The version number is a variable that starts at 0 when the GPO is created

and increments by 1 each time it is modified. . Disabled—This parameter indicates whether a local GPO is enabled or disabled.

Information for nonlocal GPOs is contained in a GPC within Active Directory.

Planning the Application of Group Policy Simply stated, you can generally consider GPOs as places to store configuration settings that can be applied to an Active Directory object or a group of objects to control the way they behave in Windows 2000, Windows XP, and Windows Server 2003. You could compare group policies to laws. Different levels of government, such as cities, states, and nations, apply various laws, and you need to reference all these laws to know exactly what is applied. In the same fashion, a computer needs to reference various GPOs to find out how to apply policies to a particular user, group, or computer.

Group Policy Inheritance Every GPO is associated with, or linked to, a container of some kind. Although GPOS can be associated with the local computer, in the Active Directory context they are usually associated with Active Directory containers, including sites, domains, and OUs. Although it is possible to

430

Chapter 7: Planning and Implementing Group Policy

create unlinked GPOs, as we discuss later in this chapter, they are not applied until they are linked to some Active Directory container. As previously mentioned, Group Policy contains both computer-specific and user-specific settings. Computer-specific settings are applied when the computer boots up and before the logon dialog box appears. User-specific settings are applied after the user logs on. Consequently, if any user-specific settings conflict with computer-specific settings, the user-specific settings overwrite the computer-specific settings. As shown in Figure 7.2, group policies are applied in the following order: . Local (L) policies are applied first. . Site-based (S) policies are applied next, overriding any conflicting local policy settings. . Domain-based (D) policies are applied next, overriding any conflicting local or site-

based policy settings. . OU-based (OU) policies are applied last, overriding any conflicting local, site, or

domain-based policy settings. If there is more than one level of OU, policies linked to the parent OU are applied first, followed by child OUs in order. Therefore, the lowest level OU policy becomes the determining factor.

Local

Site Domain

OU

Child OU

FIGURE 7.2 Group policies are applied in the local, site, domain, OU, and then child OU sequence.

This strategy can be summarized as L, S, D, OU. This is important to know because it determines how GPOs with conflicting policy settings are applied to the user or computer. Furthermore, because computer-specific settings are applied at all levels before user logon and user-specific settings are applied after logon, user-specific settings at any level overwrite conflicting computer-specific settings at any level. For example, a local user-based policy would overwrite a computer-based policy applied at the OU level.

431

Planning the Application of Group Policy

EXAM ALERT Group Policy Processing Order It is important to remember the LSDOU order, both for configuring policies in the real world and for the Microsoft exams.

In addition to this inheritance sequence, you should know that Group Policy can also be applied to both computers and users. In case of conflict, the user policy prevails over the computer policy because it is applied last. However, it is worth noting that there are very few settings that can be applied at both the computer and user levels and could be in conflict in this manner.

Using the Group Policy Management Console (GPMC) With Windows Server 2003, Microsoft released a new tool called Group Policy Management Console (GPMC). Available for download from the Microsoft website, GPMC provides enhanced solutions for the management of Group Policy. Using GPMC, you can deploy, manage, and troubleshoot implementations of Group Policy within Windows Server 2003 as well as Windows 2000 environments. You can run GPMC on any Windows Server 2003 computer or on a Windows XP Professional computer with Service Pack 1 and the .NET Framework.

EXAM ALERT Group Policy Management Console Microsoft has upgraded the 70-294 exam to include drag-and-drop as well as simulation questions that utilize the GPMC interface. It is therefore essential that you download and employ GPMC. For this reason, all further procedures in this book make use of GPMC.

GPMC provides a simplified user interface for managing Group Policy in multisite, multidomain environments. It enables an administrator to back up, restore, copy, and import GPOs in these environments. You can create scripts to simplify the various management tasks. Key features of GPMC include the following: . An advanced GUI that facilitates the use and management of Group Policy . The ability to back up and restore GPOs . The ability to copy, paste, import, and export GPOs and Windows Management

Instrumentation (WMI) filters . Enhanced management of security within Group Policy . Enhanced reporting by means of HTML for policy settings and Resultant Set of

Policy data . The ability to script Group Policy–related tasks

432

Chapter 7: Planning and Implementing Group Policy

As of June 2006, the latest version of GPMC includes Service Pack 1 (SP1). Follow Step by Step 7.2 to download and install GPMC.

STEP BY STEP 7.2 Installing GPMC with SP1 1. Open Internet Explorer and navigate to http://www.microsoft.com/downloads/ details.aspx?FamilyId=0A6D4C24-8CBD-4B35-9272-DD3CBFC81887&displaylang=en. 2. Click the Download button and follow the instructions provided to download the latest version of GPMC. 3. When the download is completed, click Run. 4. An Open File–Security Warning dialog box asks you whether you want to run the file. Click Run. 5. The Microsoft Group Policy Management Console with SP1 Setup Wizard starts with a Welcome page (see Figure 7.3). Click Next.

FIGURE 7.3 GPMC provides a wizard that facilitates its installation.

6. On the License Agreement page, click I Agree and then click Next. 7. The Installation Progress page charts the progress of installing GPMC with SP1. When installation is complete, a completion page appears. Click Finish.

When you have installed GPMC, all management of Group Policy is done from GPMC. The Group Policy tab of the Properties dialog boxes of sites, domains, and OUs in Active Directory Sites and Services and Active Directory Users and Computers no longer manages Group Policy; it instead contains a link to GPMC.

433

Planning the Application of Group Policy

You can access GPMC from the Administrative Tools folder. Follow Step by Step 7.3 to access GPMC and become familiar with its contents.

STEP BY STEP 7.3 Becoming Familiar with GPMC 1. Click Start, Administrative Tools, Group Policy Management. Alternatively, you can click Start, Run, type GPMC.msc, and press Enter. GPMC starts and shows a node for your forest in the console tree. 2. Expand this node and expand the Domains node and the entries found within your domain. The console tree expands to display entries for OUs and their GPO links, all available GPOs, and WMI filters. Nodes for RSoP (Group Policy Modeling and Group Policy Results) are also present. 3. To display the properties of any GPO, select it in the console tree. As shown in Figure 7.4, the details pane displays GPO properties and configuration options. Information includes the following tabs:

FIGURE 7.4 GPMC includes nodes that enable you to access and manage all GPOs within your Active Directory forest.

. Scope—Enables you to display GPO link information and configure security group filtering and WMI filtering. . Details—Provides information on the owner, dates created and modified, version numbers, GUID value, and enabled status. The enabled status is the only configurable option on this tab. . Settings—Enables you to display and edit policy settings. You can expand and collapse nodes to locate information on any policy setting. See Figure 7.5. . Delegation—Enables you to view and modify GPO permissions.

434

Chapter 7: Planning and Implementing Group Policy

FIGURE 7.5

You can view configured policy settings from the Settings tab of a GPO in GPMC.

We discuss procedures for configuring and managing Group Policy from GPMC in the rest of this chapter and in Chapter 8, “Managing Group Policy.”

Creating and Managing GPOs Before we discuss Group Policy strategy and the use of Group Policy to configure the computer and user environments, we look at how to create Group Policy. Windows Server 2003 provides the Group Policy Object Editor snap-in from which you can configure and manage all aspects of Group Policy. We shall discuss the creation of GPOs linked to the different Active Directory containers in turn.

New GPOs GPMC enables you to create new GPOs that you can link to a site, domain, or OU. Follow Step by Step 7.4 to create a new GPO.

STEP BY STEP 7.4 Creating a New GPO 1. Access GPMC and expand it as described in Step by Step 7.3.

435

Planning the Application of Group Policy 2. Right-click Group Policy Objects and choose New. The New GPO dialog box appears with a default name of New Group Policy object, as shown in Figure 7.6.

FIGURE 7.6 The New GPO dialog box enables you to create and name a new GPO.

3. Type a suitable name for the new GPO and then click OK. The GPO is added to the list in the console tree.

NOTE Groups That Can Create GPOs In addition to Domain Admins and Enterprise Admins, there exists another global security group called Group Policy Creator Owners that has the right to create new GPOs by default. However, members of this security group cannot link the GPOs to any Active Directory containers.

Domain-Based GPOs R2 By default, when Active Directory is installed, it creates a Default Domain Policy GPO. This GPO contains settings that apply to all computers and users in the domain. Although most policies are undefined by default, on a Windows Server 2003 R2 server, this GPO contains default password and Kerberos policies. You can access this GPO and its associated Group Policy Object Editor snap-in from GPMC by following the procedure outlined in Step by Step 7.5.

STEP BY STEP 7.5 Accessing the Default Domain Policy 1. Follow the procedure outlined in Step by Step 7.3 to open GPMC and expand its contents. 2. In the console tree, under Group Policy Objects, right-click Default Domain Policy and select Edit to display the Group Policy Object Editor snap-in, as shown in Figure 7.7. From here, you can configure all policies associated with this GPO, as we discuss throughout this chapter.

436

Chapter 7: Planning and Implementing Group Policy

FIGURE 7.7

You can configure all policies associated with a GPO from the Group Policy Object Editor snap-in.

You can also create new domain-based GPOs or link existing GPOs to the domain. Follow Step by Step 7.6 to link a GPO to a domain.

STEP BY STEP 7.6 Linking a GPO to a Domain 1. Access GPMC and expand it as described in Step by Step 7.3. 2. Right-click the domain. As shown in Figure 7.8, the context menu that appears enables you to perform a large range of management activities.

FIGURE 7.8 Right-clicking the domain in GPMC enables you to perform a large number of Group Policy management actions.

437

Planning the Application of Group Policy 3. Select Link an Existing GPO. 4. From the Select GPO dialog box shown in Figure 7.9, select the required GPO and click OK.

FIGURE 7.9

Selecting a GPO for linking to a

domain.

5. You can also create and link a new GPO in one step. To do so, choose Create and Link a GPO Here from the context menu shown in Figure 7.8. This displays the New GPO dialog box previously shown in Figure 7.6. Provide a name and click OK.

We discuss several of the other available options in later sections of this chapter or in Chapter 8.

Site-Based GPOs As discussed previously, you can also link a GPO to a site. You should take care when doing so in a multiple domain enterprise because sites can have multiple domains and multiple portions of domains within them; consequently, sporadic application of policies might occur. Follow Step by Step 7.7 to link a GPO to a site.

STEP BY STEP 7.7 Linking a GPO to a Site 1. Access GPMC and expand it as described in Step by Step 7.3. 2. By default, the Sites node does not display any sites. To display the available sites, right-click Sites and choose Show Sites. Select the sites to be displayed from the Show Sites dialog box, and then click OK. 3. Right-click the desired site and choose Link an Existing GPO.

438

Chapter 7: Planning and Implementing Group Policy 4. From the Select GPO dialog box previously shown in Figure 7.9, ensure that the proper domain is visible, select the GPO to be linked, and then click OK. 5. To view the GPOs linked to the site, select the site in the console tree. The information displayed in the details pane includes all GPOs that are linked to the site and their general properties.

NOTE Slow Logons If you have configured a site-based GPO that applies to a remote site connected by a slow WAN connection, logon times could be increased.

OU-Based GPOs The procedure for creating a GPO linked to an OU is similar to that of Step by Step 7.6, except that you right-click the OU rather than the domain in step 2. Again, you can select Create and Link a GPO Here to create a new OU-based GPO, or Link an Existing GPO to link a previously created GPO to the OU.

NOTE Default Domain Controllers Policy GPO In addition to the Default Domain Policy GPO introduced earlier, Active Directory also creates a Default Domain Controllers Policy GPO in the Domain Controllers OU. Unless you modify its links, this GPO affects only domain controllers, whose computer accounts are located in this OU by default. By default, this policy enables a series of settings in the Computer Configuration\Windows Settings\Security Settings\Local Policies node, including user rights assignments, auditing of logon and account logon events, and several security options.

Managing GPO Links When you create a GPO according to any of the procedures already described, it is not permanently fixed to the object in which you created it. You can examine, modify, or redirect GPO links, and unlink GPOs. You can also delete GPOs completely if you no longer need them. We discuss these tasks in the following sections.

439

Planning the Application of Group Policy

Modifying GPO Links When you first create a GPO, it is linked to the object (site, domain, or OU) in which you created it. It is a simple matter to link this GPO to another Active Directory container or remove an existing link. Simply right-click the container (site, domain, or OU) to which you want to link the GPO and choose Link an Existing GPO, as already described in Step by Step 7.6 for a domain or 7.7 for a site. You can even link a GPO to another domain in the same forest. When you use Step by Step 7.6 or 7.7 to link GPOs to other Active Directory objects, they could become linked to more than one object. Step by Step 7.8 shows you how to determine the objects to which a GPO is linked.

STEP BY STEP 7.8 Locating GPO Links 1. In the console tree of GPMC, select the GPO under the Group Policy Objects node. 2. In the Links section of the details pane, select the scope (entire forest, all sites, or domain). This displays the available links and their paths, as shown in Figure 7.10.

FIGURE 7.10

Locating the sites, domains, or OUs to which a GPO is linked.

440

Chapter 7: Planning and Implementing Group Policy

Unlinking and Deleting GPOs If you need to remove a GPO link to test its effects or because the GPO is linked to the wrong Active Directory object, you can remove the link. Follow the procedure outlined in Step by Step 7.9.

STEP BY STEP 7.9 Deleting a GPO Link 1. In the console tree of GPMC, select the GPO beneath the container from which you want to remove the link. 2. Right-click the GPO to be removed and click Delete (or press the Delete key). 3. You receive a Group Policy management dialog box, as shown in Figure 7.11, informing you that your action deletes the link but not the GPO itself. Click OK to delete the link.

FIGURE 7.11

Deleting a GPO link.

You may want to delete a GPO completely if you no longer need its settings. Follow Step by Step 7.10 to delete a GPO.

STEP BY STEP 7.10 Deleting a GPO 1. In the console tree of GPMC, select the GPO from the Group Policy Objects node. 2. Right-click the GPO to be deleted and click Delete (or press the Delete key).

441

Planning the Application of Group Policy 3. You receive a Group Policy management dialog box, as shown in Figure 7.12, informing you that your action deletes the GPO and all links in this domain. Click OK to proceed.

FIGURE 7.12

Deleting a GPO.

WARNING Be Sure You Will Never Need the GPO Again Before You Delete It! There is no way to recover a deleted GPO. If you need it back, you must re-create it and all the policy settings contained within it. If you might want the GPO back, a better approach is to disable it or remove the links.

Backing Up and Restoring GPOs New to GPMC is the capability of backing up and restoring GPOs. The act of backing up a GPO copies the data in the GPO to the file system. The GPO backup includes all data associated with the GPO, including its GUID and domain, the GPO settings, its discretionary access control list (DACL), links to IP security settings (but not the settings themselves), a date and time stamp, and a user-supplied description. It also includes an XML report of the GPO settings, which you can view as HTML from within GPMC. If WMI filters are present, the link to the filter but not the filter itself is backed up. In addition, links to sites, domains, or OUs are not backed up. Follow Step by Step 7.11 to back up a GPO.

STEP BY STEP 7.11 Backing up a GPO 1. In the console tree of GPMC, right-click the GPO to be backed up and select Back Up. To back up all GPOs in the domain, right-click the Group Policy Objects node and choose Back Up All.

442

Chapter 7: Planning and Implementing Group Policy 2. From the Back Up Group Policy Object dialog box shown in Figure 7.13, type or browse to the folder in which you want to store the backup. Type an optional description for the backup, and then click Back Up.

FIGURE 7.13

Backing up a GPO.

3. A Backup dialog box charts the progress of the backup. When the backup is complete, click OK.

After you have backed up a GPO, its settings are saved in a subfolder within the folder you selected in Step by Step 7.11. You can restore a GPO in the event that you have deleted it and want it back, or the GPO has become corrupted or was edited in an undesirable fashion. The restore operation restores all settings described in the previous paragraph, but not links to sites, domains, or OUs, WMI filters, or IPSec policies. Follow Step by Step 7.12 to restore a GPO.

STEP BY STEP 7.12 Restoring a GPO 1. In the console tree of GPMC, right-click the GPO to be restored and select Manage Backups. The Manage Backups dialog box shown in Figure 7.14 appears.

443

Planning the Application of Group Policy

FIGURE 7.14 You can restore a backed up GPO from the Manage Backups dialog box.

2. Select the GPO to be restored and click Restore. 3. A Group Policy Management dialog box asks you if you want to restore the selected backup. Click OK to proceed. 4. A Restore dialog box charts the progress of GPO restoration. When the restore is complete, click OK.

Importing GPOs You can use GPMC to export GPOs to other domains or import GPOs that you have exported from other domains. GPMC does not provide a specific export utility; you use the same backup procedure already described to create a backup that can be copied to another location as required. Importing settings using the Import Settings Wizard imports settings from a backed up GPO but does not modify other attributes of the GPO such as delegation, security filtering, GPO links, and links to WMI filters. To import settings, follow Step by Step 7.13.

444

Chapter 7: Planning and Implementing Group Policy

STEP BY STEP 7.13 Importing a GPO 1. In the console tree of GPMC, right-click the GPO whose settings are to be imported and choose Import Settings. 2. The Import Settings Wizard starts with a welcome page. Click Next. 3. The Backup GPO page warns you that importing settings permanently deletes existing settings and recommends that you back up these settings. Click Backup to back up the GPO settings or Next to import settings without backing up. 4. On the Backup Location page, type or browse to the path in which the backup folder is located, and then click Next. 5. On the Source GPO page, select the GPO whose settings you want to import, and then click Next. 6. The Scanning Backup page appears as the backup is scanned. You are informed about references to security principals and/or UNC paths that need to be transferred. Click Next. 7. As shown in Figure 7.15, the Migrating References page offers two options for transferring references to security principals or UNC paths. Select the appropriate option, and then click Next.

FIGURE 7.15 You have two options for migrating references to security principals and UNC paths.

8. A completion page appears. Review the settings provided and click Finish to import the GPO settings. 9. An Import dialog box charts the progress of importing settings. When the process is complete, click OK.

Managing GPOs in Other Domains You can manage GPOs in any domain in your forest or a trusted forest. Follow Step by Step 7.14 to show additional domains in your forest.

445

Planning the Application of Group Policy

STEP BY STEP 7.14 Showing Additional Domains 1. In the console tree of GPMC, right-click the Domains node and choose Show Domains. 2. From the Show Domains dialog box shown in Figure 7.16, select the domains to be displayed. You can also click Select All to display all domains. Then click OK.

FIGURE 7.16

Selecting domains to be displayed by GPMC.

Displaying additional forests is similar. Simply right-click the Group Policy Management Console link at the top of the console tree of GPMC and choose Add Forest. In the Add Forest dialog box, enter the name of a domain in the forest to be added.

Group Policy for Users and Computers Objective

Plan Group Policy strategy . Plan a strategy for configuring the user environment by using Group Policy . Plan a strategy for configuring the computer environment by using Group Policy

As shown previously in Figure 7.7, all GPOs contain two nodes: Computer Configuration and User Configuration. As their names suggest, you can configure the computer environment from the Computer Configuration node, and you can configure the user configuration from the User Configuration node. Policies specified in the Computer Configuration node apply to all users of the computer to which the GPO applies, whereas policies specified in the User Configuration node apply to all users to which the GPO applies, regardless of which computer they log on to.

446

Chapter 7: Planning and Implementing Group Policy

Consequently, you can configure both the user and computer environments according to the site, domain, or OU to which users and their computers belong. By default, the settings in a GPO are applied to all computers and users in the site, domain, or OU to which the GPO is linked.

Modifying Group Policy Inheritance As discussed previously, by default, GPOs are applied in the following order: local, site, domain, OU, child OU. When a conflict occurs, policies applied later in the sequence overwrite policies applied earlier in the sequence. GPMC enables you to view Group Policy inheritance for any site, domain, or OU, as Step by Step 7.15 shows.

STEP BY STEP 7.15 Displaying Group Policy Inheritance 1. In the console tree of GPMC, select the container for which you want to display Group Policy Inheritance. 2. In the details pane, select the Group Policy Inheritance tab. As shown in Figure 7.17, a list appears of all GPOs applied to the container selected, arranged in order of precedence of application.

FIGURE 7.17

The Group Policy Inheritance tab displays all GPOs that apply to a site, domain, or OU.

NOTE Inheritance of Site-Linked GPOs The Group Policy Inheritance tab does not show the precedence of GPOs linked to sites because computers in a given domain or OU may belong to different sites; therefore it is not possible to determine precedence unless a specific computer is selected.

447

Planning the Application of Group Policy

Group Policy provides two options that you can use to modify this sequence of GPO application: Block Inheritance and Enforced. Block Inheritance When you are administering Group Policy in a child container such as an OU or child domain, sometimes you might not want GPOs that are linked to parent containers to be applied at the lower level. Microsoft has provided the Block Inheritance option (known as Block Policy Inheritance if GPMC is not installed) to allow you to do so. To prevent the inheritance of settings in a GPO that is linked to parent containers, follow the procedure outlined in Step by Step 7.16. This setting might be useful when the administrator of an OU wants to control all GPOs that apply to computers or users in the OU without inheriting settings from the site or parent domain.

STEP BY STEP 7.16 Configuring the Block Inheritance Option 1. In the console tree of GPMC, right-click the domain or OU for which you want to block inheritance, and select Block Inheritance. 2. As shown in Figure 7.18, the icon for the container on which inheritance is blocked appears with a blue exclamation mark. GPOs from containers higher in the application sequence no longer appear in the Group Policy Inheritance tab.

When you block inheritance from higher-level Active Directory containers, you see a blue exclamation mark (circled). FIGURE 7.18

448

Chapter 7: Planning and Implementing Group Policy

Block Inheritance does have the following limitations: . You cannot selectively block GPOs from being inherited—The Block Inheritance

option blocks all GPOs from the higher level without any options. To selectively block certain GPOs from being inherited, you must specify the Enforced option (as described in the next section) for all the GPOs other than the one(s) to be blocked and then also specify Block Inheritance. . You cannot block the inheritance of a parent GPO if it is configured with the

Enforced option—This option is discussed in the following section. . The Block Inheritance option is not available for GPOs that are linked to a

site—Because sites are at the top of the inheritance sequence, this option is not available for a GPO that is linked to a site.

Enforced Use of the Enforced option (known as No Override if GPMC is not installed) prevents policies contained in the GPO where it is specified from being overwritten by other GPOs that are processed later (such as from child containers). For example, if you want to set up a domain desktop policy that applies to all computers in the domain and you do not want conflicting settings at the OU level to be applied, specify the Enforced option, as described in Step by Step 7.17. Note that you can specify the Enforced option for individual GPOs. For example, you might use the Enforced option for a GPO that contains critical corporatewide policies, such as security policies. Also, be sure to link such a GPO high in the hierarchy, such as at a site or domain.

STEP BY STEP 7.17 Configuring the Enforced Option 1. In the console tree of GPMC, expand the container on which you want to enforce a GPO to display all GPOs linked to this container. 2. Right-click the GPO link and choose Enforced. 3. As shown in Figure 7.19, the enforced policy appears in the console tree with a padlock icon and is labeled Yes in the Enforced column within the Links section of the Scope tab of the details pane.

449

Planning the Application of Group Policy

When you enforce a GPO, a padlock icon (circled) appears on the link in the console tree, and Yes appears in the Scope tab of the details pane. FIGURE 7.19

NOTE The Enforced Option Applies to the Link and Not the GPO Itself In the case of a GPO that is linked to more than one container, you can specify the Enforced option on the different links individually from the console tree of GPMC. For example, note in Figure 7.19 that the GPO labeled My New GPO is enforced for the Admins OU but not the Site1 site.

EXAM ALERT Terminologies You should be familiar with the Block Policy Inheritance and No Override terminologies because the 70-294 exam might still refer to the older terminologies. Remember that No Override means the same as Enforced. Also remember that Enforced takes precedence over Block Inheritance when both are applied.

Modifying the Sequence of GPO Application We previously discussed the default sequence in which GPOs linked to different Active Directory objects are processed. But what about more than one GPO linked to the same object (domain and so on)? As shown for the quepublishing.com domain in Figure 7.20, more than one GPO may be linked to the same object. The GPOs are applied in reverse order—bottom to top. Therefore, if settings conflict, those contained in the GPO that is highest on the list will apply. In other words, the settings in the GPO with a Link Order value of 1 have the highest precedence. In this example, that would be the Corporate Desktop Policy.

450

Chapter 7: Planning and Implementing Group Policy

FIGURE 7.20 Viewing and modifying the sequence of GPOs.

You might have to modify the sequence in which the GPOs are processed so that the proper settings are applied in case of conflicts. To do so, you can use the Up or Down buttons, as described in Step by Step 7.18.

STEP BY STEP 7.18 Modifying the Sequence of GPO Application 1. In the console tree of GPMC, select the container whose GPO sequence of application you want to modify. 2. From the Linked Group Policy Objects tab in the details pane, select the policy to be resequenced, and then click the Up or Down button as needed (refer to Figure 7.20).

Filtering the Effects of a GPO What would you do if you wanted to lock down the desktop settings of ordinary workers in a department of your company so that they have only the minimum number of applications and configuration settings available to do their job, but at the same time have others such as managers or IT workers access all available configuration options? One way to do this would be to create one or more separate OUs as needed and place the workers, such as managers and IT employees who need more access, into these OUs. You could then create the appropriate GPOs that disable the settings applied to the ordinary workers, and these GPOs would override any settings made at a higher level. This means you would have extra GPOs to look after and a greater chance of error. It would also slow down the startup and logon process because each computer would have more GPOs to process.

451

Planning the Application of Group Policy

However, there is a simpler way of accomplishing this task, and this is done by filtering the GPOs according to users’ membership in security groups. Like other items in Windows Server 2003, GPOs have a set of security permissions attached to them. The Security Filtering section of the Scope tab of a GPO’s properties displays the users, groups, and computers to which the GPO settings apply (refer to Figure 7.10). These users, groups, and computers automatically have the Apply Group Policy permission granted to them. Prior to GPMC, you could configure this permission from the Security tab of a GPO’s Properties dialog box. Using GPMC, it is simple to add or remove a group from the GPO’s access control list (ACL), as Step by Step 7.19 shows:

STEP BY STEP 7.19 Applying a GPO to a Security Group 1. Ensure that the Scope tab of the appropriate GPO is displayed in the details pane of GPMC (refer to Figure 7.10). 2. In the Security Filtering section, click Add. The Select User, Computer, or Group dialog box appears. 3. Type in the name of the user, computer, or group to which the GPO should apply, and then click OK. The name of the added object appears in the Security Filtering section. 4. To remove a group, select it and click Remove, and on the message box that appears, click OK.

NOTE Adding Groups to the Delegation Tab You can also add groups to the permissions list by clicking Add in the Delegation tab (refer ahead to Figure 7.21). The procedure is similar to that given in Step by Step 7.19.

In certain cases, you might have to explicitly deny application of a GPO to certain groups. For example, if you want to lock down the desktops of all users except administrators, you need to explicitly deny the Apply Group Policy permission to administrators. As with other permissions, an explicit denial overrides conflicting allowed permissions. You can deny application of a GPO by following the procedure outlined in Step by Step 7.20.

STEP BY STEP 7.20 Denying Application of a GPO 1. In the console tree of GPMC, select the GPO to be modified. 2. In the details pane, select the Delegation tab. As shown in Figure 7.21, a list of the users and groups with specified permissions to the GPO appears.

452

Chapter 7: Planning and Implementing Group Policy

FIGURE 7.21 The Delegation tab of a GPO’s properties displays the users and groups with specified permissions to the GPO.

3. Click Advanced to open the Security tab of the GPO Properties dialog box. 4. Select the security group to which the GPO should not apply and then deny that group the Apply Group Policy permission included on the list (see Figure 7.22). Then click OK.

FIGURE 7.22 Filtering a GPO so that it does not apply to members of the Domain Admins group.

453

Planning the Application of Group Policy 5. A message box informs you that Deny permissions entries take precedence over Allow entries. Click Yes to deny the Apply Group Policy permission (see Figure 7.23). The Delegation tab now displays Custom for the group whose permissions you have modified.

FIGURE 7.23

You receive this warning when you deny a permission.

You can exempt certain users from having the GPO apply to them by using either of two methods: . Add the users you want to exclude to a security group—Then add the security

group to the list by clicking the Add button on the Delegation tab (refer to Figure 7.21) and selecting the required group from the Select User, Computer, or Group dialog box. Then follow the procedure described earlier to deny the Apply Group Policy permission. . Add the users to whom the policy must apply to a security group—Then add this

security group to the list as stated in Step by Step 7.19. This group automatically receives the Allow permission for the Read and Apply Group Policy. Remove the Authenticated Users group from this list by highlighting it and clicking Remove. The effects of granting or denying these permissions work in a manner similar to those of other permissions, as follows: . If the Read and Apply Group Policy permissions are set to Allow, the GPO applies to

members of the security group unless they are members of another security group in which the permissions have been specifically denied. . If the Read and Apply Group Policy permissions are set to Deny, the GPO does not

apply to members of this security group. This action overrides any Allow permissions configured for other security groups to which the users belong. . If the Read and Apply Group Policy permissions have not been set to either Allow or

Deny, the GPO does not apply to members of this security group. However, if Allow permissions have been set for another security group to which the users belong, the GPO applies to them.

454

Chapter 7: Planning and Implementing Group Policy

Disabling Parts of GPOs If none of the settings under either Computer Configuration or User Configuration for a specific GPO have been configured, you might want to disable that part of the GPO. In doing so, startup and logon are expedited for users and computers that are subject to the GPO because it would otherwise take time to process each policy in the GPO. To disable Computer Configuration or User Configuration settings, follow the procedure outlined in Step by Step 7.21.

STEP BY STEP 7.21 Disabling a GPO Node 1. In the console tree of GPMC, select the required GPO under Group Policy Objects and then select the Details tab from the details pane. 2. On the Details tab, expand the GPO Status drop-down list and select the appropriate option (see Figure 7.24). 3. On the Group Policy Management dialog box that appears, click OK to confirm the settings change.

FIGURE 7.24

Disabling the User Configuration portion of a GPO.

455

Planning the Application of Group Policy

You might want to disable an entire GPO for various reasons, such as when the GPO is not functioning as you expected and you want to examine it to see what is wrong with its configuration. One way to do this is to disable both the Computer Configuration and User Configuration settings as explained previously. To do so, simply select the All Settings Disabled option from the GPO Status drop-down list displayed in Figure 7.24.

NOTE Disabling a GPO Link You can also disable a GPO’s link to an Active Directory container. This action prevents application of the GPO to this container but allows it to remain applied to any other containers to which it is linked. Right-click the GPO link under the appropriate container and choose Link Enabled to remove the check mark that appears beside this option. To re-enable the link, repeat this procedure to make the check mark reappear.

Windows Management Instrumentation (WMI) New to Windows Server 2003 and Windows XP, Windows Management Instrumentation (WMI) filters enable an administrator to modify the scope of a GPO according to the attributes of destination computers. Operating in much the same way as filtering on security groups, you can use a WMI filter to query computers on properties such as laptops versus desktops, Windows XP versus Windows Vista, destination hardware properties, and so on. WMI filters operate by means of a query written in WMI Query Language (WQL), which is similar to SQL query language. You can specify WMI filters from the WMI Filters node in GPMC. Actions available include the creation of new WMI filters and importing WMI filters from external locations. After you have done this, WMI filters are available to any GPO in your domain. You can link WMI filters to GPOs from the Scope tab of a GPO’s properties in GPMC (refer to Figure 7.10).

EXAM ALERT WMI Filters You do not need to know how to write a WMI filter query for the 70-294 exam, but you do need to know that WMI filters can query destination computers for hardware and other attributes. Also keep in mind that Windows 2000 computers do not support WMI and always apply GPOs to the WMI filters that are linked.

456

Chapter 7: Planning and Implementing Group Policy

Best Practices for Managing Group Policy The following are several best practices that you should try to follow when planning and creating GPOs: . Limit the number of GPOs—Use the smallest number of GPOs that is consistent

with your security and processing needs. User logons are processed much faster with a fewer number of GPOs to be processed. It is also easier to track errors in policy processing with fewer GPOs to check. . Use the Block Inheritance and Enforced options sparingly—Overuse of these

options results in slower processing and complicates the understanding and troubleshooting of Group Policy. . Use Group Policy filtering only when absolutely necessary—Use of this option

also slows down the processing of Group Policy. If you do need to filter a GPO, ensure that you deny both the Read and Apply Group Policy permissions, or processing of Group Policy will be further degraded. . Follow the best practices for OU design—This strategy simplifies the planning and

linking of GPOs. Refer to Chapter 6, “Implementing User, Computer, and Group Strategies,” for more information.

Some Strategies for Planning a Set of GPOs With the large number of policy settings available in the Group Policy Object Editor, the task of planning Group Policy in an organization of any size can easily become a daunting one. We have seen how to create GPOs linked to sites, domains, and OUs. In Chapter 6, we discussed the design of an OU structure from several viewpoints, including that of Group Policy. We saw that one of the major reasons why you might create an OU structure is to apply Group Policy to a set of computers or users. You can place the users or computers to which the policies are to apply into an OU, and then create a single GPO linked to that OU. In the sections that follow, we elaborate on several possible Group Policy planning strategies.

457

Planning the Application of Group Policy

Strategies for Planning GPOs Microsoft recommends that you arrange GPOs according to the settings that they contain. The following are several ways in which you can set up GPOs to reflect the settings they contain: . Single-setting GPOs—Each GPO contains a single type of setting, such as software

settings. Such a design is most suitable in an organization where administrative tasks are delegated to individuals with a single area of responsibility. . Multiple-setting GPOs—Each GPO contains multiple types of policy settings. An

example would be a GPO that contains both software and administrative template settings. Such a design is most suitable in an organization where administrative tasks are more centralized and individual administrators have a broader range of responsibility. . Dedicated-setting GPOs—Each GPO contains either computer configuration or

user configuration settings only. If you adopt this model, you should disable the unused portion of each GPO as described earlier in this chapter. Using this strategy allows you to isolate the computer configuration branch if necessary to troubleshoot improperly applied GPOs. Simply log on as a user to which the user configuration GPO does not apply.

Delegation of Group Policy Administration Chapter 6 introduced you to the concept of delegation of administrative control. You learned how to use the Delegation of Control Wizard to delegate a portion of administrative tasks to subadministrators, and that use of a system of OUs is a good means to plan such administrative delegation. Here, we revisit this concept briefly to include the delegation of control of GPOs linked to various Active Directory containers. According to the manner in which you have designed the overall delegation of administrative tasks throughout your organization, you can also delegate the administration of Group Policy in a centralized or decentralized manner, as follows: . Centralized administrative control—You can delegate administrative control of

Group Policy at only the domain or uppermost OU levels. Subadministrators who are responsible for child OUs do not have any control of GPOs. This model is most suitable when there is not a great deal of need for policy requirements that vary from one OU to the next, with a consequent small number of GPOs. . Decentralized administrative control—You can delegate administrative control of

Group Policy at all levels of OUs. This model is suitable when you have more than one second-level OU with different policy requirements that are best handled by subadministrators familiar with the needs of their OUs. Each subadministrator can be responsible for one or two GPOs linked to his OU only.

458

Chapter 7: Planning and Implementing Group Policy . Task-based administrative control—You can delegate administrative control of

Group Policy to subadministrators who have been assigned control over a specific area of administration, such as security. This model works best when you are employing single-setting GPOs as already described, and you can delegate control of each GPO to a subadministrator responsible for that area of administration. Several methods are available for delegating the creation and administration of GPOs. You can delegate the creation of GPOs to any user or group by simply adding that user or group to the Group Policy Creator Owners group. This group has the right to create GPOs in any container by default. You can also delegate the creation of GPOs to additional users or groups. Step by Step 7.22 shows you how to perform this task:

STEP BY STEP 7.22 Delegating creation of GPOs 1. In GPMC, select the Group Policy Objects node from the console tree and then select the Delegation tab in the details pane. As shown in Figure 7.25, this tab displays a list of groups and users with permission to create GPOs in the domain.

FIGURE 7.25 The Delegation tab shows the users and groups with permission to create GPOs.

459

Planning the Application of Group Policy 2. To add a user or group, click Add. In the Select User, Computer, or Group dialog box, type or browse to the name of the required user or group, and then click OK. 3. To remove a user or group, select it and then click Remove. Then click OK in the Group Policy Management dialog box that appears.

You can delegate the administration of specific GPOs to users or groups, as Step by Step 7.23 shows:

STEP BY STEP 7.23 Delegating administration of specific GPOs 1. In GPMC, select the specific GPO to be delegated from the list appearing beneath the Group Policy Object node, and then select the Delegation tab in the details pane. 2. To add a user or group, click Add. In the Select User, Computer, or Group dialog box, type or browse to the name of the required user or group, and then click OK. 3. In the Add Group or User dialog box, select the permission to be delegated, as shown in Figure 7.26, and then click OK. The added permission appears in the list in the Delegation tab.

FIGURE 7.26 The Add Group or User dialog box provides a choice of three permissions.

4. To modify permissions for a given user or group, right-click it, and select the appropriate permission (Read, Edit settings, or Edit settings, delete, modify security). Then click OK in the confirmation dialog box that appears. 5. To configure advanced permissions, select Advanced. Select the user or group and configure the permissions appearing in this dialog box (see Figure 7.27). To configure special permissions, click Advanced to access the Advanced Security Settings dialog box.

460

Chapter 7: Planning and Implementing Group Policy

FIGURE 7.27 You can configure advanced permissions from the Security Settings dialog box.

6. If you need to remove a user or group, select it and click Remove, and then click OK in the confirmation dialog box that appears.

You can delegate the linking of GPOs to specific containers (domains, sites, or OUs), as Step by Step 7.24 shows:

STEP BY STEP 7.24 Delegating linking of GPOs 1. In GPMC, select the domain or OU to be delegated, and then select the Delegation tab from the details pane. 2. Ensure that the Permission drop-down list reads Link GPOs, and then click Add. In the Select User, Computer, or Group dialog box, type or browse to the name of the required user or group, and then click OK. The user or group is added to the list in the Delegation tab. 3. To configure advanced permissions, select Advanced and proceed as described in Step by Step 7.23. 4. To remove a user or group, select it and then click Remove. Then click OK in the Group Policy Management dialog box that appears.

You can also delegate creation of WMI filters, as shown in Step by Step 7.25:

461

Planning the Application of Group Policy

STEP BY STEP 7.25 Delegating administration of WMI filters 1. In GPMC, select the WMI filters node and then select the Delegation tab from the details pane. 2. To add a user or group, click Add. In the Select User, Computer, or Group dialog box, type or browse to the name of the required user or group, and then click OK. 3. In the Add Group or User dialog box (see Figure 7.28), select the appropriate permission (Full control or Creator owner), and then click OK. The user or group is added to the list in the Delegation tab.

FIGURE 7.28 Configuring permissions for administrating WMI filters.

4. To remove a user or group, select it and then click Remove. Then click OK in the Group Policy Management dialog box that appears.

For additional delegation scenarios, refer to “Delegation and policy-related permissions” in Group Policy Management Console Help.

Group Policy Application Review When applying Group Policy, remember these key points: . By default, GPOs are applied in this sequence: local, site, domain, OU, child OU. . You can use the Block Inheritance option to prevent a child container, such as an OU

or child domain, from inheriting policies applied at a higher level. . You can use the Enforced option to prevent policies in a GPO from being overwritten

by GPOs applied at a later stage such as a child OU. . Enforced prevails over Block Inheritance when both of these options are applied.

462

Chapter 7: Planning and Implementing Group Policy . You can filter the effect of a GPO according to security group membership by denying

the Apply Group Policy permission for the required group. You can also filter the GPO by removing the Authenticated Users group from the GPO’s access control list, adding the group to which the GPO applies, and allowing the Apply Group Policy for this group. You can also use WMI filters to modify the scope of application of the GPO according to destination computer attributes. . You can disable either the user or computer portion of a GPO, when not needed, to

speed up policy processing at startup and logon. You can also disable an entire GPO if necessary.

Deploying the User and Computer Environment with Group Policy As previously mentioned and shown in Figure 7.7, all GPOs contain computer-specific and user-specific settings. Settings configured under the Computer Configuration node apply to all users of the computer and include operating system behavior, desktop appearance, security settings, startup and shutdown scripts, and computer-assigned application options and settings. Settings configured under the User Configuration node apply to the currently logged-on user and include user-related settings that apply to operating system behavior, desktop settings, security settings, assigned and published application options, application settings, folder redirection options, and user logon and logoff scripts. Both computer and user configuration settings are divided into three subnodes: Software Settings, Windows Settings, and Administrative Templates.

Software Installation Using Group Policy Objective

Configure the user environment by using Group Policy . Distribute software by using Group Policy

Objective

Deploy a computer environment by using Group Policy . Distribute software by using Group Policy

Both computer and user software settings contain only software installation settings by default. These settings are used to specify how applications are installed and maintained. Independent software vendors can configure settings that are added to these settings.

463

Deploying the User and Computer Environment with Group Policy

Before Windows 2000, the deployment or upgrading of software packages was a heavy burden on the shoulders of network administrators. It used to be that you had to go to each computer with the installation disks and manually install the application or update. Resources were available to assist you, including Microsoft’s Systems Management Server (SMS) and third-party packages, but they were difficult to use and often did not accomplish the task properly. Beginning in Windows 2000 and continuing with Windows Server 2003, Microsoft introduced Software Installation and Maintenance, which enables you to manage the installation, configuration, updating, repair, and removal of software on client computers in your organization. In addition to applications, this includes other types of software such as service packs and hotfixes. To manage these tasks, you configure Group Policy settings that specify which applications users can employ and how software updates are managed. This enables users to have the applications they need in order to do their jobs without visits from support staff for installation and configuration purposes. Windows Server 2003 introduces several new software deployment options, the most important of which is the support for 64-bit software deployment. You can ensure that only the appropriate applications are deployed to 64-bit clients. Options are available for determining whether 32-bit applications are deployed to 64-bit clients. Such automated deployment of software has additional benefits, including resilience of software. The software is always available to a user, regardless of what happens. If a user’s computer fails, a support person needs only to provide a replacement computer with Windows 2000 or XP Professional installed. The user starts the computer and logs on, and the required software packages are automatically installed. Should necessary files become corrupted or deleted, they are automatically reinstalled the next time the user requires the application. Even the removal of software is facilitated to the point that all required files and Registry entries are deleted, and any shared files (such as .dll files that are needed by other applications) are retained. You can manage the following steps in the lifecycle of software by using Software Installation and Maintenance: . Installation of software—You can configure new software for installation on client

computers, including options that allow you to assign or publish software to computers or users. You can use Microsoft Software Installer (.msi) files to specify the conditions and features that will be installed on each computer, including the components and options that will be available to users. You can use transform (.mst) files to specify installation options such as languages. . Configuration and upgrading of software—These tasks include the application of

service packs, hotfixes, and other patches that are designed to correct problems with applications and provide new functionality as released by software manufacturers. You can use patch (.msp) files to apply patches and other modifications to applications. Also included is the capability to upgrade software to newer versions—for example, Office XP to Office 2003.

464

Chapter 7: Planning and Implementing Group Policy . Removal of software—You can control the conditions under which obsolete software

is either retained or removed from client computers. You can even specify automatic removal of software so that users do not have an option in this instance. In this chapter, we concentrate on the use of Group Policy in the installation of software. We cover the configuration, upgrading, and removal of software in Chapter 8, “Managing Group Policy.”

NOTE Use Group Policy for All Software Deployment When you convert to deployment of software using Group Policy, it is best to manage all software in this manner. If you are still deploying some packages manually, it can be confusing because manually deployed software might not be advertised for an administrator who logs on locally for software installation purposes.

Assigning and Publishing Software Software Installation and Maintenance provides three methods of deploying software to users. Which method you use depends on which users require the software package in question and its urgency. You can either assign the package to users or computers, or publish it to users. There is no option for publishing software to computers.

NOTE Software Licenses Software Installation and Maintenance does not manage software licenses. You must ensure that you have the proper number of licenses for the software packages being deployed.

Assigning Software to Users When you assign a software package to users, the software follows them around to whatever computer they log on to. In this way, it is always available to each user. When a user logs on to the computer after the application has been assigned, the application is advertised in the Start menu and, if specified, an icon on the desktop. When a user invokes the application from either of these points, it is automatically installed. Assigning Software to Computers When you assign software to computers, it is available to all authenticated users of the computer, regardless of their group membership or privileges. The software package is installed at

465

Deploying the User and Computer Environment with Group Policy

the first convenient time, which is usually when the computer is first restarted after the package has been assigned. For example, suppose that you have a financial application that should be available on all computers in the Financial OU but not to computers elsewhere on your network. You would assign this application to computers in a GPO linked to the Financial OU. Publishing Software to Users When you publish software to users, it is not advertised in the same manner as when you assign it. It does not appear in the Start, Programs menu, and no icons appear on the desktop. To install it, a user has to go to the Add/Remove Programs applet in Control Panel. File types associated with the application are also registered to the application, and COM objects associated with the application are registered. Consequently, if the user double-clicks a file whose extension is associated with the application, the application is installed. This process is known as document activation. For example, if you have published Microsoft Word to users, when a user logs on, Microsoft Word appears in the Start, Programs folder and is installed when she selects this path; and if this user double-clicks a file with the .doc extension, Microsoft Word is installed. If the user double-clicks a file of unknown file extension, a query is sent to Active Directory to determine whether an application is available for that file type (and the user has the proper permissions to that application). If so, the application is installed. In general, you should assign an application to users if the application is essential or highly desirable for the users to do their jobs, and you should publish software to users when it is helpful but not essential in the performance of their jobs.

NOTE Software Resilience If you use Group Policy to assign software to users or computers—in other words, if a user attempts to uninstall the software or delete portions of it, the software is automatically reinstalled the next time the user logs on. Software deployed using Group Policy is resilient only if you have assigned it to the users or computers that require the software. Published software is not resilient; a user has to return to Control Panel Add or Remove Programs to reinstall a damaged published software program.

Use of Group Policy to Deploy a Software Package You can use any existing GPO to deploy a software package or create a special GPO according to requirements. Linking the GPO to an OU is often beneficial when the users who need the software package are all grouped within a specific OU. For example, you might create a GPO that is linked to the Financial OU to deploy a financial application that all members of this OU require but that should not be available to users or computers in other OUs. After you have created a shared installation folder and copied the software installation files, including Windows Installer package files (.msi) to this folder, you are ready to deploy the

466

Chapter 7: Planning and Implementing Group Policy

package. Using the Group Policy Object Editor snap-in for the appropriate GPO, you can then configure the appropriate type of deployment, as follows: . To assign or publish an application to users, use the User Configuration branch of

the GPO. . To assign an application to computers, use the Computer Configuration branch of

the GPO.

EXAM ALERT Remember That You Cannot Publish Software to Computers This is true because users must manually activate the installation of published software.

Step by Step 7.26 outlines the procedure for using Group Policy for software deployment.

STEP BY STEP 7.26 Deploying Software 1. In GPMC, right-click the appropriate GPO and choose Edit to open the Group Policy Object Editor snapin. Alternatively, you can create a new GPO using methods described earlier in this chapter (see the “New GPOs” section). 2. If you want to assign the software package to computers, expand the Computer Configuration\Software Settings node; if you want to assign or publish it to users, expand the User Configuration\Software Settings node. 3. Right-click the appropriate node and choose New, Package, as shown in Figure 7.29.

FIGURE 7.29

Creating a new Windows Installer package.

4. In the Open dialog box that appears, navigate to the share where the .msi file is located, select it, and click Open. 5. In the Deploy Software dialog box, select the option with which you want to deploy the software package: Published, Assigned, or Advanced, as shown in Figure 7.23. Select Advanced when adding transforms or modifications to software packages.

467

Deploying the User and Computer Environment with Group Policy

FIGURE 7.30

Selecting the method of software deployment.

6. Click OK. The deployed package appears in the details pane along with information describing its deployment method, as shown in Figure 7.31.

FIGURE 7.31

The deployed package appears in the details pane of the Group Policy Object Editor.

NOTE Use a Network Share in Deploying Software You should select a network share by means of its Universal Naming Convention (UNC) path in step 5 of Step by Step 7.26; otherwise, users will be unable to locate the package. If you do not select a UNC path, Active Directory displays a warning message alerting you to this fact.

ZAP Files Another deployment option when no .msi file is available is to use a ZAP (Zero Administration Package) file. A ZAP file is a text file, with a .zap extension, which specifies the path to the

468

Chapter 7: Planning and Implementing Group Policy

setup files associated with the application. You can only publish applications to users when using a ZAP file; you cannot assign applications when using this method. A sample ZAP file looks like the following: [application] ; You may include comments by prefixing the line with a semicolon. FriendlyName = “Examiner Version 4.0” SetupCommand = \\server2\packages\Examiner\Setup.exe DisplayVersion = 4.0 [ext] exm =

Within the [application] section is included the friendly name that will be displayed in the Add/Remove Programs applet and the UNC path to the setup files. DisplayVersion indicates the version of the program. You can also include the address of a support website by specifying it on a URL = line. The optional [ext] section contains any file extensions that are to be associated with the application, so that when the user double-clicks on a file with the indicated extension, the application is installed. To deploy the package, copy the .zap file to the shared location containing the application’s setup files and then follow Step by Step 7.26 to include the installation package in the appropriate GPO. ZAP files do not benefit from some of the advantages possessed by Windows Installer .msi files. They are not resilient; that is, they do not automatically repair themselves if a required file becomes corrupted or missing. They also do not use elevated permissions for installation, install features on their first use, or roll back unsuccessful installations or modifications. In addition, you cannot use transform files with .zap files. This means that users who want to install a .zap file must have permissions to install applications on their system.

Software Installation Properties You can specify default software installation options that apply to all software packages deployed on a per-user or per-computer basis from any given GPO. Step by Step 7.27 shows you how.

STEP BY STEP 7.27 Configuring Software Installation Properties 1. Open the Group Policy Object Editor snap-in for the GPO whose default software installation options you want to configure. 2. Expand the Software Settings node under Computer Configuration or User Configuration, as appropriate.

469

Deploying the User and Computer Environment with Group Policy 3. Right-click Software Installation and choose Properties. This action displays the General tab of the Software Installation Properties dialog box, as shown in Figure 7.32.

FIGURE 7.32 From the Software Installation Properties dialog box, you can configure default options that apply to software installation from any given GPO.

4. Configure the following options as required. They apply to all software packages deployed from this section of this GPO: . Default Package Location—The UNC path to the shared folder containing the installation files. . New Packages—This option allows you to specify that all software packages deployed from this GPO will be published, assigned, or deployed with advanced options. The option labeled Display the Deploy Software Dialog Box allows you to select the deployment method individually for each software package and displays the dialog box shown previously in Figure 7.23 when deploying the software. . Installation User Interface Options—This option controls how much the user sees during application installation. Basic provides only progress bars and error messages. Maximum provides additional information as supplied by the author of the package. It also prompts the user to add information. 5. Select the Advanced tab to specify the following additional options as required: . Uninstall the Applications When They Fall Out of the Scope of Management—This option automatically removes the software should the GPO that installed it no longer be applied to the user or computer. . Include OLE Information When Deploying Applications—This option allows you to specify whether information about Component Object Model (COM) components included with a package are deployed so that these components can be installed as required in a manner similar to file extension activation.

470

Chapter 7: Planning and Implementing Group Policy . Make 32-bit X86 Windows Installer Applications Available to Win64 Machines and Make 32-bit X86 Down-Level (ZAP) Applications Available to Win64 Machines—These options specify whether 32-bit applications of the indicated type will be made available to 64-bit computers. 6. If you need to specify preferred applications for opening a file with a given extension, select the File Extensions tab. Type or select the file extension from the Select File Extension drop-down list. All applications associated with the selected file extension will appear in the Application Precedence field. The application with the highest precedence appears at the top of the list. If you need to change this sequence, select the application and use the Up or Down command buttons as required. You can use this option to specify different requirements such as two groups requiring different applications for opening a document with a given extension. 7. To specify categories into which published applications will be grouped, select the Categories tab. Click Add to specify new categories, as shown in Figure 7.33. You can specify which category each managed application will be displayed under from the Categories tab of its Properties dialog box. After you have done so, the Add or Remove Programs applet will display these categories to users, assisting them in locating the appropriate applications.

FIGURE 7.33 You can use the Categories tab of the Software Installation Properties dialog box to specify categories into which published applications will be divided.

8. When you are finished, click OK.

Categorizing applications as described here enables you to group applications (for example, drafting applications or financial applications) when publishing them. When you do so, users can display only those applications from a given category (or all categories) from the Category drop-down list in the Control Panel Add or Remove Programs applet.

471

Deploying the User and Computer Environment with Group Policy

Software Package Properties Every software package you deploy using Group Policy has associated with it a Properties dialog box with which you can configure several installation, update, and removal properties. Right-click the package in the details pane of the Group Policy Object Editor snap-in and choose Properties to access this dialog box, which has the following six tabs: . General—This tab provides the name and general product information as supplied by

the software package’s developer. You can modify the name to provide a friendly name that the users understand, if desired. . Deployment—On this tab, you can modify the deployment options that you specified

when you originally deployed the package, as shown in Figure 7.34. You can configure the following options:

FIGURE 7.34 The Deployment tab of a software package’s Properties dialog box allows you to specify deployment and user interface options.

. Deployment Type—You can change the deployment type (published or assigned)

if required. You can also select the deployment type from the package’s context menu in the details pane of the Group Policy Object Editor. . Auto-Install This Application by File Extension Activation—Selected by

default, this option enables a published application to be automatically installed when a user opens a file whose extension is associated with the application. Note that you can also select or deselect this option simply by right-clicking the package in the details pane and choosing Auto-Install.

472

Chapter 7: Planning and Implementing Group Policy . Uninstall This Application When It Falls Out of the Scope of Management—

When this option is selected, the application is automatically uninstalled if the GPO by which it was deployed no longer applies to the user who is logged on. . Do Not Display This Package in the Add/Remove Programs Control Panel—

When this option is selected, the program is not advertised in the Add or Remove Programs applet. The user can still install it by opening a file associated with the application. . Install This Application at Logon—When this option is selected, the application

is automatically installed at the next logon without the user having to access it from the Start menu or a desktop shortcut. This option is active for assigned software only. . Installation User Interface Options—This option controls how much the user

sees during application installation. It provides the same options as discussed in the previous section for the default software installation properties. . Advanced Button—Selecting this button opens the Advanced Deployment

Options dialog box. From here, you can choose to ignore language when deploying the package or remove previous versions of the application that were not installed by means of a GPO. Some additional information provided by the package’s author is also available in this dialog box. . Upgrades—On this tab, you can manage upgrades of deployed applications. We dis-

cuss the functions of this tab in Chapter 8. . Categories—This tab enables you to specify the category into which a published

application appears in the Add or Remove Programs dialog box. To use this feature, you should first define the categories in the Categories tab of the Software Installation Properties dialog box, as described in Step by Step 7.27. . Modifications—On this tab, you can create modifications or transforms, which are

customized configurations of your application for specific purposes. For example, suppose that your company operates offices in different countries that need versions of Microsoft Word with local language dictionaries. Rather than deploying all languages to all locations in your organization, you can use transforms (.mst files) to deploy the languages as required. . Security—From this tab, you can set permissions that apply only to installation of the

application at hand. This provides a means of making only certain applications available to specified users or security groups. Administrators and those who manage the installation of applications should be allowed the Full Control permission. Users to which the software will be assigned or published should be allowed the Read permission.

473

Deploying the User and Computer Environment with Group Policy

Software Redeployment When you modify any of a software package’s properties as described in the previous section, you have to redeploy the software package so that users receive the modifications. To redeploy the package, right-click it in the details pane of Group Policy Object Editor, and choose All Tasks, Redeploy. You are warned that redeploying the application will reinstall it wherever it is installed. Click Yes to proceed.

User and Computer Environment Review When deploying the user and computer environment with Group Policy, remember these key points: . You can deploy software to users by either publishing or assigning the software. You

can deploy software to computers by assigning it. . Deploying software to a user enables the user to access the application, regardless of

the computer she is logged on to; deploying software to a computer makes the software available to all users of the computer. . When you assign software to a user or computer, it is available on the user’s Start menu

and a desktop icon if specified. The software is not actually installed until the user accesses it or double-clicks a file associated with the software application. . When you publish software to a user, it is advertised in the Control Panel Add or

Remove Programs applet, but no shortcuts are added to the Start menu. The user can install the software from the Add or Remove Programs applet or by double-clicking an associated file. Remember that published software is not resilient. . You can use a ZAP file to deploy software that has not been packaged with an .msi file.

Challenge Using Group Policy to Deploy Software In this exercise, you develop and apply a plan to deploy Microsoft Office 2003 to a series of computers. You should have one computer running Windows Server 2003 that is configured as a domain controller, and a second computer running either Windows 2000 Professional or Windows XP Professional, which is joined to the domain. You are expected to configure the domain so that all users in the domain will be able to install only the components of Office 2003 that they require. If you do not have a copy of Office 2003, you can perform the same steps with Office 2000, Office XP, or any other modern software package that includes .msi files. (continues)

474

Chapter 7: Planning and Implementing Group Policy (continued)

Try to formulate the required steps on your own. Considerable variations of this procedure are possible. If you have difficulty, look at the following steps: 1. Log on to the domain controller as the default administrator. 2. Create and share a folder named OfficeFiles on any hard drive partition of the server. 3. Copy the contents of the Office CD to the OfficeFiles shared folder. 4. Open Group Policy Management Console. 5. Expand your domain so that its linked GPOs are visible. 6. Right-click the default domain policy and click Edit. 7. In the Group Policy Object Editor snap-in, expand the User Configuration\Software Installation node. 8. Right-click Software Installation and choose New, Package. 9. In the Open dialog box, navigate by means of My Network Places to \\Server1\OfficeFiles, select Data1.msi, and then click Open. 10. On the Deploy Software dialog box, select Published and then click OK. After a few seconds, an entry appears in the details pane describing the package you just configured. 11. In the Group Policy Object Editor snap-in, navigate to Computer Configuration\Administrative Templates\Windows Components\Windows Installer. In the details pane, enable the Always Install with Elevated Privileges policy. 12. Under User Configuration, navigate to and enable the Always Install with Elevated Privileges policy. These two steps are necessary so that a user with ordinary user privileges can install the managed software. 13. Open a command prompt and type gpupdate /force. This command forces a refresh of user and computer policy. When you receive the OK to Logoff? prompt, type n. 14. At the Windows 2000/XP Professional computer, log on as an ordinary user. 15. Click Start, Programs or All Programs. Notice that Microsoft Office components are not present. 16. Click Start, Control Panel (if using Windows 2000 or the Classic Windows XP interface, click Start, Settings, Control Panel). 17. Click Add or Remove Programs and then click Add New Programs. You should see Microsoft Office 2003 Standard (or whatever version you have deployed). 18. Exit the Add or Remove Programs applet without installing Microsoft Office. 19. Navigate to My Documents or another location, such as a floppy disk, where a Word document is located. 20. Double-click the Word document. A Windows Installer dialog box appears as Microsoft Word is installed on the computer. When installation is complete, the document opens in Microsoft Word. 21. If you want, repeat this exercise with an Excel spreadsheet.

475

Deploying the User and Computer Environment with Group Policy

Enrolling User and Computer Certificates with Group Policy Objective

Configure the user environment by using Group Policy . Automatically enroll user certificates by using Group Policy

Objective

Deploy a computer environment by using Group Policy . Automatically enroll computer certificates by using Group Policy

A new feature of Group Policy in Windows Server 2003 allows you to automatically enroll users and computers for certificates, retrieve existing certificates, and renew expired certificates without user interaction. This action is referred to as autoenrollment of certificates. It handles all aspects of certificate enrollment, renewal, and housekeeping. Users need not be aware of certificate actions unless you explicitly configure certificate templates to provide user interaction. Using autoenrollment of certificates streamlines the process of obtaining, retrieving, and renewing certificates for users and computers, thereby reducing administrative effort required for these actions. Note that you must have a certification authority (CA) for certificate enrollment.

NOTE Autoenrollment Requires Enterprise Edition Your certificate server must be running Windows Server 2003 Enterprise or Datacenter Edition to support certificate autoenrollment. You cannot configure certificate autoenrollment on a CA hosted on Windows Server 2003 Standard Edition.

Windows Server 2003 supports two types of certificate templates: . Version 1 templates—The original templates introduced in Windows 2000. They are

read-only and do not support autoenrollment. . Version 2 templates—These templates are new to Windows Server 2003 and sup-

ported only on computers running Windows XP/Vista Professional and Windows Server 2003. They are editable and support autoenrollment.

NOTE Duplicating a Version 1 Template When you duplicate a version 1 template, the duplicate is created in version 2. It is editable and can be used for autoenrollment.

476

Chapter 7: Planning and Implementing Group Policy

In addition to the capacity for autoenrollment, version 2 certificate templates support several other new features. You can configure the ACL in a version 2 certificate template to define the security rights for enrollment and use of certificates. A user or computer must have both read and enroll permissions to enroll a selected certificate template. The read permission enables the user or computer to enumerate the templates. The enterprise CA enforces the enroll permission when the user employs the template to request a certificate. The CA is included in the Authenticated Users group, which by default has Read permissions on a template. Members of the Enterprise Admins and Domain Admins group, by default, have the Full Control permission on all certificate templates. You must complete the following steps to configure autoenrollment of user and computer certificates: 1. Install and configure an enterprise root CA, and optionally install and configure an

enterprise subordinate CA. We discussed procedures for installing CAs in Chapter 5, “Planning User, Computer, and Group Strategies”; see Step by Step 5.1. 2. Configure the certificate template to enable autoenrollment. You can either use a

version 2 template directly or duplicate a version 1 template, as shown in Step by Step 7.28. 3. Configure the CA to issue certificates based on the template you have configured. We

discussed the procedure for requesting certificate templates in Chapter 5; see Step by Step 5.2. At step 5 of this procedure, select the certificate you configure in Step by Step 7.21. 4. Configure Group Policy to enable autoenrollment, as shown in Step by Step 7.29.

STEP BY STEP 7.28 Configuring Certificate Templates for Autoenrollment 1. Click Start, Run, type certtmpl.msc, and then press Enter. This command opens the Certificate Templates snap-in, as shown in Figure 7.35.

477

Deploying the User and Computer Environment with Group Policy

FIGURE 7.35 The Certificate Templates snap-in.

2. The Autoenrollment column in the details pane of the Certificate Templates snap-in informs you which certificate templates support autoenrollment. Right-click the appropriate template and choose Properties. 3. On the Security tab of the template’s Properties dialog box, add the required group (if not already present), and select the Read, Enroll, and Autoenroll permissions under the Allow column (see Figure 7.36). Then click OK.

FIGURE 7.36 Configuring permissions for autoenrollment.

478

Chapter 7: Planning and Implementing Group Policy 4. On the Request Handling tab, shown in Figure 7.37, specify the appropriate purpose and then select the appropriate option from the following list. Note that available options depend on the certificate template. . Enroll Subject Without Requiring Any User Input—This option allows “silent” autoenrollment of certificates without the need for users to be aware of the use of certificates. . Prompt the User During Enrollment—This option sends a message to the user during enrollment. An example would be to request that a user enter his PIN for a smart card. . Prompt the User During Enrollment and Require User Input When the Private Key Is Used—This option prompts the user both during enrollment and use of the private key.

FIGURE 7.37

The Request Handling tab of the certificate template Properties dialog box.

STEP BY STEP 7.29 Configuring Group Policy to Enable Autoenrollment 1. Open the Group Policy Object Editor for the appropriate GPO. 2. Navigate to the Computer Configuration\Windows Settings\Security Settings\Public Key Policies node and select this node. 3. In the details pane, right-click Autoenrollment Settings and choose Properties.

479

Deploying the User and Computer Environment with Group Policy 4. On the Autoenrollment Settings Properties dialog box, as shown in Figure 7.38, select Enroll Certificates Automatically. As required, select the Renew Expired Certificates, Update Pending Certificates, and Remove Revoked Certificates, and the Update Certificates That Use Certificate Templates options. Then click OK.

FIGURE 7.38

Configuring autoenrollment settings in

Group Policy.

EXAM ALERT Remember the Differences Between Template Versions—You might encounter a scenario on the exam in which the autoenroll permission or options on the Request Handling tab are not available. The solution to this type of problem is to duplicate the template so that you create a version 2 copy.

Challenge Enabling the Autoenrollment of Users for Smart Card Certificates More than ever, companies are recognizing the need to secure their networks from unauthorized users. With the rapid growth in the use of portable computers, companies are taking additional measures, such as the use of smart cards for authenticating users, to keep their data secure. In some cases, smart cards are required only for employees who require access to confidential data, such as Legal or Research and Development groups. We discussed the use of smart cards for user authentication in Chapter 5. In this exercise, you are required to take the step of enrolling users in your company’s Legal OU for smart card certificates one step further by configuring certificate autoenrollment, including automatic renewal and certificate publication. This exercise assumes that you have installed an enterprise root CA on one of your computers and that you have created a Certificate Enrollers group and a Legal OU in Active Directory. Note that in the real world, you would likely work from an enterprise subordinate CA to keep the root CA in a secure condition and prevent its compromise. (continues)

480

Chapter 7: Planning and Implementing Group Policy (continued)

You should try working through this exercise on your own. If you are stuck, look at the following steps: 1. Open the Certificate Templates snap-in. 2. Right-click the Smartcard User template in the details pane and choose Duplicate Template. 3. On the General tab of the Properties of New Template dialog box, type Autoenrolled Smartcard User as the template display name. This name is assigned automatically as the template name. 4. On the same tab, ensure that the Publish Certificate in Active Directory option is selected. 5. Select the Request Handling tab. On this tab, select the Prompt the User During Enrollment and Require User Input when the Private Key Is Used option. This option requires the user to input her PIN when using the certificate. 6. Select the Security tab and add the Certificate Enrollers group. Grant this group the Read, Enroll, and Autoenroll permissions in the Allow column. Then click OK to add the Autoenrolled Smartcard User template to the list of certificate templates in the details pane. 7. Open the Certification Authority snap-in. 8. In the console tree, right-click Certificate Templates and choose New, Certificate Template to Issue. 9. In the Enable Certificate Templates dialog box, select Autoenrolled Smartcard User and click OK. 10. Close the Certification Authority snap-in. 11. Open the Group Policy Management Console snap-in and expand the domain to access the Legal OU. 12. Right-click this OU and choose Create and Link a GPO Here. Then type Smart Card Usage as the name of this GPO. 13. Navigate to the User Configuration\Windows Settings\Security Settings\Public Key Policies node. 14. In the details pane, right-click Autoenrollment Settings and choose Properties. 15. Select Enroll Certificates Automatically and then select the Renew Expired Certificates, Update Pending Certificates, and Remove Revoked Certificates and the Update Certificates That Use Certificate Templates check boxes. 16. Click OK to enable autoenrollment. Users will receive a reminder balloon the next time Group Policy is refreshed or when they next log on. Clicking this balloon will start a certificate enrollment wizard.

481

Deploying the User and Computer Environment with Group Policy

Enrolling User and Computer Certificates with Group Policy Review When enrolling user and computer certificates with Group Policy, remember the following: . The autoenrollment feature in Windows Server 2003 Group Policy enables you to

automatically enroll users and computers for certificates, retrieve existing certificates, and renew expired certificates without user interaction. . Only version 2 templates can be configured for autoenrollment. However, you can

duplicate a version 1 template and configure the copy for autoenrollment.

Configuring Security Settings with Group Policy Objective

Configure the user environment by using Group Policy . Configure user security settings by using Group Policy

Objective

Deploy a computer environment by using Group Policy . Configure computer security settings by using Group Policy

R2 Group Policy in Windows Server 2003 includes a large range of security settings designed for both user and computer configuration. The number of available settings has increased substantially compared to those available in Windows 2000. Windows Server 2003 SP1 and R2 have increased the number of security settings even further. Security settings are located in a subnode of the Windows Settings node under both Computer Configuration and User Configuration. From these nodes, you can manually configure security levels associated with the GPO. These settings control user access to the network, account and password policies, user rights, audit policies, wireless network policies, and software restriction policies. You can configure security settings for the startup mode and security options for system services such as file and print services, fax and telephone services, and so on. You can also configure who should and should not belong to a restricted group, configure groups to which a restricted group can belong, and apply security permissions to Registry keys. You can either use a security template to apply preconfigured security settings or manually configure them yourself. We covered the use of security templates in Chapter 5.

482

Chapter 7: Planning and Implementing Group Policy

Settings Available to Both Computers and Users You can configure public key policies and software restriction policies for both computers and users. We covered public key policies earlier in this chapter. In this section, we describe available software restriction policies. Software restriction policies enable administrators to restrict the types of software that run on computers to which the policy applies. These policies have the following benefits: . Control which programs can run on computers on your network—You can allow

only those programs that users require to do their jobs properly, and restrict the use of other programs such as games. This also helps to prevent viruses, Trojan horses, rootkits, and other malware programs from executing. . Control which programs users on multiuser computers can run—When more

than one user can access a computer, you can set user-specific policies that prevent users from accessing programs needed only by other users of the same computer. . Control whether software restriction policies apply to all users—You can specify

whether software restriction policies apply to administrators. . Prevent email attachments from executing—If you are concerned about users

receiving viruses through email, you can apply policies that restrict files with certain extensions from executing.

WARNING Software restriction works on only the most recent Windows computers Software restriction policies operate only on Windows XP and Windows Server 2003 computers. You need to upgrade other computers or use third-party software restriction settings on Windows 2000 and older computers.

Enabling Software Restriction Policies By default, no software restriction policies are defined in a new GPO. Step by Step 7.30 shows you how to enable the creation of new software restriction policies.

STEP BY STEP 7.30 Enabling the Creation of New Software Restriction Policies 1. In the Group Policy Object Editor, expand the desired node (Computer Configuration or User Configuration) and navigate to the Windows Settings\Security Settings\Software Restriction Policies node.

483

Deploying the User and Computer Environment with Group Policy 2. Right-click Software Restriction Policies and choose New Software Restriction Policies. This selection creates a default set of software restriction policies, which are displayed in the details pane of the Group Policy Object Editor snap-in (see Figure 7.39).

FIGURE 7.39

Enabling software restriction policies.

Configuring Software Restriction Policies Software restriction policies operate at one of the following two levels, which are defined in the Security Levels subnode (see Figure 7.40): . Unrestricted—Allows software to run according to a user’s access rights. This is the

default policy level. . Disallowed—Does not allow any software to run, regardless of a user’s access rights.

Four Registry path rules that allow system software to run are specified in the Additional Rules folder, preventing users from being completely locked out of the computer.

484

Chapter 7: Planning and Implementing Group Policy

FIGURE 7.40 The default software security level is Unrestricted.

The Additional Rules subnode enables you to define rules that provide exceptions to either of the two available security levels. In other words, if you have set the security level to Disallowed, you can specify rules that define what software may run, or if you have set the security level to Unrestricted, you can specify rules that define what software may not run. The following types of rules are available (see Figure 7.41):

FIGURE 7.41

Four types of new rules can be configured in the Additional Rules folder.

. Certificate rule—This type of rule identifies software according to its signing certifi-

cate. You can use a certificate rule to specify the source of trusted software that should be allowed to run without prompting a user. . Hash rule—A hash is a fixed-length series of bytes that uniquely identifies an applica-

tion or file. The policy uses a hash algorithm to calculate the hash of a specified program and compares this to the hash of a program that a user attempts to run, to determine whether the application or file should run.

485

Deploying the User and Computer Environment with Group Policy . Internet zone rule—This type of rule identifies software according to an Internet

Explorer zone (Internet, Local intranet, Trusted Sites, Restricted Sites, or My Computer). You can specify zone rules only for Windows Installer software packages. . Path rule—This type of rule identifies software according to its local or UNC file

path. This rule enables you to grant access to software located in a specific folder for each user. Follow Step by Step 7.31 to implement a software restriction policy.

STEP BY STEP 7.31 Configuring Software Restriction Policies 1. Select the Security Levels subnode to display the default security levels, as previously shown in Figure 7.40. 2. To specify the Disallowed security level, right-click Disallowed and choose Set As Default. You are warned that the default level you selected is more restricted than the current security level (see Figure 7.42). Click Yes to continue.

FIGURE 7.42 This message warns you that the Disallowed security rule is more restricted than the current security level.

3. To specify rules that govern exceptions to the security level you specified, right-click Additional Rules and choose one of the four available rules, as shown previously in Figure 7.41. 4. For example, to specify a path rule, select New Path Rule to display the New Path Rule dialog box, as shown in Figure 7.43. To create an exception to the Disallowed security level, type the path to the applications that are allowed, choose Unrestricted from the drop-down list, and then click OK. If you have retained the default Unrestricted security level, choose Disallowed from the drop-down list to disallow the specified software. You may also type an optional description. You can follow a similar procedure to designate any of the other rule types.

486

Chapter 7: Planning and Implementing Group Policy

FIGURE 7.43 The New Path Rule dialog box enables you to specify the path to software defined by an additional rule.

5. If required, specify rules for enforcement, designated file types, and trusted publishers by clicking Software Restriction in the console tree to display these items in the details pane, as shown previously in Figure 7.42. The following describes the functions of these items: . Enforcement—You can determine the scope of software restriction policies, as shown in Figure 7.44. This capability is useful for exempting local administrators from software restriction policies.

FIGURE 7.44 You can modify the scope of software restriction polices from the Enforcement Properties dialog box.

487

Deploying the User and Computer Environment with Group Policy . Designated File Types—This option determines what file types, in addition to standard types such as .exe, are considered as executable code and subject to software restriction policies. . Trusted Publishers—As shown in Figure 7.45, this option enables you to determine which users can select trusted publishers and to check for revoked certificates.

FIGURE 7.45

You can restrict which users can select trusted publishers.

Best Practices for Software Restriction The following are several practices you should follow in dealing with software restriction policies: . Create a separate GPO instead of using the Default Domain Policy GPO—Should

problems arise with software restriction policies, you can easily disable the separate GPO without affecting any policies configured in the Default Domain Policy GPO. . Use caution when selecting the Disallowed security level—This security level

keeps all applications from running except those you have specified using additional rules. . If problems occur after applying software restriction policies, try using Safe

Mode to correct them—If you find that a computer is severely locked down, restart it in Safe Mode. Software restriction policies do not apply when the computer is running in Safe Mode, and you can log on as a local administrator to edit the policy and run the Gpupdate tool. We discuss this tool in Chapter 8.

488

Chapter 7: Planning and Implementing Group Policy . Use NTFS permissions in conjunction with software access policies to obtain

the best security level—Users might attempt to circumvent software access restriction by moving or renaming restricted files. You can configure the ACLs for restricted files to overcome this problem. . Use a test lab to ensure that policy settings operate as intended before applying

them to the production domain—As with other Active Directory deployment scenarios, it is wise to set up a small domain in a test lab to ensure settings are applied as expected. This way, you can detect problematic behavior before applying software restriction policies that could affect user productivity. . Remember to filter software policy settings—As described earlier in this chapter,

you can deny the Apply Group Policy permission to users or groups for whom you do not want software policy settings to apply.

Settings Available to Computers Only Group Policy in Windows Server 2003 supports an extensive range of security settings in the Computer Configuration node of the Group Policy Object Editor. These settings include account policies, local policies, event logs, restricted groups, system services, Registry, file system, and IP security policies on Active Directory. We discuss several of the more important policy settings that you should know for the 70-294 exam. Information on all the policy settings is available in the Windows Server 2003 Help and Support Center files. Account Policy Account policy includes password policy, account lockout policy, and Kerberos policy. We discussed account policy settings in Chapter 5. Remember that account policy settings must be specified in a GPO linked to the domain; if they are configured in a GPO linked to a site or OU, they will not be applied. Audit Policy You need to create an audit policy on a domain controller to record events such as logging on and off or file and folder access throughout the domain. When you do so, auditable events are recorded in the security log of the computer at which they happen. Administrators can use Event Viewer to view any computer’s security log by connecting to the required computer. You can audit success or failure for several types of actions. In other words, you can choose to record successful actions or failed attempts at performing these actions, or both. For example,

489

Deploying the User and Computer Environment with Group Policy

if you are concerned that intruders are attempting to log on to your network, you can audit failed logon events. In most cases, you should also audit successful logon events in case intruders succeed in accessing your network. Overall, by tracking successful events, you can determine how frequently objects such as files or printers are used. Tracking unsuccessful events can alert you to possible security breaches, including attempts to access confidential data.

NOTE Local Auditing All auditing is of the local computer only. To ensure complete auditing of domain-based events, you must enable auditing on all domain controllers.

You can audit the following types of events: . Account logon—Authentication of a domain user account at a domain controller. . Account management—Creation, modification, or deletion of a user or group

account. This also includes enabling and disabling accounts and changing or resetting passwords. . Directory service access—Access by a user of an object in Active Directory that has a

system access control list (SACL) specified. Default auditing entries are included in each SACL; you can modify them from the Auditing tab of the Advanced Security Settings dialog box for the Active Directory object of concern. . Logon events—Logon or logoff by a user at a workstation or member server. . Object access—Access by a user of a file, folder, or printer. You also have to specify

which objects are audited from their Properties dialog boxes in My Computer or Windows Explorer. . Policy change—Modification of user rights assignment policies, trust policies, or audit

policies. . Privilege use—Use of a user right, such as shutting down a computer. . Process tracking—Actions performed by an application. . System events—Events that occurred on a computer such as an improper shutdown

or a disk having very little free space remaining. Follow Step by Step 7.32 to specify audit policy settings.

490

Chapter 7: Planning and Implementing Group Policy

STEP BY STEP 7.32 Configuring Audit Policy Settings 1. Access the Group Policy Object Editor snap-in for the appropriate GPO linked to a site, domain, or OU. 2. Navigate to the Computer Configuration\Windows Settings\Security Settings\Local Policies\Audit Policy node. 3. Right-click the appropriate policy and choose Properties. 4. In the Properties dialog box for the policy, select Define These Policy Settings and then choose Success, Failure, or both, as desired (see Figure 7.46). Then click OK.

FIGURE 7.46

Configuring auditing of logon events.

User Rights Assignment The term user rights refers to a predefined set of properties that are assigned to built-in domain local groups. These properties define what members of these groups can and cannot do on the network. The two classes of rights are Privileges and Logon Rights. By default, certain built-in groups are granted a set of user rights. You can use the User Rights Assignment node of Group Policy to manage these rights, including adding or removing users and groups, as shown in Step by Step 7.33.

STEP BY STEP 7.33 Configuring User Rights Assignment Settings 1. Access the Group Policy Object Editor snap-in for the appropriate GPO linked to a site, domain, or OU. 2. Navigate to the Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment node. 3. Right-click the appropriate policy and choose Properties.

491

Deploying the User and Computer Environment with Group Policy 4. In the Properties dialog box for the policy, select Define These Policy Settings. 5. Click Add User or Group, and in the Add User or Group dialog box, type or browse to the required user or group (see Figure 7.47). Then click OK.

FIGURE 7.47

Configuring user rights assignment settings.

Security Options The Security Options node contains a large set of policy options that are important in controlling security aspects of the computers to which the GPO applies. You should be familiar with what the more important of these options do and when to configure them. Following are several of the more important options: . Accounts: Rename Administrator Account—This option renames the default

administrator account to a value you specify. Intruders cannot simply look for “administrator” when attempting to access your network. . Domain member: Digitally Encrypt or Sign Secure Channel Data (Always)—

This option determines the need for encryption of secure channel traffic initiated by a domain computer. Communications can take place only with other computers running Windows NT 4.0 Service Pack 6 or higher, Windows 2000, Windows XP, or Windows Server 2003. . Domain member: Digitally Encrypt Secure Channel Data (When Possible) and

Digitally Sign Secure Channel Data (When Possible)—The domain computer attempts to negotiate encryption or signing of secure channel traffic. Encryption or signing occurs with all supported computers as listed in the preceding paragraph. If it is unable to do so, it can still communicate, for example, with Windows 9x computers. . Interactive logon: Do Not Display Last User Name—When this option is enabled,

the username of the last logged-on user does not appear in the logon dialog box, thus preventing another individual from seeing a username. . Interactive logon: Do Not Require CTRL+ALT+DEL—When this option is

enabled, a user does not need to press Ctrl+Alt+Delete to obtain the logon dialog box. In a secure environment, this policy should be disabled to force the use of this key combination. Its use prevents rogue programs such as Trojan horses from capturing usernames and passwords.

492

Chapter 7: Planning and Implementing Group Policy . Interactive logon: Message Text for Users Attempting to Log On and Interactive

logon: Message Title for Users Attempting to Log On—When these options are enabled, Windows displays a text message to users before the logon dialog box appears. You can use this text for legal reasons such as the consequences of misusing company information. You can specify the content of the message and its title by configuring both options. . Interactive logon: Require Smart Card—When this option is enabled, users must

employ a smart card to log on to the computer. . Interactive logon: Smart Card Removal Behavior—This option enables you to

specify that the computer is locked or that the user is automatically logged off when she removes her smart card from the reader. You can also specify that a remote Terminal Services session will be disconnected. . Microsoft network client and Microsoft network server: Digitally Sign

Communications (Always)—These options determine the need for server message block (SMB) signing of communications between servers and client computers. Digital signing helps to prevent “man-in-the-middle” attacks that modify SMB packets in transit. When these options are enabled, communications cannot take place with computers that do not support SMB signing of communications, such as Windows 9x computers. . Microsoft network client and Microsoft network server: Digitally Sign

Communications (If Client Agrees)—These options operate like the options in the preceding paragraph, except that unsigned communications can occur with a computer that does not support SMB signing. . Network access: Let Everyone Permissions Apply to Anonymous Users—When

this option is enabled, permissions applied to the Everyone group also apply to anonymous users. This capability can present a security risk and should be disabled in most situations. . Shutdown: Clear Virtual Memory Pagefile—The page file can contain sensitive data

that has been written there by applications. Enabling this setting clears the contents of the page file when a user logs off, preventing its access by the next user (including any unauthorized user) who logs on to the machine. Configuring any of these settings is a simple matter, as Step by Step 7.34 describes.

493

Deploying the User and Computer Environment with Group Policy

STEP BY STEP 7.34 Configuring Security Options Policies 1. Access the Group Policy Object Editor snap-in for the appropriate GPO linked to a site, domain, or OU. 2. Navigate to the Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options node. 3. Right-click the appropriate policy and choose Properties. 4. In the Properties dialog box for the policy, select Define These Policy Settings and then select either Enabled or Disabled as required (see Figure 7.48). 5. Some policies (such as smart card removal behavior) require you to select from several options. After you have done this, click OK.

FIGURE 7.48

Configuring security options settings.

Restricted Groups The Restricted Groups folder allows you to determine who can be a member of a group, and which groups each group can be a member of. By configuring this option, you can restrict who (user or group) can be a member of the restricted group. You can also restrict which groups the restricted group can belong to. If any other members have been specified in Active Directory Users and Computers, they are removed when the policy applies. This policy is reapplied whenever the policy is refreshed, which is every 5 minutes for domain controllers and every 90 minutes for member servers and client computers. You can use Restricted Groups to define the membership of local groups on a member server or client computer—for example, the local Administrators group. Follow Step by Step 7.35 to designate a restricted group.

494

Chapter 7: Planning and Implementing Group Policy

STEP BY STEP 7.35 Configuring Restricted Groups Policies 1. Access the Group Policy Object Editor snap-in for the appropriate GPO linked to a site, domain, or OU. 2. Navigate to the Computer Configuration\Windows Settings\Security Settings\Restricted Groups node. 3. Right-click Restricted Groups and select Add Group. 4. In the Add Group dialog box, type or browse to the group to be added. Then click OK to display a Properties dialog box for the group you specified. 5. To add members to this group, click the Add button under Members of This Group and type or browse to the user or group you want to add (see Figure 7.49). Then click OK. 6. To define which groups this group is allowed to be a member of, click the Add button under This Group Is a Member Of and specify the required groups in a similar manner.

FIGURE 7.49

Specifying members of restricted groups.

EXAM ALERT Limiting Membership of Local Groups You can use the Restricted Groups policy settings to limit the membership of local groups such as Administrators and Power Users on member servers and client computers. Configure these settings in a GPO linked to the OU in which the computer accounts reside. This is an efficient means of preventing users from having administrative rights on servers or other computers.

Other Available Settings The Security Settings node contains other settings that we will not discuss here. For further information, refer to the Windows Server 2003 Help and Support Center files. These groups of settings include the following: . Event Log—You can view configuration options for the Event Viewer logs, including

log sizes and action taken when an event log is full.

495

Deploying the User and Computer Environment with Group Policy . System Services—You can configure standard system services such as startup type and

restrict users from making changes in these configurations. . Registry—You can control the permissions that govern who can access and make

changes to certain portions of the Registry. . File System—You can create templates for permissions that ensure permissions on

folders and files are kept in an appropriate setting. . Wireless Network (IEEE 802.11) Policies—You can specify wireless settings such as

the use of Windows by users to configure network connection settings, enabling 802.1X authentication for wireless network connections, and the preferred wireless networks that are accessible to users. . Public Key Policies—You can configure public key infrastructure settings. This node

contains the following security settings: . Encrypting File System—You can designate selected users as Encrypting File

System (EFS) recovery agents. These users can use their certificates and public keys to recover files that other users have encrypted. . Automatic Certificate Request Settings—This option provides a wizard that

helps you configure computers to automatically request certificates from an enterprise CA. It helps to ensure that computers have the certificates required to undertake public key cryptographic operations. You need to provide certificate templates to Active Directory before running this wizard, as discussed under “Enrolling User and Computer Certificates with Group Policy” earlier in this chapter. . Trusted Root Certification Authorities—You can designate root CAs outside

your company as being trusted by computers to which the GPO applies. . Enterprise Trust—You can create a certificate trust list, which is a list of root

CAs whose certificates are considered to be trusted in your company for purposes such as client authentication or secure email. This policy setting is available for users as well as computers. . Autoenrollment Settings—You can enable or disable certificate autoenrollment.

We covered this topic in detail under “Enrolling User and Computer Certificates with Group Policy.” . IP Security Policies on Active Directory—You can control the implementation of IP

Security (IPSec) as used by the computer for encrypting communications across the network.

496

Chapter 7: Planning and Implementing Group Policy

Security Settings Review When configuring Group Policy security settings, remember these key points: . You can configure software restriction policies for both users and computers. These

policies restrict the types of software that can run and help to prevent viruses and untrusted software from running. . Account policy applies only to computers and can be configured only at the domain

level. It includes password policy, account lockout policy, and Kerberos policy. . Audit policy determines the types of events that are audited on computers to which the

policy applies. Audited events are displayed in the computer’s Security log. . You can use the User Rights Assignment policy to modify the user rights that are

assigned to certain groups. . You can configure a large number of options in the Security Options node, including

digitally encrypting or signing secure channel communications, requiring the use of a smart card, and not displaying the last username.

Redirecting Folders with Group Policy Objective

Configure the user environment by using Group Policy . Redirect folders by using Group Policy

Using Group Policy, you can redirect the folders containing a user’s profile to a network location so that all associated folders can be easily managed and backed up. This includes the following special folders: . Application Data . Desktop . My Documents and its My Pictures Subfolder . Start Menu

When configured, Group Policy redirection of folders takes precedence over any location specified in a user’s profile. Back in the days of Windows NT 4.0, it was possible to redirect folders using System Policy. Starting with Windows 2000 and continuing in Windows Server 2003, Group Policy supplies enhanced functions and additional options for managing the behavior of redirected folders. All folder redirection policies are located in the User

497

Deploying the User and Computer Environment with Group Policy

Configuration\Windows Settings\Folder Redirection node of the Group Policy Object Editor snap-in, as shown in Figure 7.50.

FIGURE 7.50 Invoking folder redirection policies.

Benefits of Folder Redirection Users and administrators benefit from using folder redirection in the following ways: . Users’ documents are always accessible to them, regardless of which computer they log

on to. . When roaming user profiles are used, only the network path to a folder such as My

Documents is actually part of the profile. This eliminates the need for copying the contents of this folder back and forth at each logon and logoff, thereby speeding up the logon/logoff process. . You can configure the Offline File technology so that users’ files are always available to

them even when they are not connected to the network. Their files are automatically cached and are in the same logical location (for example, the U: drive) on the laptop as they are when they are connected to the network, facilitating their working on the files when they are away from the office. . It is easy to back up all users’ files from a central server without interaction by the user.

The administrator or backup operator can accomplish this task as part of the routine backup task. . Administrators can use Group Policy to configure disk quotas, thereby controlling and

monitoring the amount of disk space taken up by users’ folders.

498

Chapter 7: Planning and Implementing Group Policy . You can standardize users’ working environments by redirecting the Start Menu and

Desktop folders to a common shared location. This standardization can help with remote support problems because the support staff will know the desktop layout of the users’ computers.

Implementing Folder Redirection Users for whom you configure folder redirection must have a GPO linked to some folder structure in which their user object is contained, such as a site, domain, or organizational unit. If this is so, an administrator can use Group Policy to redirect folders by editing a GPO that is linked to the appropriate container, as described in Step by Step 7.36.

STEP BY STEP 7.36 Using Group Policy to Redirect Folders 1. Expand the console tree of GPMC to access the GPOs linked to the appropriate site, domain, or OU. 2. Right-click the appropriate GPO and click Edit to open the Group Policy Object Editor snap-in. If desired, first select Create and Link a GPO Here to create a new GPO. 3. Navigate to the User Configuration\Software Settings\Folder Redirection node and expand this node to access the folders contained therein. 4. Right-click the folder to be redirected and select Properties. This action displays the Properties dialog box for the selected folder, as shown in Figure 7.51.

FIGURE 7.51

Configuring a folder redirection policy.

499

Deploying the User and Computer Environment with Group Policy 5. Under Setting, select from the following choices: . Basic—Redirect Everyone’s Folder to the Same Location—This option redirects all folders to this location. Specify the UNC path in the Target Folder Location text box. You can use the %username% variable to create a subfolder for each user with the user’s down-level logon name. . Advanced—Specify Locations for Various User Groups—This option redirects folders to different locations depending on the users’ security group memberships. The bottom part of the dialog box changes so that you can specify a UNC path for each security group. . Not Configured—Folder redirection is not applied. 6. If you have chosen the Advanced option, specify security group membership by clicking the Add button that appears (see Figure 7.52). In the folder’s Properties dialog box that appears, type or browse to the required security group. Then select from the following choices under Target Folder Location: . Redirect to the User’s Home Directory—This option redirects users’ folders to the home directory as specified in the user account’s Properties dialog box in Active Directory Users and Computers. This option works only for client computers running Windows XP Professional or Windows Server 2003, and is available only for the My Documents folder. . Create a Folder for Each User Under the Root Path—This option enables you to specify a root path in the form of a UNC path to a shared location. A subfolder is automatically created for each user in this location, and the folder path appears at the bottom of the dialog box. This option is not available for the Start Menu folder. . Redirect to the Following Location—This option enables you to specify a UNC path to the specific folder for each user. New to Windows Server 2003, you do not need to specify an environment variable; the username is appended to the path you provided, and an example is shown at the bottom of the dialog box. . Redirect to the Local User Profile Location—This option redirects users’ folders to the local user profile location specified in the user account’s Properties dialog boxes in Active Directory Users and Computers. This option is useful for returning redirected folders to their original default location. You can shift users from the Windows NT home folders model to the newer My Documents model used in Windows 2000/XP/Server 2003.

500

Chapter 7: Planning and Implementing Group Policy

FIGURE 7.52

Specifying a group and location for advanced folder

redirection.

7. If you have chosen the Basic option, select from the same choices under Target Folder Location as stated in step 6. 8. Click the Settings tab to specify additional settings pertinent to folder redirection, as shown in Figure 7.53.

FIGURE 7.3 The Settings tab of the My Documents Properties dialog box.

501

Deploying the User and Computer Environment with Group Policy 9. From this location, configure the following settings and then click OK. It is recommended that you keep the default settings enabled: . Grant the User Exclusive Rights to (folder)—Enabled by default and not available for the Start Menu folder. This setting provides the user with full control privileges to the redirected folder. No one else, not even an administrator, has any privileges to the folder. If this setting is disabled, default permissions of Users or Everyone, Read and Execute (or any other configured permission) are applied. Disable this option only if users are sharing a single location. . Move the Contents of (folder) to the New Location—Enabled by default and not available for the Start Menu folder. This setting moves the current contents of the user’s special folder to the specified location. . Leave the Folder in the New Location When Policy Is Removed—Enabled by default. If the GPO no longer applies to the user, the folder is left in its redirected location. . Redirect the Folder Back to the Local UserProfile Location When Policy Is Removed—Selecting this option redirects the folder back to its local user profile location if the GPO no longer applies to the user. . My Pictures Preferences—Available only on the My Documents Properties dialog box. Using these settings, you can either make My Pictures a subfolder of My Documents (which is recommended and allows My Pictures to follow My Documents to any specified location) or choose not to specify administrative policy (which leaves My Pictures on the user’s local hard drive or on the location specified by the user profile).

WARNING Don’t Automatically Disable Folders If you disable the Move the Contents of (folder) to the New Location option and specify the policy removal option Redirect the Folder Back to the User Profile Location When Policy Is Removed, the contents of the special folder are not copied back to the user’s profile location. Consequently, the user can no longer access the current contents of the special folder. To avoid this problem, do not disable the Move the Contents of (folder) to the New Location option.

Offline Files and Folder Redirection As we have mentioned, one benefit of folder redirection is that you can make users’ files available to them even when they are not connected to the network. The Offline Files feature, first introduced in Windows 2000, makes this possible. Offline Files is designed to allow a user to access and work with files and folders that are stored on a network share when the user is disconnected from that share, such as when she is working from home. When the user is online and opens a cached file, the computer compares the date, time, and length of the local file with the version on the server. If the version on the server is newer, the computer retrieves it so that the user always has the most up-to-date version. When the user saves the file, a copy is saved both locally and on the server.

502

Chapter 7: Planning and Implementing Group Policy

When the user is offline and working with a cached file, this file is saved back to the server the next time she goes online. This situation also occurs if the server is unavailable for any reason such as a network connectivity or disk problem. Configuring the Server for Offline Files Configuring the server to make files or folders available is a separate procedure from that of folder redirection as already discussed. To enable offline caching on the server, follow Step by Step 7.37.

STEP BY STEP 7.37 Enabling Offline Caching 1. Right-click a shared folder in My Computer or Windows Explorer and select Sharing and Security. 2. Click the Caching command button. 3. In the Offline Settings dialog box, shown in Figure 7.54, select one of the following options:

FIGURE 7.54 Use the Offline Settings dialog box to enable or disable offline caching.

. Only the Files and Programs That Users Specify Will Be Available Offline—This option allows users to control which files will be available offline. . All Files and Programs That Users Open from the Share Will Be Automatically Available Offline—This option makes all files opened by users from the shared folder automatically available offline. Select the Optimized for Performance check box to automatically cache all programs so that they will be run locally. . Files or Programs from the share will Not Be Available Offline—This option prevents users from making files available offline. 4. Click OK.

503

Deploying the User and Computer Environment with Group Policy

Configuring Client Computers to Use Offline Files You can use the Administrative Templates\Network\Offline Files nodes under either Computer Configuration or User Configuration to configure offline file policies. You can also manually configure servers or client computers to use offline files, as described in Step by Step 7.38. After you have enabled offline files, the user can cache a file to the local computer by simply navigating to the file in My Computer, Windows Explorer, or My Network Places; rightclicking the file or folder; and choosing Make Available Offline.

STEP BY STEP 7.38 Enabling a Computer to Use Offline Files 1. Open My Computer or any folder on your computer. 2. Select Tools, Folder Options to display the Folder Options dialog box. 3. On the Offline Files tab, select Enable Offline Files, as shown in Figure 7.55.

FIGURE 7.55 Use the Folder Options dialog box to enable and configure offline files.

4. Select one or more of the following options, as required: . Synchronize All Offline Files When Logging On—This option fully synchronizes offline files when a user logs on. Doing so ensures that network files reflect all latest changes. . Synchronize All Offline Files Before Logging Off—Synchronizing offline files at logoff eliminates the need for manual synchronization.

504

Chapter 7: Planning and Implementing Group Policy . Display a Reminder Every—This option makes reminder balloons pop up at the specified interval to indicate that files are being used in offline mode. . Create an Offline Files Shortcut on the Desktop—This option enables access to offline files from the desktop. . Encrypt Offline Files to Secure Data—This option uses EFS to encrypt offline files to protect them from anyone that might gain unauthorized access to the computer. It is useful for portable computers that are used away from the office. . Amount of Disk Space to Use for Temporary Offline Files—This option specifies the amount of local disk space offline files are allowed to use. 5. Click Advanced to access the Offline Files–Advanced Settings dialog box, which determines how the computer behaves when the network connection is lost. You can specify that the user is notified that she is offline but can continue to work offline, or that the user cannot work offline if the network connection is lost. You can also create exceptions to this rule. 6. When you are finished, click OK twice to exit the Folder Options dialog box.

Administrative Templates Settings Those of you who are new to Active Directory but have used Windows NT System Policy to configure desktop restrictions might be wondering what has happened to the various settings that were previously available. The answer is that they are in the Administrative Templates folder. As in System Policy, settings are available for computers and users. The Administrative Templates node is given this name because it uses administrative template files (.adm) to specify the modification of Registry settings. An .adm file is a text file that contains a hierarchy of categories and subcategories that define how the settings are displayed on the user interface and how they are written into the Registry. Computer-specific settings are managed within the HKEY_LOCAL_MACHINE subtree, whereas user-specific settings are managed within the HKEY_CURRENT_USER subtree. By default, Microsoft makes available the following five .adm files: . Conf.adm—Provides settings for NetMeeting on Windows 2000/XP/Server 2003 . Inetres.adm—Provides settings for Internet Explorer on Windows 2000/XP/Server 2003 . System.adm—Provides system settings for Windows 2000/XP/Server 2003 . Wmplayer.adm—Provides settings for Windows Media Player on Windows

2000/XP/Server 2003 . Wuau.adm—Provides Windows Update settings for Windows 2000/XP/Server 2003

505

Deploying the User and Computer Environment with Group Policy

You can also obtain .adm files with vendor-supplied software applications such as Microsoft Office or create custom .adm template files. Some settings appear under both Computer Configuration and User Configuration. Which node you use depends on whether the policy should apply to the computer regardless of who is logged on or whether it should apply to the user regardless of the computer she is logged on to. Although Microsoft does not emphasize these settings in the 70-294 exam, these settings are very important in controlling what users can and cannot do with their desktops. Therefore, we examine several of the more common settings and the ways to configure them. Table 7.1 summarizes the groups of settings available in the Administrative Templates nodes of Computer Configuration and User Configuration. TABLE 7.1 Groups of Administrative Template Settings Setting

What You Can Control

Applied To

Windows Components

Components such as NetMeeting, Internet Explorer, Windows Explorer, Microsoft Management Console, Task Scheduler, Windows Installer, Windows Messenger, Windows Media Player, and Windows Update.

Computers and Users

Although settings in these nodes keep inexperienced users from poking around in places you would rather not have them access, users can access these items by other means. If the users can access a command prompt, they can run many of these components. However, by hiding items such as Computers Near Me and Entire Network in My Network Places, you can make it difficult for users to explore servers just for the fun of seeing what they can find. Start Menu and Taskbar

What is seen or not seen on the user’s Start menu and taskbar. You can hide items that you do not want users to have available, such as the Search command, the Run command, My Documents, My Pictures, My Music, My Network Places, and so on. You can also enable users to run 16-bit programs in their own memory space and gray out unavailable Windows Installer Start menu shortcuts.

Users

Desktop

What is seen or not seen on the user’s desktop. These items include many of the ones that are configurable in the Start Menu and taskbar, such as My Documents and My Network Places. You can also configure options that pertain to the Active Desktop enhancements that are included with Internet Explorer and options that pertain to the size and refinement of Active Directory searches.

Users

(continues)

506

Chapter 7: Planning and Implementing Group Policy

TABLE 7.1 Continued Setting

What You Can Control

Applied To

Control Panel

This setting enables you to lock down part of or all the Control Panel settings. This capability is very useful in the corporate environment, where many help desk calls come from users who have experimented with settings in Control Panel. It is especially useful for controlling the Add/Remove Programs applet to restrict or prevent users from installing unauthorized or pirated software, and the Display applet, where you can limit the extent to which users can modify the display appearance and behavior of the screen saver, change the wallpaper, and so on. You can also show or hide specified applets, control the users’ ability to add, delete, and search for printers, and restrict the language selection used for Windows menus and dialog boxes.

Users

Shared Folders

Whether users can publish shared folders and Distributed File System (DFS) roots.

Users

Network

Behavior of offline files and network and dial-up connections. You can configure offline file settings such as how files are synchronized and what happens when the connection to the server is lost. Network and dial-up connection settings specify how RAS connections behave, including users’ access to their Properties dialog boxes, as well as their sharing or deletion. These settings are located under User Configuration and are generally designed to prevent users from tinkering with their network options.

Computers and Users

System

Logon and logoff functions and Group Policy itself. Logon policies determine the way scripts are processed, the use of roaming and mandatory user profiles, the effect of slow links, and so on. Several disk quota policies control how disk quotas are managed. Several policies determine the behavior of the Windows File Protection mechanism that helps to protect the operating system from damage caused by actions such as deleting system files. You can limit the size of the file cache where copies of files are stored, specify where these copies are cached, and configure options related to scanning of system files. You can disable users’ ability to run Registry editing tools (regedit.exe and regedt32.exe), which is a good idea even though regular users have only Read access to the Registry.

Computers and Users

Printers

The publication of printers in Active Directory, including web-based printing. You can prevent users from adding or deleting printers. This capability might be useful if users like to experiment with these settings and then wonder why they cannot print.

Computers

507

Deploying the User and Computer Environment with Group Policy

For every policy in the Administrative Tools folder, you can specify one of the following three settings: . Not Configured—The default setting; does not modify the Registry. Any other

setting configured in a higher-level GPO remains applied. . Enabled—Modifies the Registry to indicate the setting is enabled. . Disabled—Modifies the Registry to indicate the setting is disabled.

Each policy setting’s Properties dialog box contains an Explain tab, like the one shown in Figure 7.56. This tab provides a description that will assist you in selecting those policies you should apply.

FIGURE 7.56 The Explain tab of the Remove My Documents icon from Start Menu Properties dialog box.

You can configure any of these policies as shown in Step by Step 7.39.

STEP BY STEP 7.39 Using Group Policy to Control Administrative Templates Settings 1. Navigate to the Administrative Templates node under either Computer Configuration or User Configuration, depending on the setting you want to configure. 2. Expand this node and, if necessary, expand the appropriate subnode to locate the policy you want to configure. 3. Right-click the setting in the details pane and choose Properties.

508

Chapter 7: Planning and Implementing Group Policy 4. On the Properties dialog box that appears, select Enabled or Disabled as required (see Figure 7.57). 5. If you need to configure several adjacent policy settings, you can use the Previous Setting or Next Setting command buttons to navigate through the series of settings in any given node.

FIGURE 7.57

Configuring an Administrative Templates policy setting.

It is worthwhile to further explain the precedence of the Enabled, Disabled, and Not Configured options available for the Administrative Templates policy settings. Take a look at Figure 7.58 for an example.

Policy Application

Result of Policy Application

Hide the notification area policy. OU1

Enabled

Notification area is hidden.

OU2

Not Configured

OU1 policy still applies, and notification area is hidden.

OU3

Disabled

OU1 policy no longer applies, and notification area is not hidden.

FIGURE 7.58 Group Policy Administrative Templates application in child OUs.

509

Deploying the User and Computer Environment with Group Policy

In Figure 7.58, each OU is a child of the OU directly above it, and as you have learned, GPOs are processed sequentially with conflicting policies at each successive level overriding previously applied policies. If you enable the Hide the Notification Area policy at a GPO linked to the OU1 OU, users in this OU will notice that the notification area is hidden. If you have specified that the same policy will not be configured in the OU2 OU, the previously specified policy setting still applies, and the notification area is hidden for users in this OU also. Finally, if you have specified the same policy to be disabled in the OU3 OU, this policy setting no longer applies to users in this OU, and the notification area is no longer hidden for these users.

NOTE Disabling the Remove Microsoft includes a large number of policy settings that remove certain features from the desktop, such as the Remove Search Menu from Start Menu setting shown in Figure 7.57. You should realize that to disable these settings means that the feature will not be removed from the user’s desktop, whereas enabling these settings means that the feature will appear on the user’s desktop.

Group Policy Loopback Processing Mode One configuration option worth discussing in detail is the loopback processing mode, available from the System\Group Policy subnode under Administrative Templates. This mode applies Group Policy to the affected computers based on the location of the computer objects alone. It is useful when computers are accessible to the public—for example, kiosks in the main lobby of a building or in shopping centers. In this case, you would normally place the kiosk computers in a single OU (for example, the Kiosk OU), to which you might want to apply very strict administrative template settings. Use of the loopback processing mode setting causes affected computers to apply the set of computer-based GPOs to any user who logs on to these computers. By using the Group Policy loopback feature, GPOs that depend only on which computer the user logs on to are applied. When you enable loopback processing, you can choose either Merge or Replace mode. These modes have the following functions: . Merge—This mode merges any user-specific policies that the computer is processing

with any policy normally processed from GPOs applied to the user. To cite an example, let’s assume that a user in the Financial OU logs on to a computer in the Kiosk OU. In this case, the settings in the Kiosk OU and those in the Financial OU are merged. If settings conflict, the settings for the computer object (in this case, the Kiosk OU) prevail. . Replace—This mode replaces the user-specific policy settings with the list already

obtained for the computer (in our example, the policy settings for the Kiosk OU). Any user-based settings that normally apply to the user logging on to the kiosk computer (in our example, the Financial OU) are disregarded.

510

Chapter 7: Planning and Implementing Group Policy

EXAM ALERT Know When to Use the Two Modes of Loopback Processing Know the properties of each mode and the effects on policies received by the user. You might encounter situations such as what happens when a user from a specific OU within the company logs on to a kiosk computer.

Step by Step 7.40 shows you how to configure the loopback processing mode.

STEP BY STEP 7.40 Configuring Loopback Processing Mode 1. In the Group Policy Object Editor snap-in, navigate to Computer Configuration\Administrative Templates\System\Group Policy. 2. Right-click User Group Policy Loopback Processing Mode and choose Properties to display the User Group Policy Loopback Processing Mode Properties dialog box, as shown in Figure 7.59.

FIGURE 7.59

Configuring loopback processing.

3. Click Enabled, and in the Mode drop-down list, choose either Merge or Replace, as required. 4. Click OK or Apply.

511

Deploying the User and Computer Environment with Group Policy

Review of Group Policy User Environment Settings When configuring the user environment with Group Policy, remember these key points: . Group Policy enables you to redirect user folders such as Application Data and My

Documents to a network location where they can be easily managed and backed up. . Administrative Template settings allow you to determine what items will be available

on users’ desktops. They provide similar capabilities to those provided by Windows NT 4.0 System Policy. . By using loopback processing, you can cause local computer settings to prevail over

all Group Policy settings. This mode is useful for computers that are accessible to the public.

512

Chapter 7: Planning and Implementing Group Policy

Chapter Summary This chapter introduced you to Group Policy and its use for enforcing consistent user and computer configurations at the site, domain, and OU levels. You learned that Group Policy is applied in sets of policies called Group Policy Objects (GPOs). When GPOs are linked to different Active Directory containers, they are applied in the following sequence: local, site, domain, OU, child OU. Conflicting policy settings are applied at a later point in the sequence and override those applied earlier. GPOs can include both computer and user configurations. Computer configurations apply to all computers covered by the GPO, regardless of which user is logged on, and user configurations apply to all users covered by the GPO, regardless of which computer they are logged on to. If user and computer settings conflict, the user settings take precedence. You learned about the functions provided by Group Policy Management Console (GPMC), which provides a centralized location for managing all GPOs in the domain or forest. GPMC enables you to create and modify GPOs, their links, their precedence, their filtering, and so on. You can modify the sequence of policy application in several ways. Block Inheritance prevents policies applied at a higher level such as a domain from being enforced at a lower level such as an OU. The Enforced setting (known as No Override if GPMC is not installed) prevents policies applied at a given level from being overwritten by policies applied later in the sequence. Windows Management Instrumentation (WMI) filtering enables you to filter the application of Group Policy according to characteristics such as the operating system or hardware type of client computers. Loopback processing results in the local computer setting taking precedence over all Group Policy settings. Although you cannot apply GPOs directly to security groups, you can filter the effects of GPOs according to users’ membership in security groups. If you want the settings in a GPO to not apply to a given security group, you can deny that group the Apply Group Policy permission. Likewise, if you want the settings in a GPO to apply only to a specific security group, you can allow that group the Apply Group Policy permission and remove the Authenticated Users group from the GPO’s ACL. Many options are available for managing the user and computer environments with Group Policy. Software deployment options enable you to assign or publish software to users, or assign software to computers. Software assigned to users appears on a user’s Start menu and is installed when the user starts the application from this location or opens an associated file. Published software does not appear on the Start menu but is available for installation from the Control Panel Add or Remove Programs applet.

513

Chapter Summary

You can automatically enroll computer or user certificates using Group Policy. You can also retrieve existing certificates and renew expired certificates. User intervention is not required in most cases; indeed, the user need not know about these certificate actions except in cases in which user input is needed, such as for a smart card PIN. A large range of security settings for both users and computers is available. These settings include software restriction policies and the application of security templates. Computer-based security settings include account policies, local policies including audit policies, event logs, restricted groups, system services, Registry, file system, and IP policies. User-based folder redirection policies allow you to specify consistent locations for folders such as My Documents. This way, users’ documents are always available, regardless of what computer the users are logged on to—including when they are not connected to the network. These policies also facilitate the backup of users’ folders and the application of disk quotas. In the next chapter, we cover additional Group Policy information, including the use of RSoP and other tools to troubleshoot the application of Group Policy and the use of software policy in the updating and removal of software.

Key Terms . Administrative Templates . Assigning software . Audit policy . Block Inheritance . Certificate autoenrollment . Enforced . Folder redirection . Group Policy Container (GPC) . Group Policy Management Console (GPMC) . Group Policy modeling . Group Policy Object (GPO) . Group Policy Template (GPT) . Loopback processing mode

514

Chapter 7: Planning and Implementing Group Policy . No Override . Publishing software . Restricted Groups . Transform files . User rights . Windows Installer . Windows Management Instrumentation (WMI) . ZAP file

Apply Your Knowledge The 70-294 exam tests your knowledge of the various situations that can be encountered when planning and implementing Group Policy. You need to be aware of how Group Policy is organized and how GPOs are created, managed, and inherited through the Active Directory hierarchy. You must know how to install and configure GPMC and use this tool to deploy computer and user environments, including software installation and security policy settings. The exercises and exam questions presented here serve to reinforce these requirements. Note that you may encounter drag-and-drop or hot-spot questions on the exam. Due to the limitations of the printed page, we are unable to include questions of these types in the exam questions section. However, the explanations suggest the possibility of these question types where appropriate.

Exercises The exercises in this chapter assume that you have two computers: a Windows Server 2003 domain controller for the domain1.com domain, which we used in earlier chapters, and a client computer. The client computer can be running either Windows XP Professional or Windows Server 2003 configured as a member server. You can install this computer on the same machine that you used as a second domain controller in earlier chapters by using a dual-boot configuration. Except where indicated, you will log on as the default Administrator account, which is, by default, a member of the Domain Admins and Schema Admins groups. If you have modified these group memberships in any manner, you should reset these memberships before proceeding further.

515

Apply Your Knowledge

7.1 Creating Organizational Units, Users, and Groups In this exercise, you create OUs, users, and groups that you will use in the remaining exercises to demonstrate the features of Group Policy. Perform this exercise at the domain controller. Before you perform this exercise, you should disable the password policy you configured in exercise 5.11 of Chapter 5 if it is still in effect. Doing so allows you to use a simple password such as password for this exercise. Estimated Time: 10 minutes 1. Ensure that you are logged on as Administrator. 2. Click Start, Administrative Tools, Active Directory Users and Computers. 3. Right-click domain1.com and choose New, Organizational Unit. 4. Type Accounting as the name of the new OU and then click OK. 5. Right-click this OU and choose New, Organizational Unit. 6. Type Payable as the name of this OU and then click OK. 7. Right-click the Accounting OU and choose New, Group. Type Managers as the name of this group. Ensure that the group scope is Global and the group type is Security; then click OK. 8. Create the following users by right-clicking the indicated OU and choosing New, User. For each user, type password for the password and clear the User Must Change Password at First Logon check box. OU

First Name

Last Name

User Logon Name

Accounting

Maggie

South

MaggieS

Accounting

Darcy

Randolph

DarcyR

Payable

Diane

Stevens

DianeS

Payable

Rodney

Logan

RodneyL

Payable

Judy

Gale

JudyG

9. Right-click the Managers group and choose Properties. On the Members tab, add DarcyR and DianeS as members of this group. 10. Leave Active Directory Users and Computers open for the next exercise.

7.2 Installing the Group Policy Management Console In this exercise, you download and install GPMC for use in managing GPOs in the domain1.com domain. Perform this exercise at the domain controller while connected to the Internet. Estimated Time: 5 minutes 1. Ensure that you are logged on as Administrator. 2. Open Internet Explorer and navigate to http://www.microsoft.com/downloads/details.aspx? FamilyId=0A6D4C24-8CBD-4B35-9272-DD3CBFC81887&displaylang=en.

516

Chapter 7: Planning and Implementing Group Policy 3. Click the Download button and follow the instructions provided to download the latest version of GPMC. 4. When the download is completed, click Run, and then click Run again when you receive the Open File–Security Warning dialog box. 5. The Microsoft Group Policy Management Console with SP1 Setup Wizard starts with a Welcome page. Click Next. 6. On the License Agreement page, click I Agree and then click Next. 7. When the completion page appears, click Finish.

7.3 Creating GPOs In this exercise, you create two GPOs linked to different OUs in the domain1.com domain. These two GPOs contain settings that conflict with each other, to demonstrate policy inheritance. You also disable the Computer Configuration settings because you have not configured any policies in this node. Finally, you force the updates to the other computer. Perform this exercise from the domain controller. Estimated Time: 20 minutes 1. Click Start, Administrative Tools, Group Policy Management to open GPMC. 2. If necessary, expand the forest and domain display to locate the Accounting and Payable OUs. 3. In the console tree, select the Accounting OU. The display in the console tree should be blank because no GPOs are currently linked to this OU. 4. Right-click Accounting and choose Create and Link a GPO Here. 5. In the new GPO dialog box, type Accounting Policy as the name of the new GPO and press Enter. 6. Right-click Accounting Policy and choose Edit to open the Group Policy Object Editor snap-in. 7. Under User Configuration, expand Administrative Templates, and then click Start Menu and Taskbar. A series of policies appears in the details pane. 8. In the details pane, right-click Remove Documents Menu from Start Menu and choose Properties. 9. In the Properties dialog box that appears, select Enabled and then click OK. 10. In the details pane, select and enable the policy titled Remove Help Menu from Start Menu. 11. Click Next Setting. The next policy on the list is Remove Run Menu from Start Menu. The Properties dialog box for this policy appears. 12. Select Enabled and then click OK. You return to the Group Policy Object Editor snap-in, where you will notice that these three policies have been enabled. 13. Close the Group Policy Object Editor snap-in. 14. In the console tree of GPMC, ensure that the GPO is highlighted and that its properties are displayed in the details pane. 15. Select the Details tab, and in the GPO Status drop-down list, select Computer configuration settings disabled.

517

Apply Your Knowledge 16. A Group Policy Management dialog box asks whether you are sure you want to disable these settings. Click OK. 17. Back in the console tree of GPMC, select the Payable OU. 18. Repeat steps 4–6, naming the new GPO Accounts Payable Policy. 19. In the details pane of the Accounts Payable Policy’s Group Policy Object Editor snap-in, navigate to the User Configuration\Administrative Templates\Desktop node. 20. Right-click Prohibit Users from Changing My Documents Path and choose Properties. 21. Enable this policy and click OK. 22. In the console tree, select the Start Menu and Taskbar node. 23. In the details pane, right-click Remove Help Menu from Start Menu and choose Properties. 24. In the Properties dialog box for this policy, select Disabled. 25. Click Next Setting and disable the Remove Run Menu from Start Menu policy. Then click OK. 26. Back in the Group Policy Object Editor snap-in, you will notice the settings you have just configured are indicated in the State column. Note that these policies are in conflict with those you configured in the Accounting OU. 27. Close the Group Policy Object Editor snap-in. 28. In the console tree of GPMC, ensure that the GPO is highlighted and that its properties are visible in the details pane. 29. Select the Details tab, and in the GPO Status drop-down list, select Computer Configuration Settings Disabled, and then click OK to confirm that you want to disable these settings. 30. Close the Group Policy Management Console.

7.4 Testing GPOs In this exercise, you test the two GPOs that you created in exercise 7.3 by logging on as users from these OUs. Perform this exercise from the Windows XP or Windows Server 2003 client computer. You can also do the exercise from a Windows Server 2003 domain controller; however, you need to add the users to the domain Server Operators group to give them the right to log on locally to the domain controller. Estimated Time: 10 minutes 1. Log on as MaggieS with a password of password. 2. Click Start. Are the My Recent Documents, Help and Support, and Run menus visible on the Start menu? Why or why not?

518

Chapter 7: Planning and Implementing Group Policy 3. Log off and log back on as RodneyL with a password of password. 4. Click Start. Are the My Recent Documents, Help and Support, and Run menus visible on the Start menu? Why or why not?

5. Right-click My Documents and choose Properties. 6. Attempt to change the path in the Target text box. What happens and why?

7. Close all dialog boxes and log off.

7.5 Modifying the Inheritance of GPOs By default, GPOs are applied in the following order: local, site, domain, OU, child OU. Policy settings applied later in the sequence overwrite settings applied earlier in the sequence. You can modify this inheritance sequence by using either Block Inheritance or Enforced. In this exercise, you test the use of these options. Use both computers as indicated. Estimated Time: 15 minutes 1. Ensure that you are logged on to the domain controller as Administrator. 2. Open GPMC and, if necessary, expand the domain tree so that the Payable OU is visible. 3. Right-click the Payable OU and select Block Inheritance. 4. At the client computer or member server, log on as DianeS with a password of password. 5. Click Start. Are the My Recent Documents, Help and Support, and Run menus visible on the Start menu? Why or why not?

6. Right-click My Documents and choose Properties.

519

Apply Your Knowledge 7. Can you modify the target path? Why or why not?

8. Log off. 9. Return to the domain controller, ensuring that you are still logged on as Administrator. 10. In GPMC, right-click the Accounting Policy GPO and select Enforced. The Links section of the Scope tab in the details pane displays Yes in the Enforced column. 11. At the client computer, log back on as DianeS with a password of password. 12. Click Start. Are the My Recent Documents, Help and Support, and Run menus visible on the Start menu? Why or why not?

13. Log off.

7.6 Filtering the GPO By default, the settings in a GPO are applied to all computers and users in the container to which the GPO is linked, as well as its subcontainers. You can modify this behavior by removing the Apply Group Policy permission from a user or security group that would otherwise be subject to the policy. In this exercise, you remove this permission from users in the Managers group and then test this removal. You also remove the Enforced setting so that any conflicts introduced by this option are removed. Then you test the effects by logging on as a member of the Managers group. Do the steps from the indicated computers. Estimated Time: 15 minutes 1. Ensure that you are logged on to the domain controller as Administrator. 2. In the console tree of GPMC, right-click the Accounting Policy GPO. In the context menu, note that a check mark appears next to Enforced. Click Enforced and then notice that the check mark beside Enforced for this GPO is gone. 3. In the details pane, select the Delegation tab. 4. Click Add.

520

Chapter 7: Planning and Implementing Group Policy 5. On the Select User, Computer, or Group dialog box, type Managers in the Enter the Object Names to Select field and then click OK twice. This group is added to the list on the Delegation tab with Read displayed as the allowed permission. 6. Click the Advanced button to display the Accounting Policy Security Settings dialog box. 7. Scroll the list to locate the Managers group, select the check boxes in the Deny column beside Read and Apply Group Policy, and then click OK. 8. A Security message box warns you that Deny takes precedence over Allow and asks whether you want to continue. Click Yes. 9. At the client computer or member server, log on as DarcyR with a password of password. 10. Click Start. Are the My Recent Documents, Help and Support, and Run menus visible on the Start menu? Why or why not?

11. Log off.

7.7 Deploying Software Using Group Policy In this exercise, you publish software to the Accounting OU. Then you test its availability from the Control Panel Add or Remove Programs applet and install the package. To complete this exercise, you need a software application that is packaged as a Windows Installer .msi file. The Windows Server 2003 CD-ROM contains several software application packages that you can use for this exercise in case you do not have other packages such as Microsoft Office available. You should do these exercises from the domain controller or client computer as indicated. If you are using the Adminpak.msi package, you should have a client computer running Windows XP Service Pack 1 or later, or Windows Server 2003 as a member server. Estimated Time: 15 minutes 1. Ensure that you are logged on to the domain controller as Administrator. 2. On the C: drive, create and share a folder named Apps and copy the Adminpack.msi package from the I386 folder of the Windows Server 2003 CD-ROM to this folder. If you have another Windows Installer package you would like to use, substitute it for this package. 3. Open GPMC and select Accounting Policy under the Group Policy Objects node. 4. Right-click Accounting Policy and click Edit. 5. Navigate to the User Configuration\Software Settings\Software Installation node. 6. Right-click Software Installation and choose New, Package. 7. In the Open dialog box, use the My Network Places link to navigate to the shared folder you just created, select the package, and click Open. 8. In the Deploy Software dialog box, select Published and then click OK.

521

Apply Your Knowledge 9. Close the Group Policy Object Editor snap-in, close GPMC, and then log off. 10. At the client computer, log on as MaggieS with a password of password. 11. Click Start, Control Panel and then click Add or Remove Programs. 12. Click Add New Programs. The package you just deployed should appear. 13. Click Add to install the package. Follow the instructions in the wizard that appears to complete the installation of the package. 14. Click Start, All Programs, Administrative Tools. Note that a large number of server administration tools have been installed on this computer and are highlighted here. These tools allow you to manage Active Directory and specialized servers such as DHCP, DNS, and WINS from your client computer. 15. Log off.

Exam Questions 1. Maureen is using Group Policy to configure autoenrollment of smart card certificates. When she accessed the Certificate Templates snap-in to configure the Smartcard User certificate template, the Autoenroll permission was missing from the Security tab of the Smartcard User Properties dialog box. What does Maureen need to do to enable smart card certificate enrollment using this template?

❍

A. Obtain a certificate from a trusted third-party certification authority such as VeriSign and install this certificate on her computer.

❍

B. Ask a domain administrator to provide her with an enrollment agent certificate; then she will be able to specify the Autoenroll permission.

❍

C. Make a duplicate of the template and then configure the duplicate for autoenrollment.

❍ D. Simply give the users the Read and Enroll permissions that already exist. 2. John wants audit access to files on the shared folder \\Server7\Corpdata to determine who has been making unauthorized modifications. Which of the following does he need to do to accomplish this task? (Each answer represents part of the solution. Choose two answers.)

❏

A. Enable the Audit success for object access setting.

❏

B. Enable the Audit success for account logon setting.

❏

C. Enable the Audit success for directory service access setting.

❏ D. Configure the Corpdata shared folder for auditing. ❏

E. Configure each file in the Corpdata shared folder for auditing.

❏

F. Configure the Server7 server for auditing.

522

Chapter 7: Planning and Implementing Group Policy 3. Brent has configured several GPOs for his company’s users. The GPOs are located in the Research OU, as follows: He applied GPO1 at the domain level, specifying that users will receive the standard corporate wallpaper. He applied GPO2 at the OU level, specifying that users will not receive any standard wallpaper and that users have access to Windows Update. He specified Block Inheritance at the OU level. He applied GPO3 at the site level, specifying that access to Windows Update is removed and that account lockout will occur after four failed logon attempts. He configured this policy with the Enforced setting. Which of the following are true about users in the Research OU? Choose three answers.

❏

A. Users will receive the standard corporate wallpaper.

❏

B. Users will not receive any standard wallpaper.

❏

C. Users will be able to access Windows Update.

❏ D. Users will be unable to access Windows Update. ❏

E. User accounts will be locked out after four failed logon attempts.

❏

F. User accounts will not be locked out.

4. Anna is the systems administrator for a company that operates a single-domain Active Directory network. She is configuring the properties of several GPOs, one of which is linked to the domain, and the others are linked to various OUs including child OUs. At the domain level, she configures a Restricted Desktop GPO that removes My Network Places and Favorites from the Start menu. On the Scope tab for this policy in Group Policy Management Console, she sets the Enforced option to Yes. She also configures another GPO that disables the removal of My Network Places, links it to the IT OU, and specifies Block Inheritance so that the IT staff will be able to use My Network Places. Later, a couple of IT staffers call to complain that they cannot reach My Network Places. What is the most likely reason that they cannot reach My Network Places?

❍

A. Enforced takes precedence over Block Inheritance.

❍

B. Block Inheritance takes precedence over Enforced.

❍

C. When these options are both set, they cancel each other out.

❍ D. The policies that Anna configured at the OU level were ignored as these options can be set only at the site or domain level. 5. Jennifer is responsible for creating and deploying GPOs to her company’s computers. Her company’s network is configured as a single Active Directory domain. She uses a test lab in a separate forest to create and test a GPO containing security settings that is to be applied to all computers in the domain.

523

Apply Your Knowledge Jennifer needs to implement the security settings to all computers in the domain with the least amount of administrative effort. How should she proceed?

❍

A. In the Group Policy Management Console, create a new GPO linked to the domain, and configure the same settings in this GPO as were configured in the test forest.

❍

B. Copy the Group Policy Template (GPT) files in the SYSVOL shared folder in the test lab to the SYSVOL shared folder in the domain.

❍

C. Configure Distributed File System (DFS) to replicate the SYSVOL shared folder from the test lab to the domain.

❍ D. Using Group Policy Management Console (GPMC) in the test lab, back up the GPO. Then import this GPO into the domain. 6. Grant is responsible for a Windows Server 2003 member server named PrintSvr. This server is a print server that is configured with five printers that point to print devices in a central location of his company’s floor in a Chicago office tower. This server has a local group named PrintMgrs, which has the capability to manage the printers. Grant has received complaints that a user named Phil has been modifying the properties of the printers with the result that others cannot use the color laser print device designed for producing promotional materials. On checking the membership of the PrintMgrs group, Grant found that Phil’s account had been added to the group. He removed this account but discovered the next day that the account had again been added to the group. What does Grant need to do so that Phil cannot add his user account to the PrintMgrs group?

❍

A. Create a local policy that enables auditing of success for account management events.

❍

B. In the default domain GPO, configure auditing of success for account management events.

❍

C. In the default domain GPO, add the PrintSvr\PrintMgrs group as a restricted group.

❍ D. Replace the PrintMgrs group with a domain local group and then add this group as a restricted group in the default domain GPO. 7. Alex is a systems administrator for one branch of a government defense department that deals with protecting the country’s top-secret defense strategies. The branch’s network is configured as a single Active Directory domain. The branch’s servers have been the victim of several recent attacks by unauthorized individuals. To improve security, Alex’s manager has requested that the Administrator account on all computers in the branch be renamed. How can Alex rename this account on all computers with the least amount of administrative effort?

❍

A. Create a startup script to rename the Administrator accounts and place it in the default domain GPO.

❍

B. Use a GPO that is linked to the domain to rename the Administrator accounts.

524

Chapter 7: Planning and Implementing Group Policy

❍

C. Manually rename the Administrator account at each computer in the branch.

❍ D. Manually rename the Administrator account at each domain controller in the branch. 8. Teresa is the network administrator for Quepublishing.com, which operates an Active Directory network consisting of a single domain in which all servers run Windows Server 2003 and all client computers run Windows XP Professional. Teresa needs to deploy a design application to all users in the Engineering department. These users have accounts in the Engineering OU. Teresa copies the installation files, including a .msi file, to a shared folder on a network server. She creates a GPO linked to the Engineering OU and configures this GPO to deploy the application. Teresa needs to ensure that the application is installed and ready for use as soon as a user logs on to a computer in the Engineering department. Users should see only minimal activity as the application installs. She also needs to prevent users from continuing to use the application if their account is moved to a different OU. Teresa right-clicks the application and chooses Properties, and she then selects the Deployment tab. Which of the following options should she select in order to configure the application to meet these requirements? Choose all that apply.

❏

A. Deployment Type—Published

❏

B. Deployment Type—Assigned

❏

C. Uninstall This Application When it Falls Out of the Scope of Management

❏ D. Do Not Display This Package In the Add/Remove Programs Control Panel ❏

E. Install This Application at Logon

❏

F. Installation User Interface Options—Basic

❏ G. Installation User Interface Options—Maximum 9. Marion is the systems administrator for a company that maintains a single-domain Active Directory network with OUs corresponding to the Accounting, Sales, Marketing, Design, and Legal departments. She has created GPOs for each OU as well as settings in the Default Domain Policy GPO. The GPO for the Design OU specifies that folders for all users will be redirected to a shared folder on the DesSvr server, which is a member server in the Design department. After Marion applied the GPOs, designers complained that they no longer were able to access customizations they had created for Adobe Illustrator and Adobe Photoshop. Which of the following folder redirection policy settings is at fault?

❍

A. Application Data

❍

B. Desktop

525

Apply Your Knowledge

❍

C. My Documents

❍ D. My Pictures ❍

E. Start Menu

10. You have successfully installed and configured an enterprise root CA for your company, which operates a single Active Directory domain, and you have also configured a certificate template for autoenrollment. What additional tasks do you need to perform to enable autoenrollment of user certificates? (Each answer represents part of the solution. Choose two answers.)

❏

A. Install an enterprise subordinate CA.

❏

B. Install Internet Information Services (IIS) 6.0 on the CA.

❏

C. Configure the CA to issue certificates based on the template you have just configured.

❏ D. Configure a certificate trust list (CTL). ❏

E. Configure a GPO linked to the domain to enroll certificates automatically.

11. Managers at Shelley’s company have requested that she configure all computers used by data entry clerks so that they are unable to access the Internet. However, data entry supervisors need access to the Internet. All computers used by both data entry clerks and supervisors run either Windows 2000 Professional or Windows XP Professional. All members of the data entry team belong to the Data Entry security group, and data entry supervisors also belong to the Supervisors security group. Which of the following should Shelley do to accomplish this objective?

❍

A. Create one GPO that disables Internet access and grant the Data Entry group the Read and Apply Group Policy permissions.

❍

B. Create one GPO that disables Internet access and grant the Data Entry group the Read and Apply Group Policy permissions. Grant the Supervisors group the Read permission only on this GPO.

❍

C. Create one GPO that disables Internet access and grant the Data Entry group the Read and Apply Group Policy permissions. Also, deny the Supervisors group the Apply Group Policy permission on this GPO.

❍ D. Create two GPOs: one to disable Internet access and the other to enable Internet access. Grant the Data Entry group the Read and Apply Group Policy permissions on the first GPO and grant the Supervisors group the Read and Apply Group Policy on the second GPO.

526

Chapter 7: Planning and Implementing Group Policy 12. Bertha is the systems administrator for a company that runs a native mode Active Directory network that consists of a single domain named widgets.com. The company employs a large number of interns each summer and a smaller number of interns in the fall and winter months; these interns are students in a co-op computer science program from a nearby university. Several of the interns have performed actions on their computers that have caused instabilities in their systems, and in fact, the operating system had to be reinstalled on many of these systems. Bertha decided that she needs to restrict access to several parts of the system such as the Registry editor and portions of Control Panel, but she wants to enforce this policy to only the interns. All interns are members of a global security group called Interns. This group is located in the default Users container within the domain, but Bertha could move it to another location if necessary. She creates a new GPO that contains the appropriate restrictions for the interns. Which of the following ways could she use to apply this GPO so that only the interns would be affected by it? Each answer represents a complete solution to the problem. Choose two answers.

❏

A. Link the new GPO to the domain. Then deny the Apply Group Policy permission to the Authenticated Users group and remove the Interns group from this group.

❏

B. Link the new GPO to the domain. Then grant the Apply Group Policy permission to the Interns group and remove the Authenticated Users group from the GPO’s ACL.

❏

C. Create a new domain local security group named Interns and add the Interns global group to this group. Link the new GPO to this group.

❏ D. Create a new OU named Interns and move all the interns’ user accounts into this OU. Link the new GPO to this OU. 13. Gordon is a junior administrator for a large continentwide company whose Active Directory network contains a single domain with six sites and eight OUs. The IT manager has assigned Gordon the responsibility of administering the Marketing OU, and he has been provided with the Full Control permission for this OU. He needs to configure a GPO for deployment of a specialized application to all desktops in the Marketing department of each office in the company. The application is to be available to all users who access computers in this department, regardless of which OU their user accounts are located in. It is not to be available to users who access computers that are not located in the department, even if the users themselves are employed in the Marketing department. Which of the following steps should Gordon take to deploy this application?

❍

A. He should create a GPO that is linked to the Marketing OU. He should then edit the GPO and add a Windows Installer package for the application under the User Configuration\Software Settings\Software Installation node. On the Deploy Software dialog box, he should select Assigned.

❍

B. He should create a GPO that is linked to the Marketing OU. He should then edit the GPO and add a Windows Installer package for the application under the User Configuration\Software Settings\Software Installation node. On the Deploy Software dialog box, he should select Published.

527

Apply Your Knowledge

❍

C. He should create a GPO that is linked to the Marketing OU. He should then edit the GPO and add a Windows Installer package for the application under the Computer Configuration\Software Settings\Software Installation node. On the Deploy Software dialog box, he should select Published.

❍ D. He should create a GPO that is linked to the Marketing OU. He should then edit the GPO and add a Windows Installer package for the application under the Computer Configuration\Software Settings\Software Installation node. On the Deploy Software dialog box, he should select Assigned. 14. Charles works for a multinational organization that is headquartered in Atlanta and has branch offices in London, Frankfurt, Rome, Athens, Sydney, and Los Angeles. The organization is operating a single-domain Active Directory forest. His chief information officer has negotiated an arrangement to use Microsoft Office 2003 throughout the organization as the corporate standard office productivity suite. The deployment is to meet the following standards: . Microsoft Office 2003 will be installed on all desktop computers throughout the organization. . The company’s research department at the headquarters will not have Office 2003 installed on its computers because its documents require a third-party office suite with a specialized add-on component. These computers are all located in the Research OU. . Localized dictionaries and interfaces are to be available in every office. Charles will be using Group Policy to deploy the software. Which of the following tasks does Charles need to do to satisfy these requirements? Each answer represents part of the solution. Choose three answers.

❏

A. Create GPOs linked to each site that assign the software to computers.

❏

B. Create a GPO linked to the domain that assigns the software to computers.

❏

C. Create transform files for each required localized version and add them to the package configured for each site.

❏ D. Create a transform file that includes all localized versions and add this file to the domain-based GPO.

❏

E. Specify Block Inheritance at the Research OU.

❏

F. Specify Block Inheritance at the Atlanta site.

❏ G. Specify the Enforced option in the policy in effect at the Atlanta office.

528

Chapter 7: Planning and Implementing Group Policy 15. When you want to use Group Policy to deploy software that does not come with a Windows Installer .msi package file, one option available is to use a .zap file. Which of the following advantages of .msi package files are not available when you use a .zap file to deploy software? Choose all that apply.

❏

A. Software packages deployed with .zap files are not resilient.

❏

B. .zap files cannot be published to users; they can only be assigned.

❏

C. You cannot specify a category in which the software will appear in Control Panel Add or Remove Programs.

❏ D. You cannot modify .zap files with transform files. ❏

E. You cannot roll back unsuccessful installations or modifications when you use .zap files.

Answers to Exercises 7.4

Testing GPOs 2. None of these items are present. Because MaggieS is a member of the Accounting OU, the policies you configured for this OU prevent these items from appearing on the desktop. 4. The Help and Support and the Run menus appear on the Start menu, but the My Recent Documents menu does not. Because RodneyL is a member of the Payable OU, which is a child of the Accounting OU, the policies applied to the Payable OU override those applied to the Accounting OU. Because the Remove Documents menu from Start Menu policy was not configured for the Payable OU, this policy as applied to the Accounting OU still is enforced. 6. You cannot modify this path because the Accounts Payable Policy GPO contains a policy prohibiting users from modifying it.

7.5

Modifying the Inheritance of GPOs 5. Yes, these items are present because the policies blocking their display in the Accounting OU were blocked from the Payable OU by using Block Inheritance. 7. No, you cannot modify the target path because this was prohibited at the Payable OU level, so this policy still applies. 12. No, these items are not visible. They were both hidden at the Accounting Policy GPO level. Although the options to hide the Help and Run menus were disabled at the Accounts Payable Policy GPO level, the use of Enforced at the Accounting Policy GPO level prevented the conflicting policy at the child OU level from applying.

529

Apply Your Knowledge

7.6

Filtering the GPO 10. Yes, these icons are visible because the policy hiding them was not applied to members of the Accountants security group, of which Darcy Randolph is a member.

Answers to Exam Questions 1. C. In this scenario, Maureen has accessed a version 1 certificate template, which was first supplied with Windows 2000 and does not support autoenrollment. If she makes a duplicate of the certificate, the duplicate is created in version 2 and does support autoenrollment. She does not need a certificate from an external CA, so answer A is incorrect. She also does not need an enrollment agent, so answer B is incorrect. The Enroll permission available with version 1 certificates is insufficient to permit certificate autoenrollment, so answer D is incorrect. See the section “Enrolling User and Computer Certificates with Group Policy.” 2. A, D. Auditing of files and folders is a two-step process. John needs to configure the auditing of object access, which he can do using Group Policy. John also needs to configure auditing of the folder that contains the files to be audited, which he can do from My Computer or Windows Explorer. Account logon tracks users logging on and off but does not track file and folder access, so answer B is incorrect. Directory service access tracks access of an object in Active Directory that has a system access control list (SACL) specified, but not a file or folder, so answer C is incorrect. You could specify auditing for each file in the Corpdata shared folder, but this takes extra administrative effort, so answer E is incorrect. You cannot audit a server directly, so answer F is incorrect. See the section “Configuring Security Settings with Group Policy” for more information. 3. B, D, F. GPO2 specifies that users will not receive the standard wallpaper. Because OU-based GPOs apply after site- and domain-based GPOs, this GPO will prevail and users will not receive the wallpaper, so answer A is incorrect. Block Inheritance was immaterial in this scenario. GPO3 specifies that access to Windows Update is removed. This GPO was configured with the Enforced setting. Because Enforced takes precedence over Block Inheritance, this portion of GPO3 prevails over GPO1, and users will be unable to access Windows Update, so answer C is incorrect. However, because account lockout policy is part of account policy and can be applied only at the domain level, account lockout does not occur. Therefore answer E is incorrect. See the sections “Modifying Group Policy Inheritance” and “Configuring Security Settings with Group Policy.” 4. A. When both of these options have been set, Enforced takes precedence over Block Inheritance; the latter works only when Enforced has not been specified. Consequently, as Anna removed My Network Places at the domain level and specified the Enforced option, this prevents the OU-level policy that prevents hiding My Network Places from taking effect. Block Inheritance does not take precedence over Enforced; neither do the options cancel each other out, so answers B and C are incorrect. These options can be set at any level (site, domain, or OU), so answer D is incorrect. See the section “Modifying Group Policy Inheritance” for more information.

530

Chapter 7: Planning and Implementing Group Policy 5. D. Jennifer should use GPMC to back up the GPO in the test lab, and then import it to the domain. The capability to back up, restore, and import GPO settings is one of the new features included in GPMC that facilitates Group Policy management. Because she can import the GPO in this manner, she does not need to re-create all settings in a new GPO linked to the domain, so answer A is incorrect. Neither copying the GPT files nor using DFS replication would copy the GPO to the production domain, so answers B and C are incorrect. See the section “Backing Up and Restoring GPOs.” 6. C. Grant can include local groups from member servers or client computers in the Restricted Groups node of Group Policy. He can simply add the group and specify the user accounts of those who are entitled to manage the printers. When this is done, Phil will be unable to add himself to this group. Auditing of account management events will tell Grant who is modifying group management, but it will not stop the action from taking place, so answers A and B are incorrect. Grant could replace the local group with a domain local group and achieve the same result; however, this approach takes additional administrative effort and is therefore not the best choice. So, answer D is incorrect. See the section “Restricted Groups” earlier in this chapter. 7. B. The easiest way for Alex to rename the Administrator account on all computers is to use a GPO that is linked to the domain. He can do this by going to the Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options node and specifying the required name in the Accounts: Rename Administrator Account policy. The new name that he has provided will be applied to each computer the next time it is restarted or a logon event occurs. Alex could use a startup script to perform this task; however, because this policy is provided, he does not need to write a script, so answer A is incorrect. He could rename the Administrator account at each computer in the branch; however, this would take far more administrative effort than configuring the GPO, so answer C is incorrect. Manually renaming the account at each domain controller would not accomplish the required task because this change affects only the domain controllers, and not the client computers or member servers, so answer D is incorrect. See the section “Security Options” earlier in this chapter. 8. B, C, E, F. Teresa needs to select the following options: First she needs to change the deployment type to Assigned and select the Install This Application at Logon option. These two actions ensure that the application is installed to the computers used by all Engineering users when they first log on. She then needs to select the Uninstall This Application When It Falls Out of the Scope of Management option. Doing so removes the application if the users are moved to a different OU. She also needs to select the Basic installation user interface option because users should only see minimal activity during installation, and do not need to provide information during installation. She should not select the Published deployment type, so answer A is incorrect. She does not need to select the Do Not Display This Package in the Add/Remove Programs Control Panel option to achieve the required objectives, so answer D is incorrect. She should not select the Maximum installation user interface option, so answer G is incorrect. Note that on the exam, a question similar to this could appear as a “hot spot” question or as a live dialog box, in which you are required to select the correct options on the dialog box presented. See the section “Software Package Properties.” 9. A. The Application Data folder stores files that contain personalized information for users’ applications, including both Microsoft and non-Microsoft programs. If the contents of this folder have become inaccessible due to a folder redirection problem, users will not have their customized

531

Apply Your Knowledge settings. None of the other folders contain this type of data, so answers B, C, D, and E are all incorrect. Note that you cannot redirect the My Pictures folder by itself; you specify options for this folder when redirecting the My Documents folder. See the section “Implementing Folder Redirection.” 10. C, E. These two steps are the minimum necessary requirements for completing the procedure for enabling autoenrollment of user certificates. Although companies should install an enterprise subordinate CA and take the root CA offline to prevent its compromise, installing the subordinate CA is not necessary, so answer A is incorrect. IIS is needed only if you need to use the certificate enrollment web pages, which are not needed during autoenrollment; therefore, answer B is incorrect. A CTL is a signed list of trusted root CA certificates considered as reputable for purposes such as client authentication or secure email. It is not needed for certificate autoenrollment, so answer D is incorrect. See the section “Enrolling User and Computer Certificates with Group Policy.” 11. C. In this scenario, the data entry supervisors are members of both the Data Entry and Supervisors groups. To enable the data entry supervisors to access the Internet, Shelley needs to deny the Supervisors group the Apply Group Policy permission. If she simply grants the Data Entry group the Read and Apply Group Policy permissions, the data entry supervisors will be unable to reach the Internet because of their membership in the Data Entry group, so answers A and B are incorrect. Answer D would work if the GPOs are arranged so that the supervisors’ GPO is applied after the data entry GPO; however, this approach takes more administrative effort and is therefore not the best solution. See the section “Filtering the Effects of a GPO.” 12. B, D. By creating a new OU and placing all interns’ user accounts in this OU, Bertha can create a GPO linked to the OU that specifies the restrictions she needs to enforce. She can also accomplish her objective by ensuring that only the Interns group has the Apply Group Policy permission to a GPO linked to the domain. However, all users who authenticate to a domain controller automatically belong to the Authenticated Users, so Bertha cannot remove the interns from this group, which makes answer A incorrect. Linking a GPO to a security group is not possible, so answer C is incorrect. See the sections “Planning the Application of Group Policy” and “Filtering the Effects of a GPO.” 13. D. Gordon needs to assign the software package to computers in the Marketing OU because of the requirement for it to be available to all computers in this department, regardless of the computer to which users log on, and that it not be available to computers that are not located in the department. If he were to either assign or publish the package to users, it could become available on computers located outside the Marketing department should users from this department log on to these computers; therefore, answers A and B are incorrect. It is not possible to publish software to computers, so answer C is incorrect. See the section “Software Installation Using Group Policy” for more information. 14. A, C, E. To deploy the software package to all locations together with the appropriate transform, Charles needs to create GPOs linked to each site and apply the transforms individually to the sites where they are required. Placing the transforms in a single GPO would not create localized versions of the software, but rather a single version with all languages available at all sites; therefore, answers B and D are incorrect. Charles needs to specify Block Inheritance at the Research OU, and not at the site (which, in fact, is not possible), so answer F is incorrect. Using the Enforced option would have the opposite effect of what is intended, so answer G is incorrect. See the sections “Software Installation Using Group Policy” and “Modifying Group Policy Inheritance.”

532

Chapter 7: Planning and Implementing Group Policy 15. A, D, E. When you use .zap files to deploy software, the software packages are not resilient. Also, you cannot use transform files to modify .zap files, nor can you roll back unsuccessful installations. In addition, packages installed with .zap files do not install with elevated privileges. However, you can either assign or publish software packages, so answer B is incorrect. You also can specify software installation categories, so answer C is incorrect. See the section “ZAP files” for more information.

Suggested Readings and Resources 1. Mar-Elia, Darren. The Definitive Guide to Windows 2000 Group Policy. Santa Rosa, CA:

Realtime Publishers. 2. Melber, Derek. Security Configuration Wizard in Windows Server 2003 Service Pack

1. http://www.windowsecurity.com/articles/Security-Configuration-Wizard-WindowsServer-2003-SP1.html. 3. Microsoft Corporation. “Active Directory Collection.” http://technet2.microsoft.com/

WindowsServer/en/library/6f8a7c80-45fc-4916-80d9-16e6d46241f91033.mspx? mfr=true. 4. Microsoft Corporation. “Administering Group Policy with the Group Policy

Management Console.” http://www.microsoft.com/downloads/details.aspx? FamilyID=D8291B79-922A-439C-88E9-54041A2953DD&displaylang=en. 5. Microsoft Corporation. “Certificate Autoenrollment in Windows Server 2003.”

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/ security/autoenro.mspx. 6. Microsoft Corporation. “Enterprise Management with the Group Policy Management

Console.” http://www.microsoft.com/windowsserver2003/gpmc/default.mspx. 7. Microsoft Corporation. “Group Policy.” http://www.microsoft.com/windowsserver2003/

technologies/management/grouppolicy/default.mspx. 8. Microsoft Corporation. “How to Use Group Policy to Remotely Install Software in

Windows Server 2003.” http://support.microsoft.com/kb/816102. 9. Microsoft Corporation. “Windows Server 2003 Security Guide.” http://

www.microsoft.com/downloads/details.aspx?familyid=8A2643C1-0685-4D89-B655521EA6C7B4DB&displaylang=en.

8

CHAPTER 8

Managing Group Policy Objectives This chapter covers the following Microsoft-specified objectives for the Planning and Implementing Group Policy and Managing and Maintaining Group Policy sections of the Windows Server 2003 Active Directory Infrastructure exam:

Plan Group Policy strategy . Plan a Group Policy strategy by using Resultant Set of Policy (RSoP) plan-

ning mode . Resultant Set of Policy (RSoP) is an important new tool that helps you plan the effects of a series of GPOs on users and computers. You will be tested on when and how to use RSoP to plan the computer and user environment.

Troubleshoot issues related to Group Policy application. Tools might include Resultant Set of Policy (RSoP) and the Gpresult command. . A given user at a given computer might be affected by a complex number of Group Policies that specify settings that conflict with one another. You might be called on to troubleshoot the application of policies to users when the expected results do not appear. This objective tests your knowledge of two new tools, RSoP and Gpresult, for troubleshooting the application of Group Policy.

Maintain installed software by using Group Policy . Distribute updates to software distributed by Group Policy . Configure automatic updates for network clients by using Group Policy . Software deployment does not end with the publication or assignment of software using Group Policy. Software vendors produce upgrades, patches, hotfixes, and other modifications to their packages from time to time. Group Policy provides the means to upgrade and redeploy software packages, as well as use transform and patch files. It also enables you to specify the conditions for automatic updating of network client computers from the Windows Update site. This objective tests your knowledge of the use of Group Policy for software updating.

Troubleshoot the application of Group Policy security settings. Tools might include RSoP and the Gpresult command. . Computer and data security is of increasingly high importance in this age of computer espionage, hacking, virus proliferation, and so on. Windows Server 2003 has improved on the security settings provided with Group Policy. This objective tests your ability to use RSoP and Gpresult in troubleshooting security settings.

Outline Introduction

536

Resultant Set of Policy

536

RSoP Planning Mode

537

Running RSoP Planning Mode from Active Directory Users and Computers Running RSoP Planning Mode from Active Directory Sites and Services

538

543

Running RSoP Planning Mode from the Group Policy Management Console

544

Running RSoP Planning Mode from Its Own Console

547

Maintaining Software with Group Policy

570

Distributing Updates to Software Installed Using Group Policy

570

Use of Group Policy to Upgrade Applications

570

Use of Transform Files to Modify Software Packages

572

Redeployment of Upgraded Software

574

Use of Group Policy for Software Removal

576

Configuring Automatic Updates for Network Clients Using Group Policy

577

548

RSoP and Software Installation Using Group Policy

580

Running RSoP in Logging Mode from the Run Dialog Box

549

Group Policy Application Upgrade Review

580

Running RSoP Logging Mode from Active Directory Users and Computers

550

Running RSoP Logging Mode from Its Own Console

552

RSoP Logging Mode

Troubleshooting Group Policy Security 581

Running RSoP Logging Mode from Group Policy Management Console

554

Analyzing the RSoP Results

556

Saving RSoP Data

559

Problems Encountered in Running RSoP in Logging Mode

560

Gpresult

Other Tools for Troubleshooting Group Policy

562

Use of RSoP to Troubleshoot Group Policy Security Settings

582

Other Possible Security-related Problems

584

Use of Gpresult to Troubleshoot Group Policy Security Settings

584

Best Practices When Troubleshooting Group Policy Settings

585

Chapter Summary Key Terms

566

Gpupdate

566

Gpotool

567

Advanced System Information

567

RSoP and Gpresult Review

569

581

Use of Security Templates

Apply Your Knowledge Exercises

586 587 587 588

Exam Questions

596

Answers to Exercises

601

Answers to Exam Questions

603

Suggested Readings and Resources

606

Study Strategies . The best way to master RSoP and Gpresult is to set up a test domain with at least one client computer in addition to the server. Practice with these computers and complete the Step by Steps and the end-of-chapter exercises until you fully understand what these tools are doing. Be sure that you know how to predict the effect of multiple GPOs by using the Resultant Set of Policy tool in planning mode. . Practice as much as you can. Create a series of Group Policy Objects (GPOs) linked to different Active Directory containers, as well as one or more users in different organizational units (OUs) and security groups. Configure options you learned about in the preceding chapter, such as Group Policy filtering. Then run RSoP and Gpresult and compare their results to the policies you have configured. Make changes to the application of the policies (for example, by using the Block Inheritance or the Enforced option) and then repeat the application of RSoP and Gpresult. Look for errors or irregularities in the application of Group Policy and try to determine the reasons for their occurrence. . Understand the available methods for updating existing software deployments and what you can do with each one. Know when you would apply transformations or patches, and when to redeploy a software package. Also, know the available options for software package removal. . Create a few security-based policies and test their application using RSoP (both planning and logging mode) and Gpresult.

536

Chapter 8: Managing Group Policy

Introduction Chapter 7, “Planning and Implementing Group Policy,” introduced you to the workings of Group Policy and its application to various Active Directory containers, as well as to many of the policies that you can apply to users and computers throughout your network. That chapter also introduced you to the use of Group Policy in the field of software deployment. You learned how to create and deploy Group Policy Objects (GPOs) using the Group Policy Management Console (GPMC). You have seen how Group Policy can be applied to local computers, sites, domains, OUs, and child OUs, and how this sequence can be modified. The possibility of applying conflicting policy settings to different Active Directory containers noticeably raises the chance of error in applying policies. In Windows 2000, you had to work through the policy settings or apply third-party tools to troubleshoot unexpected or incorrect policy application. In this chapter, you learn how new tools included with Windows Server 2003 facilitate the troubleshooting of Group Policy as applied to desktop configurations and security settings. Software deployment does not end with the installation of packages using Group Policy. In this chapter, you also learn about the methods available for upgrading, patching, and redeploying software packages so that your users always have the latest versions of software they need to do their jobs properly and efficiently.

Resultant Set of Policy As you saw in Chapter 7, Group Policy is an all-encompassing, powerful tool that enables you to configure a very large number of settings that affect users and computers in your network. You can easily create a large number of GPOs, link them to sites, domains, and OUs, and then modify their application by using options such as Block Inheritance and Enforced, or filtering their application to security groups or by using Windows Management Instrumentation (WMI) filters. In Windows 2000, it was usual for administrators to log on to a client computer using a test account and then observe what happened. Because of the complexity of Group Policy, it was not uncommon to find that settings were not applied as intended. In many cases, an administrator had to print out settings that were applied at the local, site, domain, and OU levels and work through them—including checking for the application of Block Policy Inheritance and No Override (which is what the Block Inheritance and Enforced options are known as in Windows 2000 as well as in Windows Server 2003 before installing GPMC).

537

Resultant Set of Policy

RSoP queries computers running Windows XP Professional or Windows Server 2003 and informs you of which policies have been applied and in what order. RSoP can be run in either planning mode or logging mode: . Planning mode—You can use RSoP to perform a “what if” scenario to predict the

effects of a proposed series of policies on a specified user/computer combination. This mode is also known as Group Policy Modeling. . Logging mode—For a case in which a user has logged on to a specific computer, this

mode obtains information on policy application for the specific user/computer combination. In other words, it analyzes and reports on your existing Group Policy settings. This mode is also known as Group Policy Results.

RSoP Planning Mode Objective

Plan Group Policy strategy . Plan a Group Policy strategy by using Resultant Set of Policy (RSoP) planning mode

RSoP planning mode simulates the effect of a proposed series of policies on a specified user/computer combination before the specified user has logged on. In other words, it performs a “what if” analysis and reports on the policy settings you would have if you configured the settings you have specified while running RSoP.

EXAM ALERT RSoP Modes Be aware of the differences between the two modes of RSoP and when to use each of them. You might be asked to choose between planning and logging mode for a specified scenario.

Besides running RSoP for individual users and computers, you can run RSoP planning mode queries for sites, domains, and OUs. Just as you cannot apply policies directly to security groups, you cannot run RSoP queries on security groups. You can run RSoP from Active Directory Users and Computers, or you can install the RSoP snap-in in a custom MMC console. You can also run RSoP directly from GPMC. For site-based queries, you can also run RSoP from Active Directory Sites and Services.

538

Chapter 8: Managing Group Policy

RSoP planning mode is useful in the following situations: . Simulating the effect of a series of policy settings on a computer or user according to

the site, domain, or OU in which the computer or user is located . After creating a new user or security group account in Active Directory, or making

changes to security group membership . Predicting the effect of moving a computer or user to a different site or OU . Simulating the effect of a slow network connection . Simulating a loopback condition

NOTE Windows 2000 Computers Although Windows 2000 does not include RSoP, you can use RSoP to simulate the effect of Group Policy on domain computers running Windows 2000.

The following are four methods you can use to run RSoP in planning mode: . From Active Directory Users and Computers—Allows you to simulate the effect

of policies applied to a domain or OU. . From Active Directory Sites and Services—Allows you to simulate the effect of

policies applied to a site. . From Group Policy Management Console—GPMC includes a Group Policy

Modeling node that enables you to simulate the effect of policies applied to a site, domain, or OU. This method includes a newer version of the RSoP Wizard. . From its own console—Allows you to create a custom MMC console containing the

RSoP snap-in and start the RSoP Wizard to specify the user and computer to be processed.

Running RSoP Planning Mode from Active Directory Users and Computers To use Active Directory Users and Computers to run RSoP in planning mode, you need to be logged on as a member of the Domain Admins or Enterprise Admins group, or be granted the Generate Resultant Set of Policy (Planning) right. Then follow Step by Step 8.1.

539

Resultant Set of Policy

STEP BY STEP 8.1 Using Active Directory Users and Computers to Run RSoP in Planning Mode on a Domain or OU 1. In Active Directory Users and Computers, right-click the domain or OU you want to use and select All Tasks, Resultant Set of Policy (Planning), as shown in Figure 8.1. This selection starts the Resultant Set of Policy Wizard.

Accessing the Resultant Set of Policy Wizard from Active Directory Users and Computers.

FIGURE 8.1

2. On the User and Computer Selection page, shown in Figure 8.2, you can select a specific user and/or computer to test a planning scenario or accept the container information supplied according to the Active Directory object you selected. Accept these settings or select a specific user and/or computer as required, and then click Next.

Entering user and computer information into the Resultant Set of Policy Wizard.

FIGURE 8.2

540

Chapter 8: Managing Group Policy

NOTE A Shortcut in the RSoP Wizard If you do not need to specify additional RSoP settings, you can select the Skip to the Final Page of the Wizard Without Collecting Additional Data check box at any step of the wizard.

3. On the Advanced Simulation Options page, shown in Figure 8.3, you can specify the following additional policy implementation controls: . Slow Network Connection—RSoP simulates connecting over a slow connection such as a dial-up line and ignores policies that are configured not to apply over a slow connection. . Loopback Processing—You can invoke the loopback processing mode described in Chapter 7, including the Replace and Merge options. . Site—You can choose an Active Directory site whose policies you want included in your simulation or choose (None) to not include any sites in the simulation.

FIGURE 8.3

Specifying advanced RSoP simulation

options.

4. Specify the required options on this page and then click Next to display the User Security Groups page. 5. This page enables you to simulate changes to the selected user’s security groups. Click Add to display the Select Groups dialog box and then type or browse to the required group(s), as shown in Figure 8.4. When you’re done, click OK and then click Next.

541

Resultant Set of Policy

FIGURE 8.4

Specifying user security groups.

6. On the Computer Security Groups page, you can include the selected computer in security groups. This page functions the same as the User Security Groups page. When you’re finished with this page, click Next. 7. On the WMI Filters for Users page, you can include Windows Management Instrumentation (WMI) filters in the simulation. To include selected filters, click the Only These Filters option and then click List Filters to locate the filters you want to include (see Figure 8.5). Then click Next.

FIGURE 8.5

Specifying WMI filters for users.

8. The WMI Filters for Computers page performs the same task for computers as the WMI Filters page does for users. Perform the same tasks as in step 7 and then click Next. 9. The Summary of Selections page provides a summary of options you have selected while running the wizard (see Figure 8.6). If any of these settings are incorrect, click Back to change them. If you do not require extended error information, clear the check box provided. When you’re finished, click Next to process your selections.

542

Chapter 8: Managing Group Policy

The Summary of Selections page summarizes the information you provided to the RSoP Wizard.

FIGURE 8.6

10. The wizard displays a progress bar as it processes your selections. This process may take a minute or two. When the wizard is finished, it displays a completion page. Click Finish. 11. After you have completed the RSoP Wizard, it displays a Resultant Set of Policy snap-in that looks similar to the Group Policy Object Editor snap-in. 12. To view the effect of applied GPOs, expand the desired node in the console tree. As you can see in Figure 8.7, only the subnodes for which policies have been configured appear.

The RSoP snap-in displays only those policies for which GPOs are configured.

FIGURE 8.7

543

Resultant Set of Policy 13. To view the hierarchy of any configured policy, right-click it and choose Properties. The Properties dialog box displayed is similar to that obtained for any policy in the Group Policy Object Editor, except that you cannot modify the settings on the Setting tab. In addition, the dialog box contains a Precedence tab. 14. Select the Precedence tab to display the GPOs for which this policy was configured. As shown in Figure 8.8, these GPOs appear with the priorities ascending from bottom to top. This arrangement enables you to determine which GPO will enforce the setting that will apply to the selected user/computer combination.

The Precedence tab displays GPOs for which the policy is configured with the highest priority setting at the top. FIGURE 8.8

TIP Speeding Up the Wizard If you do not need to enter information into additional wizard pages, you can select the check box labeled Skip to the Final Page of This Wizard Without Collecting Additional Data. This advances you directly to the Summary of Selections page.

Running RSoP Planning Mode from Active Directory Sites and Services To use RSoP to test site-based policies, follow the procedure outlined in Step by Step 8.2.

544

Chapter 8: Managing Group Policy

STEP BY STEP 8.2 Using Active Directory Sites and Services to Run RSoP in Planning Mode on a Site 1. In Active Directory Sites and Services, right-click the desired site and choose All Tasks, Resultant Set of Policy (Planning). 2. In the Resultant Set of Policy Wizard, specify the required user and computer information. Either type the information or click Browse to locate the required Active Directory container, as shown in Figure 8.9.

FIGURE 8.9

Browsing for the appropriate Active Directory container.

3. Follow steps 3 to 14 in Step by Step 8.1 to complete the RSoP Wizard and display its results.

Running RSoP Planning Mode from the Group Policy Management Console GPMC provides a Group Policy Modeling node from which you can perform RSoP planning mode queries on any site, domain, or OU configured to display in GPMC. Note that a server running Windows Server 2003 must be present; if you have added a forest containing only Windows 2000 domain controllers to GPMC, the Group Policy Modeling node does not appear. Follow Step by Step 8.3 to perform an RSoP planning mode query from GPMC:

545

Resultant Set of Policy

STEP BY STEP 8.3 Using GPMC to Run RSoP in Planning Mode 1. Open GPMC and, if necessary, expand the forest display to locate the Group Policy Modeling node. 2. Right-click this node and choose Group Policy Modeling Wizard. This wizard starts with a welcome page. 3. Click Next to bypass the welcome page. 4. As shown in Figure 8.10, the Domain Controller Selection page enables you to select a domain controller on which you will perform the RSoP query. If necessary, select the domain from the drop-down list provided. To perform the query on a specified domain controller, select This Domain Controller and then choose the desired server from the list. When finished, click Next.

FIGURE 8.10 You can select the domain controller to be used from the Domain Controller Selection page.

5. On the User and Computer Selection page, specify the Active Directory containers to be used for user and computer information. You can either type the LDAP distinguished name (DN) of the appropriate container or click Browse to locate the desired container. When finished, click Next. 6. Follow steps 3 to 10 of Step by Step 8.1 to complete the Group Policy Modeling Wizard. 7. After the wizard has completed processing the query, you are returned to GPMC and a subnode is present under the Group Policy Modeling node. As shown in Figure 8.11, the details pane presents information using the Group Policy Modeling query, with the Summary tab initially selected. From this tab, you can obtain additional information on the query by selecting any of the Show links on the right side of the pane. You can also view the query parameters you submitted by selecting the Query tab.

546

Chapter 8: Managing Group Policy

FIGURE 8.11 GPMC displays a summary of the Group Policy Modeling query in the details pane.

8. To display information on configured settings, select the Settings tab. This tab displays the Group Policy nodes for which configured policies were processed. Click Show to display the configured policies within its node, as shown in Figure 8.12.

FIGURE 8.12 From the Settings tab you can obtain information on policies that were processed.

9. To display the RSoP snap-in, right-click the subnode in the console tree and choose Advanced View. The RSoP snap-in provides the same information already shown in Figure 8.7 and enables you to view properties and policy precedence as already described in Figure 8.8 and steps 13 and 14 of Step by Step 8.1.

547

Resultant Set of Policy

Running RSoP Planning Mode from Its Own Console You can also create a custom MMC console for running RSoP by following the procedure outlined in Step by Step 8.4.

STEP BY STEP 8.4 Using an RSoP Console to Run RSoP in Planning Mode on a Domain or OU 1. Click Start, Run, type mmc, and then press Enter. 2. From the File menu, choose Add/Remove Snap-In. Click Add and scroll down to select Resultant Set of Policy. Add this policy to the Add/Remove Snap-In dialog box and then click OK to close the dialog box. The snap-in thus created contains a single Resultant Set of Policy node, as shown in Figure 8.13.

FIGURE 8.13 Resultant Set of Policy in its own MMC console.

3. Click File, Save As, type a descriptive name, and then save the snap-in in an appropriate location. 4. To use this snap-in, right-click the Resultant Set of Policy node and choose Generate RSoP Data to start the Resultant Set of Policy Wizard with a Welcome page. 5. Click Next. The Mode Selection page, shown in Figure 8.14, asks which mode you want to use. Select Planning Mode and then click Next.

548

Chapter 8: Managing Group Policy

FIGURE 8.14

Selecting the mode in which RSoP will run.

6. On the User and Computer Selection page, type or browse to the appropriate locations, as shown previously in Figure 8.9. 7. Follow steps 3 to 14 in Step by Step 8.1 to complete the RSoP Wizard and display its results.

RSoP Logging Mode Objective

Troubleshoot issues related to Group Policy application deployment. Tools might include RSoP and the Gpresult command. RSoP logging mode works by using WMI to create a database known as the Common Information Management Object Model (CIMOM). When a user logs on to the network from a specific computer, RSoP writes the settings and any changes to the CIMOM database. Unlike when you are running RSoP in planning mode, where you could specify users, computers, sites, domains, and OUs, you can specify only users and computers when you are running RSoP in logging mode. Because you cannot link policies to security groups, you also cannot specify groups when running RSoP in logging mode. The following are four methods you can use to run RSoP: . From the Run dialog box—Allows you to rapidly display settings for the current

user/computer combination . From Active Directory Users and Computers—Allows you to specify a user/

computer combination found in Active Directory Users and Computers

549

Resultant Set of Policy . From Group Policy Management Console—GPMC includes a Group Policy

Results node that enables you to perform logging mode queries . From its own console—Allows you to create a custom MMC console containing the

RSoP snap-in and then start the RSoP Wizard to specify the user and computer to be processed, as in planning mode

Running RSoP in Logging Mode from the Run Dialog Box A simple method of running RSoP in logging mode from any computer running Windows Server 2003 or Windows XP Professional is available, using the settings for the current user. This method displays the policies applied to the currently logged-on user, together with the name of the GPO that contains the applied policy and the history of GPOs for which the policy was configured. See Step by Step 8.5.

STEP BY STEP 8.5 Running RSoP in Logging Mode from the Run Dialog Box 1. With the appropriate user account, log on to the computer for which you want to use RSoP. 2. Click Start, Run, type rsop.msc, and then press Enter. 3. A progress bar charts the progress of processing RSoP (see Figure 8.15), and then the RSoP console appears. As with the planning mode, only those nodes for which a policy is applied appear, together, with the name of the GPO that is being enforced (see Figure 8.16).

FIGURE 8.15 Charting the processing of RSoP in logging mode.

550

Chapter 8: Managing Group Policy

FIGURE 8.16 The RSoP logging mode console shows policies that were applied and their GPO.

4. See Step by Step 8.9 to analyze the displayed results.

Running RSoP Logging Mode from Active Directory Users and Computers You can also run RSoP in logging mode for a specified user/computer combination from Active Directory Users and Computers. See Step by Step 8.6.

STEP BY STEP 8.6 Running RSoP from Active Directory Users and Computers 1. Using an administrator account, log on to the domain controller (or to a computer on which the Windows Server 2003 administration tools are installed). 2. In Active Directory Users and Computers, expand the container in which the user account you want to test is located. 3. Right-click the user and choose All Tasks, Resultant Set of Policy (Logging), as shown in Figure 8.17.

551

Resultant Set of Policy

FIGURE 8.17 Starting RSoP in logging mode from Active Directory Users and Computers.

4. The Resultant Set of Policy Wizard displays a Computer Selection page. To display settings for the user logged on to a client computer, select Another Computer, type the name or IP address of the computer in the text box provided (see Figure 8.18), and then click Next. If you want to display user policy settings only, select the Do Not Display Policy Settings for the Selected Computer in the Results (Display User Policy Settings Only) check box.

FIGURE 8.18 Selecting the computer for which RSoP is to process the policy settings.

5. The User Selection page, shown in Figure 8.19, confirms the user for which RSoP will be run. Click Next.

552

Chapter 8: Managing Group Policy

FIGURE 8.19

Confirming the user to be processed.

6. The Summary of Selections page displays the list of selections that you have made. Review these selections and click Back to change any settings. Click Next to process these settings. 7. When the completion page appears, click Finish to display the RSoP console. It appears in a similar manner to that shown in Figure 8.16. 8. Follow the procedure outlined in Step by Step 8.9 to display the properties of various items.

NOTE Starting RSoP from a Computer Account Listed in Active Directory Users and Computers Right-click a computer and choose All Tasks, Resultant Set of Policy (Logging). The wizard starts and allows you to choose whether you want to display users who have logged on to the specified computer or computer settings only.

Running RSoP Logging Mode from Its Own Console As you learned in Chapter 7, you can also create a custom MMC console to run RSoP in logging mode. Follow the procedure described in Step by Step 8.3 to create the RSoP console and then follow the procedure outlined in Step by Step 8.7 to run RSoP in logging mode.

STEP BY STEP 8.7 Running RSoP from Its Own Console 1. In the RSoP console, right-click Resultant Set of Policy and choose Generate RSoP data. The Resultant Set of Policy Wizard opens with a welcome page. 2. Click Next to bypass the welcome page.

553

Resultant Set of Policy 3. On the Mode Selection page shown earlier in Figure 8.14, select the Logging Mode option and then click Next. 4. The Computer Selection page, previously shown on Figure 8.18, allows you to select the computer for which you want to display logging mode settings. Select This Computer or Another Computer as appropriate, type the name or IP address of the computer to be used, and then click Next. You can also click Browse to locate the desired computer from a list. 5. The User Selection page, shown in Figure 8.20, allows you to select the user for which you want to display logging mode settings. Only users who have logged on to the computer appear in the list. Select a user and then click Next.

FIGURE 8.20

Selecting the user to be processed.

6. The Summary of Selections page displays the selections you have specified. If you need to make any changes, click Back. Click Next to process the policy settings. 7. When the completion page appears, click Finish. The RSoP console you have created displays the results of your analysis. 8. Follow the steps outlined in Step by Step 8.9 to display the properties of various items.

TIP Displaying Only Computer or User Policy Settings The Computer Selection page provides a Do Not Display Policy Settings for the Selected Computer in the Results (Display User Policy Settings Only) check box, and the User Selection page provides a Do Not Display User Policy Settings in the Results (Display Computer Policy Settings Only) radio button. Choosing to display only computer or user policy settings is useful in troubleshooting a problem with applied policies because you can use them to isolate a problem as it occurs in either the computer or user configuration portion of Group Policy.

554

Chapter 8: Managing Group Policy

Running RSoP Logging Mode from Group Policy Management Console You can run an RSoP logging mode query from the Group Policy Results node in GPMC. This processes a query against any computer running Windows XP or Windows Server 2003 and displays the results in the details pane. You cannot use logging mode to query a Windows 2000 computer; however, you can run a planning mode query against a Windows 2000 computer. Follow Step by Step 8.8 to run RSoP logging mode from GPMC.

STEP BY STEP 8.8 Running RSoP Logging Mode from GPMC 1. In the console tree of GPMC, right-click Group Policy Results and select Group Policy Results Wizard. 2. Click Next to bypass the welcome page of the Group Policy Results Wizard. 3. On the Computer Selection page (refer back to Figure 8.18), make an appropriate selection and then click Next. 4. On the User Selection page (refer to Figure 8.19), select the required user and then click Next. 5. The Summary of Selections page displays the selections you have specified. Click Back to make changes or click Next to process these selections. 6. When the completion page appears, click Finish. Similar to the RSoP planning mode query, a subnode is added to GPMC under Group Policy Results, and the Summary tab of the query results appears in the details pane. See Figure 8.21.

Group Policy Results in GPMC provides summary information on the Summary tab in the details pane.

FIGURE 8.21

555

Resultant Set of Policy 7. To display applied settings, select the Settings tab, and then expand the appropriate node to reveal the policy settings that were applied to the targeted user/computer combination. See Figure 8.22.

FIGURE 8.22 The Settings tab of Group Policy Results displays the policies that were applied to the targeted user/computer combination.

8. To display policy-related events at the targeted computer, select the Policy Events tab. As shown in Figure 8.23, this displays a list of events that can be useful for policy application troubleshooting. You can obtain more information about an event by double-clicking it.

FIGURE 8.23 The Policy Events tab of Group Policy Results displays policyrelated events from the targeted computer.

556

Chapter 8: Managing Group Policy 9. To display the RSoP snap-in, right-click the subnode and choose Advanced View. It appears in a similar manner to that obtained from other methods of performing RSoP queries. 10. Follow the steps outlined in Step by Step 8.9 to display the properties of various items.

Analyzing the RSoP Results Regardless of the procedure used to obtain the RSoP console, the procedure for analyzing the results is the same. It is outlined in Step by Step 8.9.

STEP BY STEP 8.9 Analyzing RSoP Logging Mode Data 1. Expand the listings in the console tree to locate the policies you want to examine. 2. In the details pane, right-click the policy name and choose Properties. 3. Select the Precedence tab. As shown in Figure 8.24, this tab displays the names of the GPOs that apply and their settings.

FIGURE 8.24 Displaying the list of GPOs that are configured for a given policy.

4. Folder redirection policies appear in a slightly different format. Select the appropriate folder from the console tree to display precedence information in the details pane. As shown in Figure 8.25, the information includes the security group involved and the setting level (Basic or Advanced).

557

Resultant Set of Policy

FIGURE 8.25 Displaying folder redirection policies.

5. To display the list of all GPOs applied to the current user, right-click either Computer Configuration or User Configuration as needed, and choose Properties. This selection displays a Properties dialog box with the following two tabs: . General—Provides the list of GPOs applied, as shown in Figure 8.26. The three check boxes at the bottom control the amount of information displayed. Click Security to view permissions information. Click Edit to open the Group Policy Object Editor focused on the GPO that is highlighted in the list.

FIGURE 8.26 Displaying information on all GPOs applied to a user or computer.

558

Chapter 8: Managing Group Policy . Error Information—Provides information on any GPO components that have failed to apply properly. This information helps to facilitate troubleshooting of policies that have not applied properly. See Figure 8.27.

FIGURE 8.27

Displaying error information about GPO

application.

6. To display the selections used to generate the RSoP data, right-click the user and computer name in the console tree and choose Properties. Figure 8.28 shows the displayed list.

FIGURE 8.28 Displaying the selections used to generate the RSoP data.

559

Resultant Set of Policy 7. If you have made changes to GPOs using the Group Policy Object Editor and want to apply these changes to an open RSoP console, right-click the user/computer name and perform the appropriate step described here: . If you have run RSoP from Active Directory Users and Computers or from its own console, rightclick the user/computer name from this location and choose Refresh Query. . If you have run RSoP from Group Policy Management Console, right-click the user/computer name under Group Policy Results and choose Rerun Query. Either of these actions reprocesses the query and displays the refreshed results in the same console. 8. If you have run RSoP from Active Directory Users and Computers or from its own console and you want to change the user/computer combination being analyzed, right-click the user/computer name and choose Change Query. This restarts the Resultant Set of Policy Wizard and enables you to re-enter user and computer information, as described in Step by Steps 8.6 and 8.7.

NOTE Ensuring That the Latest Changes Have Been Applied Just as a user needs to log off and log back on to receive changes in policies, the user must also log off and log back on so that the RSoP logging mode results reflect changed policies.

Saving RSoP Data You can save the results of any RSoP query to its own console so that you can easily rerun the query at a later time. See Step by Step 8.10.

STEP BY STEP 8.10 Saving an RSoP Query 1. After running an RSoP query, select the User Account on Computer Account entry near the top of the console tree (such as “BarbS on COMPUTER1” in Figure 8.16). 2. Click View, Archive Data in Console File. 3. Click File, Save As, type an appropriate name for the file, and click Save. 4. You can rerun the same query later by simply double-clicking the file that you have created here.

EXAM ALERT RSoP in Logging Mode Works Only for a User Who Has Logged On to the Computer Being Processed You might be asked to choose between planning mode and logging mode for a user who has not logged on to that specific computer or to troubleshoot the reasons RSoP in logging mode does not work for a specific user.

560

Chapter 8: Managing Group Policy

Problems Encountered in Running RSoP in Logging Mode Following is a list of more common problems you might encounter while running RSoP in logging mode: . The user does not exist—If the user you specify has never logged on to the specified

computer, RSoP cannot process the data and displays the error shown in Figure 8.29. Verify that the username is spelled correctly. You must either have the required user either log on to the specified computer or switch to RSoP in planning mode.

FIGURE 8.29 The user does not exist because she has never logged on to the specified computer.

. You are unable to connect to the domain—When you are running RSoP from a

client computer or member server, Group Policy cannot be applied if the computer is unable to connect to the domain for any reason, including lost network connectivity. The console tree displays one or more red X icons, and the Error Information tab provides information related to the failure. See Figure 8.30.

FIGURE 8.30

domain.

You are unable to connect to the specified

561

Resultant Set of Policy . The client computer is not turned on or does not exist—The Resultant Set of

Policy Wizard displays an error informing you that the Remote Procedure Call (RPC) server is unavailable, as shown in Figure 8.31. Make sure that the computer name is spelled properly and that the computer is turned on and connected to the network; then retry your query. You can also click Browse to locate the desired computer.

FIGURE 8.31 You are unable to connect to the specified computer.

. Errors occur when applying GPOs—If an error occurs when RSoP is processing the

GPOs applied to the user, a small yellow exclamation point icon appears on the username and the branch (computer or user configuration) that is affected. See Figure 8.27 and access the Error Information tab of the branch’s Properties dialog box to display details on the error that occurred.

NOTE Ensuring Policies Are Always Applied It is possible that some users can make changes to system or Registry settings that override those applied by Group Policy. If this happens, normal Group Policy refresh will not reapply settings because this procedure only checks the version of the GPO involved, not its specific settings. You can ensure that policies are reapplied by navigating to the Computer Configuration\Administrative Templates\Group Policy node. Enable the appropriate Policy Processing settings found in this node and select the Process Even If the Group Policy Objects Have Not Changed option. This setting reapplies policies even if they have not been changed, and enables any changes made by users to be overwritten.

Troubleshooting Group Policy Just Became Easier A friend of mine is an administrator at a large company with an Active Directory domain that dates back to the early days of Windows 2000. Without a great deal of management directive, the network administrators set up a series of OUs that mirrored the company departments. They then proceeded to create GPOs that were linked to the various OUs and enforced settings peculiar to their departments. Since then, the GPO structure has been modified numerous times, and several GPOs are linked to various Active Directory containers in the company. (continues)

562

Chapter 8: Managing Group Policy (continued)

Because of users installing and running unapproved software on their computers, management asked the administrators to restrict the software that would run on users’ computers to only what is needed for actually doing their work. Some months later, the manager of the Engineering section noticed one of his users running a game program on her desktop. He asked the OU administrator to check how this could be so. The administrator discovered that the game would also run on his desktop, so he ran RSoP in logging mode to see what was wrong. The Precedence tab of the software restriction policies in the User Configuration node of the RSoP snap-in showed a GPO named Games Policy that was configured with a security level of Unrestricted, and was at the top of the precedence list. It was overriding settings in the Default Domain Policy GPO and the Engineering OU GPO, both of which specified a Disallowed software restriction policy with the appropriate exceptions for the software that users required. Removing the Games Policy GPO (which an unknown user with administrator powers had added) cured the problem that had enabled users to run games that were not allowed.

Gpresult Gpresult is a command-line version of RSoP that you can use to display logging mode infor-

mation or create batch files. The syntax for this command is as follows: Gpresult [/s computer [/u domain\user /p password]] [/user target_user] ➥ [/scope {user | computer}] {{/v | /z}]

Table 8.1 describes the options that are available with the Gpresult command. TABLE 8.1 Options Available with the Gpresult Command Option

Description

/s computer

Specifies the remote computer to be used. You can use either the computer name or IP address. If absent, the local computer is used.

/user target_user

Specifies the user to be used. If absent, the currently logged-on user is used.

/u domain\user /p password

Enables you to enter the appropriate username and password to run Gpresult in the context of another user. Include the domain if it is not the same as the current domain.

/scope {computer | user}

Limits the display to computer configuration or user configuration data.

/v

Displays verbose policy information.

/z

Displays all available information about Group Policy, more than is available with the /v option.

> filename.txt

Redirects output to the specified file. Because of the large amount of data produced by these options, you should use this option with the /v or /z option.

563

Resultant Set of Policy

NOTE Windows 2000 Version of Gpresult A Windows 2000 version of Gpresult is also available. You can download it from the Microsoft website, and you can also find it in the Windows 2000 Resource Kit. It provides the same type of information to that of the Windows Server 2003 version, and can be used on computers running Windows 2000 Server or Professional. See Microsoft Knowledge Base article 321709 for more information.

EXAM ALERT Know the Gpresult Options You should make sure that you know the major Gpresult options. In particular, be aware of the proper use of the /u and /user options.

Step by Step 8.11 shows you how to use Gpresult.

STEP BY STEP 8.11 Using Gpresult 1. Open a command prompt and type Gpresult with the appropriate parameters, as described in Table 8.1.

Figures 8.32 and 8.33 show the computer and user settings obtained from a typical run of Gpresult using only the /s and /user options. In this example, no local policy settings were configured; therefore, the local GPO is not considered to be applied because it was filtered out.

FIGURE 8.32

tings output.

Gpresult computer set-

564

Chapter 8: Managing Group Policy

FIGURE 8.33

Gpresult user settings

output.

EXAM ALERT Gpresult Does Not Work If the User Has Not Logged On to That Machine Because Gpresult is merely a command-line version of RSoP in logging mode, it cannot process data for a user who has never logged on to the specific machine.

Figure 8.34 contains a small portion of a typical output to a text file using the /v option. This option lists all policies that were applied with the name of the prevailing GPO and its state (enabled or disabled), but it does not provide policy succession information. For example, the top entry in Figure 8.34 informs you that the Default Domain Policy GPO enabled the NoControlPanel (Prohibit Access to the Control Panel) policy setting, found at the User Configuration\Administrative Templates\Control Panel node. The text string under Keyname indicates the Registry key that was configured by the policy setting. Figure 8.35 shows an example of the Registry value configured by this policy setting observed at the client computer where the user from Figure 8.34 is logged on.

565

Resultant Set of Policy

FIGURE 8.34

A portion of

Gpresult verbose results.

FIGURE 8.35 Registry Editor information showing the NoControlPanel value configured.

Figure 8.36 shows folder redirection information provided by Gpresult using the /v option. In this example, the My Documents folder was redirected to the \\Server1\Docs1 share. The top entry shows the accompanying redirection of the My Pictures subfolder. Again, succession information is not shown. You can obtain some succession information by using the /z option, but the output is lengthy with this option.

566

Chapter 8: Managing Group Policy

FIGURE 8.36 Folder redirection as displayed by Gpresult.

Other Tools for Troubleshooting Group Policy You should be aware of several other Group Policy management tools that are included with Windows Server 2003. They include Gpupdate, the Advanced System Information tool, and the Group Policy Management Console (GPMC).

Gpupdate Gpupdate is a new tool that refreshes Group Policy settings, both on the local computer and

in Active Directory. It replaces the Windows 2000 secedit /refreshpolicy command. Its syntax is as follows: Gpupdate [/target:{computer | user}] [/force] /[wait:value] [/logoff] [/boot]

NOTE Gpupdate Cannot Refresh a Remote Computer You must be situated at the computer on which you want to refresh Group Policy to run the Gpupdate command.

Table 8.2 describes the options available with this command. TABLE 8.2 Options Available with the Gpupdate Command Option

Description

/target: {computer | user}

Processes only the computer or user settings, when specified. Otherwise, both computer and user settings are processed.

/force

Forces the reapplication of all settings.

567

Other Tools for Troubleshooting Group Policy

Option

Description

/[wait:value]

Specifies the number of seconds that policy processing waits to finish. By default, this is 600 seconds; 0 means “no wait,” and –1 means “wait indefinitely.”

/logoff

Logs off after the refresh is complete to enable processing of client-side extensions, such as software installation and folder redirection that require the user to log off and back on.

/boot

Restarts the computer after the refresh is complete to enable processing of client-side extensions, such as computer-based software installation policies that require the computer to be rebooted.

EXAM ALERT Remember the Gpupdate Command Microsoft pays particular attention to the new features of the operating system on the exams. Pay attention to the fact that you must use Gpupdate and not Secedit to force a refresh of Group Policy.

Gpotool Gpotool is the Group Policy Verification Tool. Included with the Windows Server 2003

Resource Kit, Gpotool tests the health of GPOs on domain controllers running either Windows 2000 or Windows Server 2003. It tests the validity and replication status of GPOs and their consistency across each domain controller in the domain. For example, Gpotool can establish whether there is an inconsistency between the version numbers of the Group Policy template (GPT) as stored in SYSVOL and the corresponding Group Policy Container (GPC) as stored in the Active Directory database. Such an inconsistency can indicate replication problems or even corruption of a component of the GPO. If you suspect that a replication problem is occurring, use Replmon or Repadmin to check the status of replication. We discussed the use of these tools in Chapter 4, “Maintaining an Active Directory Infrastructure.”

Advanced System Information The Advanced System Information tool, which is available from the Help and Support Center, displays RSoP data for the currently logged-on user at the current computer running either Windows XP Professional or Windows Server 2003. It includes information on applied GPOs, security groups, scripts, security settings, installed programs, Registry settings, and so on. Step by Step 8.12 demonstrates how to access Advanced System Information.

568

Chapter 8: Managing Group Policy

STEP BY STEP 8.12 Using Advanced System Information 1. Click Start, Help and Support. The Help and Support Center opens. 2. (Windows Server 2003) Under Support Tasks, select Tools. (Windows XP) Under Pick a Task, select Use Tools to View Your Computer Information and Diagnose Problems. 3. In Windows Server 2003, expand the Help and Support Center Tools link. 4. Select the Advanced System Information link from the left pane. 5. On the right pane, select View Group Policy Settings Applied. 6. As shown for the user in Figure 8.37, Group Policy results appear in the right pane after a few minutes. All applied policies are shown, including the name of the GPO that prevails for each policy.

FIGURE 8.37 RSoP results displayed by Advanced System Information.

7. To save the report to an .htm file, scroll to the bottom of the right pane and select Save a Snapshot of the Currently Displayed Information to an .htm File. In Windows XP with SP2, this link is labeled Save This Report to an .htm File. On the Explorer User Prompt dialog box that appears, accept the path provided or modify it as needed (see Figure 8.38).

569

Other Tools for Troubleshooting Group Policy

FIGURE 8.38

Saving RSoP data to an .htm file.

NOTE Another Way of Running RSoP You can also run RSoP from the bottom of the Advanced System Information pane described previously and shown in Figure 8.37.

RSoP and Gpresult Review Keep the following points about RSoP and Gpresult in mind when studying for the exam: . You can use RSoP in logging mode to evaluate the effect of multiple GPOs applied to

a specified user who has actually logged on to the specified computer. You can do this from the Run dialog box, Active Directory Users and Computers, or a customized MMC snap-in that contains the RSoP console. . RSoP in logging mode provides a list of GPOs applied to the given user and computer,

and their precedence. It also provides error information on GPOs that have failed to apply. . RSoP allows you to save query information so that you can rerun a saved query later

after changing the applied GPOs. . Gpresult is a command-line version of RSoP that allows you to display logging mode

information or create batch files. . Gpupdate is a command-line tool that refreshes the application of GPOs both on the

local computer and in Active Directory. . Gpotool is a command-line tool that verifies the health and replication consistency

of GPOs. . The Advanced System Information tool displays RSoP data for the currently logged-on

user at the current computer running either Windows XP Professional or Windows Server 2003. You can save information to an .htm file for later use.

570

Chapter 8: Managing Group Policy

Maintaining Software with Group Policy In Chapter 7, we introduced the use of Group Policy for distributing and installing software. You saw how you can use Group Policy to assign software to users or computers or publish software to users. You can use these methods to deploy software packages that include Microsoft Installer (.msi) package files or Zero Administration Package (.zap) files that you can create yourself to enable deployment using Group Policy. As we discussed in Chapter 7, the lifecycle of software management includes the installation, configuration and upgrading, and removal of software. Having covered the installation of software in Chapter 7, here we concentrate on the remaining aspects of software management.

Distributing Updates to Software Installed Using Group Policy Objective

Maintain installed software by using Group Policy . Distribute updates to software distributed by Group Policy

As new versions of applications are released, it might be desirable to upgrade the current packages to take advantage of the new features that are generally offered with the upgraded version. Group Policy facilitates the process of distributing software updates. Upgrades can be either mandatory or optional. In the case of a mandatory upgrade, the current version of the software is automatically upgraded the next time the computer is started or the user logs on. For an optional upgrade, the user can either upgrade the application or continue to work with the current version. The user can even have both versions installed and access either one as she chooses.

Use of Group Policy to Upgrade Applications Step by Step 8.13 outlines the procedure for upgrading an application from the Group Policy Object Editor snap-in.

STEP BY STEP 8.13 Configuring Application Upgrades in Group Policy 1. Copy the upgrade package to the shared folder from which users will install the package. 2. Open the Group Policy Object Editor for the GPO that will hold the new package (usually, but not necessarily, the GPO that holds the package to be upgraded).

571

Maintaining Software with Group Policy 3. Navigate to the Software Installation node under Computer Configuration or User Configuration, depending on the method used to deploy the application. 4. Deploy the upgraded version of the application using the same steps you used for the initial deployment. 5. Right-click the Windows Installer package for the upgraded application that you just deployed and select Properties to display the Properties dialog box for the application to be upgraded. 6. Select the Upgrade tab and then click Add to display the Add Upgrade Package dialog box (see Figure 8.39).

FIGURE 8.39

The Add Upgrade Package dialog box.

7. If the application to be upgraded is located in the current GPO, leave the default of Current Group Policy Object (GPO) selected. Otherwise, select the A Specific GPO option and click the Browse button to locate the appropriate GPO from the Browse for a Group Policy Object dialog box that appears. After you have selected the proper GPO, click OK to return to the Add Upgrade Package dialog box. 8. Within the Package to Upgrade field, select the package to be upgraded. 9. Select from the following two choices that are available for upgrading the package: . Uninstall the Existing Package, Then Install the Upgrade Package—Use this option if you are replacing the application with a completely different one, such as from a new vendor. You might have to use this option for some applications that cannot be installed over current installations. . Package Can Upgrade over the Existing Package—Use this option when upgrading to a newer version of the same product. It retains the user’s application preferences, document type associations, and so on. 10. Click OK to return to the Upgrades tab. The selected package is displayed in the field labeled Packages That This Package Will Upgrade (see Figure 8.40).

572

Chapter 8: Managing Group Policy

FIGURE 8.40 The Upgrades tab displays the package that will be upgraded.

11. You can choose to make the upgrade mandatory for users of the existing package. To do so, select the Required Upgrade for Existing Packages check box. Otherwise, the upgrade is optional. Click OK to return to the Group Policy Object Editor. 12. Close the Group Policy Object Editor console to apply the settings you just configured.

Use of Transform Files to Modify Software Packages Transform files, which are Windows Installer package files with the .mst extension, are used to make changes to an installation database. For example, you can change the language of a user interface by employing a transform file. You can even specify which components of a package such as Microsoft Office will be installed on computers subject to the GPO where the transform is specified. When using Group Policy to deploy software, you can apply a transform at the time you deploy the software, either by assigning or publishing it. The .mst package works in conjunction with the software’s .msi package to produce the customized deployment.

NOTE Creating a .mst File Microsoft Office includes an Office Customization Installation Wizard that helps you create a .mst file. For example, this wizard helps you add language features to your Microsoft Office installation. Third-party tools such as InstallShield’s AdminStudio can also help you create .mst files.

573

Maintaining Software with Group Policy

Step by Step 8.14 outlines the procedure for deploying a software package that contains a transform file.

STEP BY STEP 8.14 Using an .mst File to Modify a Software Package 1. Open the Group Policy Object Editor that is focused on the GPO within which you want to apply the modified software package. 2. Navigate to the Software Installation folder under Computer Configuration\Software Settings or User Configuration\Software Settings, depending on whether you want to deploy the modification to users or computers. 3. Right-click Software Installation and choose New, Package. 4. In the Open dialog box that appears, navigate to the shared folder where the .msi file is located, select it, and click Open. 5. In the Deploy Software dialog box that appears, select the Advanced option, as shown in Figure 8.41.

FIGURE 8.41 You must select the Advanced deployment option to apply .mst files to the deployment package.

6. Selecting this option displays the Properties dialog box for the software package. It is a good idea to indicate a specific name for the package on the General tab (for example, Microsoft Office 2003 Premium, Spanish edition). 7. On the Deployment tab, select the required deployment type (Published or Assigned). In addition, select the required deployment options and installation user interface options, as discussed in Chapter 7. 8. Select the Modifications tab, as shown in Figure 8.42, and then click Add. In the Open dialog box that appears, select the appropriate .mst file and click Open.

574

Chapter 8: Managing Group Policy

Use the Modifications tab to add .mst files to the software deployment package. FIGURE 8.42

9. Repeat step 8 as necessary to add additional .mst files to the list on the Modifications tab. Use the Move Up and Move Down buttons as necessary to sequence the .mst files in the order (top to bottom) in which they are to be applied. 10. Click OK only after you have added and sequenced all the required .mst files. The package appears in the details pane of the Group Policy Object Editor, along with the name you specified in step 6. 11. Exit the Group Policy Object Editor.

EXAM ALERT Know the Difference Between a Transform and a Patch and What Each Can Do—Transform files have the .mst extension and customize a Windows Installer package at the time of deployment. Patch files have the .msp extension and include modifications such as bug fixes and service packs. They are more limited in nature than transforms in that they cannot specify a subset of application features and cannot remove or change the names of shortcuts, files, or Registry keys.

Redeployment of Upgraded Software In some situations, you might not need to upgrade the package; you simply might want to reinstall it on all computers covered by the GPO. A case in point is the add-ons that software vendors produce from time to time, such as patches, service packs, and hotfixes. These patches are designed to add new features or correct problems with the current application. You can apply such patches to deployed software by redeploying the software. In doing so, the redeployed software is advertised to everyone to whom the software was originally

575

Maintaining Software with Group Policy

assigned or published, and the update takes place according to the method of original deployment, as follows: . Software that was assigned to a computer is automatically redeployed the next time the

computer is started. . For software that was either published or assigned to a user, modifications are made to

the Start menu, desktop shortcuts, and Registry settings when the user logs on. When he starts the program, the patch or service pack is automatically applied. Step by Step 8.15 outlines the procedure involved in redeploying a software package for which you have received a patch, hotfix, or service pack.

STEP BY STEP 8.15 Redeploying a Software Package 1. Copy the appropriate files to the software package’s installation folder. 2. Navigate to the Software Installation node under Computer Configuration or User Configuration, depending on the method used to deploy the application. 3. Right-click the application and choose All Tasks, Redeploy Application, as shown in Figure 8.43.

FIGURE 8.43 Redeploying a software application.

4. You are warned that redeploying this application will reinstall the application everywhere it is already installed (see Figure 8.44). Click Yes to continue.

FIGURE 8.44 Group Policy issues a confirmation message before redeploying an application.

5. The next time users log on to their computers, the application will be redeployed, as described in this section.

576

Chapter 8: Managing Group Policy

NOTE You Need a New Windows Installer File to Redeploy Software To redeploy the package as described, the patch, hotfix, or service pack must come with a new Windows Installer .msi file. Otherwise, you cannot redeploy the package without preparing a new .msi file. If the supplier has included an .msp file with the patch, it will include instructions for use of this file to update the .msi file.

Use of Group Policy for Software Removal When software that was deployed using Windows Installer becomes outdated or is no longer useful to your organization, you can use a GPO to remove old software. Software removal can be either mandatory or optional. Mandatory removal results in software being uninstalled the next time a client computer is rebooted. Optional removal permits the software to remain on a client’s computer, but it is no longer supported or available for re-installation. Step by Step 8.16 outlines the procedure for removing a deployed software package.

STEP BY STEP 8.16 Removing a Software Package 1. Navigate to the Software Installation node under Computer Configuration or User Configuration, depending on the method used to deploy the application. 2. Right-click the software package to be removed and select All Tasks, Remove. 3. In the Remove Software dialog box (see Figure 8.45), choose one of the following removal methods: . Immediately Uninstall the Software from Users and Computers—Software is automatically uninstalled the next time the computer is started or the user logs on. The user does not receive an option to retain the software. . Allow Users to Continue to Use the Software, but Prevent New Installations—Software is not uninstalled and users can continue to use it. However, users who remove the software and others who do not have it can no longer install it.

FIGURE 8.45

Removal of deployed software can be either mandatory

or optional.

4. Click OK. The software package is no longer listed in the details pane.

577

Maintaining Software with Group Policy

Configuring Automatic Updates for Network Clients Using Group Policy Objective

Maintain installed software by using Group Policy . Configure automatic updates for network clients by using Group Policy

Windows Update and Automatic Updates are two features that work together to enable you to keep computers up-to-date automatically by providing critical updates such as security fixes, updated drivers, and so on. You can use Automatic Updates to automatically interact with the Windows Update site to obtain the available updates. Group Policy allows you to specify how and when client computers affected by the policy access the Windows Update website to download and install the updates. Client computers can automatically download and install these updates while users are working on their computers, without interrupting their workflow. Step by Step 8.17 shows you how to configure an automatic update policy.

STEP BY STEP 8.17 Configuring Group Policy for Automatic Updates 1. Open the Group Policy Object Editor for the GPO on which you want to configure an automatic update policy. 2. Navigate to the Computer Configuration\Administrative Templates\Windows Components\Windows Update node. If this node is not present, right-click Administrative Templates, select Add/Remove Templates, and click Add. From the Policy Templates dialog box that appears, select wuau.adm and click Open, as shown in Figure 8.46. Then click Close to close the Add/Remove Templates dialog box and return to the Group Policy Object Editor.

FIGURE 8.46 Adding the Windows Update policies to the Group Policy Object Editor.

578

Chapter 8: Managing Group Policy 3. Select the Windows Update node. Twelve policies appear in the details pane. 4. Right-click Configure Automatic Updates and choose Properties. This displays the Configure Automatic Updates Properties dialog box. 5. Select Enabled and then select one of the following options from the Configure Automatic Updating drop-down list (see Figure 8.47): . 2—Notify for Download and Notify for Install—Windows Update notifies you when updates are available by displaying an icon in the notification area and a message stating that updates are available for download. The user can download the updates by clicking either the icon or the message. When the download is complete, the user is informed again with another icon and message; clicking one of them starts the installation. . 3—Auto Download and Notify for Install—Windows Update downloads updates in the background without informing the user. After the updates have been downloaded, the user is informed with an icon in the notification area and a message stating that the updates are ready for installation. Clicking one of them starts the installation. This is the default option. . 4—Auto Download and Schedule the Install—Windows Update downloads updates automatically when the scheduled install day and time arrive. You can use the drop-down lists in the Configure Automatic Updates Properties dialog box to specify the desired days and times, which, by default, are daily at 3:00 a.m. . 5—Allow Local Admin to Choose Setting—Enables local administrators to select a configuration option of their choice from the Automatic Updates control panel, such as their own scheduled time for installations.

FIGURE 8.47 The Configure Automatic Updates Properties dialog box offers four choices for configuring automatic updating of clients.

579

Maintaining Software with Group Policy 6. Click OK to return to the Group Policy Object Editor or Next Setting to configure the next policy in the Windows Update node. 7. Optionally, configure one or more of the following policies that are available from this node: . Specify Intranet Microsoft Update Service Location—Enables you to specify an intranet web server that is running the Software Update Services for hosting updates from the Microsoft Windows Update site. Its use provides a centralized location from which client computers can download updates, thus reducing Internet traffic resulting from clients connecting to the Microsoft Windows Update site for downloads. . Enable Client-Side Targeting—Enables you to specify a target group name to be used for receiving updates from an intranet server. The server uses the group name you specify to determine which updates are to be deployed. . Reschedule Automatic Updates Scheduled Installations—Specifies the length of time in minutes that Automatic Updates waits after system startup before proceeding with a scheduled installation that was missed because a client computer was not turned on and connected to the network at the time of a scheduled installation, as previously specified by option 4 in step 5. . No Auto-Restart for Scheduled Automatic Updates Installations—Prevents Automatic Updates from restarting a client computer after updates have been installed. Otherwise, Automatic Updates notifies the logged-on user that the computer will automatically restart in five minutes to complete the installation. . Automatic Updates Detection Frequency—Specifies the length of time in hours used to determine the waiting interval before checking for updates at an intranet update server. You need to enable the Specify Intranet Microsoft Update Service Location policy to have this policy work. . Allow Automatic Updates Immediate Installation—Enables Automatic Updates to immediately install updates that neither interrupt Windows services nor restart Windows. . Delay Restart for Scheduled Installations—Specifies the number of minutes to wait before a scheduled restart takes place. . Re-Prompt for Restart with Scheduled Installations—Specifies the number of minutes from the previous prompt to wait before displaying a second prompt for restarting the computer. . Allow Non-Administrators to Receive Update Notifications—Enables users who are not administrators to receive update notifications according to other Automatic Updates configuration settings.

NOTE A Restart Is Needed to Continue Receiving Automatic Updates Notifications If the No Auto-Restart policy is enabled, Automatic Updates cannot detect future updates until the user has restarted the computer. Automatic Updates notifies the user to restart the computer to complete the installation.

8. When you are finished, exit Group Policy Object Editor.

580

Chapter 8: Managing Group Policy

RSoP and Software Installation Using Group Policy As with other Group Policy settings, you can use RSoP to troubleshoot software installation issues. RSoP in logging mode identifies all software that is available to a given user, including updates and configuration changes. RSoP also displays a list of software that a user has actually installed. When you view RSoP data for the Software Settings node under Computer Configuration or User Configuration in the RSoP snap-in, the details pane displays the following five columns by default: . Name—Displays the name of the software package you have deployed . Version—Displays the package’s version number . Deployment state—Displays whether the package is published or assigned . Source—Displays the source location of the deployed package . Origin—Displays the name of the GPO from which the package was deployed

You can add additional columns to the view for software settings information by selecting one of the following options from the View menu: . Installed applications—Displays all applications that are actually installed . Available applications—Displays all applications available to the user/computer com-

bination . Removed applications—Displays any applications that the user has removed

Group Policy Application Upgrade Review It is simple to modify applications with Group Policy using the following options: . Upgrades can be either mandatory, in which users’ software is upgraded at the next

reboot or logon, or optional, which allows the user to either upgrade or continue to use the older version of the application. . You can use .mst (transform) files to customize the installation of software packages or .msp (patch) files to apply hotfixes, service packs, and similar patches to deployed soft-

ware packages.

581

Troubleshooting Group Policy Security . A software package is redeployed when it is necessary to reinstall a modified package to

all computers covered by the GPO in which the package is deployed. . You can remove old software that is no longer required from any GPO. This removal

can be either mandatory or optional. . Automatic Updates policies manage the download and installation of Windows updates

from the Microsoft Windows Update site.

Troubleshooting Group Policy Security Objective

Troubleshoot the application of Group Policy security settings. Tools might include RSoP and the Gpresult command. Throughout this training guide, we have mentioned the various enhancements that Microsoft has put in place to improve the security of the Windows Server 2003 operating system and to ease the administration of security features. In Chapter 7, “Planning and Implementing Group Policy,” we discussed the use of Group Policy to configure security settings on domain computers. These settings include software restriction, audit policy, user rights assignment, restricted groups, system services, wireless network policies, public key policies, and IP security policies. We also discussed account policy, including password policies and their application using security templates in Chapter 5, “Planning User, Computer, and Group Strategies.” As with other policies, it is not difficult to configure settings that conflict with one another and result in an undesirable configuration of domain computers. The RSoP and Gpresult tools we discussed earlier in this chapter provide a means of analyzing and troubleshooting security from the user and computer points of view.

Use of RSoP to Troubleshoot Group Policy Security Settings Earlier in this chapter, we saw how you can use RSoP in logging mode to analyze and troubleshoot various Group Policy settings as applied to a member server or client computer in the domain. We also saw how you can use RSoP in planning mode to simulate the application of proposed Group Policy settings.

582

Chapter 8: Managing Group Policy

RSoP provides the following features that assist you in planning, managing, and troubleshooting security: . Security templates—RSoP can verify the changes made to security settings as a result

of your using Group Policy to apply security templates to a GPO. It displays a resultant policy that indicates misapplied or overwritten policies and their precedence. This information can assist you in repairing a security breach. . Security group membership and the scope of GPOs—RSoP uses Group Policy fil-

tering to report on the scope of a GPO according to security group membership. You can use this information to correct improper application of security policies according to security group membership. . Display of resultant policies that affect the given computer and user—You can con-

figure specific security settings in nearly all aspects of security from local Group Policy. These settings establish specialized security settings for a computer used for a specific purpose. If they conflict with Active Directory security settings, the latter always prevail. You can use RSoP to troubleshoot problems from applying local security settings.

Use of Security Templates We have discussed how to import a security template to a GPO. Doing so allows Group Policy to process the template and make the changes it contains to the users or computers affected by the template. You can use RSoP to verify these changes. When run in logging mode, RSoP displays the resultant policy, including misapplied or overwritten policy settings and their precedence. Keep in mind that you can also establish a security policy on a local computer. However, if a conflict occurs with Active Directory–based security settings, the latter always override locally defined security settings according to the LSDOU rule discussed in Chapter 7. The procedure for running RSoP in logging mode and displaying security settings is similar to that used for displaying other RSoP settings. The RSoP console allows you to display the applied security settings and the properties that have been configured for this setting. Step by Step 8.18 describes the viewing and troubleshooting of IP security policy assignments and their properties.

STEP BY STEP 8.18 Viewing IPSec Policy Assignments 1. Start the Resultant Set of Policy Wizard as described in any of the Step by Step procedures already discussed in this chapter. 2. After the wizard is completed and the RSoP snap-in appears, expand the Computer Configuration\ Windows Settings\Security Settings\IP Security Policies on Active Directory node. The applied policies display in the details pane, as shown in Figure 8.48.

583

Troubleshooting Group Policy Security

FIGURE 8.48 Displaying the applied IP security policies. In this case, the Secure Server policy is the one that prevails.

3. The policy that appears at the top of the list (with the smallest precedence number) is the one that prevails. To view its detailed settings, right-click this policy and choose Properties to display the policy’s Properties dialog box, as shown in Figure 8.49.

FIGURE 8.49

Displaying the properties of the policy that

prevails.

4. To display additional information on the applied IP filters, select any filter from the list whose check box is selected and then click the View button.

584

Chapter 8: Managing Group Policy

Other Possible Security-related Problems RSoP allows you to troubleshoot a large range of security-related problems. The following are some that you might encounter: . Inability to log on after applying software restriction policies—If you set an essen-

tial program or file to Disallowed when configuring a software restriction policy, you might be unable to log on. You can remedy this problem by starting the computer in Safe Mode and logging on as a local administrator. Doing so enables you to run RSoP to check policy application, make the required corrections, and then restart the computer normally. . Running only software that is signed by trusted publishers—If users are able to run

software applications that are not signed or signed by publishers with revoked certificates, use RSoP in logging mode to examine policy precedence. Another GPO linked higher in the sequence could be overwriting the GPO containing the restriction policy. . Security settings not applied as expected—This problem can occur if settings in

another GPO overwrite your intended security settings. Use RSoP in logging mode to query the user/computer combination in question and check the precedence of applied GPOs. Note that you can also test GPO links by right-clicking the GPO name in the Group Policy Object Editor and choosing Properties. The Links tab displays the objects to which the GPO is linked.

Use of Gpresult to Troubleshoot Group Policy Security Settings The use of Gpresult to view and troubleshoot the application of security policy settings in Group Policy is similar to its use for displaying other settings, as described earlier in this chapter. Figure 8.50 shows an example of user settings including filtered GPOs as displayed by Gpresult. Use the /v option to obtain verbose output, which shows the settings applied to security-based policies such as account policies, as shown in Figure 8.51.

FIGURE 8.50 Gpresult output showing GPOs that were filtered.

585

Troubleshooting Group Policy Security

Verbose Gpresult output showing account policy settings. FIGURE 8.51

NOTE Gpresult Does Not Provide Policy Precedence Data If you need to obtain policy precedence information, use RSoP in logging mode. Gpresult provides current security policy settings, but it does not pro-

vide information on the precedence of GPOs affecting security policy or other policies.

Best Practices When Troubleshooting Group Policy Settings The following are several items you should check when Group Policy settings are not being applied as expected: . Group Policy inheritance settings—Remember that the Block Inheritance and

Enforced settings affect the application of GPOs linked to various containers. Also, remember that the Enforced setting takes precedence if both these settings are configured for a given GPO. . Group Policy filtering settings—Remember that users must have both the Read and

Apply Group Policy permissions allowed for the settings in the GPO to be applied. Also remember that a specific denial of these permissions always overrides allowed permissions. . Disabled portion of the GPO—Remember that you can disable either the Computer

or User Configuration branches. If settings are configured in a branch of the GPO that is disabled, they will not be applied.

586

Chapter 8: Managing Group Policy

Chapter Summary In this chapter, you learned how to manage and troubleshoot Group Policy and apply Group Policy to the maintenance and upgrading of software. New to Windows Server 2003 Group Policy is the Resultant Set of Policy (RSoP) tool. You can run RSoP in either planning or logging mode. Also known as Group Policy Modeling, RSoP planning mode predicts the effect of multiple GPOs on a user’s computing environment according to factors such as the user’s group membership, site location, slow network connection, and so on. Also known as Group Policy Results, RSoP logging mode tracks the actual application of Group Policy to a specified user/computer combination. RSoP’s logging mode does not offer the same options as planning mode; however, it provides a list of the GPOs that were actually applied as well as those that were not applied for any reason, such as filtering. You can choose to track the application of only user settings or computer settings to simplify the chore of wading through complex settings looking for the problematic one. You can also gather RSoP logging mode data by using the Gpresult command-line tool or the Advanced System Information utility that is available from the Help and Support Center. You learned about the use of Group Policy for software maintenance. Group Policy allows you to replace an existing package with a new one or upgrade over the existing package. The latter option retains the users’ application preferences, document type associations, and so on. You can also redeploy upgraded software packages. You can apply transforms to software packages when you are deploying the software. These files, which have the .mst extension, work in conjunction with the .msi file to produce a customized deployment. Patch files, which have the .msp extension, are used for such purposes as applying bug fixes, service packs, and so on. When outdated software is no longer useful, you can use Group Policy to remove it from users’ computers. Removal can be either mandatory, in which the software is removed from the computers the next time they are restarted or the user logs on, or optional, in which the software remains on users’ computers but is not available for reinstall. You can use Group Policy to configure the conditions of automatic updates for client computers from the Windows Update website. It provides several options for scheduling and managing these updates. You also can use RSoP and Gpresult to troubleshoot security options such as IPSec policy assignments for users and computers to which the policy applies.

587

Apply Your Knowledge

Key Terms . Advanced System Information . Automatic Updates . Gpotool . Gpresult . Gpupdate . Group Policy Management Console (GPMC) . Group Policy Modeling . Group Policy Results . Logging mode . Mandatory upgrade . Optional removal . Optional upgrade . Patch files . Planning mode . Precedence . Redeployment . Resultant Set of Policy (RSoP) . Transform files . Windows Update

Apply Your Knowledge The 70-294 exam tests your knowledge of the various situations that can be encountered when managing, maintaining, and troubleshooting Group Policy. You need to know how to use RSoP to plan and troubleshoot policy settings, and when to use planning mode or logging mode. You must know how to maintain software and troubleshoot the incorrect application of Group Policy settings, including security settings. The exercises and exam questions presented here serve to reinforce these requirements.

588

Chapter 8: Managing Group Policy

Note that you may encounter drag-and-drop or hot-spot questions on the exam. Due to the limitations of the printed page, we are unable to include questions of these types in the exam questions section. However, the explanations suggest the possibility of these question types where appropriate.

Exercises The exercises in this chapter assume that you have the same two computers you used in Chapter 7: a Windows Server 2003 domain controller and a client computer running either Windows XP Professional or Windows Server 2003 as a member server. They also assume that you have performed the exercises of Chapter 7 and have logged on to the client computer as the users you have created.

8.1 Using Resultant Set of Policy in Planning Mode In this exercise, you use RSoP in planning mode to predict the effect of the various policies you configured earlier in this exercise on a user who has not logged on to the domain. Recall that the planning mode of RSoP provides a “what if” scenario to predict the effects of a proposed series of policies on a specified user/computer combination. In this exercise, you predict the policies that would apply to a user named JudyG working at the Client1 computer, given the current configuration. You then remove the Block Inheritance setting you configured earlier for the Accounts Payable Policy and repeat the prediction. Finally, you predict the effect of adding this user to the Managers group. Do this exercise at the domain controller. Estimated Time: 20 minutes 1. Log on as Administrator. 2. Click Start, Run, type mmc, and then press Enter. 3. Click File, Add/Remove Snap-In. 4. On the Add/Remove Snap-In dialog box, click Add. 5. In the Available Snap-In dialog box, select Resultant Set of Policy, click Add, and then click Close. 6. Close the Add/Remove Snap-In dialog box. 7. Click File, Save As and save the console to the desktop with a descriptive name such as RSoP. 8. In the console tree, right-click Resultant Set of Policy and choose Generate RSoP Data to start the Resultant Set of Policy Wizard. 9. Click Next. On the Mode Selection page, select Planning mode and then click Next. 10. Under User Information, select User and type Domain1\JudyG. Under Computer Information, select Computer and then type Domain1\Client1.

589

Apply Your Knowledge 11. Select the Skip to the Final Page of This Wizard Without Collecting Additional Data check box and then click Next. 12. The Summary of Selections page summarizes the selections you have made. Click Next to process the simulation. 13. When the completion page appears, click Finish to display a Console Root\JudyG on Client1— RSoP page that looks similar to the Group Policy Object Editor snap-in. 14. Expand the console tree and expand the User Configuration\Administrative Templates node. 15. Note that you have available only the nodes for which you configured policies, namely the Start Menu and Taskbar, and Desktop nodes. Click Start Menu and Taskbar. 16. What policies appear in the details pane, and what is their state?

17. Right-click one of the policies, and choose Properties. Select the Precedence tab. Why is only the Accounts Payable Policy displayed?

18. Close the Properties dialog box for the policy. 19. Click Desktop. What policy appears in the details pane, and what is its state?

20. Open Group Policy Management Console and expand the domain listing in the console tree so that the Payable OU is visible. 21. Right-click this OU and select Block Inheritance to remove the check mark from this item. 22. In the RSoP snap-in, right-click JudyG on Client1 and choose Refresh Query to reprocess the same query parameters to reflect the removal of Block Inheritance. 23. Expand the console tree to locate the Start Menu and Taskbar node and click it. Which additional policy appears in the details pane, and what is its state?

590

Chapter 8: Managing Group Policy 24. Right-click either the Help or Run menu policies and choose Properties. What entries appear in the Precedence tab? Why?

25. Close the Properties dialog box for the policy. 26. To predict the effect of adding JudyG to the Managers group, right-click JudyG on Client1 and choose Change Query to restart the Resultant Set of Policy Wizard. 27. Click Next three times to reach the User Security Groups page. 28. Click Add. On the Select Groups dialog box, type Managers and then click OK. 29. Select the Skip to the Final Page of This Wizard Without Collecting Additional Data check box and then click Next. 30. Review the summary information and then click Next. 31. When the completion page appears, click Finish. 32. Expand the console tree to locate the Start Menu and Taskbar entry. What entries appear in the details pane? Why?

33. Right-click one of these entries, choose Properties, and select the Precedence tab. What entries appear in this tab? Why?

34. Close all dialog boxes. If asked to save settings to RSOP.msc, click No. 35. Open Group Policy Management Console and expand the console tree so that the Payable OU is visible. 36. Right-click this OU and select Block Inheritance to add a check mark to this item.

591

Apply Your Knowledge

8.2 Running RSoP in Logging Mode In this exercise, you run RSoP in logging mode for several user/computer combinations used during the Chapter 7 exercises. You notice the sequence in which the GPOs were applied and the settings that prevail in the case of conflicts. Estimated Time: 20 minutes 1. Ensure that the client computer is turned on. At this point, a user does not need to be logged on to this computer. 2. Log on to the domain controller as the administrator. 3. Open the Resultant Set of Policy snap-in you created in Exercise 8.1. 4. In the console tree of the Resultant Set of Policy snap-in, right-click Resultant Set of Policy and choose Generate RSoP Data to start the Resultant Set of Policy Wizard. 5. Click Next, and on the Mode Selection page, ensure that Logging mode is selected. Then click Next. 6. On the Computer Selection page, select Another computer, type Computer1 in the text box, and click Next. 7. On the User Selection page, ensure that the Display Policy Settings For and Select a Specific User radio buttons are selected. Select DOMAIN1\MaggieS from the user list and then click Next. 8. Review your choices in the Summary of Selections page and then click Next. 9. When the Completing the Resultant Set of Policy Wizard page appears, click Finish. 10. Expand User Configuration\Administrative Templates and select Start Menu and Taskbar. What information appears in the details pane?

11. In the console tree, right-click MaggieS on Computer1—RSoP and choose Change Query to restart the Resultant Set of Policy Wizard. 12. Click Next, and on the User Selection page, select DOMAIN1\DarcyR and then click Next twice to process this query. 13. When the query is finished, click Finish. 14. On the console tree of the RSoP snap-in, expand User Configuration\Administrative Templates. What information do you receive? Why?

592

Chapter 8: Managing Group Policy 15. Repeat steps 10–12, this time selecting DOMAIN1\RodneyL as the user to be processed. 16. Expand User Configuration\Administrative Templates and select Start Menu and Taskbar. What information appears in the details pane?

17. Right-click Remove Help menu from the Start Menu, select Properties, and click the Precedence tab. What information appears? Why?

18. Click OK. 19. Open Group Policy Management Console and expand the domain listing in the console tree so that the Payable OU is visible. 20. Right-click this OU and select Block Inheritance to remove the check mark from this item. 21. Open a command prompt, type Gpupdate /force, and then press Enter. Wait until the policy refresh is completed. 22. At the client computer, log on as RodneyL with a password of password. If this user is already logged on to the client computer, log off and log back on. 23. Return to the RSoP snap-in. In the console tree, right-click RodneyL on Computer1 and choose Refresh Query to reprocess RSoP in logging mode to reflect the removal of Block Inheritance. 24. Expand User Configuration\Administrative Templates and select Start Menu and Taskbar. What information appears in the details pane?

25. Right-click Remove Help Menu from Start Menu, select Properties, and click the Precedence tab. What information appears? Why?

26. Close the RSoP snap-in. If asked whether you wish to save the settings, click No.

593

Apply Your Knowledge

8.3 Gpresult In this exercise, you run Gpresult for several user/computer combinations used during the Chapter 7 exercises and compare the results to those obtained in Exercise 8.2. Estimated Time: 10 minutes 1. You should still be logged on to the domain controller as Administrator. 2. Open a command prompt, type Gpresult /s Computer1 /user MaggieS, and press Enter. What GPOs were applied to this user?

3. Note that you do not receive any information regarding policies in the GPOs that were applied. 4. At the command prompt, type Gpresult /s Computer1 /user DarcyR, and then press Enter. What GPOs were applied to this user?

5. At the command prompt, type Gpresult /s Computer1 /user RodneyL, and then press Enter. What GPOs were applied to this user?

6. At the command prompt, type Gpresult /s Computer1 /user RodneyL /v /scope user, and then press Enter. What additional interesting information do you see?

7. At the command prompt, type Gpresult /s Computer1 /user JudyG, and press Enter. What happens? Why?

8. Close the command prompt.

594

Chapter 8: Managing Group Policy

8.4 Software Updates In this exercise, you configure an upgrade to the software package you installed in Chapter 7. Because no upgrade to the Windows Server 2003 Administration Tools Pack is available (at the time of writing), you simply reinstall the pack to observe the upgrade process. If you have another software upgrade package with a Windows Installer .msi file, you can substitute it for this package. Estimated Time: 15 minutes 1. You should still be logged on to the domain controller as Administrator. 2. Open Group Policy Management Console and expand the domain listing in the console tree to locate the Accounting Policy GPO under the Group Policy Objects node. 3. Right-click the Accounting Policy GPO and choose Edit to open the Group Policy Object Editor. 4. Navigate to the User Configuration\Software Settings\Software Installation node. The package you installed in Exercise 7.7 of Chapter 7 should be visible in the details pane. 5. Right-click Software Installation and choose New, Package. 6. In the Open dialog box, navigate through My Network Places to the shared folder that contains the Adminpak.msi file (or other file that you might have available), select this file, and click Open. 7. In the Deploy Software dialog box, select Assigned and click OK. After a few seconds, the package appears in the details pane. 8. Right-click the new package and choose Properties. Select the Upgrades tab and then click Add. 9. In the Add Upgrade Package dialog box, select the previous version of the Windows Server 2003 Administration Tools Pack. Select the Uninstall the Existing Package, Then Install the Upgrade Package option and then click OK. 10. Back in the Upgrades tab, select the Required Upgrade for Existing Packages check box and then click OK. You return to the Group Policy Object Editor, where you will notice that both the original and the upgraded packages appear. Close the Group Policy Object Editor and then click OK to close the Accounting Properties dialog box. 11. At the client computer, log on as MaggieS with a password of password. What happens before your logon completes? Why?

595

Apply Your Knowledge 12. Click Start, Active Directory Users and Computers. If this option does not appear on the program list in the Start menu, right-click Start, choose Properties, and go to the Advanced tab of the Customize Start Menu dialog box. Under System Administrative Tools, select Display on the All Programs Menu and the Start Menu option. Then click Start, All Programs, Administrative Tools, Active Directory Users and Computers. What happens? Why?

13. Click Next and then follow the instructions that appear. What happens?

14. If you want, select another tool from the Administrative Tools menu and note that the entire process repeats. 15. Close all programs and log off.

8.5 Removal of Software In this exercise, you remove the software packages you installed in the previous exercises. Then you verify its removal from the client computer. Estimated Time: 5 minutes 1. At the domain controller, open the Group Policy Object Editor console for the Accounting Policy GPO. 2. Right-click the updated software package you just configured and choose All Tasks, Remove. 3. On the Remove Software dialog box, choose Immediately Uninstall the Software from Users and Computers and then click OK. The package is removed from the details pane. 4. Close Active Directory Users and Computers. 5. Log on to the client computer as MaggieS with a password of password. What happens? Why?

6. Note that links to the administration tools are no longer present in the Start, All Programs menu. 7. Log off.

596

Chapter 8: Managing Group Policy

Exam Questions 1. You are a systems administrator for a company whose Active Directory forest includes three domains and more than 50 OUs. One afternoon you receive a call from a user named Emily at the suburban office 20 miles away; she complains that she hasn’t been able to access Internet Explorer on her Windows XP Professional computer, and that she plans to take the rest of the day off but wants the problem corrected by tomorrow morning. She needs to access information from the Internet to do her job properly. You run RSoP in logging mode to determine what policy is keeping her from accessing Internet Explorer and receive the message that you failed to connect to her computer because the RPC server is unavailable. Which of the following should you do to receive RSoP information?

❍

A. You should check the Error Information tab of the Computer Configuration node of the RSoP snap-in to obtain additional information regarding the cause of this error.

❍

B. You should run Active Directory Users and Computers, access the domain properties, and locate the RPC server. Then you should check the status of this server and its network connectivity.

❍

C. Because Emily went home early and shut off her computer, RSoP in logging mode won’t work. You should use the Gpresult command instead.

❍ D. Because Emily went home early and shut off her computer, RSoP in logging mode won’t work. You should rerun the RSoP query, changing to planning mode. 2. You are the systems administrator of a Windows Server 2003 native mode domain that has five OUs corresponding to company departments. You have implemented two IP security policies in Group Policy: One policy, contained within the Default Domain Policy GPO, specifies the Server (Request Security) option, and the second policy, contained within the Legal GPO, specifies the Secure Server (Require Security) option. The Legal GPO is linked to the Legal OU. Murray, a lawyer whose user account is in the Legal OU, complains that a user with a Windows NT 4.0 computer is able to connect to his client computer running Windows XP Professional. He understands that the Secure Server (Require Security) option should prevent connections from computers that do not support IPSec. You run RSoP in logging mode, focusing on his user account and computer, and discover that the Server (Request Security) option is the only policy that appears in the details pane when you open the IPSec Policy node. Which of the following is the most likely reason for this occurrence?

❍

A. Murray’s user account belongs to a security group for which the Apply Group Policy permission on the Legal GPO has been denied.

❍

B. The Default Domain Policy GPO has been configured with the Enforced option; therefore, conflicting policy settings configured at the Legal OU level do not apply.

597

Apply Your Knowledge

❍

C. Murray’s computer account is not located in the Legal OU. Because IP security policies are configured under the Computer Configuration node, computer policies applied in this node do not apply to his computer.

❍ D. IPSec security policies are applied only at the domain level. Policies specified at the OU level are ignored, so the domain-based policy was applied to Murray’s computer. 3. You are deploying Microsoft Office 2003 to a group of users located in your company’s Montreal office. These users need a French language dictionary, so you have obtained an .mst transform file to add the dictionary to the software installation package. You access the Modifications tab of the package’s Properties dialog box to add the modification file, but the Add button is grayed out. What is preventing you from adding the modification to this package?

❍

A. You did not select the Advanced option from the Deploy Software dialog box when you began to deploy the software. The Published or Assigned options do not allow you to deploy the software with modifications.

❍

B. You have not copied the .mst file to the same shared folder as the .msi file. These files need to be in the same location so that they are deployed together.

❍

C. You do not have the proper permissions on the .mst file. Ensure that you have the Full Control permission on this file so that it will be available when you deploy the package.

❍ D. You published the package instead of assigning it. Only assigned applications can be deployed with modifications. 4. Phil is a systems administrator for a large advertising agency that makes considerable use of Adobe Illustrator in designing and creating its products. He has received an upgrade that all users need, and he wants to ensure that they are unable to use the old version of Illustrator. What should he do to accomplish this objective with the least amount of disruption to users? (Each answer represents part of the solution. Choose two answers.)

❏

A. Select the Immediately Uninstall the Software from Users and Computers option from the Remove Software dialog box.

❏

B. Select the Advanced Deployment option from the Deploy Software dialog box.

❏

C. Select the Uninstall the Existing Package, Then Install the Upgrade Package option from the Add Upgrade Package dialog box.

❏ D. Select the Package Can Upgrade over the Existing Package option from the Add Upgrade Package dialog box.

❏

E. Select the Required Upgrade for Existing Packages option from the Upgrades tab of the package’s Properties dialog box.

598

Chapter 8: Managing Group Policy 5. You are attempting to troubleshoot an unknown policy problem using RSoP in logging mode, but the RSoP console displays several error icons. You access the Error Information tabs of the User Configuration Properties and Computer Configuration Properties dialog boxes. Which of the following errors will provide information to these tabs? Choose all that apply.

❏

A. User does not exist.

❏

B. Unable to connect to domain.

❏

C. Unable to connect to client computer.

❏ D. Folder Redirection did not complete policy processing because the user needs to log on again. 6. Helen is an assistant administrator for a company that operates an Active Directory domain with OUs for each of the company’s departments. She has configured the removal of an application from computers in the Marketing OU with the Immediately Uninstall the Software from Users and Computers option. The next day, she notices that the application is still present on several computers in the Marketing department, although it has been removed from most of the computers in this department. Which of the following is the most likely reason for the application still being present on some computers?

❍

A. Users who still have the application are supervisors in this department and are not subject to this GPO.

❍

B. Users who still have the application have reinstalled it from the Add or Remove Programs applet in Control Panel.

❍

C. The computers on which the application is still present belong to a security group for which the Apply Group Policy permission for the GPO has been denied.

❍ D. Users who still have the application have downloaded an update from the Internet that prevents the software from being uninstalled. 7. Users in your company regularly turn off their computers at the end of the business day. You want to keep the computers up-to-date by always having the most recent updates installed from the Windows Update website, so you have configured a GPO for automatic updating. But some users have complained that their computers have restarted during the lunch hour and work has been lost. What should you do to prevent data loss while keeping all client computers up-to-date?

❍ A. Enable the No Auto-Restart for Scheduled Automatic Updates installations policy. ❍ B. Enable the Do Not Display “Install Updates and Shut Down” option policy. ❍

C. Specify the Auto Download and Schedule the Install option and specify that installs take place at 4 p.m.

❍ D. Specify the Notify for Download and Notify for Install option and let users perform the downloads themselves.

❍

E. Enable the Reschedule Automatic Updates scheduled installations policy.

599

Apply Your Knowledge 8. Julian is the network administrator for an engineering firm that operates a single domain Active Directory network. He needs to use a GPO to deploy a new structural design application to all engineers and technicians. The application providers have packaged it in the native Windows Installer format. He wants to customize the installation package for this application so that users receive only company-approved components. Which type of file should Julian employ to perform this customization?

❍

A. An .msi file

❍

B. An .mst file

❍

C. An .msp file

❍ D. A .zap file 9. After a complaint from a user named Jim that he cannot reach the Display applet in Control Panel, you run RSoP in logging mode to determine what GPO is preventing him from accessing this location. After locating and modifying the responsible GPO, you return to the RSoP console and select the Refresh Query option. The results of the analysis indicate that he is still unable to reach the Display applet. Which of the following should you do next?

❍

A. Ask Jim to log off and log back on to his computer. Then run the RSoP query again using the Refresh Query option a second time.

❍

B. Rerun the RSoP query by using the Change Query option rather than the Refresh Query option.

❍

C. Execute the Gpupdate /force command and then run the RSoP query again using the Refresh Query option a second time.

❍ D. Check the Error Information tabs of the Computer Configuration and User Configuration Properties dialog boxes for further information. 10. From which of the following places can you perform a logging mode RSoP analysis of policies that apply to a given user and computer? Choose all that apply.

❏

A. Active Directory Users and Computers

❏

B. Active Directory Sites and Services

❏

C. Active Directory Domains and Trusts

❏ D. The Gpresult command ❏

E. The Computer Management MMC

❏

F. The Advanced System Information tool in the Windows XP/2003 Help and Support Center

❏ G. The Gpotool command ❏ H. The Group Policy Management Console

600

Chapter 8: Managing Group Policy 11. Teresa is the domain administrator for her company, which operates an Active Directory domain. Management has hired Carolyn as a new accounts receivable clerk, and she will be starting work next Monday. The company needs assurance that Carolyn will be able to access only the restricted portions of the desktop specified in a GPO linked to the Clerks OU. Teresa has created a new user account for Carolyn in this OU but is unsure whether the desktop policies will be properly applied because several other GPOs will also be applied to this account. What is the simplest manner that Teresa can use to ensure that Carolyn’s account receives the proper policies?

❍

A. Run RSoP in planning mode and specify the location of Carolyn’s account and the groups she will be a member of.

❍

B. Run RSoP in logging mode and specify the location of Carolyn’s account and the groups she will be a member of.

❍

C. Log on to a client computer with Carolyn’s account and explore the desktop to see what settings have been applied.

❍ D. Check the Properties dialog box for each applicable GPO to see which groups have been granted the Read and Apply Group Policy permissions. 12. Fred is the systems administrator for a company that operates an Active Directory network consisting of a single domain. All servers run Windows Server 2003 and all client computers run Windows XP Professional. The domain includes OUs that are organized by department, including Accounting and Finance. Each OU has several GPOs linked to it, and policies are also applied to users in the Default Domain Policy GPO. Because of departmental reorganization, the Accounting department has become a work unit within the Finance department, and Andrew’s manager has asked him to make the Accounting OU a child of the Finance OU. The manager has also asked him to ensure that work disruption to users in the Accounting OU is minimized, and Andrew needs to find out whether any policies in the Finance OU will adversely affect users in the Accounting OU. What should Andrew do?

❍

A. Run RSoP in planning mode on the Finance OU, and simulate policy settings for the Accounting OU.

❍

B. Run RSoP in planning mode on the Accounting OU, and simulate policy settings for the Finance OU.

❍

C. Run RSoP in logging mode on the Accounting OU, and review resultant policy settings for users in this OU.

❍ D. Run RSoP in logging mode on the Finance OU, and review resultant policy settings for users in this OU.

601

Apply Your Knowledge

Answers to Exercises 8.1

Using Resultant Set of Policy in Planning Mode 16. Remove Help Menu from Start Menu and Remove Run Menu from Start menu. These policies are disabled from the Accounts Payable policy. 17. Only the Accounts Payable Policy appears in the Precedence tab because the Accounting OU is configured with Block Inheritance and therefore does not apply at this level. 19. The Prohibit User from Changing My Documents Path policy is enabled from the Accounts Payable policy. 23. The Remove Documents Menu from Start Menu policy also appears, and its state is Enabled from the Accounting Policy. 24. The Accounts Payable Policy appears with a setting of Disabled, and the Accounting Policy also appears with a setting of Enabled. Note that the GPO higher in the list has the highest priority. The two policies both appear because you removed the Block Inheritance option that prevented the Accounting Policy entry from appearing earlier. 32. The Remove Help Menu from Start Menu and Remove Run Menu from Start Menu entries are the only ones visible. They are both disabled. The Remove Documents Menu from Start Menu policy no longer appears because the Accounting Policy is filtered to not apply to the members of the Managers group. 33. Only the Accounts Payable Policy appears in the Precedence tab because the Accounting Policy is filtered to not apply to the members of the Managers group.

8.2

Running RSoP in Logging Mode 10. Three policies appear: Remove Documents Menu from Start Menu, Remove Help Menu from Start Menu, and Remove Run Menu from Start Menu. All three are enabled from the Accounting Policy GPO. These policies appeared because MaggieS’s user account is in the Accounting OU. 14. The Administrative Templates node does not appear because DarcyR belongs to the Managers group, and the Accounting Policy GPO was configured with the Deny permission for Read and Apply Group Policy in exercise 7.5 of Chapter 7. No other GPOs with policies configured at this node would apply to this user. 16. Two policies are visible: Remove Help Menu from Start Menu and Remove Run Menu from Start Menu, both disabled, with a GPO name of Accounts Payable Policy. 17. The Accounts Payable Policy with the Disabled setting is the only GPO that is visible in the list. Because the Payable OU was configured with Block Inheritance in exercise 7.5 of Chapter 7, it does not appear in the list.

602

Chapter 8: Managing Group Policy 24. Three policies are visible: Remove Documents Menu from Start Menu, with a status of Enabled and a GPO name of Accounting Policy; Remove Help Menu from Start Menu; and Remove Run Menu from Start Menu, both of the later are disabled, with a GPO name of Accounts Payable Policy. 25. The Accounts Payable Policy with a setting of Disabled appears first, followed by the Accounting Policy, with a setting of Enabled. Note that GPOs higher in the list have the highest priority. The information that is visible here reflects the fact that the child OU GPO (Accounts Payable Policy) is applied after the parent OU GPO (Accounting Policy).

8.3

Gpresult 2. The Accounting Policy and Default Domain Policy GPOs are listed under the heading Applied Group Policy Objects. Note that they are listed in reverse order of their application; in other words, the GPO at the top of the list has precedence. 4. Only the Default Domain Policy GPO appears. Note that you are informed that this user belongs to the Managers security group. Because of this group membership, the Accounting Policy GPO was filtered out. 5. The Accounts Payable Policy, the Accounting Policy, and the Default Domain Policy all appear, in the reverse order of their application. 6. You see a long series of nodes from the User Configuration branch of Group Policy. Under Administrative templates, four policies appear: from the Accounting Policy GPO, the NoRecentDocsMenu policy (Prohibit User from Changing My Documents Path) appears with the state of Enabled; from the Accounts Payable Policy GPO, the NoRun (Remove Run Menu from Start Menu) and NoSMHelp (Remove Help Menu from Start Menu) policies appear with the state of Disabled; and the DisablePersonalDirChange policy (Prohibit User from Changing My Documents Path) appears with the state of Enabled. 7. You receive a message that this user does not have RSoP data. This situation occurred because JudyG did not log on to Computer1 during the exercises in Chapter 7. Note that if you have logged this user on to Computer1 during any type of practice not described in this training guide, you will receive RSoP data.

8.4

Software Updates 11. Before your taskbar and Start menu appear, you receive a message informing you that the managed software Windows Server 2003 Administration Tools package is being removed. This package is removed because you selected the Uninstall the Existing Package, Then Install the Upgrade Package option when you added the upgrade package. 12. A Windows Installer dialog box appears, and then the Windows Server 2003 Administration Tools Pack Setup Wizard appears. This occurs because you assigned the upgrade package to users. 13. The wizard installs Active Directory Users and Computers on the client computer. When you click Finish, Active Directory Users and Computers opens.

603

Apply Your Knowledge

8.5

Removal of Software 5. As you observed in exercise 8.3, the managed software package is removed.

Answers to Exam Questions 1. D. When used in logging mode, RSoP needs to connect to the target computer you have specified to complete the query. You could phone someone at Emily’s office and ask that he turn on her computer, but you can easily obtain the same results by switching to planning mode, entering her computer and user information, and jumping to the end of the wizard. You cannot reach the Error Information tab because the RSoP Wizard is unable to complete its processing, so answer A is incorrect. The problem is not a case of inability to reach another server, so answer B is incorrect. Gpresult utilizes the same mechanism as RSoP in logging mode, so it won’t work in this scenario; therefore, answer C is incorrect. See the section “RSoP Logging Mode.” 2. C. Most security policies, including the IPSec Policy, are located in the Computer Configuration\Windows Settings\Security Settings node. The policy that applies to a given computer depends on the OU where the computer account, not the user account, is located. Computer accounts are initially created in the Computers container of Active Directory Users and Computers and as such are subject to domain-based policies only. You can move computer accounts to OUs to have OU-based computer policies apply to them. The Apply Group Policy permission might have been denied, or the Enforced option might have been specified at the domain level; however, these are not the most likely reasons for this problem. Consequently, answers A and B are incorrect. Unlike account policies, security policies can be applied at any level in the Active Directory hierarchy; therefore, answer D is incorrect. See the section “Troubleshooting Group Policy Security.” 3. A. When you deploy a software application, you have the options Published, Assigned, and Advanced. The Published and Assigned applications enable you to publish or assign the software package without modifications only. When you select the Advanced option, the package’s Properties dialog box appears, and you can add the required transform files from the Modifications tab. The .mst file does not need to be in the same shared folder as the .msi file, so answer B is incorrect. This is not a permissions issue, so answer C is incorrect. Modified packages can be either assigned or published; you select this option from the Deployment tab of the package’s Properties dialog box, so answer D is incorrect. See the section “Use of Transform Files to Modify Software Packages.” 4. D, E. To ensure that users can access only the new version of Adobe Illustrator, Phil can configure an application upgrade in Group Policy in which he has specified the Package Can Upgrade over the Existing Package and Required Upgrade for Existing Packages options. These two options accomplish the required objectives and retain user application preferences, file associations, and so on. You do not need to perform a software removal first, so answer A is incorrect. The Advanced Deployment option is used for adding modifications for existing packages, not for configuring upgrades, so answer B is incorrect. The Uninstall the Existing Package, Then Install the Upgrade Package option totally removes all references to the previous version, including application preferences and file associations, causing some inconvenience to users; therefore, answer C is incorrect. See the section “Use of Group Policy to Upgrade Applications.”

604

Chapter 8: Managing Group Policy 5. B, D. The Error Information tabs are a source of much information about why RSoP did not complete processing properly. You are informed by the appearance of one or more red X icons or yellow exclamation point icons in the console tree of the RSoP snap-in. These two problems provide information to the Error Information tabs. The other two problems cause RSoP processing to fail before the RSoP snap-in appears, so answers A and C are incorrect. See the section “Analyzing the RSoP Results.” 6. C. The Immediately Uninstall the Software from Users and Computers option automatically removes the software the next time the user reboots his machine or logs on. It is possible that users have not performed either of these tasks, but it is also possible that the computers that still have the software are filtered from the scope of the GPO. Helen can use Gpresult to check the GPOs being applied to these computers as well as the security groups to which the computers belong. Just being supervisors would not prevent the software from being uninstalled unless it means that there is a Supervisors group from which the application has been filtered. Answer A did not include this fact, so it is incorrect. Watch out for tricky options like this on the exam. The application would not be present in the Add or Remove Programs applet, so answer B is incorrect. It is not possible to prevent software removal via a GPO by using a patch downloaded from the Internet, so answer D is incorrect. See the section “Use of Group Policy for Software Removal.” 7. A. You should enable the No Auto-Restart for Scheduled Automatic Updates Installations policy. This policy is designed to prevent client computers from restarting after updates have been installed. Note that if this policy is enabled, Automatic Updates will be unable to detect future updates without a restart; however, in this case, users are shutting down their computers at the end of the day, so this is not an issue. The Do Not Display “Install Updates and Shut Down” option determines whether this option appears in the Shut Down Windows dialog box, but does not affect restarts caused by installation of updates, so answer B is incorrect. If you were to select the Configure Automatic Updates policy and schedule the installs to take place late in the work day such as at 4 p.m., restarts will still occur (although the users will be informed five minutes before the restart), so answer C is incorrect. If you let users perform the downloads themselves, their computers may not be kept up-to-date, so answer D is incorrect. The Reschedule Automatic Updates scheduled installations policy specifies the length of time that Automatic Updates waits after startup before proceeding with a missed scheduled installation. This policy does not help in this scenario, so answer E is incorrect. Note that a question similar to this could appear on the exam as a “hot-spot” question in which you must select the correct policy setting from the details pane of a screen shot of the Group Policy Object Editor. See the section “Configuring Automatic Updates for Network Clients Using Group policy.” 8. B. An .mst file is a transform, or modification file, which is deployed together with the native Windows Installer .msi file to provide the customized installation required in this scenario. Julian would use a tool provided by the software developer to create an .mst file. The .msi file by itself can be used only to deploy the application in its native configuration, so answer A is incorrect. An .msp file is a package that can be used to deploy a patch, update, or bug fix for an application that has already been deployed using an .msi file. It is not used in a customized deployment, so answer C is incorrect. The .zap file is used only with applications that do not come with an .msi file, so answer D is incorrect. See the section “Use of Transform Files to Modify Software Packages.”

605

Apply Your Knowledge 9. A. Just as Jim needs to log off and back on to receive the changes you made to Group Policy, he needs to do the same so that you can receive the correct settings from running RSoP in logging mode. Note that had you made a change in the Computer Configuration branch, Jim would have needed to restart his computer for the change to take effect and be shown in the RSoP results. Alternatively, you could have tested the settings by using RSoP in planning mode. The Change Query option allows you to change the user and/or computer being processed but does not help in this instance, so answer B is incorrect. You might need to use the Gpupdate /force command if Jim has not received the changes when he logs back on, but this is not the first thing you should do, so answer C is incorrect. The Error Information tabs will not provide diagnostic information because no error has occurred in Group Policy processing, so answer D is incorrect. For more information, see the section “Analyzing the RSoP Results.” 10. A, D, F, H. Besides these locations, you can also access RSoP in logging mode by creating a custom MMC console containing the RSoP snap-in or by running RSoP.msc from the Run dialog box. The other locations do not offer capabilities for accessing RSoP, so answers B, C, E, and G are incorrect. See the section “RSoP Logging Mode.” 11. A. Planning mode in RSoP is designed specifically for predicting the effect of multiple GPOs and other factors on a user’s desktop (and other) configurations. Teresa can input settings such as site location, alternate Active Directory paths (which include OU membership), loopback processing, security group membership, and WMI filters and determine which policies are applied to Carolyn’s account. Logging mode does not provide all these options and is not available before the user has first logged on, so answer B is incorrect. It is not necessary to log on as the user and explore the desktop to see what settings have been applied, so answer C is incorrect. It would be timeconsuming and error prone to explore the various GPOs and their permissions, which is what Teresa would have needed to do in Windows 2000, so answer D is incorrect. See the section “Resultant Set of Policy (RSoP).” 12. B. In this scenario, Fred needs to make the Accounting OU a child of the Finance OU. Therefore, users in the Accounting OU will receive the policies contained in the Finance OU GPOs as well as the Accounting OU GPOs. To test the effect of this change on users in the Accounting OU, Fred should run RSoP in planning mode on the Accounting OU, and simulate policy settings for the Finance OU. Planning mode simulates the effect of various types of changes, including changes in Active Directory structure, on policies applied to computers and users. It simulates the effect of such changes as user or computer membership in security groups, the location of user accounts in a domain’s OU hierarchy, and the site or OU configuration of an Active Directory domain. Using planning mode on the Finance OU and simulating settings for the Accounting OU would simulate the addition of the Finance OU to the Accounting OU, which is backwards. Therefore, answer A is incorrect. Logging mode provides answers to changes that have actually taken place, and is inappropriate here, so answers C and D are incorrect. See the section “RSoP Planning Mode.”

606

Chapter 8: Managing Group Policy

Suggested Readings and Resources 1. Lundy, Jim, and Microsoft Corporation. “Administering Group Policy with the Group

Policy Management Console.” http://download.microsoft.com/download/a/9/ c/a9c0f2b8-4803-4d63-8c32-3040d76aa98d/GPMC_Administering.doc. 2. Microsoft Corporation. “Group Policy Management Console with Service Pack 1.”

http://www.microsoft.com/downloads/details.aspx?FamilyID=0a6d4c24-8cbd-4b359272-dd3cbfc81887&DisplayLang=en. 3. Microsoft Corporation. “How to Install and Use RSoP in Windows Server 2003.”

http://support.microsoft.com/default.aspx?scid=kb;en-us;323276. 4. Microsoft Corporation. “Troubleshooting Group Policy Application Problems.”

http://support.microsoft.com/kb/250842/en-us. 5. Microsoft Corporation. “Troubleshooting Group Policy in Microsoft Windows

Server.” http://microsoft.com/downloads/details.aspx?FamilyId=B24BF2D5-0D7A4FC5-A14D-E91D211C21B2&displaylang=en. 6. Microsoft Corporation. “Troubleshooting Group Policy in Microsoft Windows Server

2003.” http://download.microsoft.com/download/5/f/9/5f949309-c0f8-4a92-bd6564ce312e2a92/gpmc_troubleshooting.doc.

PART II

Final Review Fast Facts Practice Exam Practice Exam Answers

This page intentionally left blank

Fast Facts MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure The preceding chapters in this book covered the objectives for the Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure exam. We hope that you took the time not only to read through the study material, but also to work through the exercises. After working through this material a few times, you should be ready to tackle the exam. This chapter is intended to be the material that you look through just before you go into the testing center. Organized by chapter, this section provides a review of the most important points that you need to know for the exam.

610

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

Planning and Implementing an Active Directory Infrastructure As you prepare for the 70-294 exam, you should keep in mind the far-ranging topics that make up this portion of the exam. You need to be familiar with all the components that fit together to form the completed Active Directory infrastructure, what each component does, and how you can configure these components to do the jobs they are responsible for. Microsoft endeavors to create scenarios in its exam questions that relate strongly to real-world situations, and to pass the exam you need to know how you would plan and implement each component of Active Directory to achieve the expected results.

Plan a Strategy for Placing Global Catalog Servers Global catalog servers enable users to log on and access resources across multiple domains. They contain information on all the objects located in their domain, as well as a subset of information on objects located in other domains of the forest. You need to know how the factors that influence placement of global catalog servers affect the smooth operation of the enterprise.

Evaluate Network Traffic Considerations When Placing Global Catalog Servers Consider the following factors when deciding where to place your global catalog servers: . Global catalog servers play an important role in the replication of the configuration

and schema Active Directory partitions. They also hold the forest’s universal groups. . When you install the first domain controller in a new forest, this domain controller,

by default, becomes a global catalog server. . You use Active Directory Sites and Services to create additional global catalog servers.

Select the Global Catalog check box, located on the General tab of the NTDS Settings Properties dialog box, to designate a domain controller as a global catalog server. . As your forest increases in size, more users will require access to resources in other

domains. You need to designate additional global catalog servers to facilitate rapid access to these resources. You should have at least one global catalog server per site so that users can perform searches without needing to cross slow WAN links. . The size of the global catalog will also increase with increasing forest size.

Consequently, the amount of replication traffic increases with increasing forest size. You need to balance these two factors to achieve optimum forest functionality.

611

Fast Facts

Evaluate the Need to Enable Universal Group Caching Universal groups can hold members from any domain in the forest and be assigned permissions to any resource in the forest. Keep in mind the following factors related to universal group caching: . Universal group caching is a new capability of Windows Server 2003 that allows any

domain controller to store the universal group membership of a user who has logged on once to that domain controller. . When you enable universal group caching, logon times are expedited because the

domain controller does not need to access a global catalog server. Consequently, there is less need to have a global catalog server at each site. . Replication traffic is reduced because domain controllers do not need to replicate all

the objects in the forest. . You enable universal group caching at the site level by selecting a check box in the

NTDS Site Settings dialog box in Active Directory Sites and Services.

Plan Flexible Operations Master Role Placement The operations masters are roles played by domain controllers on a single master replication basis, as opposed to the multimaster replication nature of most Active Directory components. These roles are also known as flexible single-master operations (FSMO) roles. Table 1 describes the five operations master roles. TABLE 1 Operations Master Roles Operations Master

What It Does

Schema master

The schema master holds the only writable copy of the schema in each forest and is the only location at which you can perform updates and modifications to the schema. There is only one schema master per forest.

Domain naming master

The domain naming master plays a role in ensuring that names of newly created domains adhere to the proper naming conventions of trees and child domains. It also ensures that all trusts within the forest are implemented properly. There is only one domain naming master per forest.

PDC emulator

The PDC emulator acts as a primary domain controller (PDC) to any Windows NT 4.0 backup domain controllers (BDCs), replicating changes to user properties such as password changes to these servers. This server is the final authority on password changes for all domain controllers. It keeps a record of all password changes and ensures that other domain controllers know each user’s current password. The PDC emulator also acts as a time synchronization server, ensuring that the time is synchronized among all domain controllers in the domain. There is one PDC emulator for each domain in the forest. (continues)

612

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

TABLE 1 Continued Operations Master

What It Does

Infrastructure master

The infrastructure master manages information related to domain groups and their membership. It updates references from objects in its domain, such as group memberships, to other domains. This is important because users and groups can become members of groups located in other domains. There is one infrastructure master for each domain in the forest.

RID master

The RID master handles the assignment of relative identifiers (RIDs) to other domain controllers in the domain. This RID is combined with the domain security identifier (SID) to create the object’s SID. The RID master ensures that no two objects in the domain have the same SID. There is one RID master for each domain in the forest.

Plan for Business Continuity of Operations Master Roles Because domain controllers are created as peers in Active Directory, you can perform most operations on any domain controller. The FSMO role holders perform actions that can take place only at a single domain controller. You should keep the following points in mind when planning the business continuity of operations master roles: . Only Windows 2000 or Windows Server 2003 domain controllers can be configured as

operations masters. In a domain operating at the Windows 2000 mixed functional level, Windows NT 4.0 BDCs cannot hold the operations master roles. . You should move one or more operations master roles to other domain controllers for

load-balancing purposes—in other words, to distribute the processing load among more than one domain controller. . When you create a new domain in the forest, you must ensure that the domain naming

master is available. . Should you need to modify the schema, you must ensure that the schema master is

available. . In a domain operating at the Windows 2000 mixed functional level, you must ensure

that the PDC emulator is available if you need to make user account modifications, including password changes performed by the users themselves. . In any domain that contains client computers running operating systems older than

Windows 2000 and without the Active Directory client installed, you must ensure that the PDC emulator is available so that users can change their passwords. . When you modify the group membership structure of the domain in any way, you need

to ensure that the infrastructure master is available. This includes changes in group membership that can cross domains.

613

Fast Facts . When you create new user, computer, or group accounts, adequate RIDs must be avail-

able to create the SIDs for these objects. These actions require that the RID master be available. . If you need to remove any operations master temporarily from the network, you can

transfer the role to another domain controller. Use the Active Directory Users and Computers console to transfer the roles of the PDC emulator, infrastructure master, or RID master. Use the Active Directory Domains and Trusts console to transfer the role of the domain naming master. Use the Active Directory Schema console to transfer the role of the schema master. You can also use the ntdsutil utility to transfer operations master roles. . If any operations master role has become permanently unavailable (for example, data

corruption or hard disk failure), you should seize the role at another domain controller. You use the ntdsutil utility to seize operations master roles. If you seize the schema master or domain naming master, you should reformat the hard drive of the domain controller that formerly held the role and reinstall Windows before returning the server to active duty. You can transfer the infrastructure master or PDC emulator back to the original role holder after bringing it back online. You can also return the original RID master to the network by replicating data across a temporary network.

Identify Operations Master Role Dependencies Consider the following when determining which domain controllers will hold which operations master roles: . In a multidomain environment, you should not place the infrastructure master on a

domain controller that also acts as a global catalog server. If you do not follow this guideline, the infrastructure master will be unable to update and replicate the group membership information properly. . A dependency also exists between the schema master and the global catalog servers. If

you have chosen to replicate all schema attributes to the global catalog, information is added to the global catalog server that pertains to each schema attribute. Consequently, a fast connection between these servers should be available. . In general, you should place the schema master and domain naming master roles on

the same domain controller. Doing so simplifies Active Directory management. For example, you can often do without these roles on a temporary basis; should this domain controller fail, you can often repair it and bring it back online without the need to transfer or seize these roles.

614

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

Implement an Active Directory Service Forest and Domain Structure Active Directory enables you to plan and implement its structure using several methods. To make the best use of these methods, you need to first plan how you will create trees, domains, and OUs. You need to be aware of the capabilities and limitations of each Active Directory container so that you will arrive at the best design for your forest. Doing so reduces the possibility that you might have to tear down an incorrect structure and rebuild it from scratch— a process that can be very time-consuming for you and frustrating to your users.

Create the Forest Root Domain The first activity that you will need to perform when you create Active Directory is to install the forest root domain. Keep in mind the following facts when creating this domain: . The computer on which you install Active Directory must be running Windows Server

2003 Standard Edition, Enterprise Edition, or Datacenter Edition. It must have a minimum of 200MB of disk space for the Active Directory database, plus at least 50MB of disk space for the transaction log files. The global catalog requires additional disk space. You should consider these to be the absolute minimum requirements for Active Directory and know these for the exam. In the real world, you will need considerably more space as your domain size increases. . You must have a disk volume formatted with NTFS for security purposes and for the SYSVOL folder.

. You must have a Domain Name System (DNS) server running Windows 2000,

Windows Server 2003, or Berkeley Internet Name Domain (BIND) version 4.9.7 or higher. These servers all support service (SRV) resource records, and Windows or BIND version 8.1.2 servers support dynamic updates. If an appropriate DNS server is not available, you will be prompted to install one when you install Active Directory. . You use the dcpromo utility for all aspects of installation and removal of Active

Directory, including installation of the DNS server if an appropriate server is not available.

Create a Child Domain After you have installed the first domain controller in the forest, you can create child domains. Keep in mind the following when creating child domains: . The name of the child domain contains the name of the parent domain. For example, inventory.quepublishing.com is a child of the quepublishing.com domain.

. Each child domain must have a unique NetBIOS name.

615

Fast Facts . You must specify the name and password of an enterprise administrator account in the

parent domain.

Create and Configure Application Data Partitions New to Windows Server 2003 is the concept of application data partitions (also simply called application partitions). Keep in mind the following facts about application partitions: . An application partition contains application-specific data that needs to be replicated to

a specific set of domain controllers in one or more domains of the forest. . You can use the ntdsutil utility to create and manage application partitions. . Other tasks you can perform using ntdsutil include creating application partition

replicas, specifying the reference domain of the application partition, listing all available application partitions, and deleting application partitions.

Install and Configure an Active Directory Domain Controller You should always have more than one domain controller in each domain for fault tolerance and load-balancing reasons. Keep in mind the following when installing and configuring domain controllers: . When running dcpromo to add an additional domain controller, you need to specify

the username and password of an administrator account in the domain. . When installing an additional domain controller in a domain, you can use backup

media to facilitate the installation by employing the dcpromo /adv option. By doing so, the domain controller is installed with less time and network traffic required for copying domain and global catalog information, and the time for recovering a failed domain controller is reduced. . After you have installed a domain controller (including the first one), you should verify

the proper installation of Active Directory. You should ensure that the Active Directory Domains and Trusts, Active Directory Sites and Services, and Active Directory Users and Computers tools are all present. In Active Directory Users and Computers, there should be a Domain Controllers OU as well as Computers, Users, and ForeignSecurityPrincipals containers. . The system root folder (or whatever folder you specified while running dcpromo)

should contain the NTDS and SYSVOL folders. . If the domain controller is also a DNS server, a link to the DNS snap-in should appear

in the Administrative Tools folder. The DNS snap-in should include two folders for the domain name, one of them prefixed with _msdcs. Each should contain several subfolders.

616

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

Set an Active Directory Forest and Domain Functional Level Based on Requirements Keep in mind the following when configuring forest and domain functional levels: . Four domain functional levels are available, depending on the version of Windows

running on the domain controllers: Windows 2000 mixed, Windows 2000 native, Windows Server 2003 interim, and Windows Server 2003. These levels allow for backward compatibility with domain controllers running older Windows versions. . Three forest functional levels are available, depending on the functional level at which

all domains in the forest are operating: Windows 2000, Windows Server 2003 interim, and Windows Server 2003. . Some features of Active Directory in Windows Server 2003, such as forest trust rela-

tionships and domain renaming, are enabled only when the domain and forest are both operating at the Windows Server 2003 functional level. . You use Active Directory Domains and Trusts to raise the domain and forest functional

levels. . Raising the domain or forest functional level is a one-way operation; you cannot go

back to the previous level after you have made the change.

Establish Trust Relationships When establishing trust relationships, consider the following: . All domains in the same forest are connected by two-way, transitive trust relationships

by default. These relationships flow between parent and child domains of the same tree and between root domains of each tree in the forest. . You can manually establish trust relationships between two Active Directory forests,

between an Active Directory forest and a Windows NT 4.0 domain, or between an Active Directory forest and a Kerberos V5 realm. . Trust relationships can be either one-way or two-way. In a one-way trust relationship,

the trusting domain makes its resources available to the trusted domain. A two-way trust relationship is simply the sum of two one-way trust relationships in opposite directions. . You use the Active Directory Domains and Trusts snap-in to create and manage trust

relationships. This snap-in provides the New Trust Wizard to facilitate the creation of all types of trust relationships. Table 2 describes the types of trust relationships that you can create with Windows domains.

617

Fast Facts

TABLE 2 Types of Trust Relationships Trust Relationship

Description

External trust

An external trust is a one-way trust relationship set up between two individual domains in different forests, or with a Windows NT 4.0 domain or Kerberos V5 realm. The forests can be operating at any functional level.

Forest trust

A forest trust includes complete trust relationships between all domains of the two forests involved in the trust. The trust relationship can be either one-way or two-way. Both forests must be operating at the Windows Server 2003 forest functional level.

Shortcut trust

A shortcut trust is a separate trust relationship between two child domains in the same forest. It provides a rapid path for authentication and resource access between two domains in a case where the normal path would have to cross several other domains.

Implement an Active Directory Site Topology Microsoft tests your understanding of the creating and configuring of sites that represent separate physical locations of your Active Directory forest. You should keep in mind that all IP subnets connected by high-speed local area network (LAN) links should be included in a single site, whereas those subnets separated by slower, wide area network (WAN) links should be configured as separate sites.

Configure Site Links When creating and configuring site links, keep in mind the following: . The need for additional sites depends on the physical environment in your network.

Factors include the bandwidth of the link and the need for frequent replication versus network usage. The type, speed, and utilization of the connection between locations are important factors that you should keep in mind. . After you have created a new site, you need to ensure that the site is linked to other

sites, add subnets for the site, install one or more domain controllers in the site, and select the licensing server for the site. . Site links represent physical connections between sites. These connections are perma-

nent or temporary network (usually WAN) connections. . Site links use either Remote Procedure Call (RPC) over IP or Simple Mail Transfer

Protocol (SMTP) to replicate data. Most site links use RPC over IP. . You can use SMTP to replicate only the schema and configuration partitions of Active

Directory, and the global catalog between domains. It does not replicate the domain partition. You should use this protocol if the reliability of the link is not good. Its use

618

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

requires a certificate from a certification authority. In addition, you can use SMTP only when the domain controllers involved are located in different domains as well as different sites. . A site link bridge is a chain of links that allow any two domain controllers to communi-

cate with each other, whether or not they are directly connected with a site link. All site links are bridged by default. . Situations in which you should disable automatic site link bridging and create your

own site link bridges include cases where the network is not completely routed, a security policy prevents all domain controllers from communicating directly with each other, or enterprises contain a large number of sites that are not well connected. . The Knowledge Consistency Checker (KCC) is a process that runs automatically on

all domain controllers to create optimum intersite and intrasite replication topologies. The KCC ensures that every domain controller in a site can communicate with every other domain controller in the same site within three or fewer hops. The KCC uses a domain controller called the Inter-Site Topology Generator (ISTG) when creating the intersite replication topology. . Connection objects represent inbound connections to domain controllers. Although

KCC automatically creates connection objects, you might have to create connection objects manually if the connections created by the KCC do not link the specific domain controllers that should be connected.

Configure Preferred Bridgehead Servers When configuring preferred bridgehead servers, keep in mind the following: . The bridgehead server is the domain controller designated by each site’s ISTG to take

charge of intersite replication. . Usually, the ISTG automatically decides which domain controller will act as the

bridgehead server. You can use Active Directory Sites and Services to designate a preferred bridgehead server for either the IP or SMTP transport protocol. . For RPC-based replication to succeed, ISTG requires that TCP and UDP port 135 be

open on the firewall. In addition, LDAP uses TCP and UDP port 389, Kerberos uses TCP and UDP port 88, and DNS uses TCP and UDP port 53.

Plan an Administrative Delegation Strategy One of the benefits of Active Directory is that you can delegate the administration of portions of your Active Directory structure to other individuals. You can specify the types of

619

Fast Facts

administrative activities they are entitled to perform, and the OUs and/or security groups over which they will have administrative control.

Plan an OU Structure Based on Delegation Requirements Keep in mind the following when planning and designing your domain’s organizational unit (OU) structure for delegation purposes: . Active Directory enables you to delegate administrative control over a portion of

your network without the need to create separate domains, as was the case in Windows NT 4.0. . You can use a hierarchy of OUs to create a structure that facilitates the delegation of

administrative control. Several types of OU designs you might consider are administrative, geographical, and functional. You might have to consider a hybrid of these design types. . When planning an OU structure with delegation requirements in mind, keep the

structure as simple as possible and commensurate with your company’s needs for administrative delegation.

Plan a Security Group Hierarchy Based on Delegation Requirements Keep in mind the following when planning and designing your domain’s security group structure for delegation purposes: . You can create security groups into which you place users with similar needs for per-

forming administrative tasks. You can then use the Delegation of Control Wizard to delegate these tasks. . Microsoft has provided the following domain local security groups, which you can

use to delegate specific tasks to users with the appropriate needs: Account Operators, Backup Operators, Incoming Forest Trust Builders, Network Configuration Operators, Performance Log Users, Performance Monitor Users, Print Operators, and Server Operators. You can add users or groups to these groups as needed, and modify their default rights and permissions if necessary.

Managing and Maintaining an Active Directory Infrastructure The process of planning and creating your Active Directory infrastructure is only the first step you will encounter as you work with Active Directory in your organization. Now that you have created your domains, OUs, and sites, you will be getting down to the nitty-gritty of Active

620

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

Directory management. Microsoft likes to present complex scenarios on the exam in which you need to drill down into the complex issues of Active Directory management to come up with the best approach and eliminate the unsuitable alternatives presented.

Manage an Active Directory Forest and Domain Structure Active Directory provides several functions that facilitate the management of enterprises of all sizes up to multiforest international conglomerates. Microsoft expects you to know how to manage the various components of the Active Directory forest and domain structure, including trust relationships between and within forests and the workings of the schema. You also need to know when and why you would use Universal Principal Name (UPN) suffixes to facilitate user logon as well as management in multiple domain environments.

Manage Trust Relationships You should keep the following points in mind when managing trust relationships: . Validation of a trust relationship enables you to verify the proper creation and configu-

ration of a trust relationship. It also verifies that the forests can communicate with each other. . You can change the authentication scope of a trust relationship from domainwide to

selective or vice versa, if you need to modify access control to the trusting forest’s resources. . Name suffix routing is a mechanism that can manage the routing of authentication

requests across Windows Server 2003 forests connected by forest trust relationships. Its use enables name suffixes that do not exist in one forest to be used to route authentication requests to another trust. Name suffix routing is available only when you are using forest trusts. . You can configure these trust management options from the Trusts tab of your

domain’s Properties dialog box in Active Directory Domains and Trusts. .

R2 You can use Active Directory Federation Services (ADFS) in Windows Server 2003 R2 to establish a single sign on capability for users accessing multiple web applications within a single session.

Manage Schema Modifications Modifications of the schema affect all domains in the forest because there is only one schema per forest. You should keep the following points in mind when managing schema modifications:

621

Fast Facts . You should take great care when modifying the schema. Improper modifications can

cause irreparable damage to Active Directory, and even force you to reinstall the entire forest. . Only members of the Schema Admins group can modify the schema. You can improve

the security of the schema by adding administrators to this group only when you need to modify the schema. . Before you can install the Active Directory Schema snap-in, you must register the

snap-in by running the regsvr32schmmgmt.dll command at the command prompt. . The schema defines which attributes can be held by objects of various types, the vari-

ous classes that can exist, and what object class can be a parent of the current class. . You can add additional classes or attributes to the schema as needed. However, you

cannot delete or rename these objects. You can deactivate them if necessary.

Add or Remove a UPN Suffix A User Principal Name (UPN) is a logon name specified in the format of an email address. Active Directory in Windows Server 2003 includes the concept of the UPN suffix, which is the portion of the UPN to the right of the at (@) character. Keep in mind the following when managing UPN suffixes: . An additional UPN suffix is useful as a convenient means of logging on to a domain

from a computer located in another domain in the same forest or a trusted forest. . An implicit UPN is in the form user@domain, as defined on the Account tab of a user’s

Properties dialog box in Active Directory Users and Computers. . An explicit UPN is in the form string1@string2, where an administrator can define

values for both strings. Its use is practical when a company does not want to reveal its internal domain structure. Its use also simplifies the logon procedure in the case of users with long domain names. . You can add or remove UPN suffixes by using Active Directory Domains and Trusts. . You can assign an added UPN suffix to a user from the Accounts tab of a user’s

Properties dialog box in Active Directory Users and Computers. You can also assign the UPN suffix when first creating a user account from the New Object—User dialog box. . You can remove a UPN suffix that is no longer needed. However, users with this suffix

will be unable to log on until you change the suffix in use from the Accounts tab of their Properties dialog box.

622

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

Manage an Active Directory Site The proper functioning of any network with operations at more than one physical location depends on the proper day-to-day management of the network’s Active Directory sites. Microsoft will test your understanding of the various tools and techniques that it has provided for site management.

Configure Replication Schedules To ensure that the link to a branch office functions properly, you need to create a balance between replication of Active Directory at a level adequate to ensure that the directory is upto-date versus the ability to transfer data between offices as required to conduct business activities properly. Keep in mind the following when configuring replication schedules: . Intrasite replication takes place frequently and on the basis of change notification after

you have made a directory update on any domain controller. It is uncompressed and uses the RPC over IP transport protocol. You should not modify intrasite replication properties. . Intersite replication takes place every three hours by default. You can change this inter-

val or restrict the times and days of intersite replication in Active Directory Sites and Services. . Intersite replication is compressed so that it consumes less bandwidth. You can turn off

compression if you have lots of bandwidth and need to limit the amount of processing required. . You can configure intersite replication to ignore the replication schedule so that repli-

cation can take place at any time of day or night. This is useful if you need to force replication of a large number of changes. . You can manually force replication by right-clicking the connection object in the NTDS

Settings folder of Active Directory Sites and Services, and choosing Replicate Now.

Configure Site Link Costs The following are several important facts you should remember when configuring site link costs: . The site link cost is a parameter that determines which one of multiple links the KCC

will use when replicating the Active Directory database between sites. When configuring the site link cost, you should take into account variables such as bandwidth, reliability, and availability of a given line. . By default, site links are assigned a cost of 100. The lower the site link cost, the more

available a given site link is.

623

Fast Facts . The cost of a site link bridge is the sum of the costs of all site links contained within

the bridge. . You can configure site link costs from the Properties dialog box of the site link in the

IP or SMTP subfolder of the Inter-Site Transports folder in Active Directory Sites and Services.

Configure Site Boundaries The following are several important facts you should remember when configuring site boundaries: . Each site needs to be configured in terms of the IP subnets to which computers in the

site belong. . Active Directory Sites and Services provides a Subnets folder in which you can add

subnets to your network and specify the site object to which each subnet belongs.

Monitor Active Directory Replication Failures If Active Directory and File Replication Service (FRS) replication are not working properly, client computers cannot receive updates, and users might be unable to log on or access resources over Active Directory. Microsoft will test your knowledge of a broad range of monitoring tools that address not only replication monitoring, but also the overall performance of the Active Directory service.

Monitor Active Directory Replication Table 3 describes some tools that you can use when monitoring Active Directory replication. TABLE 3 Active Directory Monitoring Tools Monitoring Tool

Description

replmon

The Active Directory Replication Monitor is a GUI-based tool that enables you to perform a large number of Active Directory monitoring and troubleshooting tasks.

repadmin

The Replication Diagnostics tool is a command-line tool that performs most of the functions of replmon. This tool includes a series of parameters that perform a wide range of tasks.

dcdiag

The Domain Controller Diagnostics tool is a command-line tool that analyzes the condition of domain controllers. It performs tests that examine functions such as connectivity, replication, topology integrity, trust verification, and so on. (continues)

624

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

TABLE 3 Continued Monitoring Tool

Description

Event Viewer

The Directory Services log, found on domain controllers, records events related to actions taken on the directory service database.

System Monitor and Performance Logs and Alerts

You can use the LDAP object to monitor domain controller performance with respect to Active Directory and FRS replication.

Additional Support Tools

The Windows Server 2003 Support Tools package includes several additional tools for monitoring Active Directory. These include ADSI Edit, the Active Directory Services Interface Tool; Movetree, which enables you to move objects between domains; Ldp, which enables several operations against the directory; Ldifde, which enables you to perform batch actions with Active Directory’s LDAP data interchange format (LDIF); Dsacls, which enables the display and editing of object permissions; Dsadd, which enables you to add objects to the directory; Dsastat, which enables you to compare and detect differences between naming contexts on domain controllers; Sdcheck, which tests security descriptors for Active Directory objects; Netdiag, which tests the condition and functionality of network clients and verifies DNS name registrations; and FRSDiag, which assists you in diagnosing and troubleshooting FRS problems.

Monitor File Replication Service (FRS) Replication Keep in mind the following when monitoring FRS replication: . Active Directory uses FRS to replicate changes in the SYSVOL folder among domain

controllers. FRS is also used for replicating Distributed File System (DFS) shares. . System Monitor and Performance Logs and Alerts use the FileReplicaConn and FileReplicaSet objects for monitoring FRS replication.

. Event Viewer contains the File Replication Service log, which records events related to

actions taken by FRS.

Restore Active Directory Directory Services Backing up and restoring Active Directory are two important functions that administrators should perform (or delegate) on their network. These are important functions in any disaster recovery plan, and the ability to restore Active Directory properly might mean the difference between business survival and failure. You will need to know how and when to perform each type of Active Directory restore.

625

Fast Facts

Perform an Authoritative Restore Operation Keep in mind the following when performing an authoritative restore operation: . Whenever you make a change to some object of Active Directory, the update sequence

number (USN) increases. Active Directory uses the USN to keep track of which updates need to be replicated to which domain controllers. . You need to perform an authoritative restore if you have to recover a deleted object

such as a user, group, or OU. Performing an authoritative restore increments the USN on the restored object by 100,000, thereby ensuring that it is higher than the most recent update. . You perform an authoritative restore by using ntdsutil to mark the restored objects as

authoritative after you have performed a nonauthoritative restore of the object.

Perform a Nonauthoritative Restore Operation Keep in mind the following when performing a nonauthoritative restore operation: . You need to back up the System State data of a domain controller to back up Active

Directory. You cannot back up Active Directory by itself. In addition to the directory database and SYSVOL, System State includes the Registry, Component Services Class (COM+) Registration database, boot files, files protected by Windows File Protection (WFP), and the Certificate Services database for certificate servers. . You need to restart the domain controller in Directory Services Restore mode to

perform any type of restore operation. You can do this by pressing F8 during startup to access the Windows Advanced Options menu and selecting Directory Services Restore Mode. . If all domain controllers in a domain have been lost, you need to perform a primary

restore of the first domain controller and a nonauthoritative restore of all other domain controllers. .

R2 You need to ensure that your backups are not older than the tombstone lifetime, which is 60 days by default in initial versions of Windows Server 2003 and 180 days by default in Windows Server 2003 R2. Otherwise, Active Directory might become corrupted.

. If you need to install a new domain controller in a remote location connected by a low-

bandwidth link, you can use nonauthoritative restore to bring the new domain controller up-to-date with the rest of the domain controllers in the domain. This action reduces the amount of information that must be replicated across a slow, potentially unreliable link.

626

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

Troubleshoot Active Directory Microsoft presents scenarios on the 70-294 exam that test your ability to synthesize problem information into the best solution for troubleshooting different facets of Active Directory operation. You need to know what the more common error messages mean and which tools you should use to obtain information that assists you in solving these problems.

Diagnose and Resolve Issues Related to Active Directory Replication Keep in mind the following when dealing with problems in Active Directory replication: . If intersite replication has stopped completely, it is probable that the sites are not con-

nected by site links. Look for errors in the Directory Service and File Replication Service logs. . Slow intersite replication might indicate that insufficient site links or no site link

bridges exist. Table 4 describes several of the more common errors that you might encounter in dealing with replication. TABLE 4 Some Replication Errors Error

Meaning

RPC server is unavailable

This error occurs for various reasons, including an offline replication partner or certain DNS errors. Use the dcdiag and nslookup utilities when troubleshooting these errors.

Directory Service log error 1311

This error indicates that certain site connectivity problems exist. They can include offline domain controllers, sites that are not associated with site links, or site links that are not bridged.

Directory Service log error 1265

This error indicates that DNS configuration problems or authentication problems exist.

Access denied

If you do not have the Replication Synchronization permission when you attempt to force manual replication between replication partners from Active Directory Sites and Services, you receive this error and replication of the directory partitions will fail.

627

Fast Facts

Diagnose and Resolve Issues Related to Operations Master Role Failure Keep in mind the following when solving problems related to operations master failures: . Problems related to operations master failures might not show up until some time

later, according to the types of actions administrators or users attempt to perform. . You can use ntdsutil to determine the operations master role holders, and transfer or

seize operations master roles. Table 5 describes some of the problems you might encounter if operations masters fail. TABLE 5 Operations Master Failures Operations Master

Problems That Can Occur

Consequences If You Need to Seize This Role

Schema master

You cannot modify the schema.

You need to reformat the disk of the failed server before bringing it back online. You will also need to remove metadata belonging to the original schema master from Active Directory using ntdsutil.

Domain naming master

You cannot add or delete a domain in the forest.

You need to reformat the disk of the failed server before bringing it back online and use ntdsutil to remove metadata from the directory.

RID master

Failure is evident only if a domain controller runs out of RIDs in its current pool. In this case, you can create objects on other domain controllers but not on the one with no remaining RIDs.

After seizing this role, you can bring back the original role holder by following a special procedure recommended by Microsoft.

Infrastructure master

Failure is evident only if you have to rename or move Active Directory objects.

You can bring the original infrastructure master back online without the need to rebuild its operating system completely. (continues)

628

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

TABLE 5 Continued Operations Master

Problems That Can Occur

Consequences If You Need to Seize This Role

PDC emulator

Users with pre-Windows 2000 computers will be unable to change their passwords, and they will be unable to log on if their passwords expire. In addition, time settings might become out of sync if this server fails. If you do not bring the PDC emulator back online, Kerberos and the entire Active Directory Authentication system could fail.

You can bring the original PDC emulator back online without the need to rebuild its operating system completely.

Diagnose and Resolve Issues Related to the Active Directory Database We have already covered the tools and techniques used for resolving most issues related to the Active Directory database, but you should keep in mind the following facts related to Active Directory problems: . When you install Active Directory, dcpromo creates the dcpromo.log, dcpromoui.log,

and dcpromos.log files in the %systemroot%\Debug folder. These files provide information that can help you troubleshoot a failed Active Directory installation. . You can use the ntdsutil tool to remove orphaned metadata left behind after remov-

ing a domain controller without proper installation—for example, when the hard disk of a domain controller has failed. . Additional tasks you can perform using ntdsutil include moving and defragmenting

the Active Directory database. You need to start the domain controller in Active Directory Restore mode to perform these tasks. . Improper DNS configuration can cause one of several errors during Active Directory

installation. You might have to verify the existence of a domain controller’s A resource record, or use a tool such as dcdiag, netdiag, or nslookup to troubleshoot such problems. . Performing an authoritative restore can affect trust relationships and computer account

passwords located in the naming context of Active Directory that you have restored.

629

Fast Facts

Planning and Implementing User, Computer, and Group Strategies Users, computers, and groups are all objects as originally defined in X.500 and LDAP and adopted by Microsoft in building Active Directory. Many strategies you use in planning, implementing, and managing users, computers, and groups are consequently similar because they all boil down to the strategies of managing objects in Active Directory. Keep this in mind when encountering scenarios on the exam that ask you about dealing with any of these types of objects.

Plan a Security Group Strategy Remember that a security group is the type of group to which you can assign permissions for objects such as files, folders, and printers. Keep in mind the following points when dealing with security groups. Table 6 describes the three group scopes that you can have. TABLE 6 Group Scopes Scope

Description

Global

These groups can contain users, computers, and other global groups from the same domain and are generally employed to organize users who have similar needs for resource access.

Domain Local

These groups can contain users, computers, and groups from any domain in the forest and are generally used to grant permissions for resources in the domain in which they are located. Although you can place users directly into domain local groups, Microsoft recommends that you place users in a global group and then add the global group to the domain local group.

Universal

These groups can be used in a manner similar to that of domain local groups, but can be used to grant access to any resource in the forest. Again, you should not place users directly into universal groups. Any modification of universal group membership causes the entire forest to replicate the change. You should place users in global groups and then add the global group to the universal group.

Keep in mind the following strategies when planning and creating security groups in Active Directory: . The availability of groups and nesting depends on the functional level at which the

domain is operating. If the domain is operating at the Windows 2000 mixed functional level, you can nest global groups into domain local groups only. In addition, universal security groups are not available at this functional level.

630

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure . The recommended strategy for group nesting is to place accounts (A) into global

groups (G), add global groups to domain local groups (DL), and then assign permissions (P) to the domain local groups. This strategy can be summarized as A, G, DL, P. Be sure you remember this strategy for the exam. . The Windows 2000 native and Windows 2003 domain functional levels allow

enhanced group nesting. Universal groups can contain user accounts, global groups, and universal groups from any domain in the forest. Global groups can contain user accounts and other global groups from the same domain only. Domain local groups can contain user accounts, global groups, and universal groups from any domain. They can also contain domain local groups from the same domain. . The use of universal groups can result in a higher level of network traffic between

domain controllers during replication. Consequently, you should use universal groups sparingly, and only when their membership is relatively static. In addition, you should never place users directly into universal groups for the same reason. . In a single domain forest, there is no need to use universal groups. Simply use the A,

G, DL, P strategy already mentioned. . You can use similar strategies to enable resource access in multiple forest environ-

ments. After you’ve created the required trusts, you should create global groups in each domain and add these groups to a universal group in each forest. Then add these universal groups to domain local groups in the domains that contain resources to which access is required.

Plan a User Authentication Strategy The backbone of keeping your network secure from intruders while permitting easy access from authorized users is a proper user authentication strategy. Use of smart cards is one means of securing access. If your company does not feel it needs the expense of a smart card system, you need to have a password policy that requires users to employ effective passwords that are not easily guessed by outsiders.

Plan a Smart Card Authentication Strategy Keep in mind the following facts about the use of smart cards for authentication: . As well as smart card hardware, you need to implement a public key infrastructure

(PKI) and certification authority (CA) to handle the required certificates. . Smart cards provide a means of two-factor authentication. In other words, the user must

be in possession of the smart card and know the personal identification number (PIN) associated with it. Without both of these items, the user cannot access the network.

631

Fast Facts . You install the Certificate Services snap-in to generate the required certificates. You

then add the required certificate templates and configure access control lists (ACLs) for these templates. . The Certificate Request Wizard enables certificate issuers to obtain signing

certificates. . Users can employ the Microsoft Certificate Services web pages on the enrollment

station computer to obtain the required certificates. . Active Directory includes the Smart Card Is Required for Interactive Logon option,

which you can use to require that users employ smart cards for logon. You can also use Group Policy to enforce the use of smart cards for all users in a domain or OU.

Create a Password Policy for Domain Users The following are important facts you should remember when creating password policies for domain users: . You can set password policies only at the domain level. If you attempt to set password

policies at the site or OU level, Active Directory will ignore these settings. . You can specify minimum and maximum password ages, minimum password length,

and minimum complexity requirements for passwords. You can also specify a password history policy that specifies how many passwords are retained in a list and cannot be reused. . You can use the Security Templates snap-in to configure password policy. This snap-in

contains a series of default templates that contain password policy settings. You can use one of these templates directly or modify it as required for your security needs. . The Group Policy Object Editor, accessed from Active Directory Users and

Computers, enables you to import security templates into Group Policy.

Plan an OU Structure Understanding the use of OUs is necessary to plan an effective OU structure that enables you to perform such functions as delegating administrative tasks, administering Group Policy, and so on. The 70-294 exam presents scenarios in which you are asked to create an OU structure that will fulfill a given set of requirements.

632

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

Analyze the Administrative Requirements for an OU Consider the following when analyzing the administrative requirements for an OU structure: . You can use a hierarchy of OUs to create a structure that facilitates the delegation of

administrative control. . Administrative models can be centralized or decentralized. In practice, they tend to be

a hybrid of the two. . Some possible models you can use when creating a hierarchy of OUs include geo-

graphical location, business function, and object type (such as users, computers, and resources). You can use a combination of these models to create a nested OU structure. . You should keep your OU nesting design as simple as possible and commensurate with

administrative requirements.

Analyze the Group Policy Requirements for an OU Structure Consider the following when analyzing the Group Policy requirements for an OU structure: . Group Policy is applied in this sequence: local, site, domain, OU, child OU. The order

of application for Group Policy is essential to designing Group Policy, planning OUs for Group Policy application, and troubleshooting Group Policy. . By creating a hierarchy of OUs, you can retain the ability to delegate administrative

control of portions of your network to individual users without the need for creating additional domains. . By linking GPOs to OUs, you can create specific configurations for computers and

users according to business function. . You can also use a system of OUs to hide objects in Active Directory that you do not

want users to access.

Implement an OU Structure After you have planned your domain’s OU structure, you need to consider the requirements for implementing the structure and assigning permissions to users who will have the responsibility for administering each OU. This objective is designed to make sure that you know how to perform these tasks.

633

Fast Facts

Create an OU Be aware of the following when creating a structure of OUs: . You need to have the appropriate permissions to create an OU. You can be a member

of the Domain Admins or Enterprise Admins group, or have the appropriate permissions delegated to you. . Creating an OU is a simple task that you can accomplish from Active Directory

Users and Computers. Simply right-click the domain or parent OU and choose New, Organizational Unit. You can also create an OU from the command line using the dsadd tool.

Delegate Permissions for an OU to a User or to a Security Group Make sure that you are familiar with the following facts when delegating permissions for an OU to a user or group: . You can use the Delegation of Control Wizard to delegate administrative authority

over an OU to selected users or groups. . The Delegation of Control Wizard contains a large number of common tasks that you

can delegate, or you can create a custom task to delegate, including a granular set of permissions. . You can hide objects in an OU by configuring the appropriate permissions in the

Security tab of the OU’s Properties dialog box. Then move the objects to be hidden into the OU.

Move Objects Within an OU Hierarchy Keep in mind the following when moving objects within a hierarchy of OUs: . You can move objects between OUs in the same domain by any one of three methods:

dragging and dropping, using the Move option in Active Directory Users and Computers, or using the dsmove command-line tool. You can also use the Active Directory Migration Tool (ADMT), which is included on the Windows Server 2003 CD-ROM. . To move objects between domains, you need to use the movetree command-line tool

that is contained in the Support Tools package. . You can move OUs within a domain by using methods similar to those used for mov-

ing other objects. From Active Directory Users and Computers, you can also perform other administrative tasks such as configuring properties of OUs and renaming and deleting OUs.

634

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

Planning and Implementing Group Policy Group Policy enables you to specify a large range of settings that affect what users can do with their computers, what software will be installed and upgraded on their computers, how computer and user certificates will be enrolled, how security settings will be applied to computers, where data that users create will be saved, and so on. Group Policy makes up a large component of the 70-294 exam, and you should be familiar with all the major settings that affect the factors mentioned here.

Plan a Group Policy Strategy To plan and implement the appropriate Group Policy strategy, you need to know how Group Policy is put together and how policies specified at various levels are applied. Group Policy is applied in sets known as Group Policy Objects (GPOs), which can be linked to sites, domains, or OUs in Active Directory, as well as to the local computer. Remember the sequence of Group Policy precedence: local, site, domain, OU, child OU. This sequence governs when conflicting policy settings applied at one level will overwrite other policies. New to Windows Server 2003 is Resultant Set of Policy (RSoP), which you can use to predict the sequence of policy application as well as display the actual sequence in which existing policies have been applied. Windows Server 2003 provides a new Group Policy management tool called the Group Policy Management Console (GPMC). This tool enables you to deploy, manage, and troubleshoot implementations of Group Policy within Windows Server 2003 as well as Windows 2000 environments. You can also back up, restore, copy, paste, import, and export GPOs as well as Windows Management Instrumentation (WMI) filters. GPMC also provides enhanced security management and reporting capabilities. When you install GPMC, it takes over all GPO management facilities otherwise accessed from Active Directory Users and Computers or Active Directory Sites and Services.

Plan a Group Policy Strategy Using Resultant Set of Policy (RSoP) Planning Mode RSoP is a new feature of Windows Server 2003 that enables you to determine which policies apply to a user logged on to a given computer. You can run RSoP in either planning mode or logging mode. Keep in mind the following when using RSoP in planning mode: . Planning mode enables you to run “what if” queries that predict the effects of a pro-

posed set of policies on a specified user/computer combination. . Planning mode is also called Group Policy modeling because it simulates the effect of

changes in policy application.

635

Fast Facts . Planning mode enables you to predict the changes in policy settings should you make

modifications to a user’s environment. Modifications can include the use of slow network connections, loopback processing, changes in group membership, and the use of Windows Management Instrumentation (WMI) filters. . You can run RSoP in planning mode directly from Active Directory Users and

Computers or Active Directory Sites and Services, or you can install the RSoP snap-in in its own console. You can also run RSoP in planning mode from GPMC. . When you execute an RSoP query, the RSoP snap-in displays the policies that apply to

the given computer and user. RSoP displays their status (enabled or disabled) and the name of the GPO that provides this status. . The Precedence tab of a policy’s Properties dialog box displays the names of all GPOs

for which the policy setting is configured, together with the setting of Enabled or Disabled. GPOs that appear higher in the list have the highest priority.

Plan a Strategy for Configuring the User Environment Using Group Policy Keep in mind the following when configuring user environments with Group Policy: . You use the Group Policy Object Editor console to manage all aspects of Group Policy

administration. You can configure user settings from the User Configuration node of this console. . User settings are applied when the user logs on to the computer. They are refreshed

on member servers and client computers at 90-minute intervals with a 30-minute offset. At domain controllers, they are refreshed at 5-minute intervals. . When settings specified in the Computer Configuration and User Configuration nodes

of the Group Policy Object Editor console conflict with each other, the settings in the User Configuration node take precedence. . You can disable the processing of the User Configuration node of a GPO from the

Details tab of the GPO’s properties in the details pane of GPMC. . You can use Block Policy Inheritance and No Override to modify the default sequence

of policy application. After you install GPMC, these options are known as Block Inheritance and Enforced, respectively. You should know both of these terminologies for the 70-294 exam. . Block Inheritance prevents policy settings applied at a higher level (such as a site or

domain) from applying to users located at a lower level (such as an OU).

636

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure . The Enforced option prevents policies contained in the GPO where it is specified from

being overwritten by GPOs that are applied later. For example, if you specify Enforced on a domain-based GPO, its settings will not be overwritten by GPOs linked to an OU or child OU. . The Delegation tab of a GPO’s properties in GPMC enables you to view and modify

permissions attached to security groups. You can add and remove groups and filter GPOs so that they do not apply to specific users or security groups. To do so, deny the Read and Apply Group Policy permissions for the user or group.

Plan a Strategy for Configuring the Computer Environment Using Group Policy Keep in mind the following when configuring computer environments with Group Policy: . You can configure computer settings from the Computer Configuration node of the

Group Policy Object Editor. . Computer settings are applied to each computer when the computer is started up and

before the logon dialog box appears. . You can disable the processing of the Computer Configuration node of a GPO from

the Details tab of the GPO’s properties in the details pane of GPMC. . When you specify the Group Policy loopback processing option, local Group Policy

settings on the computer will override any other settings in other containers. This setting is useful for publicly accessible computers such as those in kiosks or shopping centers. . You can apply loopback processing in either of two modes: The Merge mode merges

any user-specific policies that the computer is processing with any policy normally processed from GPOs applied to the user. The Replace mode replaces the user-specific policy settings with the list already obtained for the computer to which it applies.

Configure the User Environment Using Group Policy User-specific settings apply to the currently logged-on user and include user-related settings that apply to operating system behavior, desktop settings, security settings, assigned and published applications options, folder redirection options, and user logon and logoff scripts.

637

Fast Facts

Distribute Software Using Group Policy When using Group Policy to distribute software to users, consider the following: . You can use Group Policy to either assign or publish software to users. . When you assign software to users, the software follows them around to whichever

computer they log on to. An assigned application is advertised in the Start menu and, if specified, a desktop icon. Starting the application from either of these locations automatically installs the application. . A user can also install an assigned software package by file invocation. In other words,

if a user opens a file that is associated with the software package, the application is automatically installed on the user’s computer. . When you publish software to users, it is not advertised in the same manner. It appears

in the Control Panel Add or Remove Programs applet, and the user can install it from this location or by file invocation. . You should assign an application to users if the application is essential or highly desir-

able in the performance of their jobs. . To use Group Policy for software deployment, the software must be packaged in a

form that is compatible with Windows Installer—either a Windows Installer package (.msi file) or a ZAP file. . You can either publish or assign applications that are deployed with an .msi file.

However, ZAP files can only be published (not assigned), and the user must perform the normal installation process for these applications. . The Software Installation Properties dialog box enables you to specify default proper-

ties to all software packages you deploy to users. The Deployment tab of this dialog box enables you to specify several deployment options, such as uninstalling the application when it falls outside the scope of the GPO, not displaying it in Add/Remove Programs, installing it at logon, and the amount of detail appearing on the installation user interface. The Categories tab enables you to separate applications into categories that will appear in the Add or Remove Programs applet of Control Panel. Doing so makes it easier for users to select the appropriate application to install from this applet.

638

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

Automatically Enroll User Certificates Using Group Policy Consider the following when using Group Policy to enroll user certificates automatically: . The auto-enrollment of certificates handles all aspects of certificate enrollment,

renewal, and maintenance. Users need not be aware of certificate auto-enrollment except in cases where interaction is required—for example, to supply a PIN for a smart card certificate. . Only version 2 certificate templates, which are new to Windows XP and Windows

Server 2003 computers, support certificate auto-enrollment. However, you can duplicate older version 1 certificate templates to obtain versions suitable for certificate autoenrollment. . You use the Certificate Templates snap-in to configure certificate templates to enable

auto-enrollment.

Redirect Folders Using Group Policy Group Policy enables you to redirect the folders containing a user’s profile to a network location where all associated folders can be easily managed and backed up. Keep the following facts in mind when using Group Policy to configure folder redirection settings: . You can specify policies that redirect the Application Data, Desktop, Start Menu, and

My Documents (with its My Pictures subfolder) folders. . Using Group Policy to redirect these folders enables you to accomplish such tasks as

standardizing users’ Start menu and desktop environments, enabling disk quotas to control and monitor use of disk space, backing up all users’ files to a central location, and simplifying the use of the Offline Files feature. Folder redirection also makes a user’s documents always available regardless of the computer the user is logged on to. . Using basic redirection, you can redirect all users’ folders to the same location. By

default, the system creates a subfolder for each user in this location. . Advanced redirection enables you to redirect folders according to users’ security group

membership. . Using either folder redirection option, you can create folders for each user, redirect all

folders to a specified location, or redirect them to the local user profile location or home directory.

639

Fast Facts

Configure User Security Settings Using Group Policy Keep the following facts in mind when using Group Policy to configure user security settings: . The Security Settings node under User Configuration\Windows Settings enables you

to configure public key policies and software restriction policies. . Software restriction policies enable you to choose Disallowed, which prevents software

from running, or Unrestricted, which uses the user’s access rights to determine software access rights. The default security level is Unrestricted. . You can define additional rules that provide exceptions to either of the two available

security levels. These rules can include certificate rules, hash rules, Internet zone rules, and path rules. . You can specify the types of executable software to which the restriction policy applies,

and exempt local administrators from the policy. . Remember that you can filter software restriction policies to specify users or groups to

whom the policy will not apply. . In case problems arise with software restriction policies, you should define them in a

separate GPO. You can also use Safe Mode to start an improperly locked-down computer to log on as a local administrator and correct the policies.

Deploy a Computer Environment Using Group Policy Computer-specific settings apply to all users of the affected computer and are applied when the computer starts up. Like user settings, they contain software settings, Windows settings, and administrative templates settings.

Distribute Software Using Group Policy When using Group Policy to distribute software to computers, consider the following: . You can use Group Policy only to assign software to computers; you cannot publish

software to computers. . When you assign software to computers, it is available to all users of the computer

regardless of their group membership or privileges. The software is installed when the computer is first restarted after you assign the software package. . You assign the software package to computers by deploying it in the Computer

Configuration node of the Group Policy Object Editor.

640

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

Automatically Enroll Computer Certificates Using Group Policy Consider the following when using Group Policy to enroll computer certificates automatically: . The auto-enrollment of certificates handles all aspects of certificate enrollment,

renewal, and maintenance. . The Automatic Certificate Request Setup Wizard helps you set up automatic certificate

requests for computers. This wizard enables an administrator to specify the types of certificate that a computer can automatically request. . You use the Certificate Templates snap-in to configure certificate templates to enable

auto-enrollment. You can select templates configured by this snap-in to provide certificates to computers from the Automatic Certificate Request Setup Wizard. . Some uses for automatically enrolled computer certificates include web servers,

IPSec security settings, and remote access servers including Internet Authentication Service (IAS).

Configure Computer Security Settings Using Group Policy Keep the following facts in mind when using Group Policy to configure computer security settings: . The Security Settings node under Computer Configuration\Windows Settings enables

you to configure an extensive range of computer security settings. . You can define software restriction policies in the same manner as with user settings. . You can define account policies including password policies, account lockout policies,

and Kerberos policies from this location. Remember that these policies apply only when configured in a GPO linked to the domain. . The Local Policies subnode of Security Settings enables you to define audit policies,

user rights assignment policies, and additional security options. The Audit Policies subnode enables you to audit activities on the network, such as user logons and file access. The User Rights Assignment subnode enables you to define which users or groups are entitled to perform system activities on the network. The Security Options subnode provides a large range of security options, including digitally signing and encrypting communications, using smart cards, renaming the administrator account, not displaying the last username on the logon dialog box, and so on. . The Restricted Groups subnode enables you to define the membership of local groups

on member servers or client computers. For example, you can limit the membership of the local Administrators and Power Users groups. . Additional computer security settings you can define include event log, system services,

Registry, file system, wireless network policies, and IP security (IPSec) policies.

641

Fast Facts

Managing and Maintaining Group Policy After you have set up Group Policy for your network, the battle is only half over. You need to perform ongoing management and troubleshooting of Group Policy as needs change and problems arise. A product such as Group Policy is bound to cause a lot of problems that you must be able to correct so that users can perform their tasks properly and their computers can function to the extent required. The ongoing maintenance of software deployed by Group Policy is an important aspect of any administrator’s duties. Group Policy provides tools that assist you in troubleshooting problems related to the initial deployment of software. In addition, as software vendors provide updates, patches, and entirely new versions of software, you must ensure that users have the appropriate software available to them at all times and that outdated software is removed when appropriate. Keeping your network secure is also an ongoing responsibility. Microsoft will test your ability to troubleshoot security settings applied with Group Policy. Like other Group Policy settings, conflicting security settings can result in their inconsistent application and can provide an entry point for intruders to your network (or prevent authorized users from accessing resources that they need).

Troubleshoot Issues Related to Group Policy Application Deployment Deployment and application of Group Policy is subject to a large number of potential problems. Microsoft expects you to know how to use the available tools for diagnosing many typical Group Policy problems. Among the available tools are RSoP in logging mode, Gpresult, Gpotool, and Advanced System Information. RSoP in logging mode provides information on the actual policies applied to a specified user/computer combination. You should be aware of the following facts: . You can run RSoP in logging mode from Active Directory Users and Computers, from

the Group Policy Management Console, from the Run dialog box, or from its own console. . RSoP in logging mode works only when the specified user has actually logged on to

the specified computer. If this is not true, you need to use RSoP in planning mode. . The Properties dialog box for any given policy provides a list of GPOs configured for

this policy, and shows the GPO whose settings prevail. . Some errors that can occur when running RSoP in logging mode include nonexistent

user, inability to connect to the specified domain, or the client computer is not turned on or doesn’t exist.

642

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Gpresult is a command-line version of RSoP that enables you to display logging mode infor-

mation or create batch files for automated execution. You can output Gpresult data to text files, including the names of the prevailing GPOs and its enabled state. Gpresult does not provide policy succession information. A version for use on Windows 2000 computers is also available. The Advanced System Information tool, available from Help and Support Center, also displays RSoP information for the currently logged-on user at a Windows XP Professional or Windows Server 2003 computer. Gpotool is the Group Policy verification tool. It tests the health of GPOs on domain controllers running either Windows 2000 or Windows Server 2003. It also tests the validity and replication status of GPOs and their consistency across each domain controller in the domain.

Maintain Installed Software Using Group Policy Microsoft will test you on the use of transform and patch files to keep software current, as well as your ability to upgrade software to new versions and remove outdated software. You will also have to know how to enable the automatic distribution of software updates to affected users and computers.

Distribute Updates to Software Distributed by Group Policy You should be aware of the following facts when using Group Policy to distribute updates to software: . You can use Group Policy to deploy software upgrades. Upgrades of existing applica-

tions may be either required or optional. . Required updates are automatically distributed to users without their intervention,

whereas optional upgrades offer the user a choice of upgrading to the newer version or staying with the original version. . Transform files have an .mst extension and are used to make changes to an installa-

tion database, such as the language of a user interface. You need to deploy the .mst file together with the .msi file using the Advanced option in the Deploy Software dialog box. . Patch files have an .msp extension and are used to add modifications such as bug fixes

and service packs to existing software. You will need to redeploy the application to add the patch file. . You can use Group Policy to remove outdated applications originally deployed using

Group Policy. Removal can be either mandatory or optional.

643

Fast Facts . If you have specified mandatory removal, the software is automatically removed the

next time the computer is restarted. If you specify optional removal, the application is still available to users, but it is no longer supported and no more software of that version will be installed. . You can use RSoP in logging mode to identify all software that is available to a given

user, including updates and configuration changes. RSoP also displays a list of software that a user has actually installed.

Configure Automatic Updates for Network Clients Using Group Policy You should be aware of the following facts when using Group Policy to provide automatic updates for network clients: . The Automatic Updates feature automatically interacts with the Windows Update

website to obtain available updates for network clients. Table 7 describes the four available options for configuring automatic updates. TABLE 7 Group Policy Troubleshooting Tools Scope

Description

Notify for Download and Notify for Install

Windows Update displays an icon that informs users that updates are available for download, and users can click the icon or message to download the updates.

Auto Download and Notify for Install

Windows Update automatically downloads updates and then informs the users, who can click the icon or message to install the updates.

Auto Download and Schedule the Install

You can schedule the download and installation of updates at an appropriate time.

Allow Local Admin to Choose Setting

You can select a configuration option of your choice from the Automatic Updates control panel, including the scheduled installation times.

. Automatic Updates also enables you to do the following: You can use an intranet web

server that is running Software Update Services to host software updates and reduce the Internet traffic resulting from automatic downloading of updates to clients. You can specify a rescheduling time for automatic updates at a computer that was not turned on at the scheduled update time. In addition, you can specify a no auto-restart option for scheduled update installations. You can enable the immediate installation of updates that do not require a restart. You can specify a delay time before a scheduled restart occurs, as well as a second prompt for restarting a computer. You can also allow nonadministrators to receive update notifications.

644

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

Troubleshoot the Application of Group Policy Security Settings Keep in mind the following facts when troubleshooting the application of Group Policy security settings: . The Security Configuration and Analysis tool enables you to analyze the security set-

tings on a computer, view the results, and resolve any discrepancies that may appear. . You can use the secedit tool with the /analyze parameter to compare the current

configuration of your computer to a security database. You can also use the /configure parameter to apply the database security settings to the computer. . You can use RSoP in logging mode to verify the changes made to security settings as

a result of using Group Policy to apply security templates to a GPO. Information provided includes which IPSec policy prevails and the properties of this policy. This information can assist you in repairing a security breach. . Using Gpresult with the /v option to obtain verbose output shows the settings applied

to security-based policies in a similar manner to the display of other policy settings.

Practice Exam The practice exam is a representation of the questions you might expect to find on the actual exam. It consists of 65 questions that reflect the material we have covered in this book. You should work through these questions in a manner similar to that of the actual exam. In other words, you should time yourself, read each question carefully, and answer all questions as well as you can. Have some note paper handy and list your answers on a sheet so that you can compare them with the correct answers after you have finished the exam. Use a second piece of note paper in a similar manner to that of the plastic sheets provided you in the exam room for making notes during the exam. As on the actual exam, most of the questions measure your ability to synthesize information you have learned in order to come up with the best answer. Many of the questions present two or more choices, each of which might seem plausible; however, there is always one answer that represents the best solution to the problem encountered or the best plan of action to follow. Read carefully through all facts presented in each question before making your decision. Answers and explanations of the correct and incorrect choices follow the practice exam. Compare your answers to the correct ones, and when you have made an incorrect choice, study the explanations and reference material so that you know the rationale behind the correct choice and the reason your choice was incorrect. Try the practice exam again a few days later, compare your efforts with the first attempt, and ensure that you understand all concepts before booking the real exam. Good luck!

646

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

Exam Questions 1. Andrew is responsible for configuring Group Policy in the quepublishing.com domain. A user named Elaine, whose account is in the Marketing OU, reports that My Network Places is missing from her Windows 2000 Professional computer’s desktop. Andrew checks the various Group Policy settings and discovers that the Remove My Documents Icon on the Desktop policy is enabled in the Default Domain Policy GPO, and that the same policy is disabled in the Marketing Policy GPO. On accessing the Group Policy Management Console, Andrew discovers that GPOs are being applied to the Marketing OU according to the information provided in the following Group Policy Management screen. He needs to ensure that Elaine can receive the My Network Places icon on the desktop without modifying policies applied to users in other departments of the company.

What should Andrew do? (Each answer represents part of the solution. Choose two answers.)

❏

A. Disable the user configuration settings in the Default Domain Policy GPO.

❏

B. Configure the Marketing OU with the Block Inheritance option.

❏

C. Modify the delegation settings of the Marketing policy so that it is not applied to Elaine’s user account.

❏ D. Remove the Enforced setting from the Default Domain Policy GPO. ❏

E. Ask Elaine to log off and log back on her computer.

647

Practice Exam

❏

F. Ask Elaine to restart her computer.

❏ G. Ask Elaine to right-click Start on her computer and choose Properties. From the Advanced tab, ask her to select My Network Places as an item to be displayed. 2. You have deployed a new Group Policy Object (GPO) that is supposed to provide a uniform desktop policy for all users in your company’s domain. During a conversation with a user named Ruth in the Marketing OU a few days later, you notice that her computer is not displaying the desktop configuration you implemented. Returning to your desktop, you run Resultant Set of Policy (RSoP) in logging mode to display the GPOs that affect Ruth when logged on to a computer named Mktg08. However, you receive a User does not exist error message. Which of the following is the most likely reason for this error?

❍

A. Ruth’s user account has become corrupted.

❍

B. Group Policy replication has failed somewhere between the domain controllers and the Mktg08 computer.

❍

C. Ruth has never logged on to the Mktg08 computer.

❍ D. Ruth’s computer is not connected to the domain. 3. Clifford is a consultant who is responsible for creating an Active Directory structure for a multinational conglomerate that requires multiple forests and child domains. The required plan specifies that some forests might need multiple trees as well as child domains within the same tree. Which of the following conditions would most likely call for the creation of a second tree in the same forest as opposed to a child domain?

❍

A. The plan calls for a domain that does not share a contiguous namespace with the forest root domain in the same forest.

❍

B. The plan calls for a domain that shares a contiguous namespace with one or more domains in the same forest.

❍

C. The plan calls for a domain with limited trust relationships with other domains in the enterprise.

❍ D. The plan calls for a domain with schema attributes that would not be compatible with the schema of the forest root domain in the same forest.

❍

E. The plan calls for the ability of domain administrators to manage only their own domains.

648

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 4. Barry is a help desk analyst for a large insurance company that operates an Active Directory domain. Because the domain contains domain controllers running either Windows 2000 Server or Windows Server 2003 as well as client computers running any of Windows NT 4.0 Workstation, Windows 2000 Professional, or Windows XP Professional, administrators in the network have left the domain functional level at Windows 2000 mixed. A user named Kristin calls Barry to inform him that she was attempting to log on to her Windows NT 4.0 Workstation computer. She was asked to change her password, but the computer would not accept any password she offered. What should Barry check first?

❍

A. He should ensure that the infrastructure master is online.

❍

B. He should ensure that the PDC emulator is online.

❍

C. He should check the properties of Kristin’s user account to ensure that the User Must Change Password at Next Logon option is not selected.

❍ D. He should raise the domain functional level to Windows 2000 native. 5. Maria is a systems administrator for a legal firm that is increasingly worried about threats to its network from unauthorized users gaining access. Management has asked her to implement a system of smart cards for user logon. After installing the appropriate hardware and creating an enterprise root certification authority (CA), Maria enabled the Smartcard User certificate template, modified the access control list (ACL) for this template to provide members of the Certificate Issuers group with the enroll permission, and obtained a signing certificate. The next morning, Joe, a member of the Certificate Issuers group, phoned Maria to inform her that he could not reach the certificate enrollment web pages from his Windows XP Professional client computer. What does Maria need to do so that Joe can enroll certificates for smart cards?

❍

A. Install Internet Information Services (IIS) on the certificate server.

❍

B. Install an enterprise subordinate CA in addition to the enterprise root CA.

❍

C. Enable the Smartcard Logon certificate template rather than the Smartcard User template.

❍ D. Ask Joe to move to a computer running Windows Server 2003. 6. Keith is a network administrator for a company that has offices in eight North American cities. The offices are linked with WAN links of varying bandwidth, and Keith has configured site links in Active Directory for the various available links. His company operates a small office located in Colorado Springs, which connects to the company’s Denver office by a T1 link and to the company’s Dallas office by a 56Kbps dial-up link. The Denver and Dallas offices also connect by a T1 link.

649

Practice Exam A junior operator in Colorado Springs calls Keith to inform him that every time administrators in Dallas issue updates to Active Directory (which has been quite frequent in recent weeks), a domain controller in Colorado Springs dials the 56Kbps link despite the rapid T1 link being available. What should Keith do to minimize the times the 56Kbps link is dialed?

❍

A. Configure the 56Kbps link to be available only outside business hours.

❍

B. Configure the 56Kbps link to use SMTP replication rather than IP.

❍

C. Create a site link bridge that encompasses the Colorado Springs-to-Denver and Denver-to-Dallas site links, and then set the cost of the site link bridge to 50.

❍ D. Create a site link bridge that encompasses the Colorado Springs-to-Denver and Denver-to-Dallas site links, and then set the cost of the 56Kbps link to 300. 7. Peter is the network administrator for a company that operates an Active Directory network with a single domain and two domain controllers named DC1 and DC2. DC1 hosts the company’s DNS server. Peter has scheduled nightly system state backups for both domain controllers. A flood in the server room damages both domain controllers. Peter purchases two new servers and installs Windows Server 2003 on both. He needs to restore Active Directory services and ensure that name resolution services are restored as rapidly as possible. How should he proceed? (Each answer represents part of the solution. Choose two answers.)

❏

A. Use dcpromo.exe to promote both servers to domain controllers.

❏

B. Restart both domain controllers in Safe Mode.

❏

C. Restart both servers in Directory Services Restore Mode.

❏ D. Restart both servers to the Recovery Console. ❏

E. Perform a nonauthoritative restore of System State on both DC1 and DC2.

❏

F. Perform an authoritative restore of System State on both DC1 and DC2.

❏ G. Perform a primary restore of System State on DC1 and a nonauthoritative restore of System State on DC2.

❏ H. Perform a primary restore of System State on DC1 and an authoritative restore of System State on DC2.

650

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 8. You are applying Group Policy to your OU structure. The OU structure is as follows: East, West, North, and Europe are at the top level of the OU structure. Within each of these location-oriented OUs, there are three departmental child OUs representing the three departments: Finance, Distribution, and Manufacturing. You need to apply a Group Policy Object (GPO) to the managers of the Finance department that deploys a custom application to them alone. You also have to deploy a second GPO that specifies a strict desktop to all users in Europe. Which of the following actions should you take to accomplish your goals? (Each answer represents part of the solution. Choose two answers.)

❏

A. Create a new OU named Managers in each of the Finance child OUs, and add user accounts for managers to the appropriate Managers OU.

❏

B. Create new OUs named Managers in each of the departmental child OUs, and add user accounts for managers to the appropriate Managers OU.

❏

C. Create new OUs named Managers in each of the top-level OUs, and add user accounts for managers to the appropriate Managers OU.

❏ D. Apply the desktop GPO to the domain and the application GPO to the Managers OUs. ❏

E. Apply the desktop GPO to the Europe OU and the application GPO to the Managers OUs.

❏

F. Apply the application GPO to the domain and the desktop GPO to the Managers OUs.

❏ G. Apply the application GPO to the Europe OU and the desktop GPO to the Managers OUs. 9. Phil is responsible for creating an organizational unit (OU) structure for his company, which has just created a new Active Directory domain named quepublishing.com. The company operates a head office in New York and three branch offices, located in Atlanta, Minneapolis, and Seattle. The Human Resources (HR) department, located in New York, is responsible for creating and maintaining user accounts in all offices, but does not have any other responsibilities for maintaining the directory structure. Each office also has a Support department that has the ability to reset passwords in its office only. Phil needs to create an OU structure that supports the delegation of authority requirements needed to accomplish the stated objectives, but minimizes the amount of administrative effort required. How should he proceed?

❍

A. Create a top-level OU named Corp and move the user accounts for the head office employees into this OU. Create child OUs under the Corp OU for each branch office, and move the user accounts for branch office employees into the child OU for their respective office.

❍

B. Create a top-level OU named Corp and then create a child OU for each office under the Corp OU. Then move the user accounts for all employees into the child OU for their respective office.

651

Practice Exam

❍

C. Create a top-level OU named Corp and then create a child OU named HR under the Corp OU. Move the user accounts of the HR employees into the HR OU. Create a second child OU named Support under the Corp OU and move the user accounts of the Support employees into the Support OU. Move the user accounts of all other employees into the Corp OU.

❍ D. Create a top-level OU named Corp and then create a child OU named HR under the Corp OU. Move the user accounts of the HR employees into the HR OU. Create child OUs named Atl_Support, Minn_Support, and Sea_Support under the Corp OU, and move the user accounts of the Support employees of each branch office into the child OU for their respective location. Move the user accounts of all other employees into the Corp OU. 10. Erin is a software support specialist who has responsibility for installing, upgrading, and removing software in her company. The company’s Active Directory domain is organized into OUs according to its business needs. She uses GPOs linked to the various OUs to deploy software. Management frequently moves users from one OU to another because of changing work responsibilities. Erin’s supervisor has asked her to ensure that software on these users’ computers is removed when they are moved to another OU if it is no longer needed. Which of the following steps does Erin need to take to accomplish this task? (Each answer represents part of the solution. Choose two answers.)

❏

A. Select the Modifications tab of the software’s Properties dialog box in the Group Policy Object Editor.

❏

B. Select the Upgrades tab of the software’s Properties dialog box in the Group Policy Object Editor.

❏

C. Select the Deployment tab of the software’s Properties dialog box in the Group Policy Object Editor.

❏ D. Select the Uninstall This Application When It Falls Out of the Scope of Management option.

❏

E. Select the Do Not Display This Package in the Add/Remove Programs Control Panel option.

❏

F. Deselect the Install This Application at Logon option.

652

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 11. You are a software support specialist for a company that operates an Active Directory domain. You have configured several GPOs for software installation in various departments of your company, each of which is represented by a different OU. Some users have been removing deployed software packages from their computers, and you need to know which users have removed these packages. Which of the following tools could you use to obtain this information?

❍

A. Gpresult

❍

B. Gpotool

❍

C. Secedit

❍ D. Dcdiag ❍

E. Gpupdate

12. You are in the process of building a new Active Directory forest for your company. The company has operated a UNIX-based network and is switching over to a Windows 2003 Active Directory forest structure. Having completed the installation of the first domain controller, you want to verify that Active Directory has been properly installed before you continue installing additional domain controllers and child domains. Which of the following actions should you perform? Choose all that apply.

❏

A. Open Active Directory Users and Computers, and verify that an OU named Domain Controllers is present.

❏

B. Open Active Directory Users and Computers, and verify that an OU named Users is present.

❏

C. Open the DNS snap-in and check for the presence of two folders for your domain name in the Forward Lookup Zone node. One of these folders should be prefixed with _msdcs.

❏ D. In the DNS snap-in, right-click your domain name under Forward Lookup Zones, choose Properties, and verify the existence of an Active Directory–integrated zone configured with secure dynamic update.

❏

E. In the %systemroot% folder, verify the existence of the Active Directory database and shared system volume folders.

❏

F. In the root of the system drive, verify the existence of the Active Directory database and shared system volume folders.

653

Practice Exam 13. Sherry is the manager of the IT staff group for a company that operates a single-domain Active Directory network that includes separate OUs for each of the company’s eight departments. The company has experienced significant growth in the past few years, and administering the network is becoming an increasingly difficult task. To ease the burden of network administration, Sherry wants to assign individual members of the IT staff group to administer only single OUs. How should she distribute the administrative tasks among individual IT staff members without assigning them excessive privileges? (Each answer represents a complete solution to this problem. Choose two answers.)

❏

A. Add the individual IT staff member to the access control list (ACL) for a different single OU with Full Control permission.

❏

B. Add the individual IT staff members to the Domain Admins global group.

❏

C. Grant the individual IT staff members Full Control permission for the Domain Controllers OU.

❏ D. Delegate Full Control of the OU to the individual IT staff member using the Delegation of Control Wizard. 14. Jason is the network administrator for a single-domain, multiple-site Active Directory network. Users at several sites are reporting that replication takes a long time to provide them with up-todate settings. Which of the following should Jason do to improve the replication efficiency?

❍

A. Create a site link between the sites.

❍

B. Create a site link bridge between the sites.

❍

C. Designate additional domain controllers as preferred bridgehead servers.

❍ D. Designate additional domain controllers as intersite topology generation servers. ❍

E. Modify the replication properties of the existing site link.

15. Shelley is the network administrator for a company that operates an Active Directory forest containing two geographically distinct domains: quepublishing.com located in Boston and west.quepublishing.com located in Phoenix. Each domain has a single site named by its city and containing three domain controllers. The two sites are connected by a 56Kbps WAN link. Shelley is configuring the placement of global catalog servers so that users in both domains achieve maximum response time for logon and resource access. Which of the following configurations should she use?

❍

A. Place two global catalog servers at the Boston site only.

❍

B. Place two global catalog servers at the Phoenix site only.

❍

C. Place a single global catalog server at both sites.

❍ D. Place a single global catalog server at the Boston site only. ❍

E. Place two global catalog servers at both sites.

654

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 16. Recently, two small software development companies called Fast Programs and Quality Software merged their operations. Both companies operate a single-domain Active Directory network. Senior managers at both companies met to decide on an Active Directory structure for the merged company. They decided to merge their Active Directory structures and share a contiguous namespace with a common schema. However, because the merger was mutually arranged between the two companies and was not a buyout of one by the other, neither company wanted to be subordinate to the other one in the Active Directory namespace. In addition, the managers decided to keep administrative capabilities within the two companies as separate as possible. Which of the following is the best means of setting up the merged Active Directory infrastructure in keeping with these requirements?

❍

A. Establish two separate Active Directory trees.

❍

B. Establish an empty root domain and configure both corporate domains as children of this domain.

❍

C. Create a new domain that encompasses both existing domains and place all resources into two OUs, one for each company. Then delegate all administrative control to administrators within each OU.

❍ D. Retain the existing two forests and create a forest trust relationship. 17. Brent is a domain administrator for a large manufacturing company that operates 12 factories in different North American cities. Each factory has an accompanying office that controls operations at that location, and there is a head office located in Atlanta. Recently, two instances of lost data have occurred because of support staff at factory locations not backing up all data on a timely basis. Brent needs to obtain information about when backup and restore attempts have occurred in the company’s domain, so he opens the Group Policy Object Editor on a GPO linked to the domain. Which of the following components in the Computer Configuration\Windows Settings\Security Settings node should Brent use to configure a policy setting that accomplishes his objective?

❍

A. Audit Policy

❍

B. System Services

❍

C. Security Options

❍ D. Windows Components ❍

E. Software Restriction Policies

655

Practice Exam 18. Charles is a systems engineer who works for an oil exploration company that operates a single office in Calgary. Within the company’s domain structure are several OUs corresponding to business divisions, including a Design OU and its child OU named Materials. At present, a local administrator in the Design OU has full control over both the Design and Materials OUs, but management has asked Charles to remove this administrator’s authority over the Materials OU. Which of the following should Charles do to accomplish this task?

❍

A. Specify Block Policy Inheritance at the Materials OU.

❍

B. Specify No Override at the Design OU.

❍

C. Configure the security settings at the Materials OU.

❍ D. Configure the security settings at the Design OU. 19. Connie is a systems administrator for an insurance company that runs a chain of branch offices in major U.S. cities. Each office is configured as its own site in Active Directory. To improve the efficiency of Active Directory site replication, Connie decided that she needed to create a site link bridge. Which of the following steps should Connie perform to accomplish this task? (Each answer represents part of the solution. Choose three answers.)

❏

A. In the console tree of Active Directory Sites and Services, right-click the Intersite Transports folder and choose New Site Link.

❏

B. In the console tree of Active Directory Sites and Services, right-click the Intersite Transports folder and choose New Site Link Bridge.

❏

C. In the console tree of Active Directory Sites and Services, right-click the required intersite transport folder and choose New Site Link.

❏ D. In the console tree of Active Directory Sites and Services, right-click the required intersite transport folder and choose New Site Link Bridge.

❏

E. In the New Object—Site Link Bridge dialog box, type a name for the site link bridge.

❏

F. In the New Object—Site Link Bridge dialog box, select the check box labeled Bridge All Site Links.

❏ G. In the New Object—Site Link Bridge dialog box, select at least two sites you want bridged and then click Add.

❏ H. In the New Object—Site Link Bridge dialog box, select at least two site links you want bridged and then click Add.

656

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 20. Evan is a domain administrator for his company, which runs a single-domain Active Directory network with three top-level OUs named North, Central, and South. Each top-level OU contains several child OUs organized along departmental lines and managed by assistant administrators in their departments. Evan has assigned Microsoft Office 2003 to all users in the company by means of a domain-based GPO. Because a possibility exists that all users might not need Microsoft Office 2003 at some time in the future, he has created GPOs linked to each OU that also assign Microsoft Office 2003 to users in their departments. Microsoft has released a service pack that addresses several newly discovered vulnerabilities in Office 2003, and Evan needs to ensure that all installations of Office 2003 upgrade with this service pack. What should Evan do to accomplish this task with the least amount of administrative effort? (Each answer represents part of the solution. Choose two answers.)

❏

A. Create an upgrade package for the domain.

❏

B. Create an upgrade package for each top-level OU.

❏

C. Create an upgrade package for each departmental OU.

❏ D. Configure the upgrade package to upgrade installations at the domain-based GPO. ❏

E. Configure the upgrade package to upgrade installations at all GPOs.

21. Nancy is a systems administrator for a company whose offices are located in two buildings of an office campus. The company’s domain includes four OUs, as follows: Users in Building A are located in the UsrBldgA OU, and computers in Building A are located in the CompBldgA OU. Users and computers in Building B are located in the UsrBldgB and CompBldgB OUs, respectively. Nancy needs to configure IPSec policies to protect data according to the following requirements: Computers in Building A have sensitive data that needs to be protected regardless of who logs on to these computers, and users in Building B need to receive IPSec policies regardless of the building at which they log on. Which of the following policies should Nancy use to configure the appropriate GPOs to accomplish this task? (Each answer represents part of the solution. Choose two answers.)

❏

A. Nancy should use the Computer Configuration node in a GPO linked to the UsrBldgA OU.

❏

B. Nancy should use the User Configuration node in a GPO linked to the UsrBldgA OU.

❏

C. Nancy should use the Computer Configuration node in a GPO linked to the UsrBldgB OU.

❏ D. Nancy should use the User Configuration node in a GPO linked to the UsrBldgB OU. ❏

E. Nancy should use the Computer Configuration node in a GPO linked to the CompBldgA OU.

❏

F. Nancy should use the User Configuration node in a GPO linked to the CompBldgA OU.

657

Practice Exam

❏ G. Nancy should use the Computer Configuration node in a GPO linked to the CompBldgB OU.

❏ H. Nancy should use the User Configuration node in a GPO linked to the CompBldgB OU. 22. Jeremy is an enterprise administrator for a company that operates an Active Directory forest with two domains and five sites corresponding to offices in cities in which the company does business. Offices in Las Vegas, Albuquerque, and El Paso are located in the quepublishing.com domain, and offices in Little Rock and Nashville are located in the examcram.com domain. The following table gives the number of users in each office: Office

Number of Users

Las Vegas

750

Albuquerque

35

El Paso

400

Little Rock

625

Nashville

50

Users in El Paso and Nashville require access to a directory-enabled application that stores information in the global catalog. To this end, Jeremy must optimize the location of global catalog servers throughout the network. In addition, Jeremy needs to ensure that users in all offices are able to log on without accessing cached credentials, and that they have access to the directoryenabled application in case a WAN link fails. Furthermore, Jeremy must accomplish these objectives while minimizing the increase in WAN traffic. How should Jeremy plan the deployment of global catalog servers? (Each answer represents part of the solution. Choose two answers.)

❏

A. Jeremy should configure the Las Vegas and Little Rock domain controllers as global catalog servers.

❏

B. Jeremy should configure the Las Vegas, El Paso, Little Rock, and Nashville domain controllers as global catalog servers.

❏

C. Jeremy should configure the Las Vegas, Albuquerque, and El Paso domain controllers as global catalog servers.

❏ D. Jeremy should configure domain controllers in all five cities as global catalog servers. ❏

E. Jeremy should enable universal group membership caching at the Albuquerque, El Paso, and Nashville domain controllers.

❏

F. Jeremy should enable universal group membership caching at the El Paso and Nashville domain controllers.

❏ G. Jeremy should enable universal group membership caching at the Albuquerque domain controllers only.

❏ H. Jeremy should not enable universal group membership caching at any of the domain controllers.

658

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 23. Lisa is a consultant hired by a large manufacturing firm that operates a single-domain Active Directory network. The company has just upgraded its domain from Windows NT 4.0 to Windows Server 2003, and has hired Lisa to help with designing an OU structure. The company operates factories in six cities and administrative offices in three of these cities. The other three cities have only a small office that keeps track of production at that location. The administrative offices contain several departments including Accounting, Marketing, Production, Executive, and Legal. Business in each department is closely related to the corresponding departments in other cities. Each department, as well as the small production offices, has its own small IT staff that is responsible for its own operations. Management has asked Lisa to design a two-level OU structure for the company. Which of the following OU structures is best suited to the company’s needs?

❍

A. Top-level geographical and bottom-level departmental

❍

B. Top-level departmental and bottom-level geographical

❍

C. Top-level geographical and bottom-level production-based

❍ D. Top-level production based and bottom-level departmental ❍

E. Top-level production based and bottom-level geographical

24. Mike is a network administrator who is setting up a smart card autoenrollment for users in his company’s Research department. He has set up an enterprise certification authority (CA) and configured the appropriate certificate template for autoenrollment. He has also installed smart card readers on all computers in the Research department and a smart card writer at the enrollment computer. The users and computers in this department are located in the Research OU, and the users are all located in the Research global group. What additional actions should Mike complete to ensure that all users in the Research department need to use their smart cards to log on to their computers? (Each answer represents part of the solution. Choose two answers.)

❏

A. Configure a GPO linked to the Research OU under User Settings\Windows Settings\Security Settings\Public Key Policies that enables the automatic enrollment of certificates.

❏

B. Configure a GPO linked to the Research OU under Computer Settings\Windows Settings\Security Settings\Public Key Policies that enables the automatic enrollment of certificates.

❏

C. Configure a GPO linked to the Research OU under User Settings\Windows Settings\Security Settings\Public Key Policies that requires the use of smart cards for user logon.

❏ D. Configure a GPO linked to the Research OU under Computer Settings\Windows Settings\Security Settings\Public Key Policies that requires the use of smart cards for user logon.

❏

E. In Active Directory Users and Computers, open the Properties dialog box for each Research user and select the Smart Card Is Required for Interactive Logon option.

❏

F. In Active Directory Users and Computers, open the Properties dialog box for the Research group and select the Smart Card Is Required for Interactive Logon option.

659

Practice Exam 25. Joe is a domain administrator for a company that operates a single-domain network with six domain controllers, three of which run Windows 2000 Server and three of which run Windows Server 2003. One Monday morning, he arrives at work to discover that a domain controller named DC5 running Windows Server 2003 has suffered a hardware failure. After making repairs, including the reinstallation of Windows Server 2003, he attempts to run dcpromo to re-create the domain controller and receives an error stating that the DC5 domain controller already exists. Joe needs to retain the DC5 name because this name is used in several network references that are hard-coded into custom applications. What should Joe do first so that he can reinstall this domain controller with the DC5 name?

❍

A. Reinstall the domain controller with a different name and then rename it to DC5.

❍

B. Restore the System State data of DC5 from a backup tape.

❍

C. Verify that the infrastructure master is online.

❍ D. Verify that the RID master is online. ❍

E. Run ntdsutil with the metadata cleanup option to remove references to DC5 from the Active Directory database.

26. Managers of the company at which you are the head domain administrator have asked you to secure the schema in your company’s Active Directory forest. You have placed the schema master and domain naming master FSMO roles on the same computer, and located this computer in a secure server room in the head office, together with two additional domain controllers to which the roles can move if necessary. You need to make a few modifications to the schema to fit the company’s business needs. Which of the following actions can you perform on the schema from the Active Directory Schema console? (Each answer represents a complete action. Choose three answers.)

❏

A. You can add new classes and attributes to the schema.

❏

B. You can remove existing classes and attributes from the schema.

❏

C. You can remove classes and attributes from the schema that were not present when the schema was installed.

❏ D. You can modify existing classes and attributes in the schema. ❏

E. You can deactivate existing classes and attributes in the schema.

❏

F. You can extend existing classes and attributes in the schema.

660

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 27. Fred is a domain administrator for his company, which operates an Active Directory domain with a business function–based OU structure. The domain contains an Accounting OU, which in turn contains a Payable and a Receivable OU. He has configured a GPO for the Accounting OU that specifies users should not have access to Control Panel, Internet Explorer, or the Run command. He has also configured a GPO for the Payable OU that redirects users’ My Documents folders to the Server1 server, and another GPO for the Receivable OU that redirects users’ My Documents folders to the Server2 server. He does not want the settings in the Accounting GPO to apply to users in either the Payable or Receivable OU. Which of the following actions should Fred do to accomplish this objective with the least amount of administrative effort?

❍

A. Fred should disable the policies that prevent access to Control Panel, Internet Explorer, and the Run command in the GPOs linked to the Payable and Receivable OUs.

❍

B. Fred should configure the No Override option on the Accounting OU.

❍

C. Fred should configure the Block Policy Inheritance option on the Accounting OU.

❍ D. Fred should configure the Block Policy Inheritance option on the Payable and Receivable OUs. 28. Judy is a systems administrator who is responsible for software deployment using Group Policy in her company’s domain. A user named Carm was attempting to install a published application but received the Feature ID not registered error message. What should Judy do so that Carm can install this application?

❍

A. Change the application deployment type from published to assigned.

❍

B. Have Carm log off his computer before logging on to a different computer.

❍

C. Have Carm log off and log back on his computer.

❍ D. Check the network connectivity from the application server to Carm’s computer. 29. Evelyn has been asked by the senior domain administrator in her company’s Windows Server 2003 domain to obtain information about Active Directory objects, including schema and configuration data. This information should include the class and distinguished names of objects found in any Active Directory container. Which of the following tools should she use?

❍

A. Repadmin

❍

B. Replmon

❍

C. ADSI Edit

❍ D. Dcdiag ❍

E. Sdcheck

661

Practice Exam 30. Rod is a systems engineer for a company that operates an Active Directory domain with three Windows 2000 domain controllers and one Windows Server 2003 domain controller. He is responsible for assigning the FSMO roles to specific domain controllers to achieve optimum network functionality. Rod needs to ensure proper synchronization of the system clocks on all computers on the network. To this end, he wants to have the Windows Server 2003 domain controller look after this requirement. Which of the following roles should he assign to this domain controller?

❍

A. PDC emulator

❍

B. Schema master

❍

C. Infrastructure master

❍ D. RID master ❍

E. Domain naming master

31. Diane is a domain administrator for an investment company that maintains a single-domain Active Directory network in its downtown Toronto office. There are five domain controllers, each of which hosts a single FSMO role. Because of the August 2003 power failure, two of the five domain controllers failed and needed major repairs. After the network had been operating for several days with the three surviving domain controllers, junior administrators reported that they could no longer create new user accounts. At the same time, Diane attempted to install Microsoft Exchange 2003 on a member server in the domain, but was unsuccessful. Diane expects the failed domain controllers to be repaired within a week. What steps should Diane take to alleviate the network problems? (Each answer represents part of the solution. Choose three answers.)

❏

A. Seize the infrastructure master and the schema master.

❏

B. Seize the RID master and the schema master.

❏

C. Seize the PDC emulator and the infrastructure master.

❏ D. Bring the repaired domain controllers back online. ❏

E. Transfer the RID master to its original role holder.

❏

F. Transfer the schema master to its original role holder.

❏ G. Transfer the PDC emulator to its original role holder. ❏ H. Transfer the infrastructure master to its original role holder.

662

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 32. Your manager has asked you to design a new Group Policy structure for your company, which includes a single domain and two levels of nested OUs. Before you create your Group Policy structure, you have to determine what policy settings are currently implemented for computers in the domain. You have installed Resultant Set of Policy (RSoP) in its own Microsoft Management Console (MMC). Which task should you run from this console?

❍

A. Select planning mode. On the User and Computer Selection page, specify the distinguished name of the domain under Computer Information and leave the User Information fields blank.

❍

B. Select logging mode. On the User and Computer Selection page, specify the distinguished name of the domain under Computer Information and leave the User Information fields blank.

❍

C. Select logging mode. Specify a user and computer for which you want to display policy settings.

❍ D. Select logging mode. Specify a computer for which you want to display policy settings, and then select the Do Not Display User Policy Settings in the Results option. 33. You are a systems administrator for an accounting company that operates an Active Directory network consisting of two domains and two sites. The forest root domain contains two domain controllers named Server1 and Server2, which are located in sites named Site1 and Site2, respectively. Server1 is configured as a global catalog server. You need to enable universal group membership caching, so you open Active Directory Sites and Services at one of the domain controllers. From which location do you enable universal group membership caching?

❍

A. The Servers container for Site1.

❍

B. The Servers container for Site2.

❍

C. The Licensing Site Settings container for Site1.

❍ D. The Licensing Site Settings container for Site2. ❍

E. The NTDS Site Settings container for Site1.

❍

F. The NTDS Site Settings container for Site2.

663

Practice Exam 34. Loretta is a domain administrator for a single-domain Active Directory network with several OUs representing the company’s departmental structure. She has created a taskpad for printer management in the Design OU and used the Delegation of Control Wizard to delegate printer management to a domain local group containing three experienced employees in this department. One of the three employees phones Loretta to complain that he is unable to access the printer management taskpad. Loretta contacts the other two employees who tell her that they can access this taskpad without any problem. Which of the following is the most likely reason for this problem?

❍

A. The employee is using a computer located in a different department.

❍

B. The employee was logged on when Loretta published the taskpad.

❍

C. The employee was logged off when Loretta published the taskpad.

❍ D. The employee is not located in the proper OU. 35. Julian is a systems administrator who is responsible for application deployment on his company’s Active Directory network. He has used an OU-based GPO to assign a computer-aided design (CAD) application to all users in the company’s Design OU. The vendors of the CAD application have located a security flaw in the application that can enable intruders to gain access to and run unauthorized code on the network. To correct this flaw, they have produced a new, more secure version of the application. Julian needs to configure the GPO to make the upgraded version appear in all users’ Start menus. He needs to allow automatic installation of the updated program only when the previous version is present, and he needs to ensure that user preference settings for the old package are retained for use with the new package. Which of the following should Julian do?

❍

A. Assign the updated application to all users using the Required Upgrade for Existing Packages option.

❍

B. Assign the updated application to all users using the Uninstall the Existing Package, Then Install the Upgrade Package option.

❍

C. Publish the updated application to all users using the Required Upgrade for Existing Packages option.

❍ D. Publish the updated application to all users using the Uninstall the Existing Package, Then Install the Upgrade package option.

❍

E. Assign the updated application to all computers using the Required Upgrade for Existing Packages option.

❍

F. Assign the updated application to all computers using the Uninstall the Existing Package, Then Install the Upgrade Package option.

664

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 36. Maggie is a domain administrator for an accounting company that has recently merged with a competitor. The competitor operates a UNIX-based network and has no plans to convert to an Active Directory–based network. Maggie needs to configure her Active Directory domain to enable users on the UNIX-based network to access resources in her domain. What should she do?

❍

A. Configure an external trust in which her domain trusts the UNIX-based network.

❍

B. Configure a realm trust in which her domain trusts the UNIX-based network.

❍

C. Configure a shortcut trust in which her domain trusts the UNIX-based network.

❍ D. Configure an external trust in which the UNIX-based network trusts her domain. ❍

E. Configure a realm trust in which the UNIX-based network trusts her domain.

❍

F. Configure a shortcut trust in which the UNIX-based network trusts her domain.

37. Bill is a network engineer who works for a large company that operates an Active Directory forest with nine domains in two domain trees. Because of a recently initiated new project, users in the inventory.US.quepublishing.com domain require access to several shared folders located in the materials.Europe.examcram.com domain. These users have complained that authentication to the materials.Europe.examcram.com domain takes more than half an hour at certain times of the day. Which of the following should Bill do to improve access times?

❍

A. Create a shortcut trust between the two domains.

❍

B. Create an external trust between the two domains.

❍

C. Create a realm trust between the two domains.

❍ D. Configure replication of the schema and configuration partitions in the forest to use SMTP as the replication protocol.

❍

E. Configure replication of the schema and configuration partitions in the forest to take place only on weekends.

665

Practice Exam 38. Rebecca is a network administrator for a company named Quepublishing that has just upgraded its Windows NT 4.0 domain to Windows Server 2003. She has been assigned the task of creating an organizational unit (OU) structure that will enable the deployment of Group Policy Objects (GPOs) that will apply to all servers in the company but not to other company computers. The company’s Engineering and Finance departments each have six file servers and four application servers. Different policy settings are to be applied according to server role, including some policies that will apply to both server roles and others that will apply to only the one server role. Additional policy settings will apply to Engineering servers only or to Finance servers only. Policy settings applied to the Engineering servers are not to be overridden by other policies. The design should not require the use of the Block Inheritance or Enforced settings. Which of the following OU structures should Rebecca create so that the resulting design minimizes the number of OUs, GPOs, and GPO links?

❍

❍ B.

A.

Quepublishing.com

File

Engineering

❍

Quepublishing.com

Engineering

Application

Finance

Engineering

Application

File

Application

❍ D.

C.

Quepublishing.com

Quepublishing.com

Servers

Servers

File

Engineering

File

Finance

Finance

Engineering

Application

Finance

Engineering

Finance

File

Application

Finance

File

Application

666

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 39. Mark is a network administrator who has been asked to provide advice on Group Policy–based security settings. A manager has asked him to configure the maximum lifetime for a service ticket. He goes to the Computer Configuration\Windows Settings\Security Settings node of the Group Policy Object Editor. In which location should Mark configure this policy?

❍

A. Kerberos Policy

❍

B. Account Lockout Policy

❍

C. Security Options

❍ D. System Services ❍

E. Public Key Policies

40. Jennifer is responsible for planning operations master role placements in her company’s Active Directory forest, which consists of a forest root domain and two child domains. She needs to determine on which server to place the infrastructure master role. Which of the following represents the best placement of the infrastructure master?

❍

A. On Server1, which hosts all four other operations master roles plus the global catalog.

❍

B. On Server2, which hosts the RID master, but not the global catalog. This server has a direct connection to Server1.

❍

C. On Server3, which is located across a WAN connection from Server1 and does not host any other operations master roles.

❍ D. On Server4, which does not host any other operations master roles, but does host the global catalog. 41. Alex is a systems administrator who is planning password policy for his company’s Active Directory domain. He is assessing the merits of the various available settings and needs to understand how to use these settings. Which of the following settings offers the weakest amount of password security?

❍

A. Enforce Password History

❍

B. Minimum Password Age

❍

C. Minimum Password Length

❍ D. Passwords Must Meet Complexity Requirements ❍

E. Store Password Using Reversible Encryption

667

Practice Exam 42. Anna is testing Kerberos and password policies for use on her company’s Active Directory domain, which has two Windows Server 2003 domain controllers. She has created these policies in a test lab and is planning to import them to the company domain after several users in the test lab have employed them for a month or two. What should she do so that she can easily import these policies at a later time?

❍

A. Take a domain controller from the test lab offline and bring it online in her company’s domain when the test period is finished.

❍

B. Take a domain controller from the company domain offline and configure the policies on it. Bring it back online when the test period is finished.

❍

C. Run an RSoP query on a computer in the test lab after the test period is finished.

❍ D. Configure a security template on a domain controller in the test lab. 43. Christina is a network administrator for a design company that operates an Active Directory forest with two domains: A.com and design.A.com. The company operates offices in Boston and Chicago, with the head office located in Chicago. Design employees have their user accounts located in the design.A.com domain, whereas management and support staff have their user accounts in the A.com domain. All network resources are located in the A.com domain. Christina has just installed a new high-speed color laser printer in Chicago that the designers will be using to print their work for managers and advertisers to use. Designers in Boston require access to this printer so that managers can approve their work. However, Christina receives several calls from designers in Boston complaining that they cannot locate the printer when they query the network. Christina suspects that the problem lies in replication between global catalog servers. What should Christina do to determine which domain controllers are global catalog servers?

❍

A. She should use replmon, add all domain controllers as monitored servers, and then select the option to display global catalog servers.

❍

B. She should use Active Directory Sites and Servers and select the option to display global catalog servers.

❍

C. She should use dcdiag with the /g option to display a list of global catalog servers.

❍ D. She should use repadmin with the /querysites option to query the Boston site for global catalog servers.

668

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 44. Lynn is the systems administrator for a Windows Server 2003 domain named examcram.com. Twelve users in the domain require access to shared folders located in various servers in the domain and in a child domain named programs.examcram.com. Some of the users belong to examcram.com; others belong to the programs.examcram.com domain. These users work with a committee of staff in another office on a common project, for which they need to receive email messages addressed to the entire committee. To enable the users to access these folders and receive common email, Lynn decides to create a new group and add the users to this group. She accesses the New Object–Group dialog box and notices that options for the group scope and type are available. What group scope and type should Lynn select to create the group required in this scenario?

❍

A. Global and Security

❍

B. Universal and Security

❍

C. Domain Local and Security

❍ D. Global and Distribution ❍

E. Universal and Distribution

45. Gail is a software support specialist who is responsible for all software in her company’s Active Directory domain. Financial users, whose user accounts are in the Finance OU, use a specialized financial application that has been published to users by a GPO named FinanceDeploy, which is linked to the Finance OU. Gail receives an upgrade to the financial application and needs to upgrade all currently installed copies of this application. She needs to ensure that the upgrade is not installed on computers on which the application has not been installed. She creates a new GPO named FinanceUpgrade linked to the Finance OU and configures it to publish the upgrade to all users in the Finance OU. The settings for each GPO are given in the following table: Setting

FinanceDeploy

FinanceUpgrade

Auto-Install This Application by File Extension Activation

Enabled

Not configured

Uninstall This Application When It Falls Out of the Scope of Management

Not configured

Enabled

Do Not Display This Package in the Add/Remove Programs Control Panel

Not configured

Enabled

Required Upgrade for Existing Packages

Not configured

Not configured

The following week, Gail realizes that the upgrade package has not been deployed to any of the client computers in the Finance OU. What should she do to ensure that the upgrade package is installed to all required computers as soon as possible?

669

Practice Exam

❍

A. In the FinanceUpgrade GPO, enable the Required Upgrade for Existing Packages option.

❍

B. In the FinanceUpgrade GPO, enable the Auto-Install This Application by File Extension Activation option.

❍

C. In the FinanceUpgrade GPO, disable the Do Not Display This Package in the Add/Remove Programs Control Panel option.

❍ D. In the FinanceUpgrade GPO, disable the Uninstall This Application When It Falls Out of the Scope of Management option. 46. You are planning Group Policy strategy for your company’s single-domain Windows Server 2003 network, and have decided to use a GPO to secure users’ desktops. The company requirements include customized desktops that users are unable to modify. These desktop configurations will include settings customized toward specific groups of users who have similar requirements. What type of user profile should you utilize in this situation?

❍

A. Local user profile

❍

B. Roaming user profile

❍

C. Mandatory user profile

❍ D. Temporary user profile 47. Kathy is deploying GPOs for users in her company’s Active Directory network. She needs to keep track of the effects of applying multiple GPOs at various levels of the Active Directory infrastructure and realizes that she can use Gpresult as part of a script that checks the application of Group Policy to a series of users. In which of the following situations can she use Gpresult as part of a script?

❍

A. To determine the precedence of security policies.

❍

B. To simulate the application of Group Policy.

❍

C. To view current Group Policy settings.

❍ D. To obtain Group Policy settings for a computer that is not available. 48. You are an enterprise administrator for a company whose Active Directory forest consists of five domains in two domain trees. Your company has signed a long-term working agreement with another company that operates a three-domain Active Directory forest. Both forests are operating at the Windows Server 2003 forest functional level. As part and parcel of the agreement, users in both companies require access to resources in all domains of the other company’s forest. Which of the following trust relationships would be most appropriate in this situation?

❍

A. A two-way transitive forest trust relationship.

❍

B. A two-way nontransitive external trust relationship.

❍

C. A one-way transitive forest trust relationship.

❍ D. A one-way nontransitive external trust relationship.

670

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 49. Bob is upgrading his company’s Windows NT 4.0 multiple domain enterprise to Active Directory and Windows Server 2003. He expects to consolidate the enterprise to one or two domains. In planning the structure of the new forest, Bob needs to determine what type of OU structure he should create. Which of the following can he accomplish by designing a hierarchy of OUs? Choose all that apply.

❏

A. Define a custom Active Directory schema.

❏

B. Delegate administrative tasks to junior administrators.

❏

C. Configure folder redirection policies.

❏ D. Configure user account policies. ❏

E. Define site boundaries.

50. Arlene is responsible for computer desktop configuration in her company. Her manager has asked her to prepare for the autoenrollment of user certificates for groups of users in the company. She needs to ensure that certificates are enrolled and updated as required. Which of the following tasks should Arlene undertake to accomplish this requirement? Choose all that apply.

❏

A. Configure settings on an enterprise certification authority (CA) server.

❏

B. Configure settings on a standalone CA server.

❏

C. Configure the retrieval of issued certificates.

❏ D. Configure a customized certificate template to enable autoenrollment. ❏

E. Configure a GPO to enable autoenrollment.

51. David is a systems administrator for a company that operates an Active Directory domain that functions at the Windows Server 2003 functional level. All domain controllers and member servers run Windows Server 2003, and client computers run either Windows 2000 Professional or Windows XP Professional. David needs to ensure that all servers and client computers are kept up-to-date with respect to service packs, hotfixes, patches, and so on. He needs to be able to test all updates before he installs them on servers or client computers. Which of the following tools should he employ?

❍

A. Windows Update

❍

B. Windows Installer

❍

C. Automatic Updates Client

❍ D. Windows Server Update Services ❍

E. Dynamic Update

671

Practice Exam 52. Josh is responsible for the implementation of his company’s Active Directory infrastructure. More specifically, he needs to ensure that the operations master servers are readily available so that the tasks they perform get done without delay. His company’s domain has five domain controllers, one of which runs Windows Server 2003 Enterprise Edition and is centrally located for availability to all sites on his company’s network. Josh needs to configure this server to ensure the uniqueness of Active Directory object IDs on the network. Which of the following operations master roles should he place on this server?

❍

A. Schema master

❍

B. RID master

❍

C. PDC emulator

❍ D. Infrastructure master ❍

E. Domain naming master

53. Doug is a systems engineer who works for a large engineering firm that operates an Active Directory forest with three domains based in the firm’s Philadelphia, St. Louis, and Seattle offices. The head office is in Philadelphia. Designers in the St. Louis office work on projects utilized throughout the domain and need to access resources located on file servers in all three locations. Designers in the Seattle office work on projects developed entirely in the same office and need access to resources located on file servers only in that location. Doug needs to design a security group strategy that will accommodate these requirements. He intends to create two security groups named Seattle Designers and St. Louis Designers, respectively. What scopes should Doug assign to these two security groups?

❍

A. St. Louis Designers–global and Seattle Designers–global.

❍

B. St. Louis Designers–domain local and Seattle Designers–global.

❍

C. St. Louis Designers–universal and Seattle Designers–global.

❍ D. St. Louis Designers–universal and Seattle Designers–domain local. ❍

E. St. Louis Designers–global and Seattle Designers–domain local.

672

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 54. Gwen is a support specialist for a company that hires a large number of short-term temporary workers. The temporary workers do not have domain user accounts but are allowed to use computers in the domain with local user accounts. Permanent workers in the company have domain user accounts. Gwen needs to make several applications available to both permanent and temporary workers. She has configured a GPO that is linked to the domain for purposes of software deployment. Which of the following software deployment types should she use?

❍

A. Use the User Configuration\Software Installation branch of the Group Policy Object Editor and configure the applications to be assigned.

❍

B. Use the User Configuration\Software Installation branch of the Group Policy Object Editor and configure the applications to be published.

❍

C. Use the Computer Configuration\Software Installation branch of the Group Policy Object Editor and configure the applications to be assigned.

❍ D. Use the Computer Configuration\Software Installation branch of the Group Policy Object Editor and configure the applications to be published. 55. Peter is using Group Policy to deploy Microsoft Office 2003 to users in his company’s Active Directory forest. Users at a branch office in Berlin need to receive the German language versions, for which Peter has a German language transform file available. When Peter accesses the Modifications tab of the installation package’s Properties dialog box, he is unable to add the transform to the package. Which of the following is the most likely reason for this problem?

❍

A. Peter failed to select the Advanced option from the Deploy Software dialog box. He needs to select this option to add transforms to the package.

❍

B. Peter selected the wrong tab of the Properties dialog box. He needs to select the Upgrades tab to add transformations to the package.

❍

C. Peter selected the wrong tab of the Properties dialog box. He needs to select the Deployment tab to add transformations to the package.

❍ D. Peter deployed the software from the Computer Configuration\Software Settings node of Group Policy. He needs to deploy the software from the User Configuration\Software Settings node to add transformations to the package.

❍

E. Peter does not have the proper permissions to perform this task. He needs to ask a domain administrator to grant him Full Control access to the software package in Group Policy.

673

Practice Exam 56. You are designing the domain structure for your company, which is in the process of upgrading its network containing five Windows NT 4.0 domains to Active Directory and Windows Server 2003. Having read about the new feature of universal group caching, you have to determine which portions of your network will benefit from this feature. Which of the following can benefit from universal group caching?

❍

A. A domain that is contained entirely within a single site and has three domain controllers.

❍

B. A small site that does not have any domain controllers but has several users that are members of universal groups.

❍

C. A site that hosts an application that queries the global catalog over port 3268.

❍ D. A site that contains a single domain controller that is not a global catalog server and several users that are members of universal groups. 57. Dimitri is a domain administrator for an oil exploration company that operates a single-domain Active Directory network. After a successful breach of a password belonging to a lawyer in the company’s Legal department, his boss asked him to implement a password policy that requires a minimum length of 10 characters, a minimum age of 7 days, a maximum age of 30 days, and complexity requirements. Users in other departments are to be subject to the current policy, which requires a minimum length of 7 characters, a minimum age of 5 days, a maximum age of 42 days, and complexity requirements. Which of the following does Dimitri need to do to implement these password policies?

❍

A. Create a separate OU for the Legal department. Then create a GPO linked to this OU that specifies these policies.

❍

B. Create a separate domain for the Legal department. Then create a GPO linked to this domain that specifies these policies.

❍

C. Create a global security group for the members of the Legal department and filter the settings in a GPO so that they apply only to members of this department.

❍ D. Use Security Templates and Security Configuration and Analysis to create a security template containing the required settings and import these settings to those computers used by members of the Legal department.

674

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 58. Sharon is a systems administrator for a company that operates an Active Directory network consisting of a single domain named examcram.com. The domain contains a series of OUs according to the company’s departmental organization. Included is a Legal OU for members of the Legal department and an Engineering OU for members of the Engineering department. The Engineering OU has two child OUs named Design and Drafting. All servers run Windows Server 2003 and all client computers run Windows XP Professional. Sharon needs to deploy a custom application to all members of the Engineering department. This application is to be installed on all Engineering computers and must not be installed on any computers located in other departments. She also needs to configure a custom password policy to apply to members of the Legal department. It is to specify passwords of at least 10 characters in length, and that passwords be changed every 30 days. No specific password requirements are in place in other departments. Sharon has created a Software GPO to deploy the custom application and a Password GPO to enforce the password policy. To which Active Directory containers should she link these GPOs?

❍

A. She should link the Password GPO to the Legal OU and the Software GPO to the Engineering OU.

❍

B. She should link the Password GPO to the Legal OU and the Software GPO to the domain.

❍

C. She should link the Password GPO to the domain and the Software GPO to the Engineering OU.

❍ D. She should link the Password GPO to the domain and the Software GPO to the Design OU. ❍

E. She should link the Password GPO to the domain and the Software GPO to the Drafting OU.

❍

F. She should link both GPOs to the domain.

59. You are a domain administrator for a company that operates an Active Directory network consisting of three domains in a single tree. You have asked an administrator named Mario to add a new attribute to the schema so that employees’ Social Security numbers can be included in the directory. However, Mario reports that he cannot create the attribute. Which of the following are possible solutions to this problem? Choose all that apply.

❏

A. Add Mario’s user account to the Schema Admins group.

❏

B. Raise the domain functional level to Windows 2000 native.

❏

C. Raise the domain functional level to Windows Server 2003.

675

Practice Exam

❏ D. Execute the regsvr32 schmmgmt.dll command at any domain controller or client computer.

❏

E. Seize the RID master role if it is unavailable.

❏

F. Seize the schema master role if it is unavailable.

60. Helen is responsible for designing an Active Directory structure to accommodate her company’s various departments. The company’s head offices occupy eight floors of a midtown Manhattan office tower. Departments include Accounting, Inventory, Marketing, Support, and Management. The company is planning to hire five new administrators, each of whom will be responsible for administering users and computers in one of the departments. How should Helen design the directory to accommodate this need?

❍

A. Create a separate site for each department.

❍

B. Create a separate child domain for each department.

❍

C. Create a separate OU for each department.

❍ D. Create a global security group for the new administrators. ❍

E. Create a domain local security group for the new administrators.

61. Tom is the systems administrator for an accounting company whose head office is in Toronto, with branch offices located in five Ontario cities. Tom’s manager wants the head office to maintain central control of corporate resources, while an individual in each branch office is to have control over user accounts, passwords, shared folders, and printers only in his or her office. Each office is configured as a separate site in Active Directory. How should Tom design Active Directory for his company to enable this need?

❍

A. Create a separate OU for each branch office.

❍

B. Create a separate child domain for each branch office.

❍

C. Create a separate domain in its own tree for each branch office.

❍ D. Create two forests, one for the head office and another for the branch offices. Within the branch office forest, create a domain for each office.

❍

E. Tom does not need to create additional containers.

676

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 62. Brian is the senior administrator for an engineering consulting firm that operates a single-domain Windows Server 2003 forest. The firm has just secured a large contract with a state department of transportation to build a new section of highway, and employees from several departments of the firm, including the IT department, will be working on this project. Brian wants employees of the IT department to be responsible for key aspects of computer management such as creating user and group accounts, assigning permissions, and keeping track of Group Policy. These employees are included in the ITStaff global group. Their authority should not extend beyond the employees involved in this project. Which of the following actions should Brian employ to provide the designated IT employees with the required administrative capabilities most efficiently?

❍

A. Create a new domain. Then move the required users, groups, and computers into this domain and add the employees of the IT department to the Domain Admins group in that domain.

❍

B. Create a new site. Then move the required users, groups, and computers into that site and delegate administrative control of the site to members of the ITStaff global group.

❍

C. Create a new OU. Then move the required users, groups, and computers into this OU and delegate administrative control of the OU to members of the ITStaff global group.

❍ D. Create a new global group. Then add the employees who will be working on the project to that group and add the ITStaff group to the Account Operators built-in group.

❍

E. Create a new domain local group. Then add the employees who will be working on the project to that group and add the ITStaff group to the Account Operators built-in group.

63. Nellie is the systems administrator for a shipping company that has recently upgraded its Windows NT 4.0 network to Windows Server 2003. The company’s Active Directory forest consists of an empty root domain with two child domains representing operations in North America and Asia, respectively. After completing the upgrade of the last Windows NT 4.0 backup domain controller to Windows Server 2003, she upgrades both domains to the Windows Server 2003 functional level. She has heard that when the domains are operating in Windows 2000 native or Windows Server 2003 functional level, there are additional possibilities for group nesting. In which of the following ways can groups be nested in these functional levels? Choose all that apply.

❏

A. Global groups can contain global groups from any domain.

❏

B. Domain local groups can contain universal groups from any domain.

❏

C. Domain local groups can contain domain local groups from their own domain.

❏ D. Universal groups can contain universal groups from any domain in the forest. ❏

E. Universal groups can contain domain local groups from any domain in the forest.

677

Practice Exam 64. You have configured several security policy settings, including password policy, using a modified security template. Now you want to apply these settings to all computers in the domain. Which of the following commands will accomplish this goal?

❍

A. Secedit /configure

❍

B. Secedit /analyze

❍

C. Gpotool

❍ D. Gpresult ❍

E. Gpupdate

65. Brigitte is a network administrator for a large department store chain that operates a Windows Server 2003 domain. Developers have designed a new accounts management system to handle accounts of customers who either order products online or shop personally in the stores. When Brigitte attempted to install the accounts management system on a member server, the installation failed. It displayed a message that it cannot create a class that is needed for the software to run on the network. Which of the following should Brigitte do? (Each answer represents part of the solution. Choose two answers.)

❏

A. She should log on as a member of the Enterprise Admins group at the computer where she is attempting to install the software.

❏

B. She should log on as a member of the Schema Admins group at the computer where she is attempting to install the software.

❏

C. She should log on as the local system account at the computer where she is attempting to install the software.

❏ D. She should ensure that no GPO contains a software restriction policy that applies to the computer where she is attempting to install the software.

❏

E. She should ensure that the shared folder containing the installation files is available and that she has the proper permissions to access it.

❏

F. She should ensure that the schema master computer is online and functioning properly.

This page intentionally left blank

Practice Exam Answers 1. D, E. Andrew needs to remove the Enforced setting from the Default Domain Policy GPO. He then needs to ask Elaine to log off and log back on to her computer. In a GPO configured with the Enforced setting, policies apply to computers and users in all down-level Active Directory containers and cannot be overridden, which is why Elaine does not receive the My Network Places icon. Disabling user configuration settings in the Default Domain Policy GPO would affect other users in the domain, so answer A is incorrect. The Enforced option prevails over the Block Inheritance option, so configuring Block Inheritance on the Marketing OU would not work, and answer B is incorrect. Modifying the delegation settings would not solve this problem, so answer C is incorrect. Asking Elaine to restart her computer would provide her with the My Network Places icon, but would take more time than simply logging off and logging back on, so answer F is incorrect. Windows 2000 does not provide the option for adding or removing My Network Places in this manner; at any rate, this would not work even in Windows XP, so answer G is incorrect. For more information, see the section “Group Policy Inheritance” in Chapter 7, “Planning and Implementing Group Policy.” 2. C. To run RSoP in logging mode, the user you specify must have logged on to the computer you specify; otherwise, you will receive the User does not exist error. In a case like that, you should use RSoP in planning mode to query the specified user/computer combination. Because the logon is required to run RSoP in logging mode, account corruption or replication failure is not present, so answers A and B are incorrect. If Ruth’s computer were not connected to the domain, you would receive an RPC server is unavailable error, so answer D is incorrect. For more information, see the section “Problems Encountered in Running RSoP in Logging Mode” in Chapter 8, “Managing Group Policy.” 3. A. One of the characteristics of a separate tree within the same forest is that the namespace is disjointed from that of other trees, such as the one containing the forest root domain. In other words, the domain does not share a contiguous namespace with the forest root domain. If the domain were to share a contiguous namespace with other domains, Clifford would need to create a child domain instead, so answer B is incorrect. If he needed to create a domain with limited trust relationships, he would have to create an additional forest because Active Directory creates two-way, transitive trust relationships between all domains in a forest. Therefore, answer C is incorrect. If he needed to create a domain with different schema attributes, he would also have to create an additional forest because the schema is unique to the forest. Therefore, answer D is incorrect. The ability to manage only their own domains is inherent in members of the Domain Admins group in any domain, so answer E is incorrect. For more information, see the sections “Logical Components of Active Directory” in Chapter 1, “Concepts of Windows Server 2003 Active Directory,” and “Subdividing the Active Directory Namespace” in Chapter 2, “Planning and Implementing an Active Directory Infrastructure.”

680

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 4. B. When a user at a pre-Windows 2000 computer is unable to change her password, the most likely reason is that the PDC emulator is not available. This server acts as a PDC to computers running older operating systems and is the only domain controller that can accept changes in user account properties including password changes at these computers. The infrastructure master processes changes in group membership but not password changes for older computers, so answer A is incorrect. There is no need to check Kristin’s user properties, so answer C is incorrect. Although raising the domain functional level to Windows 2000 native is desirable in this situation, doing so is not a requirement for having pre-Windows 2000 computers on the network, so answer D is incorrect. For more information, see the sections “Business Continuity of Operations Masters Roles” in Chapter 2, “Planning and Implementing an Active Directory Infrastructure,” and “Diagnosing Issues Related to Operations Master Role Failures” in Chapter 4, “Maintaining an Active Directory Infrastructure.” 5. A. The server acting as a CA needs to have IIS installed on it so that it can serve the certificate enrollment web pages. When she installed the CA, Maria was warned that she needed to install IIS, but she must have ignored this warning. It is desirable but not necessary to have an enterprise subordinate CA available to issue certificates, so answer B is incorrect. Either the Smartcard User or the Smartcard Logon certificate template enables the issuance of smart card certificates, so answer C is incorrect. Joe can enroll certificates from any computer on the network, so answer D is incorrect. For more information, see the section “Implementing the Use of Smart Cards” in Chapter 5, “Planning User, Computer, and Group Strategies.” 6. D. The use of a site link bridge enables Keith to route Active Directory replication across a pair of fast links rather than a single, much slower link. The cost of a site link bridge is the sum of the costs of the site links that it contains, which is 200 in this case (when costs are not given, you should assume that each link is set to the default cost of 100). Consequently, Keith has to set the cost of the 56Kbps link to a value higher than this sum. It is not possible to specify a cost for a site link bridge, so answer C is incorrect. Configuring the slow link to be available only outside business hours would prevent daytime replication, but replication would still proceed over this link at other hours, so answer A is incorrect. SMTP replication would replicate only the schema and configuration partitions between different domains, so answer B is incorrect. For more information, see the sections “Site Link Bridges” and “Configuring Site Link Costs” in Chapter 3, “Managing an Active Directory Infrastructure.” 7. C, G. In this scenario, both domain controllers have been destroyed, so it is necessary to perform a primary restore on the first domain controller (DC1) and a nonauthoritative restore on the second domain controller (DC2). To perform any type of Active Directory restore operation, Peter must first restart the server in Directory Services Restore Mode, so this is the first action for both servers. He must then perform a primary restore of System State on DC1. He should do this on DC1 and not DC2 because the question stipulates that name resolution services are to be restored as rapidly as possible. After he does this, he must then perform a nonauthoritative restore of System State on DC2. These are the only actions he has to perform. Peter should not run dcpromo on either server; doing this would install a new copy of Active Directory without any of the containers or objects present in the current directory, so answer A is incorrect. He should neither restart the server in Safe Mode nor to the Recovery Console; neither of these options would enable him to

681

Practice Exam Answers restore System State, and answers B and D are incorrect. He needs to do a primary restore on DC1 so that its directory is marked as primary for proper restoration of Active Directory services; simply doing a nonauthoritative restore on this server is inadequate, and answer E is incorrect. He should not perform an authoritative restore of System State on either server; he would do this only if he needed to restore certain objects that had been improperly deleted from the directory. Therefore answers F and H are incorrect. Note that a question similar to this may appear on the exam as a drag-and-drop question in which you must drag the required actions into boxes in the correct order for performing these actions. For more information, see the section “Restoring Active Directory” in Chapter 4, “Maintaining an Active Directory Infrastructure.” 8. A, E. You should create a sub-OU named Managers in each of the Finance OUs—that is, the East\Finance, the West\Finance, the North\Finance, and the Europe\Finance OUs. You should also apply the strict desktop GPO to the Europe OU, and the desktop will be applied only to its users. Plus, you should apply the application GPO to each of the four new Managers OUs to deploy the application to them. Answer B is incorrect because it is not necessary to create Managers OUs in all department OUs; this would deploy the application to all managers and not just the financial managers. Answer C is incorrect because this solution would also deploy the application to all managers. Answer D is incorrect because it would apply the strict desktop to all company users and not just the Europe users. Answers F and G are backward for application of the GPO. See the section “Group Policy Requirements for an OU Structure” in Chapter 6, “Implementing User, Computer, and Group Strategies.” 9. B. By creating an OU hierarchy consisting of two levels, Phil can meet the delegation requirements of this scenario. He can delegate control of the Corp OU to a group that includes the appropriate employees in the HR department, and delegate control of each child OU to a group that includes employees from its Support department. If he were to move head office employee user accounts into the Corp OU, head office Support employees delegated control of this OU would receive more administrative capability than required, so answer A is incorrect. Any OU structure that involves moving the user accounts of all regular employees into the Corp OU, regardless of location, does not allow for Support employees in the various offices to reset the passwords of users in their own office only, so answers C and D are incorrect. See the section “Planning an OU Structure Based on Delegation Requirements” in Chapter 6, “Implementing User, Computer, and Group Strategies.” 10. C, D. In this situation, Erin needs to ensure that software is removed from a user’s computer when it is no longer needed after the user transfers to another department (meaning a different OU). She can accomplish this by selecting the Uninstall This Application When It Falls Out of the Scope of Management option, which is found on the Deployment tab of the software’s Properties dialog box. The Modifications tab allows Erin to include transform files in a deployment but not to remove an unneeded software package, so answer A is incorrect. The Upgrades tab allows Erin to upgrade but not remove existing software packages, so answer B is incorrect. The Do Not Display This Package in the Add/Remove Programs Control Panel and Install This Application at Logon options do not provide uninstall features, so answers E and F are incorrect. For more information, see the section “Software Package Properties” in Chapter 7, “Planning and Implementing Group Policy.”

682

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 11. A. The Gpresult tool provides this information. This tool runs an RSoP logging mode query for the user and computer that you specify, and displays Origin properties for all software packages. This property is set to Applied Application for an installed program and to Removed Package for a program that a user has removed. Gpotool monitors the health of GPOs on Windows 2000 domain controllers. Secedit analyzes a computer’s security settings by comparing them to a template. Dcdiag monitors the health of domain controllers. Gpupdate updates Group Policy settings. None of these four tools provides software removal information, so answers B, C, D, and E are incorrect. For more information, see the sections “Maintaining Software with Group Policy” in Chapter 8, “Managing Group Policy,” and “Active Directory Support Tools” in Chapter 4, “Maintaining an Active Directory Infrastructure.” 12. A, C, D, E. Among the tasks you should perform to verify the proper installation of Active Directory are verifying the presence of a Domain Controllers OU and the existence of the NTDS (Active Directory database) and SYSVOL (shared system volume) folders. You should also verify the proper installation of DNS, including the appropriate folders for your domain in the Forward Lookup Zone node and that the zone is configured as an Active Directory–integrated zone with secure dynamic update. Active Directory Users and Computers should contain a folder named Users; however, this folder is not an OU, so answer B is incorrect. The NTDS and SYSVOL folders are located in the system root (usually C:\Windows) and not in the root of the system drive (usually C:\), so answer F is incorrect. For more information, see the section “Verifying Active Directory Installation” in Chapter 2, “Planning and Implementing an Active Directory Infrastructure.” 13. A, D. Sherry can use either of these two methods to grant the individual members of the IT staff group the capability to administer only single OUs. Either method permits her to decentralize administration of the network without sacrificing security. If she were to grant the individual IT staff members Full Control permission for the Domain Controllers OU or add the individual IT staff members to the Domain Admins global group, these users would receive administrative authority over the entire domain and not an individual OU, which is not the desired result. Therefore, answers B and C are incorrect. For more information, see the sections “Administrative Delegation Strategies” and “Delegating Permissions for an OU to a User or Security Group” in Chapter 6, “Implementing User, Computer, and Group Strategies.” 14. E. By modifying the replication properties of the existing site link, Jason can improve the replication efficiency. He can either reduce the number of minutes between replications (which is 180 minutes by default) or remove any scheduling restrictions that he has configured. He should perform this task in a manner consistent with the need to balance Active Directory replication traffic with other network traffic crossing the WAN link. Jason does not need to create an additional site link unless more than two different connections are available—for example, a 56Kbps dial-up connection and an ISDN line. This scenario does not state that more than one connection is available, so answer A is incorrect. In some cases, creating site link bridges can help (such as when two sites are connected directly with a 56Kbps dial-up link and also through a third site with T1 lines at 1.5Mbps); however, in most cases you should keep the default bridging of all site links, so answer B is incorrect. In general, you should not change the designation of the ISTG server or the preferred bridgehead server that the KCC provides, so answers C and D are incorrect. For more information, see the section “Configuring Site Links” in Chapter 3, “Managing an Active Directory Infrastructure.”

683

Practice Exam Answers 15. C. By placing a single global catalog server at each site, Shelley can achieve the objectives of fastest response time for logon and resource access. If she were to place two global catalog servers at only one site, users at that site would achieve fast logon and resource access, but users at the site without any global catalog servers would need to send requests over the slow WAN link because the domain controller would need to check universal group membership at the global catalog server on the other site. Therefore, answers A and B are incorrect. The same is true if she were to place a single global catalog server at the Boston site only, so answer D is incorrect. Placing two global catalog servers at each site would achieve load-balancing and fault tolerance, but would also generate additional replication traffic across the WAN link, thereby reducing performance. Therefore, answer E is incorrect. For more information, see the section “Evaluating Network Traffic Considerations When Placing Global Catalog Servers” in Chapter 2, “Planning and Implementing an Active Directory Infrastructure.” 16. B. By creating an empty root domain and setting up both corporate domains as child domains, the administrators can create a contiguous namespace with a common schema for the two companies, which would belong to the same Active Directory tree. Furthermore, this solution provides members of the Domain Admins group in each child domain with administrative powers over only their own domain. Establishing two separate Active Directory trees would result in a common schema but a disjointed namespace. Therefore, answer A is incorrect. Creating a single domain with two OUs would provide members of the Domain Admins group in the domain with full administrative control over the entire domain. Therefore, answer C is incorrect. Retaining the existing two forests and creating a forest trust would not create a common schema, so answer D is incorrect. For more information, see the section “Planning the Active Directory Namespace” in Chapter 2, “Planning and Implementing an Active Directory Infrastructure.” 17. C. The Security Options node, found under Local Policies in Computer Configuration\Windows Settings\Security Settings, contains three policy settings that pertain to auditing: Audit the Access of Global System Objects, Audit the Use of Backup and Restore Privilege, and Shut Down System Immediately If Unable to Log Security Audits. The Audit Policy node contains a large series of auditing options, but auditing of backup and restore is not among them, so answer A is incorrect. System Services would enable Brent to define the startup type of services. Found in the Administrative Templates node, Windows Components contains policy settings that pertain to various applications found in Windows such as Internet Explorer, Terminal Services, Task Scheduler, and so on. Neither of these two nodes contains any type of auditing settings, so answers B and D are incorrect. Software Restriction contains settings that restrict the types of software that can run on a computer subjected to the GPO, so answer E is incorrect. Note that a question of this type may appear as a hot-spot question on the exam, in which you are required to select the correct answer from an exhibit. For more information, see the section “Configuring Security Settings with Group Policy” in Chapter 7, “Planning and Implementing Group Policy.”

684

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 18. C. By configuring the security settings at the Materials OU, Charles can delegate control of this OU to the administrator that is responsible for that OU. Charles should not configure the Block Policy Inheritance setting at the Materials OU because the policy applied at this level could contain other settings that are to be applied to the Materials OU. This action would also block other GPOs. Therefore, answer A is incorrect. He should not configure No Override on the GPO at the Design OU because this setting does not enable him to delegate administrative control. This setting would prevent settings in a GPO at this level from overriding policy settings in a GPO specified at a higher level such as the domain. Therefore, answer B is incorrect. Note that after you have installed Group Policy Management Console, these settings are known as Block Inheritance and Enforced, respectively. Keep in mind that the exam might use either terminology. Charles should not configure the security options in the Design OU because these settings are correctly enabling the administrator in this OU to have control at that level, so answer D is incorrect. For more information, see the section “Delegating Permissions for an OU to a User or Security Group” in Chapter 6, “Implementing User, Computer, and Group Strategies,” and “Group Policy Inheritance” in Chapter 7, “Planning and Implementing Group Policy.” 19. D, E, H. These steps are among the ones that Connie needs to perform to create a site link bridge. To create a site link bridge, she needs to right-click the required intersite transport folder (IP or SMTP) and select the New Site Link Bridge option. This option is not available from the Intersite Transports folder, so answers A and B are incorrect. She should not select the New Site Link option, so answer C is incorrect. Doing so opens the New Object—Site Link Bridge dialog box. Connie needs to right-click the required intersite transport folder and choose Properties and then clear the Bridge All Site Links check box. This check box should be cleared and not selected; in addition, it is in the Properties dialog box for the transport and not in the New Object—Site Link Bridge dialog box, so answer F is incorrect. In this dialog box, she needs to type a name for the site link bridge, select at least two site links, and then click Add. She should not select two sites, so answer G is incorrect. For more information, see the section “Site Link Bridges” in Chapter 3, “Managing an Active Directory Infrastructure.” 20. A, E. Evan should create a single upgrade package for the domain and configure this package to upgrade installations in all GPOs. He can specify this package as a required upgrade. This procedure enables Evan to ensure that all installations of Office 2003 are upgraded without the intervention of any of the assistant administrators. He does not need to configure upgrade packages for either the top-level or departmental OUs. This means of solving the problem would require communication with the assistant administrators and leaves open an increased chance for vulnerabilities to occur, so answers B and C are incorrect. Also, if Evan were to configure an upgrade from the current GPO only, installations in other OUs would not be upgraded, also leaving open a chance for vulnerability. Therefore, answer D is incorrect. For more information, see the section “Distribute Updates to Software Installed Using Group Policy” in Chapter 8, “Managing Group Policy.”

685

Practice Exam Answers 21. C, E. IPSec policies on Active Directory are located in the Computer Configuration\Windows Settings\Security Settings node of the Group Policy Object Editor. So that computers in Building A are always protected, Nancy needs to configure these policies in a GPO linked to the CompBldgA OU. In addition, so that users in Building B receive these policies regardless of which computer they log on to, she also needs to configure these policies in a GPO linked to the UsrBldgB OU. Nancy does not need to configure these policies in a GPO linked to the UsrBldgA OU because users in Building A do not have a specific need for IPSec policies. Therefore, answer A is incorrect. She also does not need to configure these policies in a GPO linked to the CompBldgB OU because there is no need to apply IPSec policies to all computers in building B. Therefore, answer G is incorrect. Because these policies are computer based and not user based, Nancy cannot configure them for users, so answers B, D, F, and H are incorrect. For more information, see the section “Configuring Security Settings with Group Policy” in Chapter 7, “Planning and Implementing Group Policy.” 22. B, G. Jeremy needs to configure the offices in Las Vegas, El Paso, Little Rock, and Nashville as global catalog servers. This ensures that users who need access to the directory-enabled application have access to the global catalog without the need to cross the WAN connections. If he did not configure the El Paso and Nashville domain controllers as global catalog servers, access to the directory-enabled application would become slow; therefore answers A and C are incorrect. Furthermore, users in offices where the largest number of users reside should have access to the global catalog to enable rapid logon and network access; therefore, the Las Vegas and Little Rock sites also need global catalog servers, and answer C is incorrect. In addition, Jeremy needs to configure the Albuquerque site with a domain controller on which universal group membership caching has been enabled. This enables him to minimize WAN traffic while enabling logon without the use of cached credentials. It is never necessary to enable universal group membership caching at domain controllers that are configured as global catalog servers; therefore, answers E and F are incorrect. If the Albuquerque site were not configured with universal group membership caching, excessive WAN traffic would occur during logon; therefore, answer H is incorrect. For more information, see the section “Sharing Active Directory Information” in Chapter 2, “Planning and Implementing an Active Directory Infrastructure.” 23. B. In this scenario, business in each department is closely related to that of corresponding departments in other cities in which company offices are located, so Lisa should proceed with an OU design that consists of top-level business-related OUs and bottom-level geographical-based OUs. A design of geographical-based top-level OUs and departmental-based lower-level OUs would make more sense in an organization whose business at one location is less related to that at other locations, so answer A is incorrect. Because there are only three locations at which the major departments are located, it does not make sense to use production-based OUs at any level, so answers C, D, and E are incorrect. For more information, see the section “Administrative Requirements for an OU Structure” in Chapter 6, “Implementing User, Computer, and Group Strategies.”

686

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 24. B, E. To complete the autoenrollment process and require that Research users use their smart cards for logon, Mike needs to first configure a GPO that enables the automatic enrollment of certificates. The policy that he configures is found in the Computer Settings branch of the Group Policy Object Editor console, and not under the User Settings branch, so answer A is incorrect. After he has configured the automatic enrollment of certificates and created the smart cards, he needs to require that the users use their smart cards for logon. He can configure this requirement from each user’s Properties dialog box in Active Directory Users and Computers. He can select multiple users at once to configure this requirement, but he cannot do so on a group basis, so answer F is incorrect. There is no policy in the Group Policy Object Editor console that enables Mike to specify the smart card requirement, so answers C and D are incorrect. For more information, see the sections “Implementing the Use of Smart Cards” in Chapter 5, “Planning User, Computer, and Group Strategies,” and “Enrolling User and Computer Certificates with Group Policy” in Chapter 7, “Planning and Implementing Group Policy.” 25. E. In a situation like this one, in which a domain controller has been removed from the network without proper demotion, an NTDS settings object containing configuration metadata is left behind in the Active Directory configuration partition. Because of this metadata, Active Directory thinks DC5 is still present and creates an error when Joe attempts to create another domain controller named DC5. Joe can use the metadata cleanup option in ntdsutil to remove this orphaned metadata, and then he will be able to reinstall DC5 as a domain controller. If he were to reinstall the domain controller with a different name and then rename it to DC5, he would receive the same error when attempting to rename it, so answer A is incorrect. An attempt at restoring from a System State backup would also produce this error, so answer B is incorrect. The infrastructure master and RID master are not involved in this scenario, so answers C and D are incorrect. For more information, see the section “Diagnosing Issues Related to the Active Directory Database” in Chapter 4, “Maintaining an Active Directory Infrastructure.” 26. A, D, E. You can perform the following three types of modifications in the schema: You can create new classes and attributes, and you can modify or deactivate existing classes and attributes. However, you cannot remove any existing or new classes and attributes, so answers B and C are incorrect. You also cannot extend existing classes and attributes, so answer F is incorrect. For more information, see the section “Managing Schema Modifications” in Chapter 3, “Managing an Active Directory Infrastructure.” 27. D. By configuring the Block Policy Inheritance option on the Payable and Receivable OUs, Fred prevents the settings configured in the Accounting OU from applying to users located in these OUs. Note that this action will also block any policies applied at higher levels of the GPO hierarchy, such as site-based GPOs. Fred could also disable the policies that prevent access to the Control Panel, Internet Explorer, and the Run command; however, this action would take more administrative effort, so answer A is incorrect. Configuring the No Override option on the Accounting OU would prevent policies set at the Payable and Receivable OUs from overwriting policies specified at the

687

Practice Exam Answers Accounting OU. This is not the desired result, so answer B is incorrect. Configuring Block Policy Inheritance at the Accounting OU would block site- and domain-based policies from applying to the Accounting OU and its child OUs, but would have no effect on the application of policies in a GPO at the Accounting OU level, so answer C is incorrect. For more information, see the sections “Group Policy Requirements for an OU Structure” in Chapter 6, “Implementing User, Computer, and Group Strategies,” and “Group Policy Inheritance” in Chapter 7, “Planning and Implementing Group Policy.” 28. B. The Feature ID not registered error might appear when a user with a roaming profile logs on to more than one computer at the same time. Judy can correct the problem by asking Carm to log off one computer before attempting to log on to another computer and install the published application. Changing the application deployment type to assigned will not help, so answer A is incorrect. Having Carm log off and log back on his computer also does not help if he is logged on to more than one computer at the same time, so answer C is incorrect. If network connectivity were the problem, Carm would have received a different type of error, such as an inability to locate the installation share, so answer D is incorrect. For more information, see the section “Maintaining Software with Group Policy” in Chapter 8, “Managing Group Policy.” 29. C. ADSI Edit, the Active Directory Service Interfaces tool, is an MMC snap-in that enables Evelyn to view information about any Active Directory object, including schema and configuration data. Evelyn can use this tool to display the class and distinguished name (DN) of objects found in any container within Active Directory. Repadmin enables Evelyn to display replication diagnostic information from the command line. Replmon enables her to use a GUI-based interface to display replication diagnostic information. Dcdiag is the Domain Controller Diagnostic Tool. She can use this tool to analyze the condition of domain controllers. Sdcheck is the Security Descriptor Check Utility. Evelyn can use this tool to display the security descriptor for an Active Directory object, including ACLs for the object. None of these tools enable her to display the complete information about Active Directory objects, so answers A, B, D, and E are incorrect. For more information, see the section “Active Directory Support Tools” in Chapter 4, “Maintaining an Active Directory Infrastructure.” 30. A. Although the primary role of the PDC emulator is to act as a primary domain controller for Windows NT and 9x clients, this server also acts as a time server for the domain, and ensures that the system clocks on all other computers are synchronized. The PDC emulator connects to an Internet time server to ensure that it has the proper time setting. None of the other operations masters play a role in time synchronization, so answers B, C, D, and E are incorrect. For more information, see the section “Business Continuity of Operations Master Roles” in Chapter 2, “Planning and Implementing an Active Directory Infrastructure.”

688

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 31. B, D, E. The RID master provides a series of relative identifiers (RIDs) to each domain controller so that administrators may create new Active Directory objects such as user, group, and computer accounts. In its absence, administrators can continue to create objects until the pools of RIDs at existing domain controllers become exhausted, after which they are unable to do so. When Exchange Server is installed, it creates new schema objects; therefore the schema master must be present. Consequently, Diane needed to seize these two roles. She does not need to seize the infrastructure master or the PDC emulator, so answers A and C are incorrect. After the failed domain controllers are repaired, she can bring them online, reinstall Windows Server 2003, and perform nonauthoritative restores as needed. Finally, she can transfer the RID master role back to the original role holder. However, after the schema master role has been seized, she cannot transfer this role back to its original role holder, so answer F is incorrect. The PDC emulator and the infrastructure master were unaffected by the power failure, so answers G and H are incorrect. For more information, see the section “Diagnosing Issues Related to Operations Master Role Failures” in Chapter 4, “Maintaining an Active Directory Infrastructure.” 32. D. The purpose of RSoP logging mode is to display the current Group Policy settings for a specified user and/or computer. In this case, you need to specify a computer in the domain, and you can select the Do Not Display User Policy Settings in the Results option to display computer settings only. Although this is what the question asked for, doing so will not display any user-based settings that might be configured. Running RSoP in planning mode does not enable you to view the currently applied policy settings, so answer A is incorrect. Logging mode does not allow you to specify only a domain as implied in answer B, so this choice is incorrect. The question asked for only computer settings, so answer C is incorrect. For more information, see the section “Resultant Set of Policy (RSoP)” in Chapter 8, “Managing Group Policy.” 33. F. You have to select the NTDS Site Settings container in the Site2 site to enable universal group membership caching for the forest root domain. Right-click this container and choose Properties. On the Site Settings tab of the dialog box that appears, select the Enable Universal Group Membership Caching check box. Note that you must do this for Site2 and not Site1 because the server (Server1) in Site1 is configured as a global catalog server; therefore, answer E is incorrect. Neither the Servers container nor the Licensing Site Settings container allow you to enable universal group membership caching, so answers A, B, C, and D are incorrect. Note that on the exam you may be required to select the correct location from an exhibit that shows the Active Directory Sites and Services snap-ins for both sites. For more information, see the section “Evaluating the Need to Enable Universal Group Caching” in Chapter 2, “Planning and Implementing an Active Directory Infrastructure.” 34. B. When any change is made to a user’s access privileges, the user must log off and log back on to receive the change, so in this scenario it is most likely that the user was logged on when Loretta published the taskpad and has not since logged off. If the employee was using a computer located in a different department, he would receive the taskpad anyway after he had logged off and logged back on, so answer A is incorrect. If the employee was logged off when Loretta published the taskpad, he would see it as soon as he logged on and there would be no problem, so answer C is incorrect. Even if the employee’s user account is outside the OU, it is still possible to add the account to the group, so answer D is incorrect. For more information, see the section “Delegating Permissions for an OU to a User or Security Group” in Chapter 6, “Implementing User, Computer, and Group Strategies.”

689

Practice Exam Answers 35. A. Julian should assign the updated CAD application package to all users in the Design OU. He can ensure that an automatic upgrade of the package takes place by selecting the Required Upgrade for Existing Packages option. This option performs a mandatory upgrade and ensures that no copies of the previous version remain. If he were to use the Uninstall the Existing Package, and then the Install the Upgrade Package option, the previous package would also be removed, along with user preference settings. Therefore, answer B is incorrect. Because Julian wants to ensure that the upgraded version appears in all users’ Start menus, he needs to assign the application, but not publish it, so answers C and D are incorrect. Because Julian originally assigned the application to users, he should not assign the updated application to computers, so answers E and F are incorrect. For more information, see the section “Distributing Updates to Software Installed Using Group Policy” in Chapter 8, “Managing Group Policy.” 36. B. A realm trust is a mechanism whereby Maggie can grant access between an Active Directory domain and a Kerberos v.5 realm, such as a network based on UNIX servers. In this situation, users on the UNIX network need access to Maggie’s company’s domain, so she should configure the realm trust so that her domain trusts the UNIX network. Configuring the realm trust so that the UNIX network trusts her domain would enable users on her network to access the UNIX network, which is not what is specified here. Therefore, answer E is incorrect. An external trust is used to create a relationship between two Active Directory domains in separate forests, and not between an Active Directory domain and a Kerberos realm. Therefore, answers A and D are incorrect. A shortcut trust is used to create a direct trust relationship between two child domains in the same forest, and not between an Active Directory domain and a Kerberos realm. Therefore, answers C and F are incorrect. For more information, see the section “Interforest Trust Relationships” in Chapter 3, “Managing an Active Directory Infrastructure.” 37. A. Bill can use a shortcut trust relationship to provide a direct path between two child domains in the same forest. This type of trust relationship enables authentication and access requests to proceed directly between the domains without the need to proceed upwards to the forest and tree root domains. An external trust relationship connects two domains in separate forests, not in the same forest, so answer B is incorrect. A realm trust relationship connects an Active Directory domain to a Kerberos v.5 realm, such as a network based on UNIX servers, so answer C is incorrect. SMTP-based replication should be used only when a direct or reliable IP-based replication path is unavailable. Because there was no indication of this being the case in the question scenario, answer D is incorrect. Restricting replication times to weekends only might improve authentication times; however, this scenario is more a question of an access path between the domains than one of network traffic considerations. Therefore, answer E is incorrect. For more information, see the section “Active Directory Trust Relationships” in Chapter 3, “Managing an Active Directory Infrastructure.”

690

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 38. C. To meet the requirements of this scenario, Rebecca should first create a top-level OU named Servers. This OU is necessary because the policy plan requires that some policies will apply to all servers in the company. Such policy settings will be applied in a GPO linked to the Servers OU. If Rebecca produces a design that does not include a Servers OU but links these policy settings to the domain instead, they would apply to all computers in the company, not just servers. Therefore answers A and B are incorrect. At the second level, Rebecca should create File and Application OUs to which she will link GPOs containing policies that apply to all Engineering and Finance servers of a given role. Finally, she should create Engineering and Finance OUs beneath each server role, to which she will link GPOs containing policies that apply only to servers in a given department. Placing the departmental OUs at the lowest level enables her to apply policy settings to each department that are not overridden by other policies, without the need to utilize the Enforced option (known as No Override if GPMC is not installed).

Quepublishing.com

Servers

File

Engineering

Application

Finance

Engineering

Finance

If Rebecca were to choose a design in which second-level departmental OUs contained File and Application bottom-level OUs, she would have to use the Enforced option to prevent settings for the Engineering servers from being applied to Finance servers. Therefore, answer D is incorrect. For more information, see the section “Group Policy Requirements for an OU Structure” in Chapter 6, “Implementing User, Computer, and Group Strategies.”

691

Practice Exam Answers 39. A. Kerberos Policy, located in the Computer Configuration\Windows Settings\Security Settings\Account Policy node, enables Mark to configure the following five policies: Enforce User Logon Restrictions, Maximum Lifetime for Service Ticket, Maximum Lifetime for User Ticket, Maximum Lifetime for User Ticket Renewal, and Maximum Tolerance for Computer Clock Synchronization. The Account Lockout Policy node contains settings governing account lockout after entering incorrect passwords, so answer B is incorrect. The Security Options node contains device configuration options, digital encryption and signing options, logon and network access options, and other security-related settings, but not service ticket options, so answer C is incorrect. The System Services option enables Mark to specify the startup mode for Windows services, so answer D is incorrect. Public Key Policies includes Encrypting File System settings, Automatic Certificate Request and Enrollment settings, Trusted Root Certification Authorities, and Enterprise Trust settings, so answer E is incorrect. Note that a question of this type could appear on the exam as a hot-spot question in which you must select the correct option from a dialog box. For more information, see the section “Configuring Security Settings with Group Policy” in Chapter 7, “Planning and Implementing Group Policy.” 40. B. Jennifer should place the infrastructure master on a domain controller that does not host the global catalog but that has a direct connection to a global catalog server. If she places the infrastructure master on a global catalog server, the infrastructure master would be unable to locate any outdated data, and therefore it would never update that data. Consequently, answers A and D are incorrect. For the infrastructure master to function properly, it should be located in the same site as a global catalog server, so answer C is incorrect. For more information, see the sections “Flexible Operations Masters” in Chapter 1, “Concepts of Windows Server 2003 Active Directory,” and “Operations Master Role Dependencies” in Chapter 2, “Planning and Implementing an Active Directory Infrastructure.” 41. E. The Store Password Using Reversible Encryption option provides a reduced level of security because it stores passwords in a format that is effectively the same as plain text. Alex should use this option only for clients that are unable to use normal encryption, such as Macintosh computers or CHAP remote access authentication. The Enforce Password History option stores the specified number of passwords and prevents the user from reusing these passwords, so answer A is incorrect. The Minimum Password Age option specifies the minimum length of time that a user must wait before changing a password so that the user cannot cycle through a series of passwords and reuse a recent one. Therefore, answer B is incorrect. The Minimum Password Length option specifies the minimum number of characters in a password to increase its security, so answer C is incorrect. Complexity requirements dictate that a password contain uppercase and lowercase letters, numerals, and special characters to increase password security, so answer D is incorrect. For more information, see the section “Using Group Policy to Configure Password Policy Settings” in Chapter 5, “Planning User, Computer, and Group Strategies.”

692

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 42. D. By configuring the Kerberos and password policies in a security template in the test lab, Anna can test these policies and modify them as needed. When the test period is finished, she can import the template file to a domain controller in the company domain to apply them in a domainbased GPO. Taking a domain controller from the test lab to the company domain would not accomplish anything because it would be unable to join the company domain without being demoted, so answer A is incorrect. Taking a domain controller from the company domain offline would leave only one domain controller online in this scenario, removing any fault tolerance and load-balancing. Therefore, answer B is incorrect. An RSoP query would enable Anna to plan group policy settings. However, she cannot import the RSoP output into a GPO, so answer C is incorrect. For more information, see the sections “Using Security Templates to Configure Password Policy” in Chapter 5, “Planning User, Computer, and Group Strategies,” and “Configuring Security Settings with Group Policy” in Chapter 7, “Planning and Implementing Group Policy.” 43. A. replmon includes the option to display global catalog servers (which are identified by a globe icon on the top-right corner of each server icon). Active Directory Sites and Servers does not have a global catalog option, so answer B is incorrect. There is no /g option with dcdiag, so answer C is incorrect. The /querysites option of repadmin does not display global catalog servers, making answer D incorrect. For more information, see the section “Active Directory Support Tools” in Chapter 4, “Maintaining an Active Directory Infrastructure.” 44. B. Only a universal security group can achieve the specifications presented here. A universal group can contain user accounts and groups from anywhere in the Active Directory forest. Lynn can use this group scope to assign permissions to any resource in any domain within the forest or a trusted forest, either directly or by adding it to a local group located on the computer that contains the resource. A global group can contain members only from within the domain in which it resides. Therefore, in this scenario, Lynn cannot assign the members to one global group, and answer A is incorrect. However, Lynn can assign members to global security groups in each domain and then add these groups to the universal group; in fact, this is the recommended approach to creating groups in this scenario. A domain local group can include users from any domain in the forest or a trusted forest, but can be used to access only resources located in its domain. Because the scenario calls for the users to access resources from two domains, this group scope is unsuitable, and answer C is incorrect. Lynn could employ a distribution group for the purposes of addressing email to all its members as a whole; however, she cannot assign permissions to this type of group; therefore, a distribution group does not fit the specifications of this scenario, and answers D and E are incorrect. For more information, see the section “Security Groups” in Chapter 5, “Planning User, Computer, and Group Strategies.”

693

Practice Exam Answers 45. A. By selecting the Required Upgrade for Existing Packages option, Gail can ensure that the upgrade is installed on all computers on which the financial application has been installed. This option is on the Upgrades tab of the package’s Properties dialog box. On the same tab, Gail lists the original financial application as the package that will be upgraded. The Auto-Install This Application by File Extension Activation option would cause the application to be installed on computers that do not contain the original package if the user were to open a file containing an extension assigned to the original application, so answer B is incorrect. Disabling the Do Not Display This Package in the Add/Remove Programs Control Panel option would enable users to see the upgrade package in the Add/Remove Programs applet and enable users to install the upgrade without the original package, so answer C is incorrect. Disabling the Uninstall this Application When It Falls Out of the Scope of Management option would enable the package to remain installed on a computer belonging to a Finance user that moves to a different OU. This action is neither desired nor would it enable automatic installation of the upgrade, so answer D is incorrect. For more information, see the section “Use of Group Policy to Upgrade Applications” in Chapter 8, “Managing Group Policy.” 46. C. A mandatory user profile is a type of profile to which users cannot make permanent changes. Users can make changes while logged on, but their changes are not saved when they log off. This type of profile is appropriate in situations like this in which you have to specify settings that apply to specific groups of users with similar requirements. A local user profile is stored only on the computer on which it is created and cannot be configured with Group Policy, so answer A is incorrect. A roaming profile is stored on a server so that a user can access it from any computer. The user can make changes to this profile, and these changes are saved when the user logs off. This is not appropriate in this situation, so answer B is incorrect. A temporary user profile is created anytime a problem prevents the loading of a normal user profile. It is deleted when the user logs off, so it is not appropriate, and answer D is incorrect. For more information, see the sections “Group Policy for Users and Computers” and “Redirecting Folders with Group Policy” in Chapter 7, “Planning and Implementing Group Policy.” 47. C. Kathy can use Gpresult to view current Group Policy settings on a computer that is currently available on the network. Gpresult runs from the command line and executes an RSoP logging mode query against the user and computer that she has specified using the /u and /s options. Although Gpresult performs a logging mode query, it does not log details of policy precedence, so answer A is incorrect. If Kathy needs to simulate the application of policy settings, she needs to run RSoP in planning mode, so answer B is incorrect. Gpresult works only for a currently available user/computer combination, so she would need to use RSoP in planning mode to obtain policy settings for a computer that is not available. Therefore, answer D is incorrect. For more information, see the section “Gpresult” in Chapter 8, “Managing Group Policy.”

694

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 48. A. A situation in which users in multiple domain forests need access to resources in different domains of another forest calls for a forest trust relationship. Because users in both forests need access to resources in the other forest in this scenario, the trust relationship needs to be two-way. A nontransitive external trust relationship would permit users in only a single domain of one forest to access resources in a single domain of the other forest. This type of trust is not appropriate in this scenario, so answers B and D are incorrect. A one-way trust relationship would permit users in only one forest to access resources in the other forest, and not the other way around. Therefore, answer C is incorrect. For more information, see the section “Interforest Trust Relationships” in Chapter 3, “Managing an Active Directory Infrastructure.” 49. B, C. Among the tasks Bob can accomplish with a hierarchy of OUs are the delegation of administrative authority and the defining of folder redirection policies. He can create a system of OUs that mirrors the administrative divisions in his company, and thereby enable individuals in each division to administer users and resources in that division only, and defines most Group Policy settings on a division-by-division basis. If a portion of the company requires a custom schema, Bob must create a separate forest for that purpose, so answer A is incorrect. User account policies are an exception to the Group Policy settings that can be defined on an OU basis (they can be defined only on a domain basis), so answer D is incorrect. Likewise, site boundaries can be defined only on a domain basis, so answer E is incorrect. For more information, see the section “OU Structure” in Chapter 6, “Implementing User, Computer, and Group Strategies.” 50. A, D, E. To configure autoenrollment of user certificates, Arlene needs to install and configure an enterprise root CA (and, optionally, an enterprise subordinate CA). She then needs to configure a certificate template to enable autoenrollment, configure the CA to issue certificates based on this template, and finally configure a GPO to enable autoenrollment. She cannot configure autoenrollment of user certificates from a standalone CA server, so answer B is incorrect. She does not need to configure the retrieval of issued certificates (which does not provide for certificate autoenrollment), so answer C is incorrect. For more information, see the section “Enrolling User and Computer Certificates with Group Policy” in Chapter 7, “Planning and Implementing Group Policy.” 51. D. David can install Windows Server Update Services (WSUS) on a computer running Windows 2000 Server or Windows Server 2003. WSUS downloads updates from the Microsoft Windows Update website and makes them available to computers in the domain in which it is located. David can test the updates in a test lab before deploying them to domain computers. Windows Update is the website from which the updates are retrieved. Users can retrieve updates from this site, but the site by itself does not allow automated updating or testing of updates, so answer A is incorrect. Windows Installer is used to install and maintain software on computers. It is not used for retrieving and testing of software updates, so answer B is incorrect. Automatic Updates Client is the client software on computers running Windows 2000 or later that detects and processes updates received by the WSUS server. Therefore, answer C is incorrect. Dynamic Update provides up-todate setup files during Windows installation as well as updated device drivers. It does not provide continuous updates as required by this scenario, so answer E is incorrect. For more information, see the section “Configuring Automatic Updates for Network Clients Using Group Policy” in Chapter 8, “Managing Group Policy.”

695

Practice Exam Answers 52. B. The RID master handles the assignment of security identifiers (SIDs) to objects being created in the domain. The RID master hands out a pool of several hundred relative identifiers (RIDs) to every domain controller in the domain so that they can create new objects with unique identifiers. In doing so, it ensures that no two objects in the same domain can have the same RID. The schema master updates the Active Directory schema for the forest. The PDC emulator functions as a time server and as a primary domain controller to Windows NT clients. The infrastructure master ensures that references to objects in other domains are current. The domain naming master ensures that the names of child domains are unique. None of these roles ensure that objects within the domain have unique names, so answers A, C, D, and E are incorrect. For more information, see the section “Business Continuity of Operations Master Roles” in Chapter 2, “Planning and Implementing an Active Directory Infrastructure.” 53. E. Doug can use a global group to group users and groups from a single domain. He can use this group scope to grant access to resources in any domain in an Active Directory forest. This group scope is appropriate for the St. Louis Designers group because members of this group need access to resources located in all three domains. Doug can also use a domain local group to contain users and groups from any domain in the forest and grant access to resources in only a single domain. This group scope is appropriate for the Seattle Designers group because members of this group need access to resources in the same domain only. The Seattle designers do not need access to resources in the other domains, so answers A and B are incorrect. The St. Louis designers need access to other domains beside their own, so answer B is also incorrect for this reason. Doug could use a universal group to contain users and groups from any domain in the forest and grant access to resources in any domain. The requirements of this problem do not indicate the need for any universal groups, so answers C and D are incorrect. Furthermore, if he were to create a universal group and add members directly to this group, replication traffic would be increased each time the group membership is changed. For more information, see the section “Security Groups” in Chapter 5, “Planning User, Computer, and Group Strategies.” 54. C. Gwen needs to assign the software applications to computers within the scope of the GPO. By doing so, she makes the applications available to any users of the computer, whether they are using domain or local user accounts. If she were to either assign or publish the applications to users, only users with domain user accounts (permanent workers) would have access to the applications; users with local user accounts would not have access. Therefore, answers A and B are incorrect. It is not possible to publish applications to computers, so answer D is incorrect. For more information, see the section “Software Installation Using Group Policy” in Chapter 7, “Planning and Implementing Group Policy.” 55. A.Peter needs to deploy the software package using the Advanced option from the Deploy Software dialog box so that he can add a transform to the package. If he has selected either the Published or Assigned option, he will have to redeploy the software package. The Upgrades tab of the software package allows him to upgrade the software package to a new version (for example, Office 2000 to Office 2003). The Deployment tab enables Peter to specify deployment and user interface options. Neither of these tabs allows him to add a transform, so answers B and C are incorrect. Peter can deploy transforms from either the Computer Configuration or Software Configuration node, so answer D is incorrect. Peter is unable to reach this dialog box if he doesn’t have proper permissions, so answer E is incorrect. For more information, see the section “Use of Transform Files to Modify Software Packages” in Chapter 8, “Managing Group Policy.”

696

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 56. D. When users or computers are members of universal groups, the domain controller servicing the logon must be able to obtain universal group information in order to build a complete logon ticket. It can do this in either of two ways: by contacting a global catalog server or by obtaining cached information. In the case of a site that contains a single domain controller and several users that are members of universal groups, you can reduce WAN traffic by caching the universal group membership at the local domain controller. In the case of a domain at a single site, one of the domain controllers acts as a global catalog server, and all requests for universal group information are handled at that server. Because this server is rapidly available, universal group caching is not needed, so answer A is incorrect. In the case of a small site without any domain controllers, all logons must proceed over the WAN, whether or not universal group caching is enabled at the remote domain controller. Therefore, answer B is incorrect. If an application needs to access port 3268, you must have a global catalog server located at that site. Users can use that server to obtain universal group information, so answer C is incorrect. For more information, see the section “Evaluating the Need to Enable Universal Group Caching” in Chapter 2, “Planning and Implementing an Active Directory Infrastructure.” 57. B. This situation calls for stricter password policy requirements for members of the Legal department. The only way that Joe can implement this requirement is to create a separate domain because password policies can be specified only in a GPO that is linked to the domain. Joe cannot use a separate OU for this purpose, so answer A is incorrect. He also cannot use a security group and filter the settings of the GPO, so answer C is incorrect. The procedure of answer D would create a local security policy on each of the affected computers. This policy would then be overwritten by the less strict domain policy, so answer D is incorrect. For more information, see the section “Domain Password Policy” in Chapter 5, “Planning User, Computer, and Group Strategies.” 58. C. Sharon needs to link the Password GPO to the domain and the Software GPO to the Engineering OU. Although the password policies are specifically designed for members of the Legal department, account policies including password policies must be linked to the domain or they will be ignored, so answers A and B are incorrect. This does not violate the stated conditions because these conditions say that no specific passwords are in place, so it is still possible to apply these conditions to the rest of the company. If this were not so, Sharon would have to create a separate domain for the Legal users. The software must be available to all members of the Engineering department, including both the Design and Drafting work groups, so she needs to link this GPO to the Engineering department and answers D and E are incorrect. The software must not be available to members of the Legal OU, so answers B and F are incorrect. A question similar to this may be formatted on the exam as a drag-and-drop question in which you must drag the correct GPOs to the appropriate locations on a diagram of the domain and its OUs. For more information, see the section “Managing GPO Links” in Chapter 7, “Planning and Implementing Group Policy.” 59. A, D, F. Some of the problems that would prevent Mario from adding the attribute to the schema include his user account not being a member of the Schema Admins group, the Active Directory Schema snap-in not being registered, and the schema master not being available. The domain functional level at which the domain is operating does not matter, so answers B and C are incorrect. The RID master is not involved in this operation, so answer E is incorrect. For more information, see the sections “Managing Schema Modifications” in Chapter 3, “Managing an Active Directory Infrastructure,” and “Diagnosing Issues Related to Operations Master Role Failures” in Chapter 4, “Maintaining an Active Directory Infrastructure.”

697

Practice Exam Answers 60. C. Helen can use separate OUs to delegate administrative control for each department to the new administrators. In this way, the administrators will have control over the users and computers in their department, but no control over other departments. This is a situation in which using OUs makes the most sense. It would not make sense to create separate sites because the entire office is located in one building, so answer A is incorrect. There is no need to create separate child domains because the use of OUs is adequate to satisfy the requirements given here, so answer B is incorrect. The use of security groups, either at the global or domain local scope, would not permit Helen to delegate the proper level of administrative control to the new employees, so answers D and E are incorrect. For more information, see the section “Administrative Delegation Strategies” in Chapter 6, “Implementing User, Computer, and Group Strategies.” 61. E. Tom can use the Delegation of Control Wizard from Active Directory Sites and Services to delegate administrative control over sites. Doing so, the users to whom he delegates control receive authority over items in their site but not those in other sites. Because this capability is available, there is no need to create separate OUs for each branch office, so answer A is incorrect. There is also no need to create separate domains, trees, or forests because Active Directory provides for delegation of administrative control, so answers B, C, and D are incorrect. For more information, see the section “Administrative Delegation Strategies” in Chapter 6, “Implementing User, Computer, and Group Strategies.” 62. C. Among the several methods that Brian could employ to accomplish this task in Active Directory, the simplest is to create a new OU and delegate administrative control over this OU to the required group—in this case, the ITStaff group. The Delegation of Control Wizard makes it easy for him to achieve these objectives. He could create a new domain, but this is not the simplest means to accomplish these objectives. Therefore, answer A is incorrect. Creating a new site is not necessary, so answer B is incorrect. He could create a new group; however, adding the ITStaff group to the Account Operators group would provide them with authority beyond the scope of the project and not give them the authority to manage Group Policy. Therefore, answers D and E are incorrect. For more information, see the section “Planning an Organizational Unit (OU) Structure Based on Delegation Requirements” in Chapter 6, “Implementing User, Computer, and Group Strategies.” 63. B, C, D. After upgrading all domains in a forest to Windows 2000 native functional level, the possibility for nesting of groups greatly expands from the mixed mode case (in which only domain local groups can contain global groups from the same domain, and universal security groups are not available). In Windows 2000 native functional level, the following are possible: . Universal security groups can contain user accounts, global groups, and universal groups from any domain to a universal group. . Global groups can contain user accounts and other global groups from the same domain only. . Domain local groups can contain user accounts, global groups, and universal groups from any domain. They can also contain domain local groups from the same domain. Global groups cannot contain users, global groups, or universal groups from other domains or domain local groups from any domain, so answer A is incorrect. Universal groups cannot contain domain local groups from any domain, so answer E is incorrect. For more information, see the section “Security Groups” in Chapter 5, “Planning User, Computer, and Group Strategies.”

698

MCSE 70-294: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure 64. A. The Secedit command with the /configure option configures local computer security settings by applying them from a security template. You can use the /cfg parameter to specify the template to be imported into the database and the /db parameter to specify the database used to configure the security. When used with the /analyze option, the Secedit command analyzes the security settings by comparing them against the database, but it does not configure the security settings. Therefore, answer B is incorrect. Gpotool monitors the health of GPOs on domain controllers running Windows 2000. Windows Server 2003 does not use it, so answer C is incorrect. Gpresult performs a Resultant Set of Policy (RSoP) analysis on a user/computer combination. This tool does not configure security settings, so answer D is incorrect. Gpupdate refreshes local and Active Directory Group Policy settings, including security settings. It performs the same task that was done in Windows 2000 with Secedit with the /refreshpolicy option. Gpupdate does not configure security settings, so answer E is incorrect. For more information, see the sections “Using Security Configuration and Analysis to Configure Password Policy” in Chapter 5, “Planning User, Computer, and Group Strategies,” and “Troubleshooting Group Policy Security” in Chapter 8, “Managing Group Policy.” 65. B, F. The error message that Brigitte received indicates that the software needs to create one or more new classes in the schema to complete the installation. Neither the Enterprise Admins group nor the local system account has the appropriate permissions to do so, so answers A and C are incorrect. Obviously, the schema master computer must also be online and functioning properly. If a software restriction GPO were affecting the installation or if the shared folder containing the installation files did not have the proper permissions on it, she would not have been able to begin the installation in the first place. Therefore, answers D and E are incorrect. For more information, see the section “Managing Schema Modifications” in Chapter 3, “Managing an Active Directory Infrastructure.”

PART III

Appendixes APPENDIX A

Accessing Your Free MeasureUp Practice Test

APPENDIX B

MeasureUp’s Product Features

APPENDIX C

Review Questions and Answers Glossary

This page intentionally left blank

A

APPENDIX A

Accessing Your Free MeasureUp Practice Test This Exam Prep book features exclusive access to MeasureUp’s practice questions. MeasureUp is a Microsoft Certified Practice Test Provider. To access your free practice questions: 1. Retrieve your unique Registration Key on the inside of the back cover of

this book. 2. Go to www.measureup.com. 3. Create a free MeasureUp account or log in to your existing account. 4. On the Learning Locker Toolbar, click Register Products. 5. Read and consent to the License Agreement by clicking the checkbox

below the License Agreement. 6. Type your registration key number in the Key box. Do not remove any

dashes or substitute any numbers. 7. Click Register. 8. Click the Learning Locker Button to display your Personal Test Locker. 9. Click the Practice Test link, and follow the instructions to start your test

or the Learning Locker tab to return to your Leaning Locker. For more details about MeasureUp’s product features, see Appendix B, “MeasureUp’s Product Features.”

This page intentionally left blank

B

APPENDIX B

MeasureUp’s Product Features Since 1997, MeasureUp has helped more than one million IT professionals achieve certifications from the industry’s leading vendors. Created by content developers certified in their areas and with real-world experience, MeasureUp practice tests feature comprehensive questions (some with performance-based simulations, when simulations are relevant to a particular exam), detailed explanations, and complete score reporting. As a Microsoft Certified Practice Test Provider, MeasureUp’s practice tests are the closest you can get to the certification exams!

Multiple Testing Modes MeasureUp practice tests are available in Study, Certification, Custom, Missed Question, and Non-Duplicate question modes.

Study Mode Tests administered in Study Mode allow you to request the correct answer(s) and explanation for each question during the test. These tests are not timed. You can modify the testing environment during the test by clicking the Options button.

Certification Mode Tests administered in Certification Mode closely simulate the actual testing environment you will encounter when taking a certification exam. These tests do not allow you to request the answer(s) or explanation for each question until after the exam.

Custom Mode Custom Mode allows you to specify your preferred testing environment. Use this mode to specify the objectives you want to include in your test, the timer length, and other test properties. You can also modify the testing environment during the test by clicking the Options button.

704

Appendix B: MeasureUp’s Product Features

Missed Question Mode Missed Question Mode allows you to take a test containing only the questions you missed previously.

Non-Duplicate Mode Non-Duplicate Mode allows you to take a test containing only questions not displayed previously.

Question Types The practice question types simulate the real exam experience and include . Create a tree . Select and place . Drop and connect . Build list . Reorder list . Build and reorder list . Single hotspot . Multiple hotspots . Live screen . Command line . Hot area . Fill in the blank

Random Questions and Order of Answers This feature helps you learn the material without memorizing questions and answers. Each time you take a practice test, the questions and answers appear in a different randomized order.

705

Technical Support

Detailed Explanations of Correct and Incorrect Answers You’ll receive automatic feedback on all correct and incorrect answers. The detailed answer explanations are a superb learning tool in their own right.

Attention to Exam Objectives MeasureUp practice tests are designed to appropriately balance the questions over each technical area covered by a specific exam.

Technical Support If you encounter problems with the MeasureUp test engine, you can contact MeasureUp at 678-356-5050 or email [email protected]. Technical support hours are from 8 a.m. to 5 p.m. EST Monday through Friday. Additionally, you’ll find Frequently Asked Questions (FAQs) at www.measureup.com. If you’d like to purchase additional MeasureUp products, telephone 678-356-5050 or 800-649-1MUP (1687), or visit www.measureup.com.

This page intentionally left blank

C

APPENDIX C

Review Questions and Answers Chapter 1 Review Questions 1. Which LDAP naming standard used by Active Directory consists of a series of delimiters that uniquely define objects in the database? 2. What is the schema, and what purpose does it serve? 3. Which characteristic of a multidomain forest determines whether one or more trees are present? 4. Several benefits can be achieved by subdividing a domain into organizational units. Name two of these benefits. 5. What are two benefits of installing more than one domain controller in the same domain? 6. You are working from a computer in the accounts.quepublishing.com domain and want to print a document located on a server in the inventory.quepublishing.com domain to a color printer located in the design.quepublishing.com domain. What server do you need to contact for access to these resources? 7. Match each operations master to the task it performs: Operations Master

Task Performed

1. Schema master

a. Manages information related to domain groups and their membership.

2. RID master

b. Propagates changes in user properties to Windows NT 4.0 BDCs.

3. Infrastructure master

c. Plays a role in creating new domains and removing obsolete ones.

4. Domain naming master

d. Enables administrators to edit the Active Directory schema.

5. PDC emulator

e. Handles the assignment of security identifiers (SIDs) for objects being created in the domain.

708

Appendix C: Review Questions and Answers 8. What is the purpose of having more than one domain and forest functional level in Windows Server 2003 Active Directory? 9. Describe several new features introduced to Windows Server 2003 Active Directory with the R2 release.

Answers to Review Questions 1. The distinguished name (DN) consists of a series of delimiters, including the common name (CN), organizational unit (OU), domain component (DC), organization name (O), and country name (C). See the section “Naming Standards of X.500 and LDAP.” 2. The schema is a set of rules that define the classes of objects and their attributes that can be created in Active Directory. It provides a consistent set of rules for naming and describing objects. See the section “The Building Blocks of Active Directory.” 3. A multiple-domain forest that consists of a contiguous namespace comprises a single tree, whereas a forest that has a disjointed namespace comprises more than one tree. In other words, if the name of the parent domain is reflected in all child domains in the forest, there is a single tree; additional domains whose name does not reflect the parent domain comprise one or more additional trees. See the section “The Building Blocks of Active Directory.” 4. Using OUs in a domain presents several benefits. Some of these benefits are the ability to apply different sets of policies to users with different requirements, the ability to delegate control of certain user and/or computer accounts to a subset of assistant administrators, and the ability to separate various types of objects. See the section “The Building Blocks of Active Directory.” 5. Two benefits of having more than one domain controller in a domain are fault tolerance and load balancing. In other words, another domain controller can authenticate users should the first domain controller be unavailable, and multiple domain controllers spread out the work of authenticating users and other domain tasks. See the section “The Building Blocks of Active Directory.” 6. Whenever a user needs to access resources located in another domain, the computer from which he is working contacts the global catalog server to locate the required resources. See the section “The Building Blocks of Active Directory.” 7. The activities of the various operations masters are as follows:

709

Chapter 2

Operations Master

Task Performed

1. Schema master

d. Enables administrators to edit the Active Directory schema.

2. RID master

e. Handles the assignment of security identifiers (SIDs) for objects being created in the domain.

3. Infrastructure master

a. Manages information related to domain groups and their membership.

4. Domain naming master

c. Plays a role in creating new domains and removing obsolete ones.

5. PDC emulator

b. Propagates changes in user properties to Windows NT 4.0 BDCs.

See the section “Flexible Operations Masters.” 8. Domain and forest functional levels serve the purpose of selectively enabling features that domain controllers running older versions of Windows are able to support. See the section “What Is New in Windows Server 2003 Active Directory?” 9. Windows Server 2003 R2 includes the following additional features: Security Configuration Wizard, which assists you in creating security policies; enhancements to Active Directory Application Services (ADAM), including a setup wizard and an ADAM administrator account; Active Directory Federation Services (ADFS), which provides a single sign-on capability for authenticating users to multiple web-based applications; Services for UNIX, which provides password synchronization to servers running UNIX Network Information Service; improvements to Distributed File System (DFS), which includes DFS Namespaces and DFS Replication, and MMC version 3.0, which provides improved functionality for snap-ins written using .NET APIs. See the section “What Is New in Windows Server 2003 R2 Active Directory?”

Chapter 2 Review Questions 1. What are some reasons you would want to use child domains rather than OUs when planning your Active Directory implementations? 2. List several prerequisites you must satisfy before you begin to install the first domain controller for the forest root domain. 3. Name the tasks that the Active Directory Installation Wizard (dcpromo) can perform. 4. What would you use an application directory partition for?

710

Appendix C: Review Questions and Answers 5. What procedures do you need to follow when upgrading a forest containing Windows 2000 domain controllers to Windows Server 2003? Why? 6. What are several reasons for upgrading a domain from the Windows 2000 native functional level to the Windows Server 2003 native functional level? 7. What is the major reason why a domain controller that is authenticating a user at logon needs to contact a global catalog server, and what can you do to enable a user to log on without contacting a global catalog server? 8. What problem can occur if the PDC emulator is not available in a domain that is running at the Windows 2000 mixed functional level? 9. When is it appropriate to seize an operations master role rather than transfer it?

Answers to Review Questions 1. You might want to use separate domains to provide security boundaries. More specifically, the use of separate domains enables decentralized administration of network resources, varying user account requirements, and international legal and language needs. If you have multiple Internet domain names, you can mirror your organization’s Internet functionality. In the case of a massive organization, it is best to use a multiple domain structure. See the section “Planning the Active Directory Namespace.” 2. After you have planned your organization’s Active Directory structure, you should satisfy several prerequisites, including a server running Windows Server 2003 Standard Edition, Enterprise Edition, or Datacenter Edition; enough hard disk space including a volume formatted with the NTFS file system; and administrative privileges. You also need a DNS server that supports SRV resource records, although the Active Directory Installation Wizard will create one for you if one is not available. See the section “Building an Active Directory Forest.” 3. The Active Directory Installation Wizard can create a new forest, a new domain tree, the first domain controller in a domain, and additional domain controllers for existing domains. It can also install a DNS server if no suitable DNS server is available. As it installs the domain controller, it performs tasks such as creating the Active Directory database and log files and the shared system volume (SYSVOL). Furthermore, it can create a domain controller from backup media created on another domain controller in the same domain. Finally, it can also remove Active Directory from a server. See the section “Building an Active Directory Forest.” 4. You can use an application directory partition to store application-specific data and replicate it to a selected subset of domain controllers in one or more domains of the forest. See the section “Application Directory Partitions.” 5. When upgrading a Windows 2000 Server forest to Windows Server 2003, you need to run the Adprep utility. You first run Adprep /forestprep on the schema master, and then run Adprep /domainprep on the infrastructure master of each domain in the forest. Doing so

711

Chapter 3 adds new schema attributes provided by Windows Server 2003 and updates permissions on other Active Directory objects. See the section “Upgrading Windows 2000 Domains and Forests.” 6. Upgrading to the Windows Server 2003 native functional level enables all new features of Active Directory in Windows Server 2003, including domain controller renaming, updating of logon time stamps, and Kerberos KDC version numbers. It also allows you to upgrade the forest to the Windows Server 2003 forest functional level, which enables numerous additional features of Active Directory in Windows Server 2003. The most important of these features are forest trusts and domain renaming. See the section “Windows Server 2003 Functional Levels.” 7. The domain controller needs to contact the global catalog server to obtain universal group information, including its permissions for the user. To enable a logon without contacting a global catalog server, you need to enable universal group caching. Note that a domain controller always needs to contact a global catalog server the first time that user logs on to obtain the universal group information. See the section “Global Catalog Servers.” 8. In a domain running at the Windows 2000 mixed functional level, the PDC emulator acts as a primary domain controller for a Windows NT 4.0 domain. If it is unavailable, you cannot make user account modifications and users cannot change their passwords. See the section “Business Continuity of Operations Master Roles.” 9. Seizing the operations master role rather than transferring it is appropriate when the server holding the role has gone offline and it is not going to be brought online again. In some cases, you might have to seize the role even if the server will be brought online again, but then you will have to reformat the hard disk of the old server and reinstall Windows Server 2003 and Active Directory on that server. See the section “Business Continuity of Operations Master Roles.”

Chapter 3 Review Questions 1. What kinds of trusts can you create between two different Active Directory forests, and how do they differ? 2. What is the purpose of a shortcut trust? 3. What is the difference between a one-way incoming trust and a one-way outgoing trust? 4. What is the purpose of name suffix routing? 5. To add a new object and its attributes to the schema, what do you need to do first? 6. What are explicit UPNs and UPN suffixes, and why would you want to use them? 7. You are creating site link bridges manually and want to ensure the KCC uses your site link bridges. What should you do?

712

Appendix C: Review Questions and Answers 8. What is the difference between the Inter-Site Topology Generator (ISTG) and the Knowledge Consistency Checker (KCC)? 9. What are some differences between intersite and intrasite Active Directory replication? What is the major reason for these differences? 10. How do you configure Active Directory to optimize the choice of multiple links between two sites, such as T1 and dial-up? 11. Why do you need to specify IP subnets when configuring sites?

Answers to Review Questions 1. The two kinds of trust relationships between Active Directory forests are external trusts and forest trusts. External trusts exist between two specific domains in different forests. Forest trusts create transitive trust relationships between all domains in the forests involved. See the section “Interforest Trust Relationships.” 2. A shortcut trust is an additional trust relationship between two domains in the same forest that expedites the authentication process in a case where the normal authentication path would need to cross several domains. See the section “Trust Relationships Within an Active Directory Forest.” 3. A one-way incoming trust creates a one-way trust in which users in your (trusted) domain can be authenticated in the other (trusting) domain. Users in the other domain cannot be authenticated in your domain. A one-way outgoing trust creates a one-way trust in which users in the other (trusted) domain can be authenticated in your (trusting) domain. Users in your domain cannot be authenticated in the other domain. See the section “Establishing Trust Relationships.” 4. Name suffix routing is a mechanism that you can use to manage the routing of authentication requests across forests that are connected by forest trust relationships. It enables name suffixes that do not exist in one forest to be used to route authentication requests to another forest. See the section “Managing Trust Relationships.” 5. Before you can modify the schema, you need to first register the Active Directory Schema snap-in and then install it to a new MMC console. You use the regsvr32 command to register the snapin. In addition, you need to be a member of the Schema Admins group to modify the schema. You also need to ensure that the schema master is online. See the section “Managing Schema Modifications.” 6. An explicit UPN is a name in the form of string1@string2, where an administrator can define values for both strings. The UPN suffix is the part of the UPN after the at (@) sign. You can define a UPN suffix to simplify logon procedures for users in a multidomain forest. This facilitates the logon procedure for users in domains with long domain names. It also can be used to hide the domain structure of the forest from users in external forests. See the section “Adding or Removing a UPN Suffix.” 7. By default, all site links are bridged. If you do not want to use default site link bridging, you need to disable the automatic site link bridging in the IP or SMTP properties. See the section “Site Link Bridges.”

713

Chapter 4 8. The ISTG is a domain controller that creates the intersite replication topology. It considers the cost of intersite connections, checks whether any domain controllers have been added or removed, and provides this information to the KCC. The KCC is a process that runs automatically on all domain controllers and creates intrasite and intersite replication topologies. See the sections “Knowledge Consistency Checker” and “Inter-Site Topology Generator.” 9. Several of the differences between intersite and intrasite Active Directory replication are as follows: Intersite replication is compressed, whereas intrasite replication is not compressed; intersite replication can be configured to take place at certain times and intervals, whereas intrasite replication takes place automatically and frequently; intersite replication can use either RPC over IP or SMTP, whereas intrasite replication always uses RPC; and intersite replication takes place over WAN links according to site link costs that the administrator can configure, whereas intrasite replication takes place over all DCs according to a ring topology automatically created by the KCC. These differences exist because of the low bandwidth of slow-speed WAN connections between sites, and administrators can configure intersite replication so that it optimizes use of the slow link when other intersite traffic is minimal. See the section “Configuring Replication Schedules.” 10. You can optimize which of several types of links Active Directory prefers for intersite replication by specifying the site link cost parameter. This way, you can account for variables such as the monetary cost of an on-demand connection and the relative bandwidths and availability of different connection types. See the section “Configuring Site Link Costs.” 11. Active Directory has no means of associating IP subnets with different sites unless you tell it what subnet corresponds to which site. See the section “Configuring Site Links.”

Chapter 4 Review Questions 1. You attempt to run the Replication Monitor on your server, but Windows reports it cannot find this tool. What should you do? 2. Name five actions you can perform with the ntdsutil tool. 3. Besides the servers that you want data replicated between, what else must you specify when using the repadmin /replicate command? 4. Which log in Event Viewer records errors and warnings related to Active Directory? 5. How do you create and display a baseline graph of real-time Active Directory performance data? 6. A junior administrator has accidentally deleted the Publicity OU from your domain, and now users in this domain cannot log on to the network. What must you do to get this OU back? 7. A flood has ruined all the domain controllers for one domain in your forest. You have purchased and installed new Windows Server 2003 computers to act as replacement domain controllers. What should you do to restore the domain?

714

Appendix C: Review Questions and Answers 8. You have had to seize the domain naming master role. What should you do with the original holder of this role before you return it to service? 9. One of your domain controllers has experienced a total hard disk failure. What should you do to remove all references to the failed domain controller from the Active Directory database?

Answers to Review Questions 1. You need to install the Active Directory support tools from the Support\Tools folder of the Windows Server 2003 CD-ROM before you can use the Replication Monitor or many of the other tools. See the section “Active Directory Support Tools.” 2. Actions you can perform with the ntdsutil tool include the following: restoring the Active Directory database, defragmenting the Active Directory database offline, managing the domain, managing the Active Directory database and log files, cleaning up metadata, transferring and seizing operations master roles, managing security account data, and resetting the Directory Services Restore Mode password. See the section “ntdsutil.” 3. When you use the replmon command with the /replicate parameter (and many other parameters), you have to specify the naming context (or directory partition) you want replicated by its LDAP DN. See the section “repadmin.” 4. Event Viewer records Active Directory–related errors and warnings in the Directory Service log. This log exists only on domain controllers. See the section “Event Viewer.” 5. To create a graph of real-time Active Directory performance data, you use the Performance Logs and Alerts snap-in and add counters from the NTDS object. After you have collected this data, you use System Monitor to display a graph of the logged data. See the section “Using System Monitor.” 6. To get the Publicity OU back, you must perform an authoritative restore of this segment of the Active Directory database. See the section “Restoring Active Directory Services.” 7. To restore a domain after all domain controllers have been lost, you must perform a primary restore on the first domain controller. After you have done this, you need to perform a nonauthoritative restore of the other domain controllers. See the section “Restoring Active Directory Services.” 8. If you have to seize the domain naming master (or schema master) role, you should reformat the original role holder’s hard disk and reinstall Windows Server 2003 before returning it to the network. See the section “Diagnosing Issues Related to Operations Master Role Failures.” 9. Improper removal of a domain controller in such a situation leaves orphaned metadata in the Active Directory database. These references cause errors in the logs and might prevent users from accessing information. You should perform a metadata cleanup operation using the ntdsutil tool. See the section “Issues Related to Installation or Removal of Active Directory.”

715

Chapter 5

Chapter 5 Review Questions 1. What is the purpose of universal groups? When would you not use universal groups? 2. What is the recommended method of group nesting in a domain operating at the Windows 2000 mixed domain functional level? 3. What is the recommended method of group nesting in a multidomain forest when it is necessary to grant access to resources in more than one domain? When is it not possible to use this strategy? 4. What are the four types of certification authorities available in Windows Server 2003, and how do they differ? 5. Why is it important to specify a minimum password age when setting up a password policy? 6. What tool should you use to configure password policies for multiple domains at a single time?

Answers to Review Questions 1. Universal groups are used to group together users, computers, and groups from different domains in the same forest so that they can be granted access to resources in various domains in the forest. You would not use universal groups in a single-domain forest. See the section “Security Groups.” 2. At the Windows 2000 mixed functional level, you should add user accounts (A) to global groups (G). You then should add the global groups to domain local groups (DL), and finally assign permissions (P) to the domain local groups. This strategy can be summarized as A, G, DL, P. See the section “Windows 2000 Mixed Functional Level.” 3. You should add users in each domain to global groups in that domain. Then you can add these global groups to a universal group. You then add the universal group to a domain local group in the domain where the resource is located and grant permissions to that domain local group. You cannot use this strategy if any of the domains are operating at the Windows 2000 mixed functional level. See the section “Windows 2000 Native Functional Level.” 4. The types of certification authorities are as follows: (a) Enterprise root CA, or the most trusted CA in the Active Directory domain that stores its certificates in Active Directory; (b) Enterprise subordinate CA, which is subordinate to the enterprise root CA; (c) Standalone root CA, which is the most trusted CA in a hierarchy outside Active Directory; and (d) Standalone subordinate CA, which is subordinate to the standalone root CA. See the section “Smart Cards.” 5. You need a minimum password age so that users cannot cycle through a series of passwords and return to the initially used password when required to change their password. See the section “Domain Password Policy.”

716

Appendix C: Review Questions and Answers 6. You should use the Security Configuration and Analysis tool to configure password policy for multiple domains. It provides default security templates for configuring several aspects of domain controller security, and you can export security settings to simplify the setting of password policy in other domains. See the section “Domain Password Policy.”

Chapter 6 Review Questions 1. What groups should you limit access to in order to ensure network security? 2. For what structures can you delegate control? 3. What is the difference between a default container and an organizational unit? 4. What happens when you delete an OU? 5. What kind of group should be granted permissions to resources? 6. In what order should you apply rights when using group memberships under Windows 2003? 7. When should you use an administrative model for an OU structure—with a centralized or decentralized administrative structure? 8. What happens administratively to an OU that is moved? 9. When a user object is moved from one OU to another, which administrator will have control over that user?

Answers to Review Questions 1. You can limit the memberships of the Domain Admins and Enterprise Admins groups to enhance security. Administrators might still be able to perform administrative tasks through the delegation of control of OUs. See the section “Administrative Delegation Strategies.” 2. You can delegate control of organizational units and of a domain. You can delegate either full control of the unit and the tree of OUs below it, or you can delegate partial control. See the section “Administrative Delegation Strategies.” 3. A default container is created at the time the domain is installed. These containers are used for backward compatibility with Windows NT domains. They contain user and computer objects. You cannot create a tree structure within a default container. An organizational unit is a container object within a domain that can contain user, computer, group, and other types of objects. You can create a tree structure within an organizational unit by creating child, grandchild, great-grandchild, and so on OUs. See the section “Planning an OU Structure Based on Delegation Requirements.”

717

Chapter 7 4. When you delete an OU, you also delete all the contents of the OU. These contents could be child OUs, user objects, computer objects, or other types of objects. See the section “OU Structure.” 5. Domain local groups and local groups are the two kinds (scopes) of groups that should be granted rights to resources. These two groups can contain global groups and/or universal groups, as well as user objects. See the section “Planning a Security Group Hierarchy Based on Delegation Requirements.” 6. The order of building groups and granting them permissions is as follows: Accounts should be placed in global groups. If universal groups are used, the global groups should be placed within universal groups. The universal groups (or global groups in the case in which a universal group is not used) should be placed within the domain local groups. Permissions should be granted to the domain local groups. See the section “Planning a Security Group Hierarchy Based on Delegation Requirements.” 7. Administrative models for OUs do well with a centralized administrative structure. A site-based model for OUs is best used in a distributed or decentralized administrative structure. This works because, at the upper levels, it is easy to control who is delegated which duties to the users and computers within a domain. If a decentralized model is used, the administrators are located at various sites. To facilitate administration, you can then create OUs to match the sites. See the section “Administrative Requirements for an OU Structure.” 8. When an OU is moved, the user and computer objects within the moved OU will have new Group Policy Objects (GPOs) applied to them. They are inherited from the GPOs applied to the new parent OUs. See the section “Moving Objects Within the OU Hierarchy.” 9. When a user object is moved from one OU to another OU, the user is managed by the administrator who has control over the new OU. See the section “Moving Objects Within the OU Hierarchy.”

Chapter 7 Review Questions 1. What are the two components of GPOs, and what does each do? 2. What is the default sequence in which GPOs linked to various Active Directory containers is applied, and what are two means that you can use to alter this sequence? 3. What are several strategies you can use in planning a series of GPOs, and how do they differ? 4. You are applying a policy that will remove Control Panel from the desktops of all users in your organization. What are two ways you can keep administrators from being subjected to this policy? 5. You want Microsoft Access 2003 to be available on users’ Start menus but not actually installed until a user accesses it from the Start menu or double-clicks on an associated file. What should you do?

718

Appendix C: Review Questions and Answers 6. You have deployed Microsoft Word 2003 to all offices in your company, which does business in a large number of cities across North America. Users in Quebec complain that a French language version is not available. What can you do to assist these users? 7. You want to enable the automatic enrollment of user certificates based on a template that was first made available to Windows 2000. What do you need to do first? 8. You have configured a new software restriction policy for users in your office, and you receive several complaints that users are unable to reach an important accounting application. What should you do to troubleshoot this problem? 9. You have found that the accounts of several nonadministrative users have been added to the Domain Admins group by an unknown individual. How can you configure Group Policy to prevent someone from adding such accounts? 10. You received a complaint this morning from a senior manager that his computer’s hard disk had failed, and he would need to re-create several large important documents that had been stored on this computer. The computer is kept in a locked office. What should you do to prevent this problem from occurring again?

Answers to Review Questions 1. The two components of GPOs are Group Policy Containers (GPCs) and Group Policy Templates (GPTs). GPCs are Directory Services objects that include subcontainers for machine and user Group Policy information. GPTs are folder structures that include subfolders that together contain all the Group Policy information for any particular GPO. See the section “Components of Group Policy.” 2. The default sequence of GPO application is local, site, domain, OU, child OU (LSDOU). You can use either Block Inheritance or Enforced to modify this sequence. If your domain controller is not running GPMC, these settings are known as Block Policy Inheritance and No Override. See the section “Group Policy Inheritance.” 3. Some strategies for planning a series of GPOs include single-setting GPOs, which contain a single type of setting each; multiple-setting GPOs, which contain multiple types of policy settings; and dedicated-setting GPOs, each of which contains either computer configuration or user configuration settings only. See the section “Strategies for Planning GPOs.” 4. To prevent administrators from being subjected to a policy that removes Control Panel, you can deny the Apply Group Policy permission to members of the Domain Admins and Enterprise Admins groups. You can also add the users to whom the policy must apply to a security group. Then you can add this group to the list in the Delegation tab of the GPO’s Properties as it appears in the details pane of GPMC with the Read and Apply Group Policy permissions allowed, and then remove the Authenticated Users group from the same list. See the section “Filtering the Effects of a GPO.”

719

Chapter 8 5. In this case, you should assign Microsoft Access 2003 to users. This way, the software can follow them around to whatever computer they log on to. It is advertised in the Start menu and, if specified, an icon on the desktop. A user can install the application by starting it from either of these locations or by double-clicking an associated file. See the section “Software Installation Using Group Policy.” 6. You should apply a transform (.mst) file to the software package, specifying the required French language options. You should then redeploy the software package to users at the Quebec site. See the section “Software Installation Using Group Policy.” 7. You need to make a duplicate of the template. The original Windows 2000 templates (also called version 1 templates) are read-only and do not support autoenrollment. However, when you duplicate these templates, the template is created in version 2. It is editable and supports autoenrollment. See the section “Enrolling User and Computer Certificates with Group Policy.” 8. You should start a computer in Safe Mode. Software restriction policies do not apply when the computer is running in Safe Mode, and you can log on as a local administrator to edit the policy and run gpupdate. See the section “Configuring Security Settings with Group Policy.” 9. You can define a Restricted Groups policy to prevent this type of action from occurring again. These policies, which are in the Computer Configuration\Windows Settings\Security Settings\ Restricted Groups node, enable you to determine who can be a member of a group and which groups the group can be a member of. See the section “Restricted Groups.” 10. You should redirect the manager’s My Documents folder to a network share on a server. Not only is it easy to back up all users’ files without user interaction, but also the users’ documents are available to them regardless of which computer they are logged onto. See the section “Redirecting Folders with Group Policy.”

Chapter 8 Review Questions 1. You need to determine the effect of Group Policy on several computers that are to be located in kiosks in your office building’s lobby. What option should you specify when running RSoP in planning mode? 2. What are several options available to you when you are using RSoP to plan the effects on users of possible changes in your Active Directory environment? 3. Name several ways to start RSoP in logging mode, along with any limitations that each has. 4. When the RSoP console displays more than one GPO in the Precedence tab of a policy’s Properties dialog box, which policy takes precedence over the others? 5. Name three ways to save RSoP data for later referral. (Hint: Two of these are done from a location other than the RSoP console.)

720

Appendix C: Review Questions and Answers 6. Users in your company’s Mexico City office have complained that they do not have a Spanish spellcheck dictionary in their copies of Microsoft Word, which was assigned to them in a GPO. How would you correct this problem? 7. Users in your company have been using an outdated application for which you have received a replacement. After announcing that you would be removing the outdated application at the end of the month, you receive several complaints that users do not want to give up this program. What should you do? 8. You have configured a policy for automatic updating of Windows for computers on your network to keep them current and receive all fixes on a timely basis; however, you discover that the update sessions are consuming an inappropriately large amount of incoming network and Internet bandwidth. What should you do?

Answers to Review Questions 1. You should invoke the loopback processing mode. This mode causes computer settings to prevail over user settings, as opposed to the opposite (normal) sequence. Its use implements administrative template settings for computers based on the location of the computer object alone. See the section “RSoP Planning Mode.” 2. When using RSoP in planning mode, you have a series of options available to you to simulate changes in your Active Directory environment. These options include the use of slow network connections, loopback processing, site location, security group membership of users or computers, and the use of WMI filters for users or computers. See the section “RSoP Planning Mode.” 3. You can run RSoP logging mode from the Run dialog box, Active Directory Users and Computers, or its own console. You can also run RSoP logging mode from the Group Policy Results node of the Group Policy Management Console. When you run RSoP from the Run dialog box, you can process settings only for the current user and computer. When you use Active Directory Users and Computers, you need to either start with a user and specify any computer from the wizard, or start with a computer and specify any user from the wizard. Using either GPMC or the RSoP console is the most versatile method because it allows you to specify both computers and users. See the section “RSoP Logging Mode.” 4. When more than one GPO appears in the Precedence tab of a policy’s Properties dialog box, the GPO that appears at the top of the list always has the highest priority, and so on down the list. This is also true for policies that display their information directly in the details pane, such as folder redirection and IP security policies. See the sections “Analyzing the RSoP Results” and “Use of Security Templates.”

721

Chapter 8 5. From the RSoP console, you can save RSoP data by selecting the user/computer combination near the top of the console, clicking View, Archive Data in Console File, clicking File, Save As, and then specifying a filename. You can also save RSoP data by running the Gpresult command and directing its output to a text file, or by accessing Advanced System Information from the Help and Support Center and accessing the link titled Save a Snapshot of the Currently Displayed Information to an .htm File, which is located at the bottom of the results display. See the sections “Saving RSoP Data,” “Use of Gpresult to Troubleshoot Group Policy Security Settings,” and “Advanced System Information.” 6. You need to access the appropriate GPO and create a new software package, deploying it with the Advanced option. You can then add the .mst file that contains the Spanish language files at the Modifications tab of the package’s Properties dialog box. See the section “Use of Transform Files to Modify Software Packages.” 7. When you use Group Policy to remove the outdated application, you should select the Allow Users to Continue to Use the Software, but Prevent New Installations option. This is an optional removal, which means that the old application is no longer supported in Active Directory but is still available to all users who want to continue using it. See the section “Use of Group Policy for Software Removal.” 8. You can take two steps to alleviate this bandwidth problem and keep your users’ computers updated: First, you can use the Auto Download and Schedule the Install option and schedule all installs to take place during the night. Second, you can set up an intranet web server to receive the updates as they are posted. Then configure the Specify Intranet Microsoft Update Service Location policy in the GPO where the automatic update policy is configured. See the section “Configuring Automatic Updates for Network Clients Using Group Policy.”

This page intentionally left blank

Glossary Access control list (ACL) The list of permissions to access any object, such as a file, folder, printer, Group Policy Object (GPO), security certificate, and so on. The entries in the ACL determine the level of access that a process, user, or group receives. Active Directory The hierarchical directory service that originated with Windows 2000 and is improved with Windows Server 2003. It is designed to identify all resources on a network and allow users easy access to these resources. It also provides tight security across the network. Active Directory Application Mode (ADAM) A special mode of Active Directory that provides directory services for applications. It contains a suite of tools that enable you to create ADAM instances, including application directory partitions, and administer these instances as well as portions of Active Directory itself. Active Directory Federation Services (ADFS) A new feature of Active Directory in Windows Server 2003 R2 that enables you to set up a single sign-on capability for users to access web applications across forest boundaries without creating an external or forest trust relationship. Active Directory Migration Tool (ADMT) A wizard-based tool that assists you in moving users, groups, computers, and other objects from one domain to another. You can use this tool for moving objects from any domain including a Windows NT 4.0 domain to any Active Directory domain in the same or separate forests.

724

Active Directory replication

Active Directory replication The process by which the Active Directory partitions are copied among domain controllers in the forest to keep all domain controllers up to date. Separate replication topologies exist for the schema partition, the configuration partition, the domain partition, the application partition, and the global catalog. Administrative Templates The section of Group Policy from which administrators can configure settings that are applied to users’ desktops, specify programs that users can run, and so on. They apply changes to client computer Registry settings. Advanced System Information A tool provided with Windows XP and Windows Server 2003 that enables you to obtain system information, including running services, error logs, and Group Policy settings applied. The Group Policy settings are gathered using Resultant Set of Policy (RSoP) in logging mode. Application directory partition Also simply called “application partition,” a partition of Active Directory in which applications store data that can be replicated to a defined set of domain controllers in the forest—for example, Active Directory–integrated domain name system (DNS) zone data. Assigning software Deployment of software packages via Group Policy in which the software is automatically made available on the Start menu of all affected users or computers. Attribute Any descriptive property or characteristic of an object. This can include properties of files and folders such as archive or read-only, as well as descriptors of Active Directory schema classes, which define the type of information that a schema class can contain—for example, a user’s full name.

Audit policy A set of rules specified in Group Policy that determine which security events are logged in a computer’s security log. You can specify the tracking of events such as user logon, object access, account management, and so on. Authentication scope The range within which Active Directory will authenticate a user from another domain. When defining a trust relationship, you can use this option to restrict the level of access external users will have when accessing resources in a trusted domain. Authoritative restore A type of Active Directory restore operation in which restored objects will replace updated objects in the directory. This process increases the restored object’s update sequence number (USN) by 100,000, making it higher than the current object’s USN. Automatic Update A feature of Windows XP and Windows Server 2003 that enables you to keep your computer up to date by automatically connecting to the Windows Update website and downloading available updates. Backup The process of creating a second copy of programs, disks, or data, for the purpose of ensuring data availability in the event of some type of failure. Backup domain controller (BDC) A Windows NT domain controller that contains a readonly copy of the domain directory database. It is used for fault tolerance and load-balancing purposes. It can be used in an Active Directory domain that is operating at the Windows 2000 mixed functional level.

725

DCPROMO

Berkeley Internet Name Domain (BIND) The original DNS implementation that can operate on most versions of UNIX. Active Directory can function with versions 4.9.7 and later; however, version 8.2.1 or later is recommended for complete functionality. Block Inheritance A Group Policy setting that prevents a child container from applying GPO settings linked to higher-level containers known as Block Policy Inheritance if GPMC has not been installed. For example, you can use Block Inheritance at the organizational unit (OU) level so that only OU-level policies are applied. Certificate A digital statement that secures information on the network. It binds a public key to the individual or organization that holds the corresponding private key. The certificate is signed by the certification authority that issues it. Certificate auto enrollment A new feature of Group Policy in Windows Server 2003 that allows an administrator to automatically enroll users and computers for certificates, retrieve existing certificates, and renew expired certificates without user interaction. Certification authority (CA) A server that verifies the authenticity of public keys that belong to subjects such as users, computers, or other certification authorities. Child domain A domain that is located beneath another domain in the Active Directory or DNS hierarchical namespace. For example, inventory.company.com is a child domain of the company.com domain. Class A category of objects with similar attributes—for example, a file or group. All objects within a given class share common attributes, whereas objects within different classes may have other types of attributes.

Configuration partition The partition of Active Directory that contains information about the structure of Active Directory in the forest, including domains, sites, and services. It is replicated throughout the entire forest. Connection object In Active Directory, an object that represents a connection between two domain controllers for replication purposes. Although the Knowledge Consistency Checker (KCC) automatically creates connection objects, you can also create and configure them manually. Container In Active Directory, a type of object (such as an organizational unit) that is capable of holding other objects. This term can also refer in general to any item such as a folder that is capable of holding other items. Cross-forest trust Also known as a forest trust, a type of trust relationship in which all domains of one forest share trust relationships with all domains of a second forest. New to Windows Server 2003, this type of trust is available only if the forest is operating in the Windows Server 2003 functional level. Dcdiag A domain controller support utility that analyzes the state of domain controllers, providing detailed information about possible system abnormal behavior. It can test functions such as connectivity, replication, topology integrity, verification of trusts, and so on. Dcpromo A Windows utility that promotes member servers to domain controllers and creates new forests, trees, child domains, or additional domain controllers in the same domain. It can also install DNS as needed or demote domain controllers to member or standalone servers.

726

Delegation of authority

Delegation of authority The process of granting permissions to users or groups for performing a subset of administrative operations in Active Directory. Directory Services Restore Mode A special version of Safe Mode in which a domain controller is restarted as an standalone server. The directory database is rendered offline so that you can perform operations such as restoring, moving, or offline defragmentation on the Active Directory database. Distinguished name (DN) The name of an Active Directory object that uniquely defines the object in the namespace. Defined according to the Lightweight Directory Access Protocol (LDAP), it contains the organizational units and domain to which the object belongs. Distribution group A type of group that cannot be assigned any security permissions or rights. It is used for purposes such as the distribution of email. Domain An Active Directory container that holds user, computer, and group objects and separates them from other portions of the network. It provides a security and replication boundary. A domain is also the basic unit within the DNS or Internet namespace. Although Active Directory and DNS domains often correspond with each other, they should not be confused with each other. Domain controller A computer that holds a writable copy of the Active Directory database. It participates in Active Directory replication and authenticates users for access to domain resources. Domain functional levels A property of Active Directory domains that determines

which operating system domain controllers can run, compared to the level of Active Directory functionality that is supported. For example, the Windows 2000 mixed functional level supports any of Windows NT, 2000, and Server 2003 domain controllers but supports only limited functionality as was available in Windows NT. Domain local group A group scope that is normally used for assigning rights and permissions on resources in a single domain. Domain name system (DNS) A hierarchical, distributed database of mappings of computer names to IP addresses that is used to locate computers on a network or the Internet. Active Directory uses DNS as its primary locator service for finding all domain resources, including domain controllers and shared files. Domain naming master A domain controller that controls the addition and removal of domains, ensuring that new domain names are unique to the forest. Only one domain controller in a forest can hold this role at any time. Domain partition A partition of Active Directory that holds all information pertaining to objects within a domain. It is replicated only to domain controllers within its own domain. Encrypting File System (EFS) A means of storing files in an encrypted format, thereby protecting them from access by unauthorized users. Enforced A Group Policy setting available to GPMC that enforces the application of a GPO to all lower-level containers. Known as No Override if GPMC is not installed. For

727

Global group

example, an enforced domain-level policy is applied to all OUs in the domain regardless of settings in OU-based GPOs. Enterprise certification authority A certification authority that is fully integrated with Active Directory. It can provide certification services such as smart card logon across the entire domain. Event Viewer A Microsoft Management Console (MMC) snap-in that enables an administrator to view and/or archive event logs on a Windows 2000/XP/2003 computer. You can monitor information about application, security, system, DNS, and Active Directory events. External trust A type of trust relationship that is manually created between two domains in different forests operating at either the Windows 2000 or Windows Server 2003 functional level. It is one-way and nontransitive, and can be created between an Active Directory domain and a Windows NT domain or Kerberos realm. Flexible single-master operations (FSMO) A domain controller that holds one of five roles that are single-master in nature (that is, cannot be modified from multiple locations in the network at the same time). They are the domain naming master, schema master, infrastructure master, primary domain controller (PDC) emulator, and relative identifier (RID) master. Folder redirection A process that places users’ folders on a server location in which they can be administered and backed up easily. You can use Group Policy to specify folder redirection.

Forest A logical grouping of Active Directory domains that share the same schema and configuration partitions and are connected by two-way transitive trust relationships. They also share the same global catalog and search capabilities. Forest functional level A level that determines the capability of an Active Directory forest to utilize all available features of Active Directory in Windows Server 2003, compared to the operating system that domain controllers can run. You can utilize the Windows Server 2003 forest functional level only after all domains in the forest operate at the Windows Server 2003 domain functional level. Forest trust A type of trust relationship in which all domains of one forest share trust relationships with all domains of a second forest. This trust relationship is available only if both forests are operating at the Windows Server 2003 functional level. Global catalog A partial replica of the domain directory partition that is replicated to all global catalog servers in the forest. It contains a subset of information about objects in the forest and provides for the authentication of users and location of objects across domains in the same forest. Global catalog server A domain controller that hosts a copy of the global catalog and replicates with other global catalog servers in the forest. Global group A security or distribution group that can contain users from anywhere in the domain, and can be added to domain or computer local groups to grant permissions to the users as a whole.

728

Globally Unique Identifier (GUID)

Globally Unique Identifier (GUID) A unique 16-byte identifier for devices or objects in Active Directory.

information for each GPO. It contains subcontainers for user and computer Group Policy data.

GPO inheritance The set of rules that determine which higher-level GPO settings are applied by lower-level GPOs in Active Directory. By default, the GPO inheritance is local, site, domain, OU, child OU. You can modify this inheritance by using Block Policy Inheritance or No Override.

Group Policy filtering The process of assigning permissions to a GPO. You can use Group Policy filtering to determine which users and groups will receive a given GPO; for example, you can deny the Apply Group Policy permission to a group such as Domain Admins so that group members do not receive the effect of the given GPO.

Gpotool A command-line utility that tests the validity and replication status of GPOs on domain controllers running either Windows 2000 Server or Windows Server 2003. Gpresult A command-line utility that displays Group Policy settings and Resultant Set of Policy (RSoP) data for a computer or user. Gpupdate A command-line utility that refreshes Group Policy settings, both in Active Directory and at the local computer. It replaces the Windows 2000 secedit/ refreshpolicy command. Group nesting The process of adding one group to another to grant access to objects such as files, folders, printers, GPOs, and so on. Group Policy A set of configuration settings applied to an Active Directory object that defines the behavior of the object and its child objects. Group policies are applied to User and Computer objects as defined in Active Directory. They are used for many purposes such as software deployment, security settings, and configuration of user profile settings. Group Policy container An Active Directory container that includes attributes and version

Group Policy Management Console (GPMC) An optional tool that facilitates the management and administration of Group Policy. GPMC enables you to manage all aspects of Group Policy, including all GPOs available to the forest, from a single console. Group Policy Modeling The process of using Resultant Set of Policy (RSoP) to determine the effect of a series of GPOs on a user or group. You can simulate the effect of membership in sites, OUs, or groups. You can also simulate the effect of several other factors that can determine GPO application, such as slow network connections or loopback conditions. Group Policy Object (GPO) A series of policy settings that are created using the Group Policy Object Editor and applied to a specific Active Directory container such as a site, domain, or OU. Group Policy Results Also known as Resultant Set of Policy (RSoP) logging mode, a tool that queries Group Policy and informs you of which policies have been applied and in what order. Group Policy template A hierarchy of folders in the SYSVOL share that holds all the information for a given GPO.

729

NetBIOS

Hierarchical A structure that expands to several levels from a single starting point, such as a company organizational chart of the Active Directory forest namespace. In Active Directory, the forest root domain is the starting point of the hierarchy.

Local group A security group that can exist on member and standalone servers and client computers. It is used for assigning permissions on the computer on which it is located only and can contain domain users and groups as well as local users.

Infrastructure master The operations master that updates group memberships across the domain whenever the memberships change. This role is held by a single domain controller in each domain.

Logging mode A mode used by Resultant Set of Policy (RSoP) to gather information from the existing policies applied to a given computer and user.

Interim functional levels Domain and forest functional levels that arise only when Windows NT domains are being upgraded to Windows Server 2003. They can accommodate both Windows NT and Windows Server 2003 domain controllers but not Windows 2000. Intersite Topology Generator (ISTG) A domain controller used by the Knowledge Consistency Checker (KCC) to create the replication topology between sites. It considers the cost of intersite connections and checks for domain controllers added to or removed from the site. Knowledge Consistency Checker (KCC) A built-in process that runs automatically on all domain controllers and creates Active Directory replication topologies, both intrasite and intersite. Lightweight Directory Access Protocol (LDAP) A protocol originally designed by the Internet Engineering Task Force (IETF) to work as a front-end client service to X.500–compatible directory services. Microsoft designed Active Directory on the basis of LDAP, providing support in Active Directory for LDAP versions 2 and 3.

Loopback processing mode A special mode of processing GPOs in which computer settings prevail over user settings, as opposed to the opposite (normal) sequence. It is useful in situations such as kiosks where computers are freely accessible to the public. Mandatory upgrade An upgrade to an existing software package deployed by using Group Policy that is automatically installed to all computers and users to which the software policy applies. Movetree A utility that enables administrators to move objects between domains in a forest. Name suffix The part of a User Principal Name after the at sign (@), which usually refers to the domain in which the user resides. Also a DNS name suffix. Namespace A naming context (such as an Active Directory tree) that refers to a bounded area within which a name is resolved or translated into information that is encompassed by the name. NetBIOS An Application Programming Interface (API) that can be used by application programs on a LAN to provide easy access to networking services. NetBIOS also is responsible for providing names to networked computers.

730

No Override

No Override A modification to the usual GPO inheritance rules that prevents a lowerlevel container from overwriting policies that are set at a higher level. For example, you can use No Override at the domain level to force all OUs in the domain to accept domain policies. This setting is known as Enforced after GPMC has been installed. Nonauthoritative restore An Active Directory restore operation in which restored objects are not marked as authoritative. Ntdsutil A management utility used by Active Directory for maintenance operations such as seizing operations master roles, managing application partitions, and performing authoritative restore operations. NTFS The native file system used by Windows NT/2000/XP/2003 for storing and retrieving files on a hard disk. It provides numerous enhancements over FAT-based file systems such as the ability to specify file- and folder-level permissions, auditing, and so on. Object A distinct entity with a defined, named set of attributes that can be cataloged by a directory service such as Active Directory—for example, a file, folder, printer, user, computer, or group. It can also refer to an entity that can be linked in objectmodel programming or a component that can be monitored on a computer using System Monitor. Object identifier (OID) A unique X.500 identifier associated with all object classes or attributes in the directory. It consists of a dotted decimal string in which each dot represents a new branch in the hierarchy. One-way trust A trust relationship that operates in only a single direction. For exam-

ple, users in domain A can access resources in domain B, but users in domain B cannot access resources in domain A. You can configure one-way trusts to Active Directory domains, Windows NT domains, or Kerberos realms outside your forest. Optional removal A method of removing software in Group Policy that allows users to continue using an outdated software package that is no longer supported. Optional upgrade An upgrade to a software package deployed using Group Policy that a user is not forced to install. Organizational unit (OU) An Active Directory container that can hold objects such as users, groups, computers, or other OUs. It is a subdivision within a domain that permits a hierarchical structure to which group policies can be assigned. Parent domain At the top of every Active Directory tree, the root-level domain (such as corp.com). Lower-level domains can exist beneath it (such as inventory.corp.com). Password complexity A rule that can be applied using Group Policy that prevents users from employing simple, easy-to-guess passwords. The default password complexity requires at least three of the following four groups: lowercase letters, uppercase letters, numerals, and special characters. Password policy Policy settings in a domainbased GPO that specify the requirements for passwords in the domain. Patch files Files issued by an application developer that correct a minor bug or provide additional capability to an application already in use.

731

Replmon

PDC emulator An operations master that functions as a primary domain controller (PDC) to down-level computers in an Active Directory domain. It handles replication with Windows NT 4.0 backup domain controllers (BDCs) and authentication of down-level clients. It also handles time synchronization duties in the domain. Planning mode Also known as Group Policy modeling, a mode used by Resultant Set of Policy (RSoP) to simulate the effect of membership in sites, OUs, or groups. You can also simulate the effect of several other factors that can determine GPO application such as slow network connections or loopback conditions. Precedence The sequence or hierarchy of application of Group Policy objects (GPOs). The GPO that is applied last has the highest precedence. Primary domain controller (PDC) In a Windows NT 4.0 or older domain, the server that contains a writable copy of the directory database. It authenticates users and enables administrators to make changes to user, computer, and group accounts in the domain. It also replicates the directory database to the backup domain controllers. Public Key Infrastructure (PKI) A certificatebased system of digital certificates and certification authorities that validate the parties involved in an electronic transaction. Publishing software A means of using Group Policy to deploy software that enables a user to optionally install the software package by using Control Panel Add or Remove Programs or by opening an associated document.

Redeployment The process of reinstalling a modified application using Group Policy to computers covered by the Group Policy Object (GPO) that originally deployed the application. Relative distinguished name (RDN) The portion of a distinguished name that provides the unique identification of an object in the namespace. It is a unique attribute of the object itself. Remote Procedure Call (RPC) An interprocess communications method that enables a distributed application to call services located on various computers across the network. Rendom A utility that enables administrators to rename domains that are operating at the Windows Server 2003 functional level. Repadmin A utility that enables administrators to check replication consistency between domain controllers. You can monitor the status of replication, display replication metadata, force replication to take place, and force the Knowledge Consistency Checker (KCC) to recalculate replication topologies. Replication The process of synchronizing Active Directory information among domain controllers in a domain or forest. When changes are made to Active Directory objects, only enough information to indicate what change occurred and where is replicated. Replmon A GUI-based utility that enables administrators to monitor the status of replication. You can also use this utility to display and recalculate the replication topology and force replication.

732

Restricted groups

Restricted groups Security groups whose membership is controlled through a policy established in Group Policy. You can use this concept to control the membership of groups such as Domain Admins, Account Operators, or any security group you have created in Active Directory. Resultant Set of Policy (RSoP) A Group Policy planning and troubleshooting tool that queries Group Policy and retrieves information from computers running Windows XP Professional or Windows Server 2003. It also informs you of which policies have been applied and in what order. RID master An operations master that creates relative identifiers (RIDs) and distributes them to other domain controllers in a domain. The RIDs are used together with the domain identifier to create security identifiers (SIDs) that identify new domain objects. A domain can have only one RID master. Schema A set of rules that define the classes of objects that can be stored in the Active Directory database and the attributes that objects in each of these classes can possess. Schema master The domain controller that holds the only writable version of the Active Directory schema. This server collects all changes made to the schema and ensures that they are replicated to other domain controllers in the forest. A forest can have only one schema master. Schema partition The partition of Active Directory that stores the schema information. The schema master replicates this partition to all domain controllers in the forest.

Secedit A command-line tool that enables you to analyze and configure security on one or more computers using security templates. Security Configuration and Analysis An MMC snap-in that is used to analyze local computer security settings and apply security templates. You can also use it to create a security template from the local computer security configuration settings. Security group A group for which you can configure permissions on resources in Active Directory and create email distribution lists. Security identifier (SID) A unique variablelength alphanumeric data construct that uniquely identifies a security principal such as a user, group, service, or computer account within the Active Directory forest. Security template A text file containing a series of security configuration settings that can be imported into a GPO and applied to all computers that are subject to the GPO. It can also be applied to local computers. Service (SRV) resource records Records used by DNS to store information about where computers that provide a specific service are located on the network. Information in these records includes the name of the service and the DNS name of the host that is providing the service. The DNS service used by Active Directory must support the use of SRV resource records. Shortcut trust A one-way or two-way transitive trust relationship that is manually created between two child domains in the same forest, for purposes of providing a shortened interdomain authentication path.

733

Transitive trust

Simple Mail Transfer Protocol (SMTP) TCP/IP that is used for transporting data in the form of email messages across the network. In Active Directory, SMTP can be used to exchange the Active Directory schema and configuration partitions and the global catalog between domains.

Subnet A network within a network. Usually, a subnet is a physically independent network segment that shares a network address with other portions of the network and is distinguished by a subnet ID. Active Directory uses subnets to define the portions of the network included in sites.

Site A physical location in an Active Directory network that contains one or more domain controllers. It consists of one or more interconnected TCP/IP subnets. It facilitates replication of Active Directory data and authentication of users.

System State Operating system–specific data that is backed up by the Ntbackup program as a unit. It contains the Registry, COM+ class registration database, and system and boot files; on domain controllers, it includes the Active Directory database and the SYSVOL folder.

Site link An Active Directory object that represents paths used for replication of information between two or more sites. It can include sites that communicate at uniform cost by means of the same intersite transport. Site link bridge A connection between two or more site links that Active Directory can use as a replication path between sites that are not directly linked but share a common intersite transport. By default, the Knowledge Consistency Checker (KCC) automatically bridges site links. Site link cost A numeric value that incorporates factors such as the availability and bandwidth of a given site link. The Knowledge Consistency Checker (KCC) uses this number in determining the optimum replication topology. Smart card A credit card–sized device on which is written certificates enabling authentication of a user on the network. It can include information such as public and private keys and other kinds of personal data, and is used with a personal identification number (PIN) to provide a secure form of authentication.

SYSVOL The shared system volume of Active Directory. It includes files that are replicated among all domain controllers in the domain including Group Policy templates. Taskpad A customized view of a portion of the directory that resides in the details pane of an MMC console, typically created when an administrator delegates control of a portion of an OU to a user. Transform files Modifications to a Windows Installer software package distributed in the form of .mst files. You can use transform files to modify the behavior of a package being deployed using Group Policy—for example, to include foreign languages in Microsoft Office. Transitive trust A trust relationship that flows through a series of domains, enabling trust relationships among all domains in a series. For example, if domain A trusts domain B and domain B trusts domain C in a transitive trust relationship, domain A also trusts domain C. These trust relationships can be either one way or two way. In Active Directory, the default trusts are two way and transitive.

734

Tree

Tree A group of Active Directory domains that share a contiguous namespace—in other words, a parent domain and its child domains or subdomains. Trust relationship A relationship between domains that permits users in one domain (the trusted domain) to access the resources of the other (trusting) domain. This relationship permits users and groups in the trusted domain to be given rights and permissions in the trusting domain even though those accounts do not exist in the other domain’s directory. Two-way trust A relationship between domains in which the two domains act as both trusting and trusted; in other words, users and groups in either domain can access resources in the other domain. It is merely a combination of two trust relationships in opposite directions. In Active Directory, all trusts within a forest are two way. Universal group A security or distribution group that can contain users and groups from any domain in the forest. It exists in the global catalog. Universal security groups can be assigned permissions on any resource in the forest. Universal group caching A mechanism whereby a user’s memberships in universal groups can be retained on a domain controller after the user has been authenticated once at that domain controller. Its use eliminates the need for the domain controller to contact a global catalog server to complete the user’s logon. Update sequence number (USN) A number that the domain controller uses to track the updates to Active Directory that have taken place. It allows multimaster replication to

take place properly and enables authoritative restores of Active Directory. UPN suffix The portion of the UPN to the right of the at sign (@). Active Directory in Windows Server 2003 allows you to add an additional UPN suffix to simplify administration and user logon processes. User Principal Name (UPN) A form of the domain username in the form of an email address, such as [email protected]. This naming scheme was introduced in LDAP and is based on RFC 822. User rights System or domain tasks that a user is entitled to perform, including privileges and logon rights. Windows Installer A feature of Active Directory that provides for automated installation and repair of applications across the network. It also provides for cleaner and more efficient removal of old software without leaving unused .dll files or removing those that are also used by other programs. Windows Management Instrument (WMI) A management tool that enables you to query computers for configuration information on which the scope of a GPO can be modified according to the destination computers’ attributes. GPMC enables you to create WMI filters and link them to GPOs as required. Windows Update A Microsoft website that hosts all available updates for Windows operating systems, including patches, hotfixes, service packs, and so on. This site analyzes the configuration of a computer that connects to it and informs the user of critical or important updates that the user should download.

735

ZAP file

WINS A server application that maps NetBIOS computer names to IP addresses. It was the principal name resolution method employed by Windows NT 4.0. Although DNS has replaced WINS as the fundamental name resolution method in Windows 2000/XP/Server 2003, WINS is used on networks containing pre-Windows 2000 computers. X.500 A series of standards that define a hierarchical directory database. It was originally developed by the International Standards Organization (ISO), and Microsoft used it as the basis for developing Active Directory. ZAP file A text file (known as Zero Administration Package) that specifies the path to the setup files associated with an application being published using Group Policy and Windows Installer. It provides an alternative to .msi files when the latter are not available.

This page intentionally left blank

A Access denied error (replication), 626 accessing ADAM ADSI Edit MMC snap-in, 239 MeaureUp practice questions, 701 Account Operators security group, 379 account policies configuring, 337-338 Group Policy and, 339 lockout policies, 339 accounts, upgrading servers to domain controllers, 45 accounts domain, 118 ACLs (Access Control Lists), configuring, 324-326 Active Directory advantages of, 26-27 file requirements, 276-277 installing overview, 38 prerequisites, 52 new features, 27-30 system requirements, 43-44 troubleshooting database issues, 628 uninstalling, 63-65 verifying installation, 53-55

738

Active Directory Installation Wizard

Active Directory Installation Wizard capabilities, 45 domain controllers, creating first in new forest, 46-52 Active Directory Sites and Services connection objects, creating, 166-168

ADAM (Active Directory Application Mode), 29-31 ADSI Edit, 239 command-line tools, 71 components of, 70 R2 enhancements, 70

domain controllers, adding to a site, 158

add parameter (repadmin utility), 222

global catalog servers, creating, 610

adding forest trust relationships, 139-140

intersite replication intervals, configuring, 175-176

ADFS (Active Directory Federation Services), 31, 138

licensing server, selecting, 158-159

administration. See also managing

new sites, creating, 156-157 preferred bridgehead server, designating, 169-171

best practices, group management compared to user management, 371 OUs, 406-407

replication, manually forcing, 179-180

delegation overview, 370-371

running RSoP planning mode, 543-544

delegation requirements, 371-384

site link bridges, creating, 164-165

planning considerations, 632

site links, creating, 162-163

structure requirements, 385-387, 619

subnets, assigning to a site, 159-160 Active Directory Users and Computers

administrative configuration (business requirements), OU planning, 373

domain naming master, transferring, 92

administrative domain structure, 40

operations master roles, transferring at domain level, 90-92

administrative privileges, Active Directory system requirements, 44

OUs

Administrative Templates, Group Policy and, 504-511

changing, 394 creating, 391-393 delegating permissions, 396-398 running RSoP in logging mode, 550-552 in planning mode, 538-543 trust relationships, removing, 137-138

Administrators security group, 379 ADMT (Active Directory Migration Tool), 404 Adprep command-line tool, 30 ADSI Edit, 238-239 advanced backups, 253-256 Advanced System Information tool, 567-569 Advertising test (dcdiag utility), 225

739

Auto Generate File Names for Log Files option (replmon utility)

OUs, 17-18

answers to practice exams, 679-697 to review questions, 707-721

trees, 16 namespaces, 11-12

application data partitions, planning considerations, 615

objects, 12

Application log (Event Viewer), 225

schemas, 12-13

application directory partitions, 14

partitions, 14

creating, 67-68

assigning software, Software Installation and Maintenance, 464-465

deleting, 70

attributes, 12

listing, 69

classes, adding to, 147-148

overview, 67

schema, 145-147, 150-151

reference domains, 69 replicas, creating, 68-69 applications

creating, 186-187 attributeSchema class, schema modifications, 142

data replication, 172

audit policies, Group Policy, 488-489

deployment

authentication, 317

Group Policy and, 426

ADFS, 138

troubleshooting, 641-642

planning strategies

planning, Group Policy and, 429-431, 435-441, 446-457, 462 updating Group Policy, 570-572, 642-643

smart cards, 630-631 scope changing, 134

applying existing schema to new domains, 66 GPOs, sequencing, 449-450

trust relationships, 132, 140, 189 smart cards implementing, 319-334

architecture containers, 12 global catalog, 13 logical components domains, 15-16 forests, 17

password policies, 631

planning, 318-319 authoritative restore operations, 262-263, 625 Ntdsutil, 211 troubleshooting, 280-281 Auto Generate File Names for Log Files option (replmon utility), 218

How can we make this index more useful? Email us at [email protected]

740

autoentrolling of certificates, Group Policy

autoentrolling of certificates, Group Policy, 475-480

bridgehead servers, 166 configuring, 169-170

automatic updates, configuring

planning considerations, 618

for network clients, 643

builtin container, 376

Group Policy, 577-579

business requirements, OU planning, 373

automatically generated connection object properties, configuring, 168

C c parameter (dcdiag utility), 224

B

Cache tab (replmon utility), 219

backing up GPOs, 441-442 OUs, 393 Backup Operators security group, 379 backup/restore operations

canonical names, 10 case studies OU planning, 373-374 replication, 247

advanced backups, 253-256

centralized administrative control, Group Policy, 457

authoritative, 256, 262-264, 625

centralized OU structure, 386

nonauthoritative, 257-261, 625

Cert Publishers security group, 379

overview, 248

certificate rule, software restrictions, 484

performing, 250-253

Certificate Services, installing, 319-322

permissions, 249

certificates

types, 248-249 bandwidth, site topology and, 156 best practices Group Policy security settings, 585 monitoring and logging performance, 237-238 namespace planning, 41-43 Block Inheritance, 447-448 boundaries, sites, 159-161

autoenrollment, Group Policy, 475-480 enrolling user certificates, 640 Group Policy, 638 certification process, fixed-form exams, xxix. See also exam, preparing for Check Replication Topology option (replmon utility), 219 child domains compared to OUs, 19 creating, 60-63 planning considerations, 614

741

counters, Performance console

data replication, 172

classes, 12 attributes, adding, 147-148 schema, 150-151, 155 creating, 186-187

domain controllers, planning considerations, 615 Group Policy

classSchema class, schema modification and, 142

computer security settings, 339, 481-496, 640

Clear Log option (replmon utility), 220

environment, 423

collaboration, forest trusts and, 121

intersite replication intervals, 175-176

command line operations master roles, transferring, 93

properties, 191-192 name suffix routing, 136

tools ADAM, 71 Adprep, 30 ntdsutil, 67-68

replication schedules, 171-178, 622 site topology, 172-175 Restricted Group policies, 494

components of ADAM, 70

site boundaries, 159-161

compression

site link bridges, 164-165

backup options, 254

site links, 162-163, 181-182

intersite replication and, 174

sites, 157-159, 178-179, 190-191 Software Installation and Maintenance and, 463

computers certificates autoenrolling, 475-480 enrolling, 481 Group Policy and, 445-453 computers container, 376 configuration partition, 14

connection objects, configuring, 166-167 console, running RsoP in logging mode, 552-553 in planning mode, 547-548 containers, 12 LostAndFound, 262

configuring Account Policy, 337-338 ACLs, 324-326 Automatic Updates, 577-579 bridgehead servers, 169-170

OUs and, 376 contiguous namespaces, 12 copy backups, 249 counters, Performance console, 230

connection objects, 166-167

How can we make this index more useful? Email us at [email protected]

742

creating

creating

dcpromo program, 72

domain controllers at remote site, 60

child domains, creating, 61-63

domains with shared schema, 66

domain controllers, demoting, 64-66

forest root domains, 45-52

log files, troubleshooting Active Directory installation and removal, 277

group accounts, 312 with csvde tool, 313-314 with dsadd tool, 315 with ldifde tool, 314-315 with scripts, 316 OUs, 395 Schema snap-in attributes, 145-147 sites, 156-157, 178-179 user accounts, 312 with csvde tool, 313-314 with dsadd tool, 315 with ldifde tool, 314-315 with scripts, 316

second domain controller, installing, 56-57 deactivating Schema objects, 145 decentralized administrative control, Group Policy, 457 decentralized OU structure, 386 Default Domain Controllers Policy GPO, 438 default password filter, 337 Default Path for Replication Status Logs option (replmon utility), 219 defragmenting Active Directory database, 211, 265-266

crossforest access, 131

delegated permissions, removing with dsrevoke tool, 400

crossforest trusts, 118

delegating

relationships, removing, 137 csvde tool, creating user and group accounts, 313-314

GPO administration, 459-460 GPO creation, 458 GPO linking, 460 OU strategies, 370 planning, 371-378

D daily backups, 249 database

security groups, 378-384 WMI filter administration, 461 Delegation of Control Wizard, 375, 398

corruption, troubleshooting, 281

Delete option (replmon utility), 220

files, locating, 49

deleting

offline defragmentation, 211 dcdiag command, 223-225, 623

application directory partitions, 70 GPOs, 440 delimiters, X.500 distinguished names, 8

743

Domain Admins security group

demoting domain controllers, 64

disabled parameter, GPTs, 429

deploying

disabling

computer environments, 639

GPO links, 455

domain plans, 41

GPO nodes, 454

software with Group Policy, 473-474

GPO parts, 454

ZAP files, 467-468

disjointed namespaces, 12

DFS (Distributed File System), improvements to, 31

disk space, Active Directory system requirements, 43

DFS Replication, 245

displaying LDAP distinguished names, 9

DIB (Directory Information Base), 6

distinguished names (DN), LDAP, 8-9

differential backups, 249

distribution groups, 302-303, 306

digital certificates

DN (distinguished names)

requesting, 323-324

canonical names, 10

smart card user authentication, 319

LDAP, 8-9

Directory Information Base (DIB), 6

DNS (Domain Name System)

directory replication, forest trusts, 121

child domains, importance of, 62

Directory Service log (Event Viewer), 226, 626

errors, troubleshooting, 279

directory services

requirements, 614

Active Directory, advantages of, 26-27 GUIDs, 10

installing, 50 suffixes, routing, 134

history, 5-6

DNS server, Active Directory system requirements, 44

naming standards

DNS Server log (Event Viewer), 226

LDAP distinguished names, 8-9

DnsAdmins security group, 379

LDAP relative distinguished names, 9

DnsUpdateProxy security group, 379

LDAP User Principal Name, 9

documenting OU design, 377

protocols LDAP, 7

Domain Admins group, trust relationships, 120

X.500, 6-7

Domain Admins security group, 379

SIDs, 10 Directory Services Restore Mode, 266

How can we make this index more useful? Email us at [email protected]

744

Domain Computers security group

Domain Computers security group, 379

transferring from command line, 93

domain controllers, 22-23

transferring schema master role, 93

application directory partition reference domains, 69

planning considerations, 615

application directory partition replicas, creating, 68-69

site topology and, 157

application directory partitions creating, 67-68 deleting, 70 listing, 69 bridgehead servers, configuring, 169-170 containers, OUs and, 376 creating at remote site, 60 in new forest, 46-52 demoting, 64-65

renaming, 77-78 storing, 44 universal group caching, enabling, 85-86 upgrading from servers, 45 guided practice exercises, 80-81 Domain Controllers security group, 379 domain functional levels, 73-74 raising, 76-77 requirements, 75 Domain Guests security group, 379

Directory Services Restore Mode, 266

domain local groups compared to local groups, 303

global catalog servers, 610

domain local scope, 303, 629

creating additional, 82 evaluating network traffic, 83-84 installing

domain naming master, 611 failure, troubleshooting, 273 troubleshooting, 627

from backup media, 57, 59-60

domain naming master (FSMO role), 25, 92

second, 55-57

domain partitions, 14, 67

monitoring, 624

Domain Users security group, 379

operations master roles

domain-based GPOs, 435

identifying dependencies, 95-96

domains, 15-16

moving, 88-89

accounts domain, 118

seizing, 94-95

applying existing schema to, 66

transferring, 90-92

child

transferring domain naming master role, 92

compared to OUs, 19 creating, 60-63 planning considerations, 614

745

empty forest root domains

structure

data replication, 172 default security groups, 378

hiding UPN suffixes, 152

directory services, history of, 5-6

implementation, 115

empty forest root domains, 41

managing, 115, 141-151 topology compared to site topology, 22

forest root domains, 17 creating, 45-52

trees, 41

planning considerations, 614

trusting domain, 118 user passwords

functional levels, 29 guided practice exercises, 19-20

configuring account policy, 337-338

management

creating, 335-337 Security Configuration and Analysis plug-in, 340-347

Ntdsutil, 211 schema modifications, 620-621

Windows 2000, upgrading to Windows Server 2003, 72

trust relationships, 620 UPN suffixes, 621 multiple, benefits of, 15 namespace planning, 38 best practices, 41-43 geographical and administrative structure, 40 overview, 43 using organizational units, 39 using separate, 39 naming, 48

dsacls command, 239 dsadd command, 239 dsadd tool, creating user and group accounts, 315 dsastat command, 240 dsmod command, 239 dsrevoke tool, removing delegated permissions, 400 dsrm command, 240

OUs hierarchies, 375 objects, moving, 404-406 planning considerations, 616

E email

renaming, 77-78

distribution groups, 306

resource domain, 118

X.500 protocol, 6-7

schema and, 155

empty forest root domains, 41

How can we make this index more useful? Email us at [email protected]

746

Enable Debug Logging option (replmon utility)

Enable Debug Logging option (replmon utility), 219

exams, MCSE fixed-form format, xxv

encryption keys, upgrading servers to domain controllers, 45

objectives, xix-xx overview, xxiv

Enforced option, configuring, 448-449

preparing for, xxii, xxxi

enrolling user/computer certificates, 475-481

exam formats, fixed-form exams, xxix

Enrollment Agent Certificate, granting permission to, 324

general tips, xxvii learning styles, xxii

Enterprise Admins security group, 380

pretesting, xxiv

error 1265, troubleshooting, 271-272

study tips, xxii-xxiv

error 1311, troubleshooting, 270-271

retake policy, xxx-xxxi

errors

simulation questions, xxvi-xxvii

Access Denied, troubleshooting, 272

simulation questions, answering, xxix-xxx

DNS, troubleshooting, 279 replication, troubleshooting, 626 RPC Server Is Unavailable, troubleshooting, 269-270 RSoP applying GPOs, 561

test taking strategies, xxviii explicit UPNs, 151 extensibility, schemas, 13 external trust relationships, 617 external trusts, 118, 121

client does not exist, 561

establishing, 122-131

unable to connect to domain, 560

one-way, 125

user does not exist, 560

two-way, 125

establishing trust relationships, 122 external trusts, 122, 125-128 forest trusts, 129-130

F

shortcut trusts, 130-131

f parameter (dcdiag utility), 224

Event Viewer

failed replication, monitoring tools, 208-210

FRS failure, monitoring, 624

dcdiag, 223-225

replication monitoring, 225-227

Event Viewer, 225-230

customizing, 228-230

Ntdsutil, 211

FRS replication, 246

repadmin, 220-223 replmon, 212-220

747

Frsevent test (dcdiag utility)

fault tolerance, 22, 44

creating first domain controller, 46-52

ferr parameter (dcdiag utility), 224

domains, schema, 155

File Replication Service log (Event Viewer), 226

empty forest root domains, 41

File Replication Services Diagnostics Tool (FRSDiag), 240

global catalog servers and, 610

file systems

functional levels, 30 group nesting strategies, 309-310 guided practice exercises, 19-20

Active Directory system requirements, 43 requirements, 614 files, folder redirection and, 501-504 filtering Event Viewer views, 228 filters, GPO effects, 450, 452-453 flat namespaces, 11 FSMO server unavailability, examples, 88-89 folder redirection, Group Policy and, 426, 496-504, 638 forcing replication, 179-180, 622 forest functional levels, 74-75 raising, 77

implementing, 115 management considerations schema modifications, 620-621 trust relationships, 620 UPN suffixes, 621 managing, 115, 141-151 OU hierarchies, 375 root domain, planning considerations, 614 trust relationships, 28, 119-120 interforest, 120-121 Windows 2000, upgrading, 72

requirements, 76 forest trusts, 121, 617

Freesysvol test (dcdiag utility), 225

creating, 187-188

FRS (File Replication Service) failures, monitoring, 623-624

crossforest

FRS replication

access, 131

log files, 247

removing, 137

monitoring, 244

establishing, 122-131

Event Viewer, 246

testing, 189-190

Performance console, 245-246

unique name suffix conflicts, 136

FRSDiag command, 240

validation, 188-189

Frsevent test (dcdiag utility), 225

forests, 17 child domain planning considerations, 614

How can we make this index more useful? Email us at [email protected]

748

FSMO (flexible single-master operations)

FSMO (flexible single-master operations) See also operations masters business continuity and, 612-613

network traffic, evaluating, 83-84 placing, 87 planning

domain naming master, 25

enabling universal group caching, 611

infrastructure master, 25

network traffic considerations, 610

PDC emulator, 25

overview, 610

RID master, 26 schema master, 24 functional levels domain, 73-74

role of, 610 global groups, preventing access to confidential information, 309 global scope, 303, 629

raising, 76-77

GPCs (Group Policy Containers), 427-428

requirements, 75

GPMC (Group Policy Management Console), 431. See also GPOs

forest, 74-75 raising, 77 requirements, 76

GPOs backing up, 441-442

guided practice exercises, 80-81, 311-312

creating, 434-435

overview, 79

denying application of, 451-454

planning considerations, 616

Enforced option, configuring, 448-449

Windows 2000 mixed, security groups, 304-305

linking to a domain, 436-437

Windows 2000 native, security groups, 305-306

links, deleting, 440-441

Windows Server 2003, security groups, 306

importing, 443-444

linking to a site, 437-438 links, locating, 439-440 installing, 432-432 nodes, disabling, 454 restoring, 442-443

G

running RSoP in logging mode, 554-556

geographical domain structure, 40

running RSoP planning mode, 544-546

global catalogs, 13, 86 global catalog servers, 23-24

GPOs (Group Policy Objects), 427 administration of, delegating, 459-460

creating additional, 82

application sequence, 449-450

guided practice exercises, 96-97

applying to security group, 451

749

Group Policy

backing up, 441-442

troubleshooting, 561-562

creating, 434-440, 458

GPotool command, 567

deleting, 440 disabling, 454

Advanced System Information tool, 567-569

domain-based, 435

Gpupdate command, 566

effects, filtering, 450-453

GPotool command, 567

exempting users, 453

Gpresult command

group policy inheritance, modifying, 446-447

Group Policy, troubleshooting security settings, 584-585

importing, 443

implementing, 563-565

installation, 432-433

options, 562

link management, 438-441

overview, 562

linking

Windows 2000 version, 563

delegation of, 460

GPTs (Group Policy Templates), 427-428

to domains, 436

Gpupdate command, 566

to sites, 437-438

grafting, 17 graphing performance statistics, 240-242

links deleting, 440 disabling, 455

group accounts creating, 312

managing, 433-440, 444-445

with csvde tool, 313-314

nodes, 388, 454

with dsadd tool, 315

OU structure, planning considerations, 632

with ldifde tool, 314-315

OU-based, 438 properties, displaying, 433 planning strategies, 457-458 restoring, 442 security templates, implementing, 582 site-based, 437 software deploying, 465-467 installation options, 468-470

with scripts, 316 upgrading servers to domain controllers and, 45 group nesting, guided practice exercises, 311-312 group policies. See GPOs Group Policy Administrative Templates, 504-505, 507-511 application deployment, 426, 641-642

How can we make this index more useful? Email us at [email protected]

750

Group Policy

application planning, 429-431, 435-441, 446-457, 462

managing, 433-440 restoring, 442

Automatic Updates, configuring, 577-579

GPTs, 427-428

best practices, 456, 585

inheritance, 388, 429-431

certificates autoenrollment, 475-476, 478-480 enrolling, 640

Block Policy Inheritance, 447-448 loopback processing mode, 509 configuring, 510-511

computer environment, 639

management, 641

computer security, configuring, 640

network clients, automatic updates, 643

computers, 445-453

No Override option, 448-449

delegation administration, 457-458

OU structure requirements, 387-391

domain user passwords

overview, 426-429

configuring account policy, 337-338

performance considerations, 389

creating, 335-337

planning considerations

Security Configuration and Analysis plug-in, 340-347

computer environment configuration, 636

Enforced option, 448-449

configuring user security settings, 639

enrolling user/computer certificates, 481

enrolling user certificates, 638

environment, deploying, 423

redirecting folders, 638

folder redirection, 426

RSoP mode, 634-635

forcing refresh, 567

software distribution, 637

GPCs, 427

user environment configuration, 635636

GPMC, 431 GPO properties, displaying, 433

processing order, 431

installation, 432-433

redirecting folders, 496-504

GPOs, 427

roaming users, 389

backing up, 441-442

security option, 426

creating, 434-440

security settings, 481, 495-496

deleting, 440

account policies, 339

importing, 443

audit policies, 488-489

linking to domains, 436

Restricted Groups, 493-494

linking to sites, 437-438

Security Options node, 491-493

751

installing

software restriction, 482-488 troubleshooting, 581-585, 644 user rights, 490-491 software deploying, 465-467, 473-474 distributing updates, 642-643 listing installed, 580 package properties, 471-472 planning, 423 redeploying, 473, 574-575

H hard disks file system requirements, 614 space requirements, 43 hardware requirements for lab/study guide, xv smart card user authentication, 318 hash rule, software restrictions, 484 hierarchical namespaces, 11 history of directory services, 5

removing, 576 testing, 391 updating, 570-574 users, 445-453

I-J

Group Policy Creator Owners security group, 380

identifying operations master role dependencies, 95

group policy inheritance (GPOs), modifying, 446-447

IETF (Internet Engineering Task Force), 7

groups

implications of moving objects, 405-406

nesting, 307-308, 382-384

implementing site topologies, 155 implicit UPNs, 151

multiple forest environments, 309-310

importing GPOs, 443

universal groups, 308-309

incremental backups, 249

security planning, 629-630

infrastructure master, 274, 612, 627

Guests security group, 380

infrastructure master (FSMO role), 25

GUID (Globally Unique Identifier), 10, 427

inheritance

guided practice exercises, forest and domain structures, 19-20

Block Policy Inheritance, 447-448 Enforced option, 449-450 Group Policy, 388, 429-431 installing. See also uninstalling Active Directory overview, 38

How can we make this index more useful? Email us at [email protected]

752

installing

prerequisites, 52

intrasite replication, 173, 622

system requirements, 43-44

inverted tree hierarchical structure, X.500, 6

uninstalling, 63-65

IP (Internet Protocol) subnets, 155

verifying installation, 53-55

IPSec, viewing policy assignments, 582-583

Active Directory Schema snap-in, prerequisites, 145

ISTG (Intersite Topology Generator), 166-168

Certificate Services, 319-322 DNS, 50 domain controllers

K-L

from backup media, 57-60

KCC (Knowledge Consistency Checker), site topology and, 165-166

planning considerations, 615

Kccevent test (dcdiag utility), 225

GPMC with SP1, 432-433

Kerberos, forest trusts and, 121

Schema snap-in, 142-144, 185-186

KnowsOfRoleHolders test (dcdiag utility), 225

second domain controller, 55-57

lab equipment, hardware/software requirements, xv

Software Installation and Maintenance, 463 software options, 468-470 troubleshooting Active Directory installation/removal

LDAP (Lightweight Directory Access Protocol), 7 domain controllers, monitoring, 624 naming standards

dcpromo log files, 277

distinguished names, 8-9

Ntdsutil, 278-279

relative distinguished names, 9

Windows Server 2003 Support Tools, 209-210 instructional features of book, xiii-xiv interforest trust relationships, 120-121 Internet zone, software restrictions, 485 intersite replication, 174, 622

User Principal Name, 9 performance issues, OU design, 371 ldifde command, 239 OUs, creating, 395 user and group accounts, creating, 314-315

intervals, configuring, 175-176

ldp command, 239

property configuration, 191-192

licensing server, site topology and, 158

restricting time, 176

Lightweight Directory Access Protocol. See LDAP

753

manually forcing replication

limiting local group membership, 494

logoff scripts, Group Policy, 426

links

logon

GPOs, 438-441

scripts, Group Policy, 426

site links configuration, 162-163

troubleshooting software restriction policy problems, 584

cost, configuring, 181-182

UPN suffixes and, 152

site link bridges, 163-165 transitive site links, 163 listing known application directory partitions, 69

loopback processing mode (Group Policy), 509-511 LostAndFound container, 262

load balancing, 22, 88

M

local groups compared to domain local groups, 303

MachineAccount test (dcdiag utility), 225

restricting membership to, 494

managing

log files

domains, 211, 444-445

FRS replication, 247

forest and domain structure, 620

location, 49

Group Policy, 641

logging directory service information, Event Viewer and, 226-227 performance

groups compared to users (best practices), 371 schema modifications, 620-621 replication, 180

best practices, 237-238 statistics, 240-242 scheduling, 236 logging mode (RSoP), 537, 548-549

sites boundaries, 623 link costs, 622-623 replication schedules, 622

compared to planning mode, 559

trust relationships, 620

running from console, 552-553

UPN suffixes, 621

running from GPMC, 554, 556

manually forcing replication, 622

running from Run dialog, 549-550 running from Users and Computers, 550-552

How can we make this index more useful? Email us at [email protected]

754

MCP exam retake policy

MCP exam retake policy, xxx-xxxi

objects and counters, 230

MCSE exam

Performance Logs and Alerts, 234-237

fixed-form format, xxv overview, xxiv

System Monitor, 231-234 replication

simulation questions, xxvi-xxx

dcdiag, 223-225

test taking strategies, xxviii

Event Viewer, 225-230 Ntdsutil, 211

MeasureUp accessing practice questions, 701

overview, 243-244

practice test options, 703-705

repadmin, 220-223

technical support, 705

replmon, 212-220 tools, 208-210

Media option (Installation Wizard), 57-60 metadata, removing, 211

movetree command, 239

mixed mode operation, 73

movetree tool, 404

MMC (Microsoft Management Console) snap-ins

moving

default, 53

Active Directory database, 264-265 OU objects

Schema snap-in and, 143

between domains, 404

MMC version 3.0, 32

implications of, 405-406

modifying

with domains, 404-405

OUs, properties, 407

multimaster replication, 15, 171

permissions with Security tab, 398, 400 schema, 13 monitoring FRS failures, 623 tools for, 623-624 FRS replication

N n parameter (dcdiag utility), 224 name suffix routing, trust relationships, 132-136, 140

Event Viewer, 246

namespace planning, 11-12

overview, 244-245

best practices, 41-43

Performance console, 245-246

domain trees, 41

performance, best practices, 237-238 Performance console, 230

geographical and administrative domain structure, 40 multiple domain trees, 41

755

objects

overview, 38, 43

nonauthoratative restore, 257-262

using organizational units, 39

nonauthoritative restore operations, 625

using separate domains, 39

normal backups, 249

child domains, 61

Notify when replication fails after this number of attempts option (replmon utility), 218

domains, 48

NTDS Quotas container, 377

root domain, 38

ntds.dit files, 15

naming

naming standards (directory services), LDAP distinguished names, 8-9 relative distinguished names, 9 User Principal Name, 9 native mode operation, 73 NCSecDesc test (dcdiag utility), 224 nesting groups, 382-384 guided practice exercises, 311-312 strategies for, 307-310 NETBIOS, domain names, 48

ntdsutil command, 67 Active Directory Database, moving, 264-265 application directory partitions, creating, 68 operations master roles, transferring, 93 replication monitoring, 211 seizing operations master roles, 94 troubleshooting Active Directory installation/removal, 278-279 NTLM authentication, forest trusts and, 121

netdiag command, 240 NetLogons test (dcdiag utility), 224 network clients Automatic Updates, configuring for, 577-579 updating Group Policy and, 643

O objectives of exam, xix-xx objects, 6

Network Configuration Operators security group, 380

ADSI Edit, 238

network traffic, global catalog server planning, 610

connection objects, configuring, 166-167

new Active Directory features, 27-29

OUs, moving, 400-404, 633

New Trust Wizard, 122

Performance console, 230

No Override option, Group Policy, 448-449

Schema, deactivating, 145, 149

classes, 12 global catalog, 13

How can we make this index more useful? Email us at [email protected]

756

ObjectsReplicated test (dcdiag utility)

ObjectsReplicated test (dcdiag utility), 225

OUs (organizational units), 17-18

offline defragmentation, performing, 265-266

administration, 406-407

offline files, folder redirection and, 501-504

backing up, 393

OID (Object Identifier), 147

changing, 394

one-way trust relationships, 118, 125, 140

creating, 391-393, 633

operating systems, Active Directory system requirements, 43

with csvde tool, 395

operations master roles, 87, 611

with scripts, 395

with ldifde tool, 395

business continuity of, 612-613

delegating permissions, 396-398

dependencies, 613

delegation, 370-371

guided practice exercises, 96-97

Delegation of Control Wizard, 375

identifying dependencies, 95-96

design factors, 375

moving, 88-89

namespace subdivision and, 39

placement of, 96

objects, moving, 400-405, 633

seizing, 94-95, 211, 275-276

permission delegation, 633

transferring, 90-91

planning

domain naming master role, 92 from command line, 93 schema master role, 93 troubleshooting failures, 272, 627-628 domain naming master, 273

delegation requirements, 371, 373375, 377-378 delegation requirements for security groups, 378-384 planning considerations

infrastructure master, 274

administrative requirements, 632

PDC emulator, 274

GPO requirements, 632

RID master, 273

properties, 407

schema master, 273

structure

organization of book, xii

administrative requirements, 385-387

organizational charts, OU planning and, 373

Group Policy requirements, 387-391

organizational units. See OUs

overview, 384

originating updates, replication, 173

planning, 619

OU-based GPOs, 438

757

physical components

Performance console

P-Q p parameter (dcdiag utility), 224 parameters of Adprep command-line tool, 30

FRS replication, monitoring, 245-246 objects and counters, 230 Performance Logs and Alerts, 234-237

partitions, 14

System Monitor, 231-234

application data partitions, planning considerations, 615

Performance Log Users security group, 380

directory, synchronizing, 217-218

Performance Logs and Alerts, 234-237

password policies. See also passwords guided practice exercises, 347-348 planning considerations, 631 passwords

Performance Monitor Users security group, 380 performance statistics, graphing, 240-242 permissions backups, 249

domain users configuring account policy, 337-338 creating, 335-337 Security Configuration and Analysis plug-in, 340-347

domain controllers, setting, 50 forcing replication, 217 modifying with Security tab, 398-400 OUs

restore mode, 211, 259

delegating, 396-398, 633

Restore Mode Administrator, 51

design considerations, 370

security of, 52

inheritability, 375

patches compared to transform files, 574

removing with dsrevoke tool, 400

path rule, software restrictions, 485

upgrading servers to domain controllers and, 45

PDC (primary domain controller), 5 PDC emulator (FSMO role), 25, 611 troubleshooting, 274, 628 performance database and log file placement, 52 Group Policy, 389 monitoring and logging, best practices, 237-238

physical components domain controllers, 22-23 domain naming master, 25 FSMO roles, 24 global catalog servers, 23-24 infrastructure master, 25 PDC emulator, 25

OU design considerations, 371

RID master, 26

universal group caching, 85

schema master, 24 sites, 21

How can we make this index more useful? Email us at [email protected]

758

physical environment, site topology and

physical environment, site topology and, 156 PKI (public key infrastructure), smart card authentication and, 318 placing global catalog servers, 87 operations master, 96 planning administration, OU structure, 619 application data partitions, 615 authentication strategies, 630-631

OU structure, 371-378 administrative requirements, 632 delegation for security groups, 378-384 GPO requirements, 632 preferred bridgehead servers, 618 security groups, 629-630 hierarchy, 619 site links, 617-618 planning mode (RSoP), 537

domain controller installation and configuration, 615

compared to logging mode, 559

domains, 616

running from GPMC, 544-546

forests, 614

running from Active Directory Sites and Services, 543-544

global catalog servers enabling universal group caching, 611 network traffic considerations, 610 overview, 610 Group Policy, 634 computer environment configuration, 636

running from console, 547-548

running from Active Directory Users and Computers, 538-543 policies displaying user or computer settings only, 553 Gpresult command

configuring user security settings, 639

implementing, 563-565

enrolling user certificates, 638

options, 562

redirecting folders, 638

overview, 562

RSoP mode, 634-635

Windows 2000 version, 563

software distribution, 637 user environment configuration, 635636 operations master roles, 611

group Advanced System Information tool, 567-569 GPotool command, 567

business continuity of, 612-613

Gpupdate command, 566

dependencies, 613

troubleshooting, 561-562

759

pruning

RSoP analyzing results, 556-559 client does not exist errors, 561 errors when applying GPOs, 561 logging mode, 537, 548-549 logging mode, running from console, 552-553

Pre-Windows 2000 Compatible Access security group, 380 preferred bridgehead server, designating, 169-170 preparation for MCSE exams fixed-form format, xxv overview, xxiv

logging mode, running from GPMC, 554-556

simulation questions, xxvi-xxvii

logging mode, running from Run dialog, 549-550

test taking strategies, xxviii

logging mode, running from Active Directory Users and Computers, 550-552 overview, 536-537

answering, xxix-xxx prerequisites for Active Directory Schema snap-in, 145 primary restore, 264 Print Operators security group, 380

planning mode, 537-538

privileges, Active Directory system requirements, 44

planning mode, running from console, 547-548

processing order, Group Policy, 431

planning mode, running from GPMC, 544-546

properties

planning mode, running from Active Directory Sites and Services, 543-544 planning mode, running from Active Directory Users and Computers, 538-543

Program Data container, 377 intersite replication, 191-192 of OUs, 407 software packages, Group Policy and, 471-472 subnet sites, 160 System Monitor, 233-234

saving results, 559

Properties option (replmon utility), 220

unable to connect to domain errors, 560

protocols

user does not exist errors, 560 practice exam questions, 646-676

LDAP, 7 X.500, 7 pruning, 17

answers, 679-697

How can we make this index more useful? Email us at [email protected]

760

public key infrastructure

public key infrastructure. See PKI publishing software, Software Installation and Maintenance, 464-465

renaming domain controllers, 77-78 domains, 77-78 rendom.exe utility, 77

questions (exam), simulation, xxvi-xxvii answering, xxix-xxx

repadmin command, 623 add parameter, 222 replicate parameter, 221 replication monitoring, 220-221

R

replsummary parameter, 223

R2 (Release 2), 30

showconn parameter, 223

ADAM, enhancements, 70

showmeta parameter, 221

ramifications of moving objects, 405-406

showreps parameter, 222

RDC (remote differential compression), 32

sync parameter, 222-223

RDNs (relative distinguished names), LDAP, 9

syncall parameter, 223

realm trusts, 121

replicate parameter (repadmin utility), 221

reapplying GPO policies, 561

replication

redeployment of Group Policy software, 473

application directory partitions, 68-69

redirection, folders, 426, 496-504

case study, 247

registering Active Directory Schema snap-in, 142

dcdiag and, 223-225

relationships, trust relationships, 115, 118

directories, forest trusts and, 121

Remote Desktop Users security group, 380

Event Viewer, 225-227

DFS Replication, 245

customizing, 228-230

Remote Procedure Call over IP, site links and, 617

failures, monitoring, 623-624

removing

forcing, 179-180, 217

application directory partitions, 70

FRS

crossforest trust relationships, 137

log files, 247

delegated permissions with dsrevoke tool, 400

monitoring, 244-246

forest trust relationships, 139-140 UPN suffixes, 154

ignoring schedules, 178

761

restore operations

intersite replication, 174 intervals, configuring, 175-176 property configuration, 191-192

slow response to clients, 269 stopped replication, 268 USN and, 172

intrasite, 173

Replication Monitor tool. See replmon command

managing, 180

replication schedules

restricting time, 176

monitoring, overview, 243-244

configuring, 171-178

monitoring tools, 208-210

ignoring, 177

multimaster replication, 171 multiple replication topologies, 173 Ntdsutil and, 211 originating update, 173 overview, 171 pull/push processes, 173

Replication Synchronization permission, forcing replication, 217 Replications test (dcdiag utility), 224 Replicator security group, 381 replmon command, 623 options, 218-220 replication monitoring

RDC, 32 repadmin and, 220-223 replmon and, 212-218 replmon options, 218-220 schedules, management considerations, 622 site topology, schedule configuration, 172-175 site topology and, 156 troubleshooting, 267, 626 Access Denied errors, 272 error 1265, 271-272 error 1311, 270-271 RPC Server Is Unavailable error, 269-270 slow replication, 269

displaying pending changes, 215-216 implementation, 212-214 synchronizing directory partitions, 217-218 replsummary parameter (repadmin utility), 223 resource domain, 118 resource management, forest trusts and, 121 restoration, authoritative, 211 Restore Mode Administrator password, 51 restore mode password, 211, 259 restore operations authoritative, 262-263 GPOs, 442 nonauthoratative, 257-262, 625 overview, 256 primary, 264 types, 248

How can we make this index more useful? Email us at [email protected]

762

restoring Active Directory

running from Active Directory Users and Computers, 550-552

restoring Active Directory, 267 Restricted Groups folder, Group Policy and, 493-494

overview, 536-537

restriction policies, software, 482-488

planning mode, 537

review questions and answers, 707-721

running from console, 547-548

RID master (FSMO role), 26, 89, 612

running from GPMC, 544, 546

troubleshooting, 273, 627

running from Active Directory Sites and Services, 543-544

RidManager test (dcdiag utility), 225

running from Active Directory Users and Computers, 538-543

roaming users, Group Policy and, 389 root domains

results

naming, 38

Advanced System Information tool, 567

planning considerations, 614 RPC Server Is Unavailable error, 626

analyzing, 556-559

troubleshooting, 269-270

saving, 559

RPCs (Remote Procedure Calls)

unable to connect to domain errors, 560

replication and, 172

user does not exist errors, 560

site links and, 162 RSoP (Resultant Set of Policy) client does not exist errors, 561

Windows 2000, 538 Run dialog, running RSoP, 549-550

errors when applying GPOs, 561 Group Policy planning considerations, 634-635 troubleshooting security settings, 581-584

S s parameter (dcdiag utility), 224 SAM (Security Accounts Manager), 5

installed software, listing, 580

scheduling replication, 178

launching from account in Active Directory Users and Computers, 552

schema, 12-13

logging mode, 537, 548-549

applying to new domains, 66 attributes, 150-151

running from console, 552-553

creating, 186-187

running from GPMC, 554, 556

classes, 150-151, 155

running from Run dialog, 549-550

creating, 186-187

763

security groups

domains, forests, 155

domains, default security groups, 378

modification management, 141-151, 155, 620-621

Group Policy, 426 account policies, 339

objects, deactivating, 145, 149

audit policies, 488-489

replication and, 171

configuration, 339, 481-496

Schema Admins group, 13

Restricted Groups, 493-494

Schema Admins security group, 381

Security Options node, 491-493

schema master (FSMO role), 24, 611 transferring, 93

settings, troubleshooting, 581-585, 644

troubleshooting, 273, 627

user rights, 490-491

schema partition, 14

password selection, 52

Schema snap-in

restore mode password, 259 software restrictions, 482-487

attributes adding to a class, 147-148 creating, 145-147 installation, 142-144, 185-186

best practices, 487-488 trust relationships managing, 620 planning considerations, 616

scopes, 629 distribution and security groups, 303 nesting capabilities, 317 scripts Group Policy, 426 replmon, adding servers, 215 user and group accounts, creating, 316 sdcheck command, 240

user authentication, 317 smart cards, 318-334 user settings, configuring with Group Policy, 639 Security Configuration and Analysis plug-in, password policy configuration, 340-347 Security Configuration Wizard, 31 security groups

security administrator security groups, 383 backup permissions, 249 computer, configuring with Group Policy, 640 domain controller permissions, pre-Windows 2000 servers, 51

functional levels Windows 2000 mixed, 304-305 Windows 2000 native, 305-306 Windows Server 2003, 306 GPOs, applying, 451 hierarchy, planning, 619

How can we make this index more useful? Email us at [email protected]

764

security groups

OU delegation requirements, 378-384 overview, 302 planning, strategies, 629-630 scopes, 303 Security log (Event Viewer), 225 Security Options node, Group Policy and, 491-493 Security tab (Properties dialog box), modifying permissions, 398-400 security templates, 582 Security Templates snap-in configuring security password policy, 340-347 guided practice exercises, 347-348 seizing operations master roles, 94-95, 275-276 Server Operators security group, 381 servers bridgehead servers, 166 licensing server, site topology, 158 upgrading to domain controller, 45 Services test (dcdiag utility), 225 shortcut trust relationships, 617 shortcut trusts, 118-120 creating, 130-131 Show Attribute Meta-Data for Active Directory Object option (replmon utility), 220 Show Bridgehead Servers option (replmon utility), 220 Show Current Performance Data option (replmon utility), 219 Show Domain Controllers in Domain option (replmon utility), 219

Show Global Catalog Servers in Enterprise option (replmon utility), 220 Show Group Policy Object Status option (replmon utility), 219 Show Replication Topologies option (replmon utility), 219 Show Retired Replication Partners option (replmon utility), 218 Show Transitive Replication and Extended Data option (replmon utility), 218 Show Trust Relationships option (replmon utility), 220 showconn parameter (repadmin utility), 223 showmeta parameter (repadmin utility), 221 showreps parameter (repadmin utility), 222 shutdown, Group Policy scripts, 426 SIDs (security identifiers), 10, 89 signing certificates, obtaining, 326-328 simulation questions, xxvi-xxvii answering, xxix-xxx site link bridges, 156, 163 configuring, 164-165 site links cost, configuring, 181-182 RPCs and, 162 SMTP and, 162 site management, 115 site maps, OU planning and, 373 site topology, 155 bandwidth and, 156 bridgehead servers, 166 configuration, 169-170 domain controllers, 157

765

Software Installation and Maintenance

implementation, 115

smart card authentication strategies, 630-631

KCC and, 165-166

implementing, 319-334

licensing server, 158

planning, 318-319

physical environment and, 156

SMTP (Simple Mail Transfer Protocol)

physical links, 156

replication and, 172

replication, 156

site links and, 162, 617

ports used during, 170-171

snap-ins (MMC), default, 53

schedule configuration, 171-178

software

site boundaries, configuring, 159-161 site configuration, 157-159 site creation, 156-157 site link bridges, 156 site-based GPOs, 437

assigning, Software Installation and Maintenance, 464-465 deploying with Group Policy, 465-467, 473-474 distributing Group Policy, 637-639 installation options, 468-470

sites, 21

installed, listing, 580

boundaries configuring, 159-161 management considerations, 623 configuring, 157-159, 178-179, 190-191 creating, 156-157, 178-179, 190-191 global catalog servers, requirements, 610 intersite replication, 174 intrasite replication, 173 links, cost considerations, 622-623 planning considerations, creating and configuring site links, 617-618 site link bridges, 164 site links, 162-163 topology compared to domain topology, 22 skip parameter (dcdiag utility), 224

modifying transform files, 572-574 package properties, 471-472 publishing, Software Installation and Maintenance, 464-465 redeploying, 574-575 removing, 576 restriction policies best practices, 487-488 enabling, 482-487 updating, 570-572 Software Installation and Maintenance assigning software, 464-465 configuration and, 463 installation and, 463 publishing software, 464-465 software removal and, 464 upgrades and, 463

How can we make this index more useful? Email us at [email protected]

766

SPN (Service Principal Name) suffixes, routing

SPN (Service Principal Name) suffixes, routing, 134

Ntdsutil, 211 Performance console

startup scripts, Group Policy, 426

objects and counters, 230

Status Logging tab (replmon utility), 219

Performance Logs and Alerts, 234-237

storing domain controllers, 44

System Monitor, 231-234

study tips, xxii-xxiv

repadmin, 220

fixed-format exams, xxix

replsummary parameter, 223

learning styles, xxii

add parameter, 222

pretesting, xxiv

replicate parameter, 221

study strategies, xxii-xxiv

showconn parameter, 223

subnets, 155 sites

showmeta parameter, 221 showreps parameter, 222

assigning to, 159

sync parameter, 222-223

properties, 160

syncall parameter, 223

subobjectives of exam, xix-xx suffixes (UPN), adding/removing, 151-154 Support Tools

replmon, 212-218 options, 218-220 sdcheck, 240

FRSDiag, 240

sync parameter (repadmin utility), 222-223

ldifde, 239

syncall parameter (repadmin utility), 223

ADSI Edit, 238 dcdiag, 223-225

Synchronize Each Directory Partition with All Servers option (replmon utility), 219

dsacls, 239

System container, 377

dsadd, 239

System log (Event Viewer), 226

dsastat, 240

System Monitor, 231-234

dsmod, 239

system requirements, 614

dsrm, 240

Active Directory, 43-44

Event Viewer, 225-227

smart card user authentication, 318

customizing, 228-230

System State, backing up, 250-253

installing, 209-210

Systemlog test (dcdiag utility), 225

ldp, 239

SYSVOL folder, location, 49

movetree, 239 netdiag, 240

767

trust relationships

DNS errors, 279

T target audience of book, xi-xii

Group Policy, security settings, 581-585, 644

task-based administrative control, Group Policy, 458

operations master roles, 272, 627-628

templates, Administrative Templates, 504-511

domain naming master, 273 infrastructure master, 274

test lab implementation, importance of, 63

PDC emulator, 274

test parameter (dcdiag utility), 224

RID master, 273

test taking strategies, xxviii

schema master, 273 replication, 267-268, 626

testing forest trusts, 189-190

Access Denied errors, 272

Group Policy, 391

error 1265, 271-272

replication, dcdiag utility, 224

error 1311, 270-271

topologies, 155 multiple replication topologies, 173 implementation, 115 transferring operations master roles, 90, 92

RPC Server Is Unavailable error, 269-270 slow replication, 269 slow response to clients, 269 stopped replication, 268

transform files compared to patches, 574 modifying software packages, 572-574 transitive site links, 163 trees (domains), 16 child domains, creating, 60-63 multiple, 41

troubleshooting methodology, 267 trust relationships, 115, 118 authentication scope, 132-134, 140, 189 crossforest trusts, 118 removing, 137 Domain Admins group, 120 external trusts, 118, 121

troubleshooting Active Directory database issues, 628 installation/removal, 277-279 application deployment, Group Policy issues, 641-642 authoritative restores, 280-281

forest trusts, 119-121 adding/removing, 139-140 creating, 187-188 crossforest relationships, 131 interforest, 120-121 testing, 189-190

database corruption, 281 How can we make this index more useful? Email us at [email protected]

768

trust relationships

unique name suffix conflicts, 136

network clients, Group Policy and, 643

validation, 188-189

software, Group Policy and, 570-572, 642-643

management, 132, 134-137, 620 name suffix routing, 132-136 one-way, 118, 140 planning considerations, 616 realm trusts, 121 shortcut trusts, 118-120 creating, 130-131 two-way, 119, 140 validating, 132-133 trusted domains, 118 trusting domains, 118 two-way trust relationships, 119, 140 external trusts, 125

upgrading domain controllers, guided exercise practice, 79-81 Windows 2000 domains, 72 Windows 2000 forests, 72 UPNs (User Principal Names) authentication, forest trusts and, 121 explicit, 151 implicit, 151 suffixes adding/removing, 151-154, 621 LDAP, 9 routing, 134 user accounts

U

creating, 312 with csvde tool, 313-314

u parameter (dcdiag utility), 224

with dsadd tool, 315

uninstalling Active Directory, 63-65

with ldifde tool, 314-315

unique name suffixes, conflicts between, 136

with scripts, 316

universal distribution groups, Windows 2000 mixed functional level, 305 universal groups, 381 caching, 84, 85-86, 611 nesting strategies, 308-309 universal scope, 303, 629 UNIX, 31 DNS servers, system requirements, 44-45 Update Status option (replmon utility), 219 updating

upgrading servers to domain controllers and, 45 user authentication, 317 planning considerations password policies, 631 smart cards, 630-631 smart cards implementing, 319-334 planning, 318-319 user rights, Group Policy and, 490-491

769

Windows Server 2003, Support Tools

Windows 2000

users certificates

Gpresult command, 563

autoenrolling, 475-480 enrolling, 481 domains

Windows 2000 mixed (functional level), 73 security groups, 304-305 Windows 2000 native (functional level), 74

configuring account policy, 337-338 creating passwords, 335-337 Security Configuration and Analysis plug-in, 340-347 GPOs, exempting from, 453 Group Policy and, 445-453

security groups, 305-306 Windows Installer software, redeploying, 576 transform packages and, 572-574 Windows Server 2003, Support Tools ADSI Edit, 238

users container, 376

dcdiag, 223-225

Users security group, 381

dsacls, 239

USN (update sequence number), replication and, 172

dsadd, 239 dsastat, 240 dsmod, 239 dsrm, 240

V

Event Viewer, 225-230

validating trust relationships, 132-133 forest trusts, 188-189 verifying

FRSDiag, 240 installing, 209-210 ldifde, 239

Active Directory installation, 53-55

ldp, 239

backup options, 254

movetree, 239

VerifyReferences test (dcdiag utility), 225

netdiag, 240

viewing permissions with Security tab, 398-400

Ntdsutil, 211 Performance console, 230 Performance Logs and Alerts, 234-237 repadmin, 220-223

W

replmon, 212-220

“what if” scenarios, RSoP planning mode, 537

sdcheck, 240 System Monitor, 231-234

How can we make this index more useful? Email us at [email protected]

770

Windows Server 2003, Support Tools

Windows Server 2003 (functional level), 74-75 security groups, 306 Windows Server 2003 interim (functional level), 74 Windows Server 2003 Support Tools package, 624 wizards Installation Wizard, Media option, 57-60 New Trust Wizard, 122 WMI (Windows Management Instrumentation) filters, 455 administration of, delegating, 461

X-Y-Z X.500 protocol, 6-7 ZAP (Zero Administration Package) files deployment and, 467-468

MCSE titles from Exam Cram Prepare for the MCSE, MCSA, and other Microsoft Certifications with Exam Cram

Exam Cram has the resources you are looking for to prepare for your MCSE certification. These proven and popular Exam Cram series match the different learning needs of different certification candidates, providing expert authors, proven practice tools, and valuable learning and exam readiness feedback. Look to Exam Cram for

MCSE Titles ISBN

TITLE

0-7897-3617-9

MCSA/MCSE 70-290 Exam Cram

0-7897-3648-9

MCSA/MCSE 70-290 Exam Prep

0-7897-3618-7

MCSA/MCSE 70-291 Exam Cram

0-7897-3649-7

MCSA/MCSE 70-291 Exam Prep

0-7897-3619-5

MCSE 70-293 Exam Cram

0-7897-3650-0

MCSE 70-293 Exam Prep

0-7897-3620-9

MCSE 70-294 Exam Cram

0-7897-3651-9

MCSE 70-294 Exam Prep

0-7897-3360-9

MCSA/MCSE 70-270 Exam Cram

0-7897-3363-3

MCSA/MCSE 70-270 Exam Prep

QUICK Exam Crams provide strong foundational knowledge review, test-taking tips, exam practice, and readiness feedback. Exam Crams provide you with a succinct way to hone your knowledge for test day to ensure you maximize your score.

COMPREHENSIVE Exam Preps are the whole package. You get in-depth tutorial learning on the test topics, practice testing on both individual test sections as well as simulating the complete exam, test-taking strategies, and feedback on areas requiring further preparation.

Visit www.examcram.com for more information on these and other Exam Cram products.

MCSE Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Exam Cram 2 (Exam Cram 70-294)

MCSE Self-Paced Training Kit (Exam 70-294) Planning, Implementing, and Maintaining a Microsoft® Windows Server™ 2003 Active Directory® Infrastructure

MCSE 70-294 Exam Cram: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

MCSE 70-291 Exam Cram: Implementing, Managing, and Maintaining a Microsoft Windows Server 2003 Network Infrastructure

MCSA MCSE 70-294 Exam Cram: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure (2nd Edition) (Exam Cram)

MCSE Designing a Microsoft Windows Server 2003 Active Directory and Network Infrastructure Exam Cram 2

MCSE Self-Paced Training Kit Exam 70-297): Designing a Microsoft Windows Server 2003 Active Directory and Network Infrastructure: Exam 70-297); ... Active Directory and Network Infrastructure

MCSE Self-Paced Training Kit (Exam 70-291): Implementing, Managing, and Maintaining a Microsoft Windows Server 2003 Network Infrastructure: Implementing, ... Server(tm) 2003 Network Infrastructure

MCSE Self-Paced Training Kit (Exam 70-291): Implementing, Managing, and Maintaining a Microsoft Windows Server 2003 Network Infrastructure: Implementing, ... Server (tm) 2003 Network Infrastructure

MCSE Self-Paced Training Kit (Exam 70-297): Designing a Microsoft Windows Server 2003 Active Directory and Network Infrastructure: (Exam 70-297); Designing ... Active Directory and Network Infrastructure

MCSE Self-Paced Training Kit (Exam 70-293): Planning and Maintaining a Microsoft Windows Server 2003 Network Infrastructure: Planning and Maintaining a ... Network Infrastructure (Pro-Certification)

MCSE Self-Paced Training Kit (Exam 70-293): Planning and Maintaining a Microsoft Windows Server 2003 Network Infrastructure: Planning and Maintaining a ... Network Infrastructure (Pro-Certification

MCSE Self-Paced Training Kit (Exam 70-293): Planning and Maintaining a Microsoft Windows Server 2003 Network Infrastructure: Planning and Maintaining a ... Network Infrastructure (Pro-Certification)

MCSE Managing and Maintaining a Microsoft Windows® Server 2003 Environment Exam Cram™ 2 (Exam 70-290)

MCSE Self Paced Training (Exam 70-293): Planning and Maintaining a Microsoft Windows Server 2003 Network Infrastructure

MCSE Self-Paced Training Kit (Exam 70-293): Planning and Maintaining a Microsoft® Windows Server™ 2003 Network Infrastructure

MCSE (Exam 70-294) Windows Server 2003 Active Directory Planning Implementation

MCSE Self-Paced Training Kit (Exam 70-294): Planning, Implementing, and Maintaining a Microsoft(r) Windows Server(tm) 2003 Active Directory(r) Infrastruct

Mastering Active Directory for Windows Server 2003

MCSE Self-Paced Training Kit (Exam 70-294): Planning, Implementing, and Maintaining a Microsoft(r) Windows Server(tm) 2003 Active Directory(r) Infrastruct

MCSE 70-294 Exam Prep: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure (2nd Edition)

MCSE Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Exam Cram 2 (Exam Cram 70-294)

MCSE Self-Paced Training Kit (Exam 70-294) Planning, Implementing, and Maintaining a Microsoft® Windows Server™ 2003 Active Directory® Infrastructure

MCSE 70-294 Exam Cram: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

MCSE 70-291 Exam Cram: Implementing, Managing, and Maintaining a Microsoft Windows Server 2003 Network Infrastructure

MCSA MCSE 70-294 Exam Cram: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure (2nd Edition) (Exam Cram)

MCSE Designing a Microsoft Windows Server 2003 Active Directory and Network Infrastructure Exam Cram 2

MCSE Windows Server 2003 Active Directory Infrastruktur

MCSE 70-290 Exam Prep: Managing and Maintaining a Microsoft® Windows Server™ 2003 Environment

MCSE: Windows Server 2003 Active Directory Planning, Implementation, and Maintenance Study Guide (70294)

MCSE 70-291: Implementing, Managing, and Maintaining a Microsoft Windows Server 2003 Network Infrastructure

MCSE Designing a Windows Server 2003 Active Directory and Network Infrastructure: Exam 70-297 Study Guide

MCSE 70-293 Exam Cram: Planning and Maintaining a Windows Server 2003 Network Infrastructure

MCSE Self-Paced Training Kit Exam 70-297): Designing a Microsoft Windows Server 2003 Active Directory and Network Infrastructure: Exam 70-297); ... Active Directory and Network Infrastructure

MCSE Self-Paced Training Kit (Exam 70-291): Implementing, Managing, and Maintaining a Microsoft Windows Server 2003 Network Infrastructure: Implementing, ... Server(tm) 2003 Network Infrastructure

MCSE Self-Paced Training Kit (Exam 70-291): Implementing, Managing, and Maintaining a Microsoft Windows Server 2003 Network Infrastructure: Implementing, ... Server (tm) 2003 Network Infrastructure

MCSE Self-Paced Training Kit (Exam 70-297): Designing a Microsoft Windows Server 2003 Active Directory and Network Infrastructure: (Exam 70-297); Designing ... Active Directory and Network Infrastructure

MCSE Self-Paced Training Kit (Exam 70-293): Planning and Maintaining a Microsoft Windows Server 2003 Network Infrastructure: Planning and Maintaining a ... Network Infrastructure (Pro-Certification)

MCSE Self-Paced Training Kit (Exam 70-293): Planning and Maintaining a Microsoft Windows Server 2003 Network Infrastructure: Planning and Maintaining a ... Network Infrastructure (Pro-Certification

MCSE Self-Paced Training Kit (Exam 70-293): Planning and Maintaining a Microsoft Windows Server 2003 Network Infrastructure: Planning and Maintaining a ... Network Infrastructure (Pro-Certification)

MCSE Managing and Maintaining a Microsoft Windows® Server 2003 Environment Exam Cram™ 2 (Exam 70-290)

MCSE Self Paced Training (Exam 70-293): Planning and Maintaining a Microsoft Windows Server 2003 Network Infrastructure

MCSE Self-Paced Training Kit (Exam 70-293): Planning and Maintaining a Microsoft® Windows Server™ 2003 Network Infrastructure

MCSE (Exam 70-294) Windows Server 2003 Active Directory Planning Implementation

MCSE Windows Server 2003 Network Infrastructure (Exam 70-293)

MCSE Designing a Windows Server 2003 Active Directory and Network Infrastructure

MCSE Self-Paced Training Kit (Exam 70-294): Planning, Implementing, and Maintaining a Microsoft(r) Windows Server(tm) 2003 Active Directory(r) Infrastruct

Mastering Active Directory for Windows Server 2003

MCSE Self-Paced Training Kit (Exam 70-294): Planning, Implementing, and Maintaining a Microsoft(r) Windows Server(tm) 2003 Active Directory(r) Infrastruct

MCSE Self-Paced Training Kit (Exam 70-294): Planning, Implementing, and Maintaining a Microsoft(r) Windows Server(tm) 2003 Active Directory(r) Infrastruct

MCSE Self-Paced Training Kit (Exam 70-294): Planning, Implementing, and Maintaining a Microsoft(r) Windows Server(tm) 2003 Active Directory(r) Infrastruct

MCSE 70-294 Exam Prep: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure (2nd Edition)

MCSE Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure Exam Cram 2 (Exam Cram 70-294)

MCSE Self-Paced Training Kit (Exam 70-294) Planning, Implementing, and Maintaining a Microsoft® Windows Server™ 2003 Active Directory® Infrastructure

MCSE 70-294 Exam Cram: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure

MCSE 70-291 Exam Cram: Implementing, Managing, and Maintaining a Microsoft Windows Server 2003 Network Infrastructure

MCSA MCSE 70-294 Exam Cram: Planning, Implementing, and Maintaining a Microsoft Windows Server 2003 Active Directory Infrastructure (2nd Edition) (Exam Cram)

MCSE Designing a Microsoft Windows Server 2003 Active Directory and Network Infrastructure Exam Cram 2

MCSE Windows Server 2003 Active Directory Infrastruktur

MCSE 70-290 Exam Prep: Managing and Maintaining a Microsoft® Windows Server™ 2003 Environment

MCSE: Windows Server 2003 Active Directory Planning, Implementation, and Maintenance Study Guide (70294)

MCSE 70-291: Implementing, Managing, and Maintaining a Microsoft Windows Server 2003 Network Infrastructure

MCSE Designing a Windows Server 2003 Active Directory and Network Infrastructure: Exam 70-297 Study Guide

MCSE 70-293 Exam Cram: Planning and Maintaining a Windows Server 2003 Network Infrastructure

MCSE Self-Paced Training Kit Exam 70-297): Designing a Microsoft Windows Server 2003 Active Directory and Network Infrastructure: Exam 70-297); ... Active Directory and Network Infrastructure

MCSE Self-Paced Training Kit (Exam 70-291): Implementing, Managing, and Maintaining a Microsoft Windows Server 2003 Network Infrastructure: Implementing, ... Server(tm) 2003 Network Infrastructure

MCSE Self-Paced Training Kit (Exam 70-291): Implementing, Managing, and Maintaining a Microsoft Windows Server 2003 Network Infrastructure: Implementing, ... Server (tm) 2003 Network Infrastructure

MCSE Self-Paced Training Kit (Exam 70-297): Designing a Microsoft Windows Server 2003 Active Directory and Network Infrastructure: (Exam 70-297); Designing ... Active Directory and Network Infrastructure

MCSE Self-Paced Training Kit (Exam 70-293): Planning and Maintaining a Microsoft Windows Server 2003 Network Infrastructure: Planning and Maintaining a ... Network Infrastructure (Pro-Certification)

MCSE Self-Paced Training Kit (Exam 70-293): Planning and Maintaining a Microsoft Windows Server 2003 Network Infrastructure: Planning and Maintaining a ... Network Infrastructure (Pro-Certification

MCSE Self-Paced Training Kit (Exam 70-293): Planning and Maintaining a Microsoft Windows Server 2003 Network Infrastructure: Planning and Maintaining a ... Network Infrastructure (Pro-Certification)

MCSE Managing and Maintaining a Microsoft Windows® Server 2003 Environment Exam Cram™ 2 (Exam 70-290)

MCSE Self Paced Training (Exam 70-293): Planning and Maintaining a Microsoft Windows Server 2003 Network Infrastructure

MCSE Self-Paced Training Kit (Exam 70-293): Planning and Maintaining a Microsoft® Windows Server™ 2003 Network Infrastructure

MCSE (Exam 70-294) Windows Server 2003 Active Directory Planning Implementation

MCSE Windows Server 2003 Network Infrastructure (Exam 70-293)

MCSE Designing a Windows Server 2003 Active Directory and Network Infrastructure

MCSE Self-Paced Training Kit (Exam 70-294): Planning, Implementing, and Maintaining a Microsoft(r) Windows Server(tm) 2003 Active Directory(r) Infrastruct

Mastering Active Directory for Windows Server 2003

MCSE Self-Paced Training Kit (Exam 70-294): Planning, Implementing, and Maintaining a Microsoft(r) Windows Server(tm) 2003 Active Directory(r) Infrastruct

MCSE Self-Paced Training Kit (Exam 70-294): Planning, Implementing, and Maintaining a Microsoft(r) Windows Server(tm) 2003 Active Directory(r) Infrastruct

MCSE Self-Paced Training Kit (Exam 70-294): Planning, Implementing, and Maintaining a Microsoft(r) Windows Server(tm) 2003 Active Directory(r) Infrastruct

Recommend Documents