70-640 Notes
Chapter 1 Intro to Active Directory
No two objects can have the same distinguished name
cn=tom,ou=revere,dc=bigdeal,dc=com
Relative distinguished name is the most granular part of the distinguished name. 2 objects can have the same as long as their containers are different.
cn=revere,ou=ma,c=us
cn=revere,ou=nh,c=us
The UPN is a shortcut name for the user that can be the same
as a logon name or email address.
You cannot upgrade from Windeows NT directly to 2008
Canonical Name is the reverse order of a DN
bigdeal.com/marketing/toml
Flat namespace = bigdeal
hierarchical namespace = www.sales.bigdeal.com
The two types of namespaces are contiguous and disjointed. They are defined as
follows:
¦ Contiguous: The name of child objects in the hierarchy contains the name of
the parent object; for example, the relationship between domains within the
same tree.
¦ Disjointed: The name of a child object in the hierarchy does not contain the
name of the parent object; for example, the relationship between different
trees in the same forest.
The schema is a set of rules that define the classes of objects and their attributes
that can be created in Active Directory. It defines what attributes can be held by
objects of various types, which of the various classes can exist, and what object class
can be a parent of the current object class. For example, the User class can contain
user account objects and possess attributes such as password, group membership,
home folder, and so on.
The global catalog is a central information database that can hold data describing
objects throughout the Active Directory forest namespace. Active Directory builds
up the global catalog by replicating information between all domain controllers in
the forest.As well as providing a physical location that contains a subset of all information in
each domain’s Active Directory database, the global catalog is a service that permits
the resolution of many common queries that originate from anywhere in the
forest. It holds and organizes the common attributes used in search operations,
such as usernames and group names, filenames, and so on.Active Directory stores the global catalog on the first domain controller in a new forest.
Active Directory is divided into several partitions—not to be confused with disk
partitions—that allow the enterprise-level network to be scaled to enormous
proportions while remaining manageable. A schema partition and a configuration
partition are stored on all domain controllers within an Active Directory forest,
and application and domain partitions are common to domain controllers within a
domain. The roles of these partitions are as follows:
¦ Domain partition: This partition contains information about all objects such as
users, groups, computers, and OUs in a domain. It is replicated to all domain
controllers within the domain, and a subset of this information is replicated to
global catalog servers in the forest.
¦ Schema partition: This partition contains definitions of all objects and their
attributes. Rules for creating and working with them are also located here.
This partition is replicated to all domain controllers in the forest.
¦ Configuration partition: This partition contains information about the structure
of Active Directory in the forest, including domains, sites, and services. It
is also replicated to all domain controllers in the forest.
¦ Application partition: First introduced in Windows Server 2003, this partition
contains application-specific data that needs to be replicated throughout specified
portions of the forest. It can be replicated to a specific domain controller
or to any set of domain controllers anywhere in the forest. In this way, it differs
from the domain partition in which Active Directory replicates data to all
domain controllers in that domain. It also contains DNS information for
Active Directory–integrated DNS zones.
Each domain has its own ntds.dit file, which is stored on (and replicated among) all domain controllers by a process called
multimaster replication.
All domains in a tree are linked with two-way, transitive trust relationships; in
other words, accounts in any one domain can access resources in another domain
and vice versa.
Microsoft includes the concept of sites to group together resources
within a forest according to their physical location and/or subnet. A site is a set of
one or more IP subnets, which are connected by a high-speed, always available local
area network (LAN) link.A site can contain objects from more
than one tree or domain within a single forest, and individual trees and domains
can encompass more than one site. The use of sites enables you to control the
replication of data within the Active Directory database as well as to apply policies
to all users and computers or delegate administrative control to these objects
within a single physical location. In addition, sites enable users to be authenticated
by domain controllers in the same physical location rather than a distant location
as often as possible. You should configure a single site for all work locations connected
within a high-speed, always available LAN link and designate additional
sites for locations separated from each other by a slower wide area network
(WAN) link. Using sites permits you to configure Active Directory replication to take advantage
of the high-speed connection. It also enables users to connect to a domain controller
using a reliable, high-speed connection.
A domain controller stores a complete copy of
all objects contained within the domain, plus the schema and configuration information
relevant to the forest in which the domain is located. Unlike Windows NT,
there are no primary or backup domain controllers. Similar to Windows 2000 and
Windows Server 2003, all domain controllers hold a master, editable copy of the
Active Directory database.
The global catalog is a subset of domain information created for enabling domain
controllers in other domains in the same forest to locate resources in any domain.
By default, the first domain controller installed in a new domain becomes a global
catalog server.It provides info on objects within that forest, allows UPN logins and provided info on universal groups
Microsoft designed Active Directory in such a fashion that you can perform most
configuration activities from any domain controller. However, certain functions
within the directory are restricted to specific domain controllers, which are known
as flexible single-master operations (FSMO) servers, or simply as operations masters.
These functions include the following:
¦ Schema master: Holds the only writable copy of the Active Directory schema.
This is a configuration database that describes all available object and function
types in the Active Directory forest. Only one domain controller in the forest
holds this role.
¦ Domain naming master: Ensures that any newly created domains are uniquely
identified by names that adhere to the proper naming conventions for new
trees or child domains in existing trees. Only one domain controller in the forest
holds this role.
¦ PDC emulator: Serves as a primary domain controller (PDC) for Windows
NT 4.0 client computers authenticating to the domain and processes any
changes to user properties on these clients, such as password changes. This
server also acts as a time synchronization master to synchronize the time on
the remaining domain controllers in the domain. One domain controller in
each domain holds this role.
¦ Infrastructure master: Updates references in its domain from objects such as
domain group memberships, to objects in other domains. This server
processes any changes in objects in the forest received from global catalog
servers and replicates these changes to other domain controllers in its domain.
One domain controller in each domain holds this role.
¦ RID master: Assigns SIDs to objects created in its domain. A SID consists of a
domain identifier common to all objects in its domain and a relative identifier
(RID) that is unique to each object. This server ensures that no two objects
have the same RID and hands out pools of RIDs to every domain controller in
its domain. One domain controller in each domain holds this role.
Read-only domain controller: A read-only domain controller (RODC) is a domain
controller that contains a read-only copy of the directory database. It can perform
all client-based actions such as authenticating users and distributing
group policies to clients, but administrators cannot make changes to the database
directly from the RODC. It is particularly useful for branch office deployment
where security might not be as high as in the central office and no
administrative personnel are present for day-to-day operations.
Server Core: A Server Core is a stripped-down version ofWindows Server
2008 that does not contain any GUI, taskbar, or Start menu. After logging on,
you are presented with a command prompt window from which you perform
all administrative actions. A Server Core computer uses less hardware and
memory resources than a normal server but is able to perform most (but not
all) of the roles that a normal server performs. Furthermore, a Server Core
computer is more secure because it presents a smaller attack footprint than a
normal server.
R2 has several new features that were added specifically to work with Windows 7 client computers.
The following are some of the most significant new features:
¦ Active Directory Recycle Bin: Recovery of accidentally deleted objects in
Active Directory has always been a difficult procedure that has resulted in
significant domain controller downtime. In Windows Server 2008 R2, objects
deleted from AD DS or AD LDS are moved into a recycle bin that works in
much the same way as the desktop recycle bin. The deleted object even retains
its attributes. You can simply restore the accidentally deleted object from the
recycle bin, and all its attributes come with it. This is even true for a container
such as an OU; all objects contained within an accidentally deleted OU are
restored when you restore the OU from the recycle bin.
¦ Windows PowerShell 2.0: Included by default in Windows 7 and Windows
Server 2008 R2, this is a task-based command-line scripting interface that
enables you to perform a large number of remote management tasks.
PowerShell includes the Integrated Scripting Environment (ISE), which assists you in the task of writing,
testing, and executing scripts. You can also perform automated troubleshooting of remote computers.
Included also isan Active Directory module that provides cmdlets for administrative,
configuration, and diagnostic tasks.
¦ Active Directory Administrative Center (ADAC): This is a new task-based administrative
tool built on PowerShell 2.0 that centralizes a number of object
management tasks within a single graphical user interface (GUI). It harnesses
the functionality of Active Directory Users and Computers, Active Directory
Sites and Services, and Active Directory Domains and Trusts. You can administer
objects such as user, group, or computer accounts or OUs from within
multiple trusted domains including ones in remote locations. You can also
install ADAC on a Windows 7 computer as part of the Remote Server
Administration Tools (RSAT).
¦ Best Practices Analyzer (BPA): This is a new management tool that assists you
in implementation of best practices in configuring the AD DS environment.
You can use this tool to troubleshoot unexpected behavior in Active Directory
and obtain recommendations for improved configuration.
¦ Offline domain join: Enables administrators to pre-stage domain accounts in
AD DS so that these accounts can be imported into any type of automated
computer deployment process such as Sysprep. The newly deployed machines
are automatically joined to the domain when they first connect to the network.
¦ Active Directory health check: Microsoft has enhanced the functionality of the
replsum.exe command to provide additional information on outbound and
inbound replication and error diagnostics for failed replications.
¦ Active Directory Web Services: This feature provides a web service–based
interface to AD DS domains and AD LDS instances.
¦ Active Directory Management Pack: This feature assists you in monitoring
AD DS performance. You can discover and detect problems with computers
and software, as well as health state violations.
¦ Remote Desktop Services (RDS): This is an enhancement to Terminal
Services, which enables users on the local network or remotely via the Internet
to access desktop sessions based on virtual machines or applications in the data
center. Any client that supports Remote Desktop Protocol (RDP) can enable
user communication with virtual desktops hosted on the RDS server.
¦ HyperV: Available as a server role in Windows Server 2008 R2, this is a
hypervisor-based server virtualization technology. It enables you to consolidate
multiple servers on a single physical machine, thereby optimizing hardware
usage and reducing overall costs. The Live Migration feature enables you to move running virtual servers
from one physical machine to another without loss of user connections and consequent user downtime.
This facilitates host server management in cases where you need to reboot the host server; simply
move all virtual servers to a different physical machine. Virtual server hard
disks are configured as VHD files, which can be configured with the native
boot function for booting without a virtual machine or hypervisor. In
Windows Server 2008 R2, you can use dynamically expanding VHD files with optimized performance.
¦ DirectAccess: This is a new feature of Windows 7 and Windows Server 2008
R2 that enables users to directly connect to corporate networks from any
Internet connection. When enabled, a user is able to access network resources
as though he were actually at the office. DirectAccess uses IPv6 over IPSec to
create a seamless, bidirectional, secured tunnel between the user’s computer
and the office network without the need for a virtual private network (VPN)
connection. You can configure and monitor this feature from the DirectAccess
Management Console.
¦ BranchCache: This feature provides a local file-caching service that enables
users in branch office locations to cache files on a local computer, thereby
reducing access time for these files. You can configure this feature through
Group Policy. BranchCache uses a hashing mechanism to identify files that
have been cached on a localWindows 7 computer so that other users in the
same office can access the locally cached version of the file. Changes to the file
are saved to both the locally cached version and to the version on the remote
server.
¦ Windows Server Migration Tools: This is a new feature that assists you in migrating
server roles, features, operating system settings, and shares from one
server to another one.
¦ Managed Service Accounts: Assists administrators in isolating service accounts
and their passwords used by directory-enabled applications for authentication
purposes. This helps to protect applications from failing due to
authentication failure resulting from accidental lockout, disabling, or other
reasons.
Chapter 2 Installing and Configuing DNS for Active Directory
The following are the typical levels of the hierarchical DNS namespace:
¦ Root-level domains: This is the top of the DNS hierarchy. Specified by a period
or dot, it is not included in domain names. DNS servers at this level enable you
to access servers for the top-level domains.
¦ Top-level domains: This is a standard set of domains that have been assigned by
the Internet Society (ISOC). Expanded somewhat in recent years, it includes
the domains shown in Figure 2-1 plus several others. In addition, two-letter
ISO standard country name abbreviations are used as top-level domain names,
for example .ca for Canada and .au for Australia.
¦ Second-level domains: This represents additional groupings; for example,
Microsoft or UCLA. Second-level domains can be further subdivided. In fact,
you can have up to a limit of 127 levels.
¦ Hostnames: These are the individual names assigned to individual computers
within domains. The combination of a hostname, an organization’s domain
name, and the Internet top-level domain name creates a name (FQDN) that is
unique across the Internet. Hostnames used inside domains are added at the
beginning of the domain name and are also referred to by their FQDNs. For
example, a computer called search in the Microsoft domain has an FQDN of
Each DNS name server stores information about a discrete portion of the Internet
namespace. Such a portion is known as a zone and the DNS server that is primarily
responsible for each zone is considered to be authoritative for that zone. In other
words, the DNS server is the main source of information regarding the Internet
addresses contained within the zone. A zone can be considered a part of the big
database that is DNS and can contain information on one or more AD DS domains.
Zones are defined by who looks after maintaining the records that they contain.
In Windows Server 2008, DNS stores its zone data in one or more application
directory partitions, each of which is an AD DS partition that contains
application-specific data (in this case, DNS) that needs to be replicated throughout
specified portions of the forest. This replication takes place by a process called zone
transfers, which take place among all DNS servers in the forest.
search.Microsoft.com. The www is actually a hostname (or one of the names)
used by a particular computer.
Primary Zones
A primary zone is a master copy of zone data hosted on a DNS server that is the
primary source of information for records found in this zone. This server is considered
to be authoritative for this zone, and you can update zone data directly on
this server. It is also known as a master server. If the zone data is not integrated with
AD DS, the server holds this data in a local file named <zone_name.dns> that is
located in the %systemroot%\system32\DNS folder.
Secondary Zones
A secondary zone is an additional copy of DNS zone data hosted on a DNS server
that is a secondary source for this zone information. This server obtains the zone
information from the server hosting the corresponding primary zone. Using secondary
zones improves name resolution services on the network by providing redundancy
and load balancing. The server that hosts a secondary zone is frequently
Stub Zones
A stub zone contains source information about authoritative name servers for its
zone only. The DNS server hosting the stub zone obtains its information from
another server that hosts a primary or secondary copy of the same zone data. The
following are several purposes of stub zones:
¦ Maintain a current list of delegated zone information within a hierarchy of
DNS zones. A DNS server can host a parent zone at the primary or secondary
level together with stub zones for its child zones and thereby have a list of
authoritative DNS servers for the child zones.
¦ Enable improved name resolution by enabling a DNS server to rapidly locate
the stub zone’s list of name servers without the need for querying other servers
to locate the appropriate DNS server.
¦ Simplify the administration of DNS by enabling the distribution of the list of
authoritative DNS servers throughout a large enterprise network without the
need for hosting a large number of secondary zones.
An Active Directory–integrated zone stores its data in one or more application directory
partitions that are replicated along with other AD DS directory partitions.
This helps to ensure that zone data remains up-to-date on all domain controllers hosting DNS in the domain.
Using Active Directory–integrated zones also provides the following benefits:
¦ It promotes fault tolerance because data is always available and can always be
updated even if one of the servers fails. If a DNS server hosting a primary zone
outside of AD DS fails, it is not possible to update its data because no mechanism
exists for promoting a secondary DNS zone to primary.
¦ Each writable domain controller on which DNS is installed acts as a master
server and allows updates to the zones in which they are authoritative; no separate
DNS zone transfer topology is needed.
¦ Security is enhanced because you can configure dynamic updates to be secured;
by contrast, zone data not integrated with AD DS is stored in plain-text
files that unauthorized users could access, modify, or delete.
Either primary or stub zones can be integrated with AD DS. It is not possible to
create an Active Directory–integrated secondary zone.
called the secondary server.
An Active Directory–integrated zone stores its data in one or more application directory
partitions that are replicated along with other AD DS directory partitions.
This helps to ensure that zone data remains up-to-date on all domain controllers
hosting DNS in the domain. Using Active Directory–integrated zones also provides
the following benefits:
¦ It promotes fault tolerance because data is always available and can always be
updated even if one of the servers fails. If a DNS server hosting a primary zone
outside of AD DS fails, it is not possible to update its data because no mechanism
exists for promoting a secondary DNS zone to primary.
¦ Each writable domain controller on which DNS is installed acts as a master
server and allows updates to the zones in which they are authoritative; no separate
DNS zone transfer topology is needed.
¦ Security is enhanced because you can configure dynamic updates to be secured;
by contrast, zone data not integrated with AD DS is stored in plain-text
files that unauthorized users could access, modify, or delete.
Either primary or stub zones can be integrated with AD DS. It is not possible to
create an Active Directory–integrated secondary zone.
