yeahimkindofabigdeal: 70-640 Notes

70-640 Notes

Chapter 1 Intro to Active Directory

No two objects can have the same distinguished name

cn=tom,ou=revere,dc=bigdeal,dc=com

Relative distinguished name is the most granular part of the distinguished name. 2 objects can have the same as long as their containers are different.

cn=revere,ou=ma,c=us

cn=revere,ou=nh,c=us

The UPN is a shortcut name for the user that can be the same

as a logon name or email address.

You cannot upgrade from Windeows NT directly to 2008

Canonical Name is the reverse order of a DN

bigdeal.com/marketing/toml

Flat namespace = bigdeal

hierarchical namespace = www.sales.bigdeal.com

The two types of namespaces are contiguous and disjointed. They are defined as

follows:

¦ Contiguous: The name of child objects in the hierarchy contains the name of

the parent object; for example, the relationship between domains within the

same tree.

¦ Disjointed: The name of a child object in the hierarchy does not contain the

name of the parent object; for example, the relationship between different

trees in the same forest.

The schema is a set of rules that define the classes of objects and their attributes

that can be created in Active Directory. It defines what attributes can be held by

objects of various types, which of the various classes can exist, and what object class

can be a parent of the current object class. For example, the User class can contain

user account objects and possess attributes such as password, group membership,

home folder, and so on.

The global catalog is a central information database that can hold data describing

objects throughout the Active Directory forest namespace. Active Directory builds

up the global catalog by replicating information between all domain controllers in

the forest.As well as providing a physical location that contains a subset of all information in

each domain’s Active Directory database, the global catalog is a service that permits

the resolution of many common queries that originate from anywhere in the

forest. It holds and organizes the common attributes used in search operations,

such as usernames and group names, filenames, and so on.Active Directory stores the global catalog on the first domain controller in a new forest.

Active Directory is divided into several partitions—not to be confused with disk

partitions—that allow the enterprise-level network to be scaled to enormous

proportions while remaining manageable. A schema partition and a configuration

partition are stored on all domain controllers within an Active Directory forest,

and application and domain partitions are common to domain controllers within a

domain. The roles of these partitions are as follows:

¦ Domain partition: This partition contains information about all objects such as

users, groups, computers, and OUs in a domain. It is replicated to all domain

controllers within the domain, and a subset of this information is replicated to

global catalog servers in the forest.

¦ Schema partition: This partition contains definitions of all objects and their

attributes. Rules for creating and working with them are also located here.

This partition is replicated to all domain controllers in the forest.

¦ Configuration partition: This partition contains information about the structure

of Active Directory in the forest, including domains, sites, and services. It

is also replicated to all domain controllers in the forest.

¦ Application partition: First introduced in Windows Server 2003, this partition

contains application-specific data that needs to be replicated throughout specified

portions of the forest. It can be replicated to a specific domain controller

or to any set of domain controllers anywhere in the forest. In this way, it differs

from the domain partition in which Active Directory replicates data to all

domain controllers in that domain. It also contains DNS information for

Active Directory–integrated DNS zones.

Each domain has its own ntds.dit file, which is stored on (and replicated among) all domain controllers by a process called

multimaster replication.

All domains in a tree are linked with two-way, transitive trust relationships; in

other words, accounts in any one domain can access resources in another domain

and vice versa.

Microsoft includes the concept of sites to group together resources

within a forest according to their physical location and/or subnet. A site is a set of

one or more IP subnets, which are connected by a high-speed, always available local

area network (LAN) link.A site can contain objects from more

than one tree or domain within a single forest, and individual trees and domains

can encompass more than one site. The use of sites enables you to control the

replication of data within the Active Directory database as well as to apply policies

to all users and computers or delegate administrative control to these objects

within a single physical location. In addition, sites enable users to be authenticated

by domain controllers in the same physical location rather than a distant location

as often as possible. You should configure a single site for all work locations connected

within a high-speed, always available LAN link and designate additional

sites for locations separated from each other by a slower wide area network

(WAN) link. Using sites permits you to configure Active Directory replication to take advantage

of the high-speed connection. It also enables users to connect to a domain controller

using a reliable, high-speed connection.

A domain controller stores a complete copy of

all objects contained within the domain, plus the schema and configuration information

relevant to the forest in which the domain is located. Unlike Windows NT,

there are no primary or backup domain controllers. Similar to Windows 2000 and

Windows Server 2003, all domain controllers hold a master, editable copy of the

Active Directory database.

The global catalog is a subset of domain information created for enabling domain

controllers in other domains in the same forest to locate resources in any domain.

By default, the first domain controller installed in a new domain becomes a global

catalog server.It provides info on objects within that forest, allows UPN logins and provided info on universal groups

Microsoft designed Active Directory in such a fashion that you can perform most

configuration activities from any domain controller. However, certain functions

within the directory are restricted to specific domain controllers, which are known

as flexible single-master operations (FSMO) servers, or simply as operations masters.

These functions include the following:

¦ Schema master: Holds the only writable copy of the Active Directory schema.

This is a configuration database that describes all available object and function

types in the Active Directory forest. Only one domain controller in the forest

holds this role.

¦ Domain naming master: Ensures that any newly created domains are uniquely

identified by names that adhere to the proper naming conventions for new

trees or child domains in existing trees. Only one domain controller in the forest

holds this role.

¦ PDC emulator: Serves as a primary domain controller (PDC) for Windows

NT 4.0 client computers authenticating to the domain and processes any

changes to user properties on these clients, such as password changes. This

server also acts as a time synchronization master to synchronize the time on

the remaining domain controllers in the domain. One domain controller in

each domain holds this role.

¦ Infrastructure master: Updates references in its domain from objects such as

domain group memberships, to objects in other domains. This server

processes any changes in objects in the forest received from global catalog

servers and replicates these changes to other domain controllers in its domain.

One domain controller in each domain holds this role.

¦ RID master: Assigns SIDs to objects created in its domain. A SID consists of a

domain identifier common to all objects in its domain and a relative identifier

(RID) that is unique to each object. This server ensures that no two objects

have the same RID and hands out pools of RIDs to every domain controller in

its domain. One domain controller in each domain holds this role.

Read-only domain controller: A read-only domain controller (RODC) is a domain

controller that contains a read-only copy of the directory database. It can perform

all client-based actions such as authenticating users and distributing

group policies to clients, but administrators cannot make changes to the database

directly from the RODC. It is particularly useful for branch office deployment

where security might not be as high as in the central office and no

administrative personnel are present for day-to-day operations.

Server Core: A Server Core is a stripped-down version ofWindows Server

2008 that does not contain any GUI, taskbar, or Start menu. After logging on,

you are presented with a command prompt window from which you perform

all administrative actions. A Server Core computer uses less hardware and

memory resources than a normal server but is able to perform most (but not

all) of the roles that a normal server performs. Furthermore, a Server Core

computer is more secure because it presents a smaller attack footprint than a

normal server.

R2 has several new features that were added specifically to work with Windows 7 client computers.

The following are some of the most significant new features:

¦ Active Directory Recycle Bin: Recovery of accidentally deleted objects in

Active Directory has always been a difficult procedure that has resulted in

significant domain controller downtime. In Windows Server 2008 R2, objects

deleted from AD DS or AD LDS are moved into a recycle bin that works in

much the same way as the desktop recycle bin. The deleted object even retains

its attributes. You can simply restore the accidentally deleted object from the

recycle bin, and all its attributes come with it. This is even true for a container

such as an OU; all objects contained within an accidentally deleted OU are

restored when you restore the OU from the recycle bin.

¦ Windows PowerShell 2.0: Included by default in Windows 7 and Windows

Server 2008 R2, this is a task-based command-line scripting interface that

enables you to perform a large number of remote management tasks.

PowerShell includes the Integrated Scripting Environment (ISE), which assists you in the task of writing,

testing, and executing scripts. You can also perform automated troubleshooting of remote computers.

Included also isan Active Directory module that provides cmdlets for administrative,

configuration, and diagnostic tasks.

¦ Active Directory Administrative Center (ADAC): This is a new task-based administrative

tool built on PowerShell 2.0 that centralizes a number of object

management tasks within a single graphical user interface (GUI). It harnesses

the functionality of Active Directory Users and Computers, Active Directory

Sites and Services, and Active Directory Domains and Trusts. You can administer

objects such as user, group, or computer accounts or OUs from within

multiple trusted domains including ones in remote locations. You can also

install ADAC on a Windows 7 computer as part of the Remote Server

Administration Tools (RSAT).

¦ Best Practices Analyzer (BPA): This is a new management tool that assists you

in implementation of best practices in configuring the AD DS environment.

You can use this tool to troubleshoot unexpected behavior in Active Directory

and obtain recommendations for improved configuration.

¦ Offline domain join: Enables administrators to pre-stage domain accounts in

AD DS so that these accounts can be imported into any type of automated

computer deployment process such as Sysprep. The newly deployed machines

are automatically joined to the domain when they first connect to the network.

¦ Active Directory health check: Microsoft has enhanced the functionality of the

replsum.exe command to provide additional information on outbound and

inbound replication and error diagnostics for failed replications.

¦ Active Directory Web Services: This feature provides a web service–based

interface to AD DS domains and AD LDS instances.

¦ Active Directory Management Pack: This feature assists you in monitoring

AD DS performance. You can discover and detect problems with computers

and software, as well as health state violations.

¦ Remote Desktop Services (RDS): This is an enhancement to Terminal

Services, which enables users on the local network or remotely via the Internet

to access desktop sessions based on virtual machines or applications in the data

center. Any client that supports Remote Desktop Protocol (RDP) can enable

user communication with virtual desktops hosted on the RDS server.

¦ HyperV: Available as a server role in Windows Server 2008 R2, this is a

hypervisor-based server virtualization technology. It enables you to consolidate

multiple servers on a single physical machine, thereby optimizing hardware

usage and reducing overall costs. The Live Migration feature enables you to move running virtual servers

from one physical machine to another without loss of user connections and consequent user downtime.

This facilitates host server management in cases where you need to reboot the host server; simply

move all virtual servers to a different physical machine. Virtual server hard

disks are configured as VHD files, which can be configured with the native

boot function for booting without a virtual machine or hypervisor. In

Windows Server 2008 R2, you can use dynamically expanding VHD files with optimized performance.

¦ DirectAccess: This is a new feature of Windows 7 and Windows Server 2008

R2 that enables users to directly connect to corporate networks from any

Internet connection. When enabled, a user is able to access network resources

as though he were actually at the office. DirectAccess uses IPv6 over IPSec to

create a seamless, bidirectional, secured tunnel between the user’s computer

and the office network without the need for a virtual private network (VPN)

connection. You can configure and monitor this feature from the DirectAccess

Management Console.

¦ BranchCache: This feature provides a local file-caching service that enables

users in branch office locations to cache files on a local computer, thereby

reducing access time for these files. You can configure this feature through

Group Policy. BranchCache uses a hashing mechanism to identify files that

have been cached on a localWindows 7 computer so that other users in the

same office can access the locally cached version of the file. Changes to the file

are saved to both the locally cached version and to the version on the remote

server.

¦ Windows Server Migration Tools: This is a new feature that assists you in migrating

server roles, features, operating system settings, and shares from one

server to another one.

¦ Managed Service Accounts: Assists administrators in isolating service accounts

and their passwords used by directory-enabled applications for authentication

purposes. This helps to protect applications from failing due to

authentication failure resulting from accidental lockout, disabling, or other

reasons.

Chapter 2 Installing and Configuing DNS for Active Directory

The following are the typical levels of the hierarchical DNS namespace:

¦ Root-level domains: This is the top of the DNS hierarchy. Specified by a period

or dot, it is not included in domain names. DNS servers at this level enable you

to access servers for the top-level domains.

¦ Top-level domains: This is a standard set of domains that have been assigned by

the Internet Society (ISOC). Expanded somewhat in recent years, it includes

the domains shown in Figure 2-1 plus several others. In addition, two-letter

ISO standard country name abbreviations are used as top-level domain names,

for example .ca for Canada and .au for Australia.

¦ Second-level domains: This represents additional groupings; for example,

Microsoft or UCLA. Second-level domains can be further subdivided. In fact,

you can have up to a limit of 127 levels.

¦ Hostnames: These are the individual names assigned to individual computers

within domains. The combination of a hostname, an organization’s domain

name, and the Internet top-level domain name creates a name (FQDN) that is

unique across the Internet. Hostnames used inside domains are added at the

beginning of the domain name and are also referred to by their FQDNs. For

example, a computer called search in the Microsoft domain has an FQDN of

Each DNS name server stores information about a discrete portion of the Internet

namespace. Such a portion is known as a zone and the DNS server that is primarily

responsible for each zone is considered to be authoritative for that zone. In other

words, the DNS server is the main source of information regarding the Internet

addresses contained within the zone. A zone can be considered a part of the big

database that is DNS and can contain information on one or more AD DS domains.

Zones are defined by who looks after maintaining the records that they contain.

In Windows Server 2008, DNS stores its zone data in one or more application

directory partitions, each of which is an AD DS partition that contains

application-specific data (in this case, DNS) that needs to be replicated throughout

specified portions of the forest. This replication takes place by a process called zone

transfers, which take place among all DNS servers in the forest.

search.Microsoft.com. The www is actually a hostname (or one of the names)

used by a particular computer.

Primary Zones

A primary zone is a master copy of zone data hosted on a DNS server that is the

primary source of information for records found in this zone. This server is considered

to be authoritative for this zone, and you can update zone data directly on

this server. It is also known as a master server. If the zone data is not integrated with

AD DS, the server holds this data in a local file named <zone_name.dns> that is

located in the %systemroot%\system32\DNS folder.

Secondary Zones

A secondary zone is an additional copy of DNS zone data hosted on a DNS server

that is a secondary source for this zone information. This server obtains the zone

information from the server hosting the corresponding primary zone. Using secondary

zones improves name resolution services on the network by providing redundancy

and load balancing. The server that hosts a secondary zone is frequently

Stub Zones

A stub zone contains source information about authoritative name servers for its

zone only. The DNS server hosting the stub zone obtains its information from

another server that hosts a primary or secondary copy of the same zone data. The

following are several purposes of stub zones:

¦ Maintain a current list of delegated zone information within a hierarchy of

DNS zones. A DNS server can host a parent zone at the primary or secondary

level together with stub zones for its child zones and thereby have a list of

authoritative DNS servers for the child zones.

¦ Enable improved name resolution by enabling a DNS server to rapidly locate

the stub zone’s list of name servers without the need for querying other servers

to locate the appropriate DNS server.

¦ Simplify the administration of DNS by enabling the distribution of the list of

authoritative DNS servers throughout a large enterprise network without the

need for hosting a large number of secondary zones.

An Active Directory–integrated zone stores its data in one or more application directory

partitions that are replicated along with other AD DS directory partitions.

This helps to ensure that zone data remains up-to-date on all domain controllers hosting DNS in the domain.

Using Active Directory–integrated zones also provides the following benefits:

¦ It promotes fault tolerance because data is always available and can always be

updated even if one of the servers fails. If a DNS server hosting a primary zone

outside of AD DS fails, it is not possible to update its data because no mechanism

exists for promoting a secondary DNS zone to primary.

¦ Each writable domain controller on which DNS is installed acts as a master

server and allows updates to the zones in which they are authoritative; no separate

DNS zone transfer topology is needed.

¦ Security is enhanced because you can configure dynamic updates to be secured;

by contrast, zone data not integrated with AD DS is stored in plain-text

files that unauthorized users could access, modify, or delete.

Either primary or stub zones can be integrated with AD DS. It is not possible to

create an Active Directory–integrated secondary zone.

called the secondary server.

An Active Directory–integrated zone stores its data in one or more application directory

partitions that are replicated along with other AD DS directory partitions.

This helps to ensure that zone data remains up-to-date on all domain controllers

hosting DNS in the domain. Using Active Directory–integrated zones also provides

the following benefits: