1	Accelerated MCSE in a Week Win2000 Herb Martin LearnQuick.Com http://LearnQuick.Com
2	Exams Exam 70-210 Windows 2000 Professional Exam 70-215 Windows 2000 Server Exam 70-216 Network Administration Exam 70-217 Active Directory Administration Exam 70-219 Active Directory Design Exam 70-220 Windows 2000 Security Design Exam 70-221 Windows 2000 Network Design
3	Accelerated MCSE Win2000 70-217 Active Directory Administration 70-219 Active Directory Design Herb Martin LearnQuick.Com http://LearnQuick.Com
4	Registering for the exam SYLVAN PROMETRIC 1-800-755-EXAM or 1-800-755-3926 http://www.2Test.Com to register online VUE 1-800-837-8734 or 1 800 TEST REG http://www.vue.com/testing/index.html Microsoft MCP site http://www.Microsoft.Com/MCP
5	Windows 2000 Active Directory Administration Microsoft Certified Professional Exam 70-217 Implementing & Administering a Microsoft® Windows® 2000 Directory Services Infrastructure 110 minutes, 45 questions, passing 665/1000
6	Win2000 Active Directory Design Microsoft Certified Professional Exam 70-219 Designing a Microsoft® Windows® 2000 Directory Services Infrastructure 240 minutes, 4 testlets/40 questions, passing 613/1000
7	Exam focus and context Supported users range from 200-26,000+ Physical locations range from 5-150+
8	Typical network services and applications include File and print Database and Messaging Proxy server or firewall Dial-in server Desktop management Web hosting
9	Connecting Individual offices to the corporate network Users at remote locations to the corporate network Corporate networks to the Internet
10	70-217 Measures your ability to configure and troubleshoot Windows 2000 Active Directory components DNS for Active Directory Active Directory security solutions Manage and optimize the desktop environment using Group Policy Configure and Troubleshoot Active Directory DNS for Active Directory Change and Configuration Management Manage and Optimize Active Directory Components Active Directory Security
11	70-219 Design a directory service architecture Meeting Business and Technical Requirements Unified directory services such as Active Directory and Windows NT domains Connectivity between and within systems, system components, and applications Data replication such as directory replication and database replication
12	Exam 70-217 Topics Configure Active Directory DNS for Active Directory Change and Configuration Management Manage Active Directory Components Active Directory Security
13	Exam 70-219 Topics Analyzing Business Requirements Analyzing Technical Requirements Designing a Directory Service Architecture Designing Service Locations
14	1 Configure Active Directory
15	What is Active Directory An accounts database—and more Hierarchical directory of domain information Contains: Users, Groups, Organizational Units, Computers …and other objects Extensible store
16	Domain Purpose is to authenticate and share resources Single accounts database (Active Directory) All machines and users have an account Access to Domain resources requires domain authentication
17	Multi-Master Any DC can accept changes All DCs replicate changes to the others No one DC is “in charge” No PDC or BDCs, just DCs
18	WinNT Domain Problem Had no structure The (Domain) Administrator had authority over everything Users needing authority over a subset, needed to be Admins No delegation
19	WinNT Domain Solution Create MORE domains Use explicit trusts for cross-domain access
20	OU—Organizational Unit Structural Component of a Domain Can be nested Can be used to delegate authority and control Group Policy can be linked to OUs
21	Microsoft Drawing Conventions Domains are TRIANGLES Domains are SECURITY boundaries OU’s are CIRCLES Are merely administrative convenience containers
22	Perhaps a Poor OU Example
23	OU Planning Users will NOT navigate the OU hierarchy Do NOT automatically think ‘business units’ Think primarily about administration Child OU’s can override earlier Group Policies …but earlier Group Policies can be marked no override
24	Requirements for Active Directory REQUIRES: NTFS drive REQUIRES: Dynamic DNS configured on network REQUIRES: TCP/IP on DCs (and on Active Directory clients)
25	Choosing the Root Domain Name DNS name Public or Private Name Child of a Public (registered domain)
26	Examples: Registered Internet name: LearnQuick.Com Child of Registered name: Corp.LearnQuick.Com Completely private name: LearnQuick.local
27	Caution: Root Forest Domain Name FIRST (root) domain name cannot be changed!!! Name is PERMANENT Can never be changed Serious issue if you sell the DNS name
28	Registered name Easy to understand One name for internal and external use Security issue though May be difficult for internal users to connect to external corporate resources
29	Child of Registered name Simple to understand austin.LearnQuick.Com privately—LearnQuick.Com publicly
30	Private Internal Name May be difficult for internal users to understand More complex Proxy configuration Duplication efforts in managing resources Example: LearnQuick.local
31	Installing Active Directory Run DCPromo to create a Domain Controller (DC) …from command line or from Configure Your Server Machine becomes a DC (domain controller) (Run DCPromo again to REMOVE Active Directory)
32	Choosing Domain “NetBIOS” name Default is left most DNS tag LearnQuick.Com == LearnQuick You can ALTER the default Important if: Name exceeds 15 characters OR Domains have that part in common south.Europe.MyCompany.Com south.Africa.MyCompany.Com
33	DCPromo converts machine to a NEW DC 1^st DC creates new Domain, new Tree, or new Forest Tree is domain hierarchy sharing a common DNS hierarchy Forest is a grouping of Trees with NON-contiguous DNS names
34	Install Active Directory \\toro\examsw2k\cs\AD\DCPromoWizDCTypeFC.gif
35	Choose DC Role First in Forest (creates new domain, tree, & forest) First in Tree (creates new domain & tree) First in Domain (creates new domain) Or additional DC in existing domain
36	Single Domain, Tree, and Forest \\toro\examsw2k\cm\visiodrw\ForestTree.vsd
37	Domains within a Single Tree and Forest
38	Types of Trusts Domain trusts (2-way, automatic, transitive) External trusts (1-way, manual, non-transitive) Short-Cut trusts (2-way, manual, transitive)
39	Trusts Trusts provide access to resources located in the trusting domain Trus’ting à TrusTEd Resources (tings) à Users (Ted & Ed) In WinNT all trusts were explicit, one way, non-transitive This is still available in Win2000 Win2000 provides automatic, 2-way, transitive trusts within a forest
40	Automatic Transitive Trusts Parent and Child trust each other automatically Original Forest-Root domain has a 2-way trust with other Tree-Root domains (within the forest) Automatic trusts are transitive throughout a Forest
41	Trusts within a Forest Automatic trusts are transitive throughout forest If AàBàC then effectively AàC ChildßTRUSTSàParent…ßTRUSTSàRoot [ ßTRUSTSà1^st Root ] ßTRUSTSàOther RootßTRUSTSàChild… Effectively, ALL domains within the forest trust each other
42	Domain Trees within a Forest
43	Shortcut trusts
44	Why do you create additional domains? Full Control by other administrators Decentralized network administration Mirror existing WinNT domain structure Massive numbers of objects Replication efficiency—usually NOT a problem though BEST REASON: Different SecurityàAccount Policies Password, Lockout, Kerberos policies Only Security Account Policies are DOMAIN Specific!
45	Why do you create additional Trees? Because the DNS domain names are NOT contiguous Example: LearnQuick.Com and MCSE2000Help.Com
46	How many domains? Need 3 locations to manage DIFFERENT password policies All domains will use the same DNS base name (same starting point) Required: 1 Domain for each such policy Perhaps, need all three to be children of root domain Answer: 4 domains (or maybe 3), 1 Forest, 1 Tree
47	How many Trees? Company was merged from 3 companies Each company has its own DNS name hierarchy There are three different DNS names Answer: 3 Trees within 1 Forest How many domains? At least 3 (1 for each tree root)
48	How many Forests? Separate Forests provide complete autonomy …or different Schemas Two companies want to work together Joint venture Neither wants to be subordinate to the other Answer: 3 Forests (1 for each company, 1 for the join venture) How many trees and domains? (At least 3D, 3T)
49	Case of “marketing” DNS names You own additional DNS names for marketing You do not want or need corresponding Win2000 Domains …then you do NOT need extra trees Use Trees when DNS names are non-contiguous …AND names need to be Win2000 domains TOO
50	How many Trees? Example 2 Company uses LearnQuick.Com for internal DNS Company owns 32 DNS names for external use Answer: 1 Tree (Those marketing DNS names will NOT be Win2000 domain trees)
51	Active Directory Files Database and Logs May require 1GB to install NTDS (NT Directory Services)
52	Location of NTDS Database and Logs \\toro\examsw2k\cs\AD\ADDatabaseandLogLocationsFC.gif
53	SysVol (Plays the role that NetLogon played in WinNT) Contains Scripts and Policy Files that are not directly in Active Directory Replicated to ALL DCs within the domain
54	Location of SYSVOL \\toro\examsw2k\cs\AD\ADSharedSysVolFC.gif
55	CAUTION: Local Administrator Password!!! \\toro\examsw2k\cs\AD\ADRestoreModeAdminPwordFC.gif
56	Sites A site is a collection of well-connected subnets Declares that machines on those nets are LOCAL to each other Replication works differently within a site Machines try to authenticate WITHIN their site Machines try to use servers WITHIN their site
57	Site Bandwidth Local Ethernets are usually a single site No hard rule Probably multiple sites if less than 512Kbps connection Might include ‘client only’ physical locations in central site If there are no DCs or Servers, this is most probably correct
58	KCC Knowledge Consistency Checker Automatically creates the replication topology
59	Active Directory Sites and Services Create sites Create subnets Create site links Create site link bridges Create connection objects Create GC (global catalog) servers
60	Configure and manage replication Configure site link replication schedule (availability) Configure site link cost Configure site link replication frequency AD Bridges all site links by default KCC adds connections
61	Active Directory Sites and Services MMC \\toro\examsw2k\cs\AD\ADSitesServicesConsoleFC.gif
62	Creating (Active Directory) Subnets Not really ‘creating’ subnets Just adding the subnets to the AD Sites configuration Once created, subnets will be used to describe sites
63	Create sites \\toro\examsw2k\cs\AD\ADSitesServicesConsoleNewSiteFC.gif
64	Site Links Manually created (just add subnets) Used to determine INTERSITE replication paths KCC uses site links to generate replication connections
65	Configure Site Link Schedule (available time windows) Frequency (how often) Cost (lower is preferred link)
66	Create site links \\toro\examsw2k\cs\AD\ADSiteServicesSiteLinkFC.gif
67	Site Links join Sites
68	Create Site Link Bridge(s) Bridging GROUPS Site Links Should be called “Site Link Group” KCC automatically bridges all Site Links Seldom need to create Site Link Bridges If you enable MANUAL bridging, you MUST create and manage Don’t do it (unless you must)
69	Default : Bridge ALL Site Links
70	Site Link Bridges with 2 “Nets”
71	Create connection objects Automatically created by KCC (usually) Can be manually created Can be manually configured Can ONLY set schedule (not frequency or cost) Create only if REQUIRED and it must PERSIST (until deleted)
72	Replication
73	GC (Global Catalog) Server Important in MULTI-domain forest First DC becomes a GC server by default YOU must configure others if needed Right-click on ServerName/NTDS Settingsà Check Global Catalog box
74	Create GC (global catalog) servers \\toro\examsw2k\cs\AD\ADSiteServicesRightClickNTDSGlobalCatFC.gif
75	Global Catalog Server Forest wide information Contains PART of the information for every object of the forest Eliminates the replication of ALL data between different domains Serves as a sort of “forest-wide cache” Need AT LEAST one per site if more than one domain, especially in NATIVE mode Need two (from any domain) for redundancy
76	Move server between AD sites \\toro\examsw2k\cs\AD\ADSiteServicesSiteMoveFC.gif
77	Just right-click—Move—Select site! \\toro\examsw2k\cs\AD\ADSiteServicesSiteMove2FC.gif
78	Operations Masters (Formerly known as FSMO) Schema Master 1 per Forest Domain Naming Master 1 per Forest PDC Emulator 1 per Domain RID Master 1 per Domain Infrastructure Master 1 per Domain
79	Schema Master–1 per Forest Holds the master copy of the Schema There is ONE shared schema for ENTIRE forest Only place to edit Schema If down has little effect until Schema changes are needed Users won’t notice if down
80	Domain Naming Master– 1 per Forest Add new domains to forest Removes domains from forest If down has little effect unless adding/removing domains Users won’t notice if down
81	PDC Emulator– 1 per Domain Acts as PDC for WinNT BDCs Time master Domain Master Browser (NetBIOS) Password changes propagate here first Failed passwords are tried here before refusing logon If down, BDCs will not receive changes …users may be inconvenienced if down …fault tolerant password checking not available
82	RID Master–1 per Domain Each DC must give out UNIQUE IDs RID master assigns blocks of Relative IDs to each DC If down, no effect until a DC creates enough objects to exhaust supply
83	Infrastructure Master – 1 per Domain Maintains reference to Group members from other domains Especially members of Universal groups in native mode Temporary loss is not usually visible …unless recently moved a large number of accounts Keeps references to objects it ‘does not hold’ Should NOT hold the GC If it held the GC, it would hold all objects
84	Transfer operations master roles Use NTDSUtil or GUI tools to transfer operations master roles First connect to the DC that will assume role (NTDSUtil can seize roles but don’t do it – unless you MUST!)
85	Three domain specific roles use: Active Directory Users and Computers PDC Emulator, Infrastructure Master, RID Master Right-click—Operations Masters
86	Forest Wide Roles Transfer Schema role in Active Directory Schema Transfer Domain Naming Master in Active Directory Domains and Trusts
87	Operations Master Example Domain Naming Master is broken What should I do? When? Answer: Seize role, before adding or removing a domain
88	How Many PDC Emulators? You have 4 domains Answer: 4 PDC emulators 1 PDC Emulator per domain
89	How Many Schema Masters? You have one forest root domain Answer: 1 Schema master One per Forest The schema is COMMON to the entire forest
90	How many GCs per Site? You have three domains in a site At least ONE; domain does NOT matter 2 for fault tolerance You have 4 sites, how many GCs? At least 4 (1 per site)
91	What kind of Trust between trees? Same forest Answer: Automatic, Two-Way, Transitive
92	What path does Kerberos Authentication take? From user domain to parent to root… to root to child to resource domain
93	Business Criteria versus Design Elements? Multiple locations Names Changes Business Reorganizations Selling Internet names Security Account Policies Political Issues
94	Location of Master Roles Usually together Move RID and PDC emulator if heavily loaded Infrastructure master should NOT hold the GC
95	Forest wide role placement Domain Naming and Schema Master on same server Must always hold GC (Domain Naming Master requires this) Remember you can have additional GCs
96	FYI: Verify Active Directory installation Network connectivity? Ping, IPConfig, NLTest, NetDiag, NetMon Name resolution working? Ping, NSLookup, NBTStat, DNSCmd DC working? DCDiag, DSAStat, NTDSUtil Authentication working? Event Viewer Access control ok? Event Viewer, DSACLS, NetDom, ClonePrincipal, SDCheck
97	FYI: NLTest Check that the (DC) locator and secure channel are functioning
98	FYI: NetDiag Designed for comprehensive network testing without user intervention Have users run and send in the output TIP: Capture output, then search for FAIL or WARN
99	FYI: DSAStat Compare Directory services information Objects and sizes Detect differences
100	FYI: DCDiag Checks status of domain controllers (across the Enterprise)
101	FYI: DSACLS View or modify the access control lists of directory objects
102	FYI: NetDom time, query, move, /help Batch management of trusts, joining computers to domains Verifying trusts and secure channels
103	FYI: SDCheck Check ACL propagation and replication for specified objects in the directory
104	FYI: DNSCmd Check dynamic registration of DNS including Secure DNS update, as well as deregistration of resource records
105	OU Architecture
106	LostAndFound Container If an OU has been deleted but… Objects were added (at another DC) These objects are now ‘orphaned’ They can be found in the domain LostAndFoundContainer
107	Reasons for Creating an OU Delegate Administration Hide Objects Associate Group Policy OUs are really about making administration easier
108	Reasons to Defer OU Creation Centralized Administration Model (all in one OU) Users change business groups frequently (not as bad as domains) Not just because it matches the business model OUs don’t receive permissions (security Groups) Users don’t usually even see an OU
109	Backing up Active Directory With domain controller online Along with other system and data files Using batch file commands Use any removable media, network drive, or file
110	Backup System State Data \\toro\examsw2k\cs\AD\ADBackUpWizFC.gif
111	Active Directory Backup Requirements ONLY Normal Backup (not incremental or differential) Must be LOCAL (not network) Must Backup “System State Data” Performed by Backup Operator or an Administrator
112	Backup Processing \\toro\examsw2k\cs\AD\ADBackUpWizInProcessFC.gif
113	System State Includes System startup files Registry COM+ class registration database Certificate Services database (if installed) DNS service (if DNS installed) Cluster service (if Clustering installed) Active Directory (if a DC) File Replication service (AND SYSVOL if a DC)
114	Restore from Backup \\toro\examsw2k\cs\AD\\ADRestoreBackUpWizNOTF8.gif
115	Backup Media and Location \\toro\examsw2k\cs\AD\ADBackUpWizFileNameFC.gif
116	Windows 2000 Advanced Options Menu (F8) Please select an option: Safe Mode Safe Mode with Networking Safe Mode With Command Prompt Enable Boot Logging Enable VGA Mode Last Known Good Configuration Directory Services Restore Mode ßßß Debugging Mode Boot Normally
117	Directory Services Restore Mode Boot Choices press F8 Choose: Directory Services Restore Mode Must be Local Administrator NOT Active Directory Domain Administrator Active Directory is offline Age of restored data must be less than tombstone lifetime (60 days default)
118	Active Directory Defragmentation Automatic, online Online Defragmentation: Arranges and frees space WITHIN the DB Does NOT reduce database file size Removing a GC does not reduce database size
119	Offline defragmentation (Compacting the database) Reduces database size Most useful for significant decrease in size E.G, a global catalog server becomes a normal domain controller
120	Compacting the Database (Offline defragmentation) Must use “Directory Services Restore” Mode Use NTDSUtil “compact to” on database Archive original Use NTDSUtil to move database back
121	Active Directory File names Ntds.dit Active Directory database file Edb.chk Checkpoint file Edb*.log Transaction logs—10 MB each Res1.log & Res2.log Reserved transaction logs Located by default in %WinDir%\NTDS
122	Active Directory File Placement SysVol requires NTFS Best to place Logs and Database on separate physical drives DB best on array (read performance) Log on spare single disk (write performance)
123	Non-Authoritative Restore of Active Directory Boot in Active Directory Restore mode (F8) Requires LOCAL Administrator (remember that password—from DCPromo!) Restore the system state data Then Active Directory is updated through normal replication
124	Authoritative Restore of Active Directory Starts with NON-Authoritative restore Reboot BACK to Active Directory Restore mode Then mark all or a portion as authoritative That portion takes precedence over other DCs
125	What can be recovered? Single objects, OU trees, or the whole directory (Must first do non-Authoritative restore) Must perform authoritative restore before bringing Active Directory online
126	NTDSUtil Restore Authoritative “Portion” NTDSUtil authoritative restore restore Subtree OU=Marketing,DC=LearnQuick,DC=COM
127	NTDSUtil Restore Fully Authoritative NTDSUtil authoritative restore restore database
128	Insuring Integrity of Group Policy Restore to two locations Perform Authoritative Restore Reboot normally Publish SYSVOL Copy extra SYSVOL over active SYSVOL
129	Recover from a system failure Re-Install Win2000 Server Promote to DC Replicate Active Directory and SYSVOL normally …or Restore from Backup media Possible to restore to different hardware (video, net, disk)
130	NTDSUtil features (command line) Authoritative restore - Authoritatively restore the DIT database Domain management - Prepare for new domain creation Files - Manage NTDS database files IPDeny List - Manage LDAP IP Deny List LDAP policies - Manage LDAP protocol policies Metadata cleanup - Clean up objects of decommissioned servers Roles - Seize or Transfer NTDS role owner Security account management - Manage Security Account Database (Duplicate SID Cleanup) Semantic database analysis - Semantic Checker (don’t use)
131	Win2000 Server ResKit Distributed Systems Guide Chapter 9—Active Directory Backup and Restore
132	1 DNS for Active Directory
133	DNS Servers—Zones Usually Primary or Secondary Can be integrated with Active Directory
134	DNS and Active Directory DNS is NOT Active Directory DNS zones CAN be stored in Active Directory Active Directory requires DYNAMIC DNS (to operate)
135	Creating a DNS Zone \\toro\examsw2k\cs\216\DNSNewZoneWizFC.gif
136	DNS in Active Directory Better security Better replication Multi-master dynamic registration Multi-master replication
137	DNS in Active Directory \\toro\examsw2k\cs\AD\ADDNSZonesRightClickFC.gif
138	Active Directory Requires NTFS IP Infrastructure (servers and clients really) Dynamic DNS
139	Active Directory DNS Zone \\TORO\examsw2k\cs\AD\ADDNSZones.gif
140	Active Directory Integrated DNS Zone Active Directory DNS acts as primary AD Integrated DNS servers can have ‘ordinary’ secondary DNS servers Any Secondaries must support SRV records
141	Configure zones for dynamic updates \\toro\examsw2k\cs\AD\ADDNSZonePropGenFC.gif
142	Scavenging DNS Records Removes stale records Disabled by default Must be enabled on server AND zone Set Scavenging Period on the SERVER Set NoRefreshInterval AND RefreshInterval on ZONE
143	Internal and External DNS Common to setup Internal as private name space Then use external as internal’s forwarder Internal DNS does NOT replicate to external DNS Internal users can resolve both internal-external names External visitors can only access external names
144	Internal Name Relationships Same as External—LearnQuick.com Different— LearnQuick.local vs. LearnQuick.com Child—internal.LearnQuick.Com Internal PRIVATE name can —and should be registered Firewall should separate
145	BIND versions and requirements (If using BIND instead of Win2000 DNS) BIND 4.9.7 (MINIMUM as secondary) BIND 8.1.2 MINIMUM to support Active Directory as the PRIMARY BIND 8.2 (TESTED) Berkeley Internet Name Domain (DNS Server)
146	1 Change and Configuration Management
147	Group Policy Create a Group Policy object (GPO) Link an existing GPO Delegate administration of Group Policy Group Policy inheritance Filter Group Policy settings with security group permissions Modify Group Policy Group Policy Objects are NOT profiles
148	GPO Application Local Site Domain OU (and all child OUs)
149	Caution: Users and Computers Default Containers for upgraded (WinNT) objects Are not OUs Cannot have GPOs Merely for convenience Best Practice: Move these object to real OUs
150	Later GPO Overrides But, earlier GPO can be marked “NO OVERRIDE” Can also “Block Inheritance” at LATER level Block, avoids ALL previous GPOs in chain “NO OVERRIDE” takes precedence over “Block Inheritance”
151	Multiple GPOs on a Container Applied from Bottom of screen UP Top of list is last, gets to override
152	GPOs affect … Computers Users Both (Can also disable) Permissions can FILTER GPO application Without APPLY GPO, GPO does not apply to user or group!
153	GPO are separate objects Can be LINKED to MANY containers You do NOT need to re-create GPO, just LINK where needed
154	How can set option for all users in Domain? Create a Group Policy Object (GPO) Link GPO to the Domain container How about multiple domains in a tree? Link GPO to EACH domain—there is no GP inheritance for Domains
155	How to apply GPO to all OUs? If hierarchical, link to TOP OU
156	Examples: You can control Startup menu (logoff, shutdown) RegEdit restrictions (prevent running RegEdit) Password policies (only at DOMAIN) Access to TaskMan and Start/Run
157	Manage and troubleshoot user environments using Group Policy Control user environments using administrative templates Assign script policies to users and computers
158	GPO can assign scripts Startup/shutdown (computer) Logon/Logoff (user) Bat, CMD, Console-VBS or JS etc. Kept in SysVol and replicated
159	Scripts run Synchronously …by default Synchronous is really: SEQUENTIAL Asynchronous is really: CONCURRENT Change to ‘asynchronous’ to allow user to gain control sooner Timeout is 600 seconds (can be changed)
160	Using Group Policy to Deploy Software Publish or Assign Initial deployment Upgrades and patches Removal of software
161	Installation Files .MSI—Microsoft Installer .MSP—Patch files for upgrades ONLY .MST—transform, can modify MSI behavior Example: .MST—can change dialog language
162	Assign Per user or Per computer Mnemonic: An Assignment is REQUIRED Visible on Start menus Use when users MUST use software (e.g., anti-virus, email) When assigned to user, fully install on first use When assigned to computer, installs when safe (at startup)
163	Assign Can Repair When user deletes application Removes from menus Assign can automatically repair
164	Assigning an Application (ActivePerl) \\toro\examsw2k\cs\AD\ADGroupPolSoftwareDeployPropsFC.gif
165	"\\toro\examsw2k\cs\AD\ADGroupPolSoftwareInstPropFC.gif" \\toro\examsw2k\cs\AD\ADGroupPolSoftwareInstPropFC.gif
166	Publish Per user only (cannot publish to a machine) Available from Add/Remove Programs Mnemonics: Publish means Advertise Users can READ the published papers (computer can’t read)
167	Both Publish and Assign Install on document activation Users clicks on (starts) associated document
168	Add/Remove Programs \\toro\examsw2k\cs\AD\ADAddRemoveProgsFC.gif
169	Deploy software by using Group Policy Windows Installer Packages Maintain software by using Group Policy Configure deployment options Common problems during software deployment
170	Computer Configuration Operating system behavior Desktop behavior Security settings Computer startup and shutdown scripts Computer-assigned application options Application settings
171	Computer Policy is applied At startup At periodic intervals
172	User Configuration Operating system behavior Desktop settings Security settings Assigned and published applications Application settings Folder redirection options User logon and logoff scripts
173	Editing Group Policy Objects An administrator A Creator Owner A user with delegated access to the Group Policy object
174	Deploy Win2000 using RIS (Remote Installation Services) Covered in Server and Professional
175	RIS Servers Require Authorization for RIS (done like DHCP) DHCP Server DNS Server Active Directory PXE Network Clients …or RBFG.exe generated diskette User (installer) permissions on files
176	Install an image on a RIS client computer Create a RIS boot disk Configure remote installation options Troubleshoot RIS problems Manage images for remote installations Can configure MULTILANGUAGE multlng.OSC file
177	Configure RIS security Authorize a RIS server (authorized like a DHCP server) Enable “respond to clients” Grant computer account creation rights OR… …Pre-stage RIS client computers for added security and load balancing
178	1 Manage Active Directory Components
179	Manage Active Directory objects Between domains—MoveTree Between OUs (within Domain) Between Forests—ClonePrincipal
180	Between domains (within Forest) Native mode only (destination domain) Use MoveTree FROM RID Master MoveTree /start /s SrcSrv /d DstSrv /sdn SrcTree /ddn DstTree Source and Destination servers are DNS SERVER names Source and Destination trees are distinguished names
181	MoveTree Example movetree /s toro.learnquick.com /d ebi.MCSE2KHelp.com /sdn OU=Marketing,DC=LearnQuick,DC=COM /ddn OU=Sales,DC=MCSE2KHelp,DC=COM (above is ALL one line)
182	Between OUs (within Domain) Right clickàMove Does NOT support drag ‘n drop
183	FYI: SidHist An accessory script to ClonePrincipal Not directly related to Moving Users or OUs
184	Publish resources in Active Directory Active Directory Users and Computers Printers Shared Folders (File Shares)
185	Locate objects in Active Directory Active Directory Users and Computers Find any object in Active Directory Use simple search or advanced—any attribute
186	Search Active Directory \\toro\examsw2k\cs\AD\ADFindUsersCompFC.gif
187	Search Results \\toro\examsw2k\cs\AD\ADFindUsersCompResultFC.gif
188	User Properties \\toro\examsw2k\cs\AD\ADFindUsersCompResultFC2.gif
189	Explorer Search for… Files and Folders Computers Printers People …or Internet resources
190	Search from Explorer \\toro\examsw2k\cs\AD\ADFindUsingExplorerFC.gif
191	Active Directory Users and Computers \\toro\examsw2k\cs\AD\ADUsersRightClickFC.gif
192	Manage accounts manually…or by scripting ADSI Active Directory Services Interface Windows Scripting Host CScript—console & WScript—windowed Both VBScript and JScript Other languages such as Perl, TCL, REXX, and Python
193	Active Directory coexists with other directory services Interoperable Standard directory access protocols (LDAP) Programming interfaces (APIs) —such as ADSI and LDAP Migration tools for IMPORT/EXPORT LDIFDE (ldap) CSVDE (comma separated)
194	Control access to Active Directory objects Permissions (ACLs and ACEs like files) Delegation of control
195	Active Directory Delegation of Control Wizard Delegate common tasks Create a custom task to delegate
196	Delegate the following common tasks Create, delete, and manage user accounts Reset passwords on user accounts Read all user information Create, delete, and manage groups Modify the membership of a group Manage Group Policy Links
197	Win2000 Native vs. Mixed Mode When All DCs are running Win2000 you can switch to Native Switch using Active Directory Users and Computer One way change—cannot go back Native mode has NOTHING to do with older clients, just DCs
198	Native Mode Features Universal Groups become available Group type conversion is enabled Domain Local Groups (instead of ordinary local groups) Group nesting is enabled (e.g., global in global) Moving users and groups into domain is enabled
199	AGUDLR User AccountsàGlobalàUniversalà Domain LocalàResource Permissions Place permissions on resource for Domain Local groups Put Universal groups into Domain Locals (NATIVE mode only) Put Global groups into Universals Put Users into Globals
200	Universal Groups Only available in NATIVE mode Native mode also allows group nesting GlobalsàGlobals UniversalsàUniversals Universals should NOT contain users
201	Mixed Mode AGLP or Native Mode AGUDLP Users AccountsàGàL àResource Permissions Users AccountsàGàUàDL àResource Permissions
202	Understanding Universal Groups Visible THROUGHOUT the entire Forest Can contain Users, Global Groups, or Universal groups from the entire forest Can be added to Local Groups
203	Universal Groups Best Practices Do NOT add users to Universal Groups even though it is technically legal Universal Groups should SELDOM change Put users into Global Groups, add Global Groups to the Universal Groups Add Universal Groups to Domain Local Groups Assign Permissions to the Domain Local
204	When to use a Universal Group? MUST be in native mode If the group will contain users, probably choose Global If group includes Global groups, probably choose Universal If group includes Universal groups, cannot be Global
205	Managing OUs and Permissions Think of OUs like directories Think of Users like files NOT really true, but easy way to think about it Grant (or delegate) permissions on OUs …to local Admins who will create and manage Users
206	Manage User Accounts \examsw2k\cs\AD\ADComputersRightClickFC.gif
207	Group Policy Applies to Computers and to Users May be selectively enabled/disabled (improves performance too) LocalàSiteàDomainàOU (all OUs in hierarchy)
208	Block and No Override Use Sparingly - Routine use of these features makes it troubleshooting difficult to troubleshoot policy If conflicting, No Override WINS …No Override from HIGHER authority cannot be blocked
209	The Block Policy inheritance Blocks Group Policy objects from higher in the Active Directory …higher in the hierarchy of sites, domains, and organizational units Does not block GPOs that have No Override enabled Block Policy inheritance ACTUALLY set on sites, domains, and OUs …NOT set on individual Group Policy objects (Same GPO can link to various sites, domains, or OUs)
210	No Override Prevents subsequent modifications of active policy Prevents Block Inheritance No Override ACTUALLY set on sites, domains, and OUs …NOT set on individual Group Policy objects (Same GPO can link to various sites, domains, or OUs)
211	Controlling the Domain with Group Policy Install Software (Publish or Assign) Windows Settings (Scripts and Security)
212	Group Policy Links \\toro\examsw2k\cs\AD\ADDCRightClickPropandGroupPolFC.gif
213	Editing the linked Group Policy \\toro\examsw2k\cs\AD\ADGroupPolExampleFC.gif
214	Group Policy Properties \\toro\examsw2k\cs\AD\ADGroupPolLinksDiagBoxFC.gif
215	Logon, Authentication, Referral Performance Local DC—same LAN—same site Also true for DNS and WINS or ‘referral’ services Also true for DFS—server local to site is preferred
216	Designing Service Locations considerations Performance Fault tolerance Manageability
217	Server Placement Review Operations masters Global catalog servers Domain controllers DNS servers
218	Local Active Directory Issues Replication—INTERSITE replication and bridgehead servers Up-to-date data (latency)—schedules and frequency of connections Bandwidth usage—Intersite replication is COMPRESSED
219	Replication Protocols RPC-IP – well-connected networks intraSite or intersite SMTP – asynchronous, certificate required, crosses poor links OR firewall filters INTERdomain–requires multiple domains
220	Replication Protocols
221	Intersite replication Compressed RPC-IP or SMTP SMTP (only for different domains) No NOTIFICATION— uses Pull SCHEDULES
222	Intrasite replication NOT Compressed RPC Logical Ring with ‘extra edges’ Extra edges or connections ensure no more than 3 DC hops Notification based & Pull
223	How does Intrasite replication work? Changes at DC cause notification of partner DCs DC notifies (2) other DCs which PULL changes Replicates to other DCs Other DCs notify additional DCs until all are up to date
224	How does INTERSITE Replication work? (RPC-IP) During available times at periodic intervals only Bridgehead DC from site requests changes from Bridgehead DC at other site (Bridgehead DC then shares changes using Intrasite replication)
225	Which replication to use? Intrasite RPC—well connected LANs (or PERHAPS T1/T3) Intersite RPC—reliable WANS especially lower speed WANS …but including many higher speed (T1 or even T3) SMTP—unreliable WANS between DIFFERENT domains OR FILTERED WANS (e.g., firewalls filtering RPC) Might even be the reason for CREATING a domain
226	Why would we add sites across high speed WANS? Mainly to control the time or amount of replication Usually WANS are relatively expensive or restricted If same site, any (or all) DCs can replicate at any time If same site, no compression If different site, only Bridgehead servers replicate If different site, replication is compressed
227	When would we use SMTP? Mainly for unreliable connections Perhaps dial-up (intermittent) VERY long distance (Foreign public telephone networks) High latency (perhaps satellites) Not connected at the same time window SMTP uses store and forward features of email
228	1 Active Directory Security
229	Security Tools Apply security policies by using Group Policy Using “Security Templates” (.inf files) with “Security Configuration and Analysis” MMC SecEdit—command line version of tool Implement an audit policy
230	Security Policies Account Policies Password and account lockout policies Local Policies Auditing, user rights and security options policies Event Log Event Log settings and Event Viewer Restricted Groups Restricted Groups System Services System service settings Registry Registry security settings File System File security settings Public Key Policies Certificates and Recovery Agents IPSec Policies IPSec Admin for secure communication
231	Local Policies Audit Policy User Rights Assignment Security Options
232	Problem solving by Audit How to detect if someone is deleting files? Audit file access success AND on Files How to detect if someone is modifying accounts? Success for “Account Management” (or even failure) Can SEARCH for “Account Management” in Event Viewer
233	How to move or duplicate a Security Policy? Use SecEdit or… Security Configuration and Analysis (GUI) Both manage: Security Templates (.inf files) Export from correct machine Import to other machine(s) or Import in Group Policy (perhaps to DC policy)
234	One DC is correct, how to apply to all 5 Export with SecEdit or Security Configuration and Analysis Import to (new or existing) Domain Controller Policy …or import to each DC local policy
235	SecEdit /configure (from a stored template) /refreshpolicy (machine_policy or user_policy) /export /analyze ( /validate )
236	Security Areas
237	1 Designing a Directory Service Architecture
238	Designing Organizational Unit (OU) structures Mirror Administrative model Delegate or ease Administrative control Map existing resource domains Link different Administrative policy (GPO) Mirror geographic and company structure
239	Schema modification Schema can ONLY be changed at the Schema Master Schema can ONLY be changed by Schema Admins Schema changes must be enabled on the Schema Master Note: Enterprise and Domain Admins are NOT Schema Admins
240	Best Practices: Schema Changes Schema should be changed with great care Additions cannot be removed Generally change using programs that add new functionality