Real MCTS/MCITP Exam 70-640 Prep Kit (eBook)

Front Cover 1
The Real MCTS/MCITP Exam 70-640 Active Directory Configuration Prep Kit 4
Copyright Page 5
Technical Editor 6
Technical Reviewer 7
Contributing Authors 8
Contents 12
Foreword 22
Chapter 1: Configuring Server Roles in Windows 2008 34
Introduction 35
New Roles in 2008 35
Using Server Manager to Implement Roles 36
Using Server Core and Active Directory 42
What Is Server Core? 43
Read-Only Domain Controllers (RODCs) 48
Introduction to RODC 48
Its Purpose in Life 48
Its Features 49
Configuring RODC 49
Removing an RODC 54
Active Directory Lightweight Directory Service (LDS) 55
When to Use AD LDS 55
Changes from Active Directory Application Mode (ADAM) 56
Configuring AD LDS 56
Working with AD LDS 59
Active Directory Rights Management Service (RMS) 61
What's New in RMS 61
RMS vs. DRMS in Vista 62
Configuring RMS 63
Active Directory Federation Services (ADFS) 70
What Is Federation? 70
Why and When to Use Federation 71
Configuring ADFS 72
Summary of Exam Objectives 85
Exam Objectives Fast Track 85
Exam Objectives Frequently Asked Questions 87
Self Test 89
Self Test Quick Answer Key 92
Chapter 2: Configuring Network Services 94
Introduction 95
Configuring Domain Name System (DNS) 96
Identifying DNS Record Requirements 101
Installing and Configuring DNS 105
Using Server Core and DNS 109
Configuring Zones 112
Zone Transfer 115
Active Directory Records 118
Reverse Lookup Zones 119
Configuring Reverse Lookup Zones 120
Configuring Zone Resolution 124
Configuring Dynamic Host Configuration Protocol (DHCP) 126
DHCP Design Principles 128
DHCP Servers and Placement 129
Installing and Configuring DHCP 130
Using Server Core and DHCP 133
Configuring DHCP for DNS 135
Configuring Windows Internet Naming Service (WINS) 136
Understanding WINS Replication 138
Automatic Partner Configuration 138
Push Partnerships 139
Pull Partnerships 140
Push/Pull Partnerships 141
Replication Models 141
Ring Models 142
Hub-and-Spoke Models 142
Hybrid Replication Models 143
Static WINS Entries 143
Installing and Configuring 144
Using Server Core for WINS 144
Configuring WINS for DNS 145
Summary of Exam Objectives 147
Exam Objectives Fast Track 148
Exam Objectives Frequently Asked Questions 150
Self Test 152
Self Test Quick Answer Key 156
Chapter 3: Working with Users, Groups, and Computers 158
Introduction 159
Navigating Active Directory Users and Computers 159
Creating and Modifying User Accounts 162
User Account Types 162
Creating a New Account 163
Domain User Account Considerations 164
Password Considerations 165
Creating a New Account Using Active Directory Users and Computers 166
Modifying a Domain User Account Using Active Directory Users and Computers 169
Common User Management Options 189
Creating a New User Account Using Script 190
Creating User Template 191
Configuring User Principal Names 192
Creating and Modifying Computer Accounts 193
Creating a New Computer Account Using Active Directory Users and Computers 194
Modifying a Computer Account Using Active Directory Users and Computers 195
Creating a New Computer Account Using a Script 200
Resetting a Computer Account Using Active Directory Users and Computers 200
Creating and Modifying Groups 202
Creating a Group 202
Types of Groups 203
Group Scopes 203
Universal Groups Replication Concerns 204
Group Strategies 204
Creating a New Group Using Active Directory Users and Computers 205
Modifying a Group Using Active Directory Users and Computers 206
Creating a New Group Using Script 209
The Delegation of Tasks 210
RODC (Read-Only Domain Controller) 217
Exam Objectives Fast Track 218
Exam Objectives Frequently Asked Questions 222
Self Test 225
Self Test Quick Answer Key 228
Chapter 4: Configuring the Active Directory Infrastructure 230
Introduction 231
Working with Forests and Domains 232
Understanding Forests 233
Understanding Domains 233
Forest and Domain Functional Levels 235
Using Domain Functional Levels 236
Using the Windows 2000 Domain Functional Level 237
Windows Server 2003 Domain Functional Level 237
Windows Server 2008 Domain Functional Level 238
Configuring Forest Functional Levels 239
Windows 2000 Forest Functional Level (default) 239
Windows Server 2003 Forest Functional Level 240
Windows Server 2008 Forest Functional Level 241
Raising Forest and Domain Functional Levels 241
Raising the Domain Functional Level 242
Understanding the Global Catalog 243
UPN Authentication 245
Directory Information Search 245
Universal Group Membership Information 247
Understanding GC Replication 247
Universal Group Membership 248
Attributes in the Global Catalog 248
Placing GC Servers within Sites 249
Bandwidth and Network Traffic Considerations 250
Universal Group Membership Caching 251
Working with Flexible Single Master Operation (FSMO) Roles 253
Placing, Transferring, and Seizing FSMO Role Holders 256
Locating and Transferring the Schema Master Role 257
Locating and Transferring the Domain Naming Master Role 260
Locating and Transferring the Infrastructure, RID, and PDC Operations Master Roles 261
Placing the FSMO Roles within an Active Directory Environment 265
Working with Sites 266
Understanding Sites 266
Subnets 269
Site Planning 270
Criteria for Establishing Separate Sites 270
Creating a Site 271
Renaming a Site 276
Creating Subnets 277
Associating Subnets with Sites 280
Creating Site Links 282
Configuring Site Link Cost 285
Understanding Replication 288
Intrasite Replication 289
Intersite Replication 291
Bridgehead Servers 292
Site Link Bridges 292
Scheduling 293
Forcing Replication 294
Replication Protocols 294
Planning, Creating, and Managing the Replication Topology 295
Planning Replication Topology 295
Creating Replication Topology 295
Configuring Replication between Sites 296
Troubleshooting Replication Failure 297
Troubleshooting Replication 297
Using Event Viewer 298
Working with Trusts 299
Default Trusts 305
Forest Trusts 305
External Trusts 306
Shortcut Trusts 307
SID Filtering 308
Summary of Exam Objectives 310
Exam Objectives Fast Track 312
Exam Objectives Frequently Asked Questions 314
Self Test 318
Self Test Quick Answer Key 323
Chapter 5: Understanding Group Policy 324
Introduction 325
Types of Group Policies 325
Local Group Policy 326
Non-Local Group Policy Objects 329
Preferences 336
Network Location Awareness 339
User 340
Computer 341
Group Policy Hierarchy 342
Site, Domain, and OU Hierarchy 342
Group Policy Processing Priority 344
Creating and Linking GPOs 347
Creating Stand-Alone GPOs 347
Linking Existing GPOs 348
Creating and Linking at One Time 349
Controlling Application of Group Policies 351
Enforce 351
Block Inheritance 355
Group Policy Results and Group Policy Modeling 356
WMI 363
Group Policy Filtering 364
Group Policy Loopback 367
GPO Templates 367
Administrative Templates 368
Security Templates 370
Starter GPOs 374
Summary of Exam Objectives 379
Exam Objectives Fast Track 380
Exam Objectives Frequently Asked Questions 381
Self Test 383
Self Test Quick Answer Key 389
Chapter 6: Configuring Group Policy 390
Configuring Software Deployment 391
Installation Overview 391
Publishing to Users 394
Assigning to Users 397
Assigning to Computers 401
Maintenance 403
Redeploying Software 403
Upgrading Software 404
Removing Software Deployed with Group Policy 408
Forced Removal 409
Optional Removal 410
Configuring Account Policies 411
Domain Password Policy 412
Account Lockout Policy 413
Fine-Grain Password and Account Lockout Policies 417
Configuring a Fine-Grain Password Policy 419
Applying Users and Groups to a PSO with Active Directory Users and Computers 427
Configuring Audit Policies 430
Logon Events 432
Directory Service Access 434
Configuring Directory Service Access Auditing in Group Policy 434
Configuring Active Directory Object Auditing 435
Object Access 437
Configuring Object Access Auditing in Group Policy 438
Configuring Object Level Auditing 438
Other Audit Policies 441
Configuring Additional Security-Related Policies 442
User Rights 442
Security Options 444
Restricted Groups 448
Adding a New Restricted Group 449
Modifying a Restricted Group 452
Deleting a Restricted Group 453
Administrative Templates 453
ADMX Central Store 455
Adding ADM Templates to a GPO 457
Converting ADM Files to the ADMX Format 460
Converting ADM Files to ADMX Files Using the Command Prompt 460
Converting ADM Files to ADMX Files Using the MMC Snap-in 460
Summary of Exam Objectives 465
Exam Objectives Fast Track 467
Exam Objectives Frequently Asked Questions 470
Self Test 473
Self Test Quick Answer Key 477
Chapter 7: Configuring Certificate Services and PKI 478
Introduction 479
What Is PKI? 480
The Function of the PKI 482
Components of PKI 483
How PKI Works 485
PKCS Standards 487
How Certificates Work 493
Public Key Functionality 496
Digital Signatures 497
Authentication 498
Secret Key Agreement via Public Key 499
Bulk Data Encryption without Prior Shared Secrets 499
User Certificates 512
Machine Certificates 513
Application Certificates 513
Analyzing Certificate Needs within the Organization 513
Working with Certificate Services 514
Configuring a Certificate Authority 514
Certificate Authorities 515
Standard vs. Enterprise 515
Root vs. Subordinate Certificate Authorities 516
Certificate Requests 517
Certificate Practice Statement 522
Key Recovery 522
Backup and Restore 522
Assigning Roles 529
Enrollments 529
Revocation 530
Working with Templates 534
General Properties 536
Request Handling 538
Cryptography 539
Subject Name 541
Issuance Requirements 542
Security 545
Types of Templates 546
User Certificate Types 546
Computer Certificate Types 547
Other Certificate Types 549
Custom Certificate Templates 549
Securing Permissions 552
Versioning 553
Key Recovery Agent 554
Summary of Exam Objectives 556
Exam Objectives Fast Track 557
Exam Objectives Frequently Asked Questions 559
Self Test 562
Self Test Quick Answer Key 565
Chapter 8: Maintaining an Active Directory Environment 566
Introduction 567
Backup and Recovery 567
Using Windows Server Backup 568
Scheduling a Backup 573
Backing Up to Removable Media 581
Backing Up System State Data 584
Backing Up Key Files 588
Backing Up Critical Volumes 589
Recovering System State Data 590
Recovering Key Files 592
Directory Services Restore Mode 598
Performing Authoritative and Nonauthoritative Restores 601
Authoritative Restore 601
Nonauthoritative Restore 608
Linked Value Replication 608
Backing Up and Restoring GPOs 608
Offline Maintenance 617
Restartable Active Directory 617
Offline Defrag and Compaction 620
Active Directory Storage Allocation 623
Monitoring Active Directory 624
The Network Monitor 624
The Task Manager 627
The Applications Tab 629
The Processes Tab 630
The Services Tab 631
The Performance Tab 631
The Networking Tab 632
The Users Tab 634
The Event Viewer 635
Custom Views 635
Windows Logs 638
Applications and Services Logs 639
Subscriptions 640
Replmon 644
Using Replmon 644
RepAdmin 651
Windows System Resource Manager 654
The Windows Reliability and Performance Monitor 656
Resource Overview 657
The Performance Monitor 658
The Reliability Monitor 660
Data Collector Sets 662
Reports 664
Summary of Exam Objectives 666
Exam Objectives Fast Track 668
Exam Objectives Frequently Asked Questions 670
Self Test 672
Self Test Quick Answer Key 677
Appendix: Self Test Appendix 678
Chapter 1: Configuring Server Roles in Windows 2008 679
Chapter 2: Configuring Network Services 684
Chapter 3: Working with Users, Groups, and Computers 689
Chapter 4: Configuring the Active Directory Infrastructure 694
Chapter 5: Understanding Group Policy 701
Chapter 6: Configuring Group Policy 709
Chapter 7: Configuring Certificate Services and PKI 715
Chapter 8: Maintaining an Active Directory Environment 721
Index 730