Real MCTS/MCITP Exam 70-648 Prep Kit (eBook)

Front Cover 1
The Real MCTS/MCITP Exam 70-648 Upgrading your MCSA on Windows Server 2003 to Windows Server 2008 Prep Kit 4
Copyright Page 5
Technical Editor 6
Contributing Authors 7
Contents 12
Foreword 26
What Is MCTS Exam 70-648? 26
Path to MCTS/MCITP/MS Certified Architect 27
Exam Day Experience 30
Pedagogical Elements 34
Additional Resources 35
Chapter 1: Deploying Servers 36
Introduction 37
Installing Windows Server 2008 37
Changes in Functionality from Windows Server 2003 with SP1 to Windows Server 2008 38
Installing Windows Server 2008 Enterprise Edition 43
What Is New in the AD DS Installation? 56
Installing from Media 72
Installing Server Core 73
The Windows Deployment Service 76
What Is WDS? 77
Configuring WDS 78
Capturing WDS Images 86
Deploying WDS Images 87
Configuring Storage 89
RAID Types 90
Network Attached Storage 91
Storage Area Networks 92
Fibre Channel 94
iSCSI 95
iSCSI Initiators and Targets 95
Mount Points 97
Configuring High Availability 100
Failover Clusters 100
Installing and Validating a Failover Cluster 101
Managing the Failover Cluster 103
Network Load Balancing 104
Configuring Windows Activation 108
Using Multiple Activation Keys 109
Using Key Management Service Keys 109
License States 110
Reporting 111
Installing a KMS 111
Creating a DNS SRV Record 113
Enabling Clients to Use KMS 114
Activating the System 115
Summary of Exam Objectives 116
Exam Objectives Fast Track 117
Exam Objectives Frequently Asked Questions 119
Self Test 122
Self Test Quick Answer Key 126
Chapter 2: Configuring DNS 128
Introduction 129
An Introduction to Domain Name System (DNS) 129
Understanding Public Name Resolution 132
Understanding Private Name Resolution 133
Understanding Microsoft's DNS Terminology 134
Configuring a DNS Server 135
Installing the DNS Server Role 135
Understanding Cache-Only DNS Servers 136
Configuring Root Hints 137
Adding Root Hint Records 138
Editing Root Hints Records 139
Removing Root Hints Records 140
Copying Root Hints from Another Server 141
Configuring Server-Level Forwarders 141
Configuring Conditional Forwarding 145
Creating Conditional Forwarders 145
Managing Conditional Forwarders 148
Server Core 150
Creating DNS Zones 151
Creating a Standard Primary Forward Lookup Zone 154
Creating a Secondary Forward Lookup Zone 159
Creating an Active Directory Integrated Forward Lookup Zone 161
Creating a Standard Primary Reverse Lookup Zone 164
Creating a Standard Secondary Reverse Lookup Zone 169
Creating a Zone Delegation 170
Creating a Stub Zone 173
Using the New GlobalNames Zone Feature 174
Enabling a Domain Controller to Support GlobalNames Zones 175
Creating the GlobalNames Zone 176
Configuring and Managing DNS Replication 178
Manually Initiating Replication Using DNS Manager 178
Configuring DNS Servers to Allow Zone Transfers 179
Configuring a Standard Primary Zone for Transfers 179
Configuring an AD Integrated or Secondary Zone for Transfers 181
Configuring the SOA Record 181
Creating an Application Directory Partition 184
Creating and Managing DNS Records 186
Managing Record Types 186
Creating Host Records 186
Creating A Records 186
Creating AAAA Records 188
Creating Pointer Records 190
Creating MX Records 193
Creating SRV Records 194
Creating CNAME Records 198
Creating NS Records 199
Configuring Windows Internet Name Service (WINS) and DNS Integration 201
Creating a WINS Lookup Record 201
Creating a WINS Reverse Lookup Record 204
Understanding the Dynamic Domain Name System (DDNS) 207
Configuring DDNS Aging and Scavenging 208
Enabling Automatic Scavenging 210
Initiating Manual Scavenging 211
Configuring Name Resolution for Client Computers 212
How Name Resolution Works in Windows XP and Later 214
Configuring the DNS Server List 215
Configuring the Suffix Search Order 217
Configuring the HOSTS File 218
Configuring the NetBIOS Node Type 219
Configuring the WINS Server List 222
Configuring the LMHOSTS File 223
Understanding Link-Local Multicast Name Resolution (LLMNR) 225
Managing Client Settings by Using Group Policy 226
Summary of Exam Objectives 229
Exam Objectives Fast Track 231
Exam Objectives Frequently Asked Questions 234
Self Test 237
Self Test Quick Answer Key 241
Chapter 3: Configuring Server Roles in Windows 2008 242
Introduction 243
New Roles in 2008 243
Using Server Manager to Implement Roles 244
Using Server Core and Active Directory 250
What Is Server Core? 251
Read-Only Domain Controllers (RODCs) 256
Introduction to RODC 256
Its Purpose in Life 256
Its Features 257
Configuring RODC 257
Removing an RODC 262
Active Directory Lightweight Directory Service (LDS) 263
When to Use AD LDS 263
Changes from Active Directory Application Mode (ADAM) 264
Configuring AD LDS 264
Working with AD LDS 267
Active Directory Rights Management Service (RMS) 269
What's New in RMS 269
RMS vs. DRMS in Vista 270
Configuring RMS 271
Active Directory Federation Services (ADFS) 278
What Is Federation? 278
Why and When to Use Federation 279
Configuring ADFS 280
Summary of Exam Objectives 293
Exam Objectives Fast Track 293
Exam Objectives Frequently Asked Questions 295
Self Test 297
Self Test Quick Answer Key 300
Chapter 4: Configuring Certificate Services and PKI 302
Introduction 303
What Is PKI? 304
The Function of the PKI 306
Components of PKI 307
How PKI Works 309
PKCS Standards 311
How Certificates Work 317
Public Key Functionality 320
Digital Signatures 321
Authentication 322
Secret Key Agreement via Public Key 323
Bulk Data Encryption without Prior Shared Secrets 323
User Certificates 336
Machine Certificates 337
Application Certificates 337
Analyzing Certificate Needs within the Organization 337
Working with Certificate Services 338
Configuring a Certificate Authority 338
Certificate Authorities 339
Standard vs. Enterprise 339
Root vs. Subordinate Certificate Authorities 340
Certificate Requests 341
Certificate Practice Statement 346
Key Recovery 346
Backup and Restore 346
Assigning Roles 353
Enrollments 353
Revocation 354
Working with Templates 358
General Properties 360
Request Handling 362
Cryptography 363
Subject Name 365
Issuance Requirements 366
Security 369
Types of Templates 370
User Certificate Types 370
Computer Certificate Types 371
Other Certificate Types 373
Custom Certificate Templates 373
Securing Permissions 376
Versioning 377
Key Recovery Agent 378
Summary of Exam Objectives 380
Exam Objectives Fast Track 381
Exam Objectives Frequently Asked Questions 383
Self Test 386
Self Test Quick Answer Key 389
Chapter 5: Maintaining an Active Directory Environment 390
Introduction 391
Backup and Recovery 391
Using Windows Server Backup 392
Scheduling a Backup 397
Backing Up to Removable Media 405
Backing Up System State Data 408
Backing Up Key Files 412
Backing Up Critical Volumes 413
Recovering System State Data 414
Recovering Key Files 416
Directory Services Restore Mode 422
Performing Authoritative and Nonauthoritative Restores 425
Authoritative Restore 425
Nonauthoritative Restore 432
Linked Value Replication 432
Backing Up and Restoring GPOs 432
Offline Maintenance 441
Restartable Active Directory 441
Offline Defrag and Compaction 444
Active Directory Storage Allocation 447
Monitoring Active Directory 448
The Network Monitor 448
The Task Manager 448
The Applications Tab 453
The Processes Tab 454
The Services Tab 455
The Performance Tab 455
The Networking Tab 456
The Users Tab 458
The Event Viewer 459
Custom Views 459
Windows Logs 462
Applications and Services Logs 463
Subscriptions 464
Replmon 468
Using Replmon 468
RepAdmin 475
Windows System Resource Manager 478
The Windows Reliability and Performance Monitor 480
Resource Overview 481
The Performance Monitor 482
The Reliability Monitor 484
Data Collector Sets 486
Reports 488
Summary of Exam Objectives 490
Exam Objectives Fast Track 492
Exam Objectives Frequently Asked Questions 494
Self Test 496
Self Test Quick Answer Key 501
Chapter 6: Configuring Group Policy 502
Configuring Software Deployment 503
Installation Overview 503
Publishing to Users 506
Assigning to Users 509
Assigning to Computers 513
Maintenance 515
Redeploying Software 515
Upgrading Software 516
Removing Software Deployed with Group Policy 520
Forced Removal 521
Optional Removal 522
Configuring Account Policies 523
Domain Password Policy 524
Account Lockout Policy 525
Fine-Grain Password and Account Lockout Policies 529
Configuring a Fine-Grain Password Policy 531
Applying Users and Groups to a PSO with Active Directory Users and Computers 539
Configuring Audit Policies 542
Logon Events 544
Directory Service Access 546
Configuring Directory Service Access Auditing in Group Policy 546
Configuring Active Directory Object Auditing 547
Object Access 549
Configuring Object Access Auditing in Group Policy 550
Configuring Object Level Auditing 550
Other Audit Policies 553
Configuring Additional Security-Related Policies 554
User Rights 554
Security Options 556
Restricted Groups 560
Adding a New Restricted Group 561
Modifying a Restricted Group 564
Deleting a Restricted Group 565
Administrative Templates 565
ADMX Central Store 567
Adding ADM Templates to a GPO 569
Converting ADM Files to the ADMX Format 572
Converting ADM Files to ADMX Files Using the Command Prompt 572
Converting ADM Files to ADMX Files Using the MMC Snap-in 572
Summary of Exam Objectives 577
Exam Objectives Fast Track 579
Exam Objectives Frequently Asked Questions 582
Self Test 585
Self Test Quick Answer Key 589
Chapter 7: Configuring the Active Directory Infrastructure 590
Introduction 591
Working with Forests and Domains 592
Understanding Forests 593
Understanding Domains 593
Forest and Domain Functional Levels 595
Using Domain Functional Levels 596
Using the Windows 2000 Domain Functional Level 597
Windows Server 2003 Domain Functional Level 597
Windows Server 2008 Domain Functional Level 598
Configuring Forest Functional Levels 599
Windows 2000 Forest Functional Level (default) 599
Windows Server 2003 Forest Functional Level 600
Windows Server 2008 Forest Functional Level 601
Raising Forest and Domain Functional Levels 601
Raising the Domain Functional Level 602
Understanding the Global Catalog 603
UPN Authentication 605
Directory Information Search 605
Universal Group Membership Information 607
Understanding GC Replication 607
Universal Group Membership 608
Attributes in the Global Catalog 608
Placing GC Servers within Sites 609
Bandwidth and Network Traffic Considerations 610
Universal Group Membership Caching 611
Working with Flexible Single Master Operation (FSMO) Roles 613
Placing, Transferring, and Seizing FSMO Role Holders 616
Locating and Transferring the Schema Master Role 617
Locating and Transferring the Domain Naming Master Role 620
Locating and Transferring the Infrastructure, RID, and PDC Operations Master Roles 621
Placing the FSMO Roles within an Active Directory Environment 621
Working with Sites 626
Understanding Sites 626
Subnets 629
Site Planning 630
Criteria for Establishing Separate Sites 630
Creating a Site 631
Renaming a Site 636
Creating Subnets 637
Associating Subnets with Sites 640
Creating Site Links 642
Configuring Site Link Cost 645
Understanding Replication 648
Intrasite Replication 649
Intersite Replication 651
Bridgehead Servers 652
Site Link Bridges 652
Scheduling 653
Forcing Replication 654
Replication Protocols 654
Planning, Creating, and Managing the Replication Topology 655
Planning Replication Topology 655
Creating Replication Topology 655
Configuring Replication between Sites 656
Troubleshooting Replication Failure 657
Troubleshooting Replication 657
Using Event Viewer 658
Working with Trusts 659
Default Trusts 665
Forest Trusts 665
External Trusts 666
Shortcut Trusts 667
SID Filtering 668
Summary of Exam Objectives 670
Exam Objectives Fast Track 672
Exam Objectives Frequently Asked Questions 674
Self Test 678
Self Test Quick Answer Key 683
Chapter 8: IP Addressing and Services 684
Introduction 685
Configuring IPv4 and IPv6 Addressing 685
IPv4 Quick Review 687
Configuring Local IPv4 Settings 689
Configuring IPv4 Options 691
Subnetting 691
Supernetting 695
Alternative Configuration 696
Internet Protocol Version 6 (IPv6) 696
IPv6 Address Format 696
IPv6 Address Types 697
IPv6 Autoconfiguration Options 698
IPv6 Transition Technologies 698
Configuring IPv6 Settings 699
Configuring Dynamic Host Configuration Protocol (DHCP) 701
Adding the DHCP Server Role 702
Configuring DHCP Scopes 704
Configuring IPv4 Scopes and Options 704
DHCP IPv4 Reservations 707
Configuring DHCP Scope Options 707
Server Options 707
Scope Options 708
Reservation Options 708
Setting Scope Options 709
Configuring IPv6 Scopes 710
Configuring IPv6 Scope Options 713
DHCP IPv6 Client Reservation Configuration 713
Creating New Options 714
New Options Using the Windows Interface 715
New Options Using the Command Line 715
Exclusions 715
DHCP Relay Agents 719
PXE Boot 719
DHCP and Network Access Protection (NAP) 721
DHCP Configuration via Server Core 723
Configuring Network Authentication 726
NTLMv2 and Kerberos Authentication 727
WLAN Authentication Using 802.1x and 802.3 729
Wireless and Wired Authentication Technologies 730
Implementing Secure Network Access Authentication 732
Routing and Remote Access Services (RRAS) Authentication 736
Configuring IP Security (IPsec) 738
IPsec Authentication Header (AH) 740
IPsec Encapsulating Security Payload (ESP) 741
Configuring IPsec in Windows Server 2008 742
Creating IPsec Policy 744
IPsec Using the Command Line 744
IPsec Isolation Policy 746
Windows Firewall with Advanced Security in Windows Server 2008 747
Network Perimeter Firewalls 747
Host-based Firewalls 747
New Features in Windows Firewall with Advanced Security 747
IPsec Integration 748
Support for IPv6 749
Support for Active Directory User, Computer, and Groups 749
Location-Aware Profiles 749
Detailed Rules 749
Expanded Authenticated Bypass 750
Network Location-Aware Host Firewall 750
Server and Domain Isolation 752
Server Isolation 752
Domain Isolation 752
Configuring Windows Firewall with Advanced Security 752
Incoming and Outgoing Traffic Filtering 754
Firewall Rules 754
Connection Security Rules 757
Firewall Profiles 758
IPsec Settings 759
Monitoring 763
Managing Windows Firewall with Advanced Security via Group Policy 764
Identifying Ports and Protocols 765
Command Line Tools for Windows Firewall with Advanced Security 766
Summary of Exam Objectives 768
Exam Objectives Fast Track 770
Exam Objectives Frequently Asked Questions 774
Self Test 777
Self Test Quick Answer Key 783
Chapter 9: Configuring Network Access 784
Introduction 785
Windows Server 2008 and Routing 786
Window Server 2008 and Remote Access 787
Windows Server 2008 and Wireless Access 788
Configuring Routing 788
Routing Fundamentals 789
Static Routing 792
Routing Internet Protocol (RIP) 793
Open Shortest Path First (OSPF) 794
Configuring Remote Access 795
Routing and Remote Access Services (RRAS) 796
Network Policy Server and Network Access Protection 798
Dial-Up 802
Remote Access Policy 803
Network Address Translation (NAT) 805
Internet Connection Sharing (ICS) 807
Remote Access Protocols 810
Virtual Private Networks 817
Installing and Configuring a SSL VPN Server 818
Inbound/Outbound Filters 822
Configuring Remote Authentication Dial-In User Service (RADIUS) Server 823
Configuring Wireless Access 827
Set Service Identifier (SSID) 831
Wi-Fi Protected Access (WPA) 832
Wi-Fi Protected Access 2 (WPA2) 833
Ad Hoc vs. Infrastructure Mode 833
Wireless Group Policy 835
Summary of Exam Objectives 837
Exam Objectives Fast Track 837
Exam Objectives Frequently Asked Questions 841
Self Test 843
Self Test Quick Answer Key 847
Chapter 10: Network Access Protection 848
Introduction 849
Working with NAP 851
Network Layer Protection 851
NAP Clients 852
NAP Enforcement Points 853
Active Directory Domain Services 854
NAP Health Policy Server 854
Health Requirement Server 854
Restricted Network 855
Software Policy Validation 856
DHCP Enforcement 856
VPN Enforcement 862
Communication Process with VPN Client and NAP 862
Configuring NAP Health Policies 866
Connection Request Policies 867
Network Policies 868
Health Policies 869
Network Access Protection Settings 871
IPsec Enforcement 872
Secure Network 873
Boundary Network 873
Restricted Network 874
Flexible Host Isolation 874
802.1x Enforcement 877
Summary of Exam Objectives 881
Exam Objectives Fast Track 882
Exam Objectives Frequently Asked Questions 884
Self Test 886
Self Test Quick Answer Key 890
Appendix: Self Test Appendix 892
Chapter 1: Deploying Servers 893
Chapter 2: Configuring DNS 898
Chapter 3: Configuring Server Roles in Windows 2008 904
Chapter 4: Configuring Certificate Services and PKI 909
Chapter 5: Maintaining an Active Directory Environment 915
Chapter 6: Configuring Group Policy 923
Chapter 7: Configuring the Active Directory Infrastructure 929
Chapter 8: IP Addressing and Services 936
Chapter 9: Configuring Network Access 946
Chapter 10: Network Access Protection 951
Index 956