Untitled

[woodrowye-blog]

Automate creation of Active Directory accounts

Automate creation of Active Directory accounts. Could consist of but is just not limited to:bulk import; configure the UPN; produce pc, user, and group accounts (scripts,import, migration); template accounts; contacts; distribution lists Sustain Active Directory accounts. May well include but will not be restricted to: configure group membership; account resets; delegation; AGDLP/AGGUDLP; deny domain neighborhood group; local vs. domain; Protected Admin; disabling accounts vs. deleting accounts; deprovisioning; contacts; developing organizational units (OUs); delegation of handle Produce and apply Group Policy objects (GPOs). Might include things like but is just not restricted to:enforce, OU hierarchy, block inheritance, and enabling user objects; group policy processing priority; WMI; group policy filtering; group policy loopback Configure GPO templates. Could involve but is not limited to: user rights; ADMX Central Shop; administrative templates; security templates; restricted groups;security choices; starter GPOs; shell access policies Configure software deployment GPOs. May incorporate but just isn't restricted to: publishing to users; assigning computer software to users; assigning to computers; computer software removal Configure account policies. May incorporate but is not limited to: domain password policy; account lockout policy; fine-grain password policies Exam objectives are topic to change at any time without having prior notice and at Microsoft's sole vBdiscretion. Please stop by Microsoft's internet site for probably the most present listing of exam objectives. Configure audit policy by utilizing GPOs. Might include things like but is just not restricted to: audit logon events; audit account logon events; audit policy alter; audit access privilege use; audit directory service access; audit object access Configure backup and recovery. May perhaps include things like but will not be restricted to: utilizing Windows Server Backup; back up files and method state information to media; back up and restore by applying removable media; execute an authoritative or non-authoritative Active Directory restore; linked worth replication; Directory Services Recovery Mode (DSRM) (reset admin password); back up and restore GPOs Perform offline upkeep. Could contain but is not limited to: offline defragmentation and compaction; Restartable Active Directory; Active Directory database storage allocation Monitor Active Directory. May possibly involve but is just not limited to: Network Monitor; Process Manager; Occasion Viewer; ReplMon; RepAdmin; Windows Technique Resource Manager; Reliability and Overall performance Monitor; Server Overall performance Advisor; RSOP CONFIGURING ACTIVE DIRECTORY CERTIFICATE SERVICES Install Active Directory Certificate Services. May possibly include but will not be limited to: standalone vs. enterprise; CA hierarchies root vs. subordinate; certificate requests; certificate practice statement.

[woodrowye-blog]

the ICANN, RIR, and ISPs:Online Corporation for Assigned Names and Numbers (ICANN) Regional Net Registry (RIR) Your World wide web service provider (ISP)

You will discover 3 organizations that take a bite out in the 1st 48 bits of addresses. These are the ICANN, RIR, and ISPs:Online Corporation for Assigned Names and Numbers (ICANN) Regional Net Registry (RIR) Your World wide web service provider (ISP) Thankfully, the precise scope in the importance of those organizations is outside the objectives of this exam. Suffice to say, the internet address prefix goes through 3 filters going from ICANN to RIR to ISP that significantly more and alot more uniquely define the coverage location of those addresses.A single from the greatest modifications that came with IPv6 was the total and total removal from the concept of a broadcast address. And when you ask most busy administrators, thats a great issue. The cause is the fact that IPv6 has rather replaced the want for broadcast addresses together with the con- cept of multicast addressing. The word multicast is having somewhat ahead of myself, so Ill get started by defining the 3 distinctive kinds of addresses that happen to be accessible to you in IPv6: Unicast A unicast address is an address which is assigned to a particular host to ensure that host, and only that one particular particular host, can send and obtain information. Its equivalent to saying You and only you happen to be identified as this. Multicast A multicast address is properly a grouping of addresses which is addressed for the point of sending and receiving advice to that group. So, if you ever wanted to send a broadcast of material, you could send it to a particular multicast group.The name is a bit confusing, but an anycast address is similar to a multicast address in that its sent to a particular group of addresses, but only the address nearest to it. So, instead of sending it to each member with the group, it sends to a especially close to member of that group. For the purposes of this book, Ill focus on unicast addresses, simply because theyre what you as an administrator most care about. Concepts for example multicast addressing are a great deal more developed toward network administration and engineering, because they figure out what certain routing protocols are implemented and where they are able to and cannot be broadcast all through the network.

[woodrowye-blog]

The major rule for putting an infrastructure master is to not location it on any machine that is a global catalog server

The major rule for putting an infrastructure master is to not location it on any machine that is a global catalog server. This can be simply because when the international catalog server checks with other domains, it is going to not notice the inconsistencies amongst the two domains, for the reason that its already conscious of what they really should be. Instead, it is best to try to location a domain control- ler in an area that is not a international catalog server but has access to a domain controller from yet another domain. Maybe its just a holdover from the days of old, but to this day when particular administrators hear the phrases primary domain controller and backup domain controller from their friend Windows NT four, they shiver a bit bit. This can be because the world of Windows administra- tion was nowhere close to as friendly inside the early days as it is now. You dont necessarily will need a lecture on how issues implemented to become, even though. Instead, as a Windows Server 2008 administrator, you just ought to know tips on how to handle old equipment. The only reason to use this role is for those who have a machine operating Windows NT four that doesnt understand Active Directory. In this situation, the major domain controller can guarantee that all older machines can adjust passwords as Windows Server 2008 emulates the older authentication approach. Also, a principal domain controller tends to make certain that all machines with pre CActive Directory installations can maintain their instances synchronized. In Active Directory, the notion of a web site is fairly closely related to the idea of a subnet. A subnet is an isolated location within a network that is certainly blocked by a router that stops broadcast targeted traffic. From a design standpoint, this creates separation (and so isolation), and places physi- cal firewalls in between places. The caveat to this design is the fact that you may not must route amongst IP based subnets by making use of a router

[woodrowye-blog]

A special domain controller responsible for keeping backward compatibility with Windows NT domain controllers

A subset of an objects attributes that is stored inside the Global Catalog (GC) to cut down replication website traffic. The PAS may be changed by modifying the schema and marking attributes for replication to the GC.A policy that makes it possible for an administrator to ascertain which user groups are going to be allowed to utilize the read-only domain controller (RODC) credential caching. A Windows Installer file that updates application code. Patches is often employed to produce positive that new features are installed immediately after an application has already completed installation. A patch file will not remove any installed components.PDC Emulator Master Inside a domain, the PDC Emulator Master is responsible for main- taining backward compatibility with Windows NT domain controllers. When operating in mixed-mode domains, the PDC Emulator is able to method authentication requests and serve as a principal domain controller (PDC) with Windows NT backup domain controllers (BDCs). Security constructs made use of to regulate access to resources by username or group affiliation. Administrators can assign permissions to let any degree of access (like read- only, read/write, or delete) by controlling the capacity of users to initiate object services. Security is implemented by the technique checking the users security identifier (SID) against every objects access manage list (ACL).An RSoP mode that is made use of to plan Group Policy alterations before putting them into effect. See also Logging mode, Resultant Set of Policy (RSoP).pointer (PTR) record Used to associate an IP address to its hosts name. This record is essential due to the fact IP addresses begin with all the least-specific portion initially (the network) and end with the most particular portion (the host); whereas hostnames begin using the most distinct por- tion in the beginning along with the least specific at the finish. A special domain controller responsible for keeping backward compatibility with Windows NT domain controllers. main zone This zone is accountable for sustaining all of the records for the DNS zone. It consists of the primary copy in the DNS database and all record updates occur here. You create a brand new principal zone whenever you create a brand new DNS domain.

[woodrowye-blog]

Counters Counters are the actual parameters measured by Performance Monitor.

Counters Counters are the actual parameters measured by Performance Monitor. They're specific items that are grouped inside efficiency objects. For example, within the Processor efficiency object, there is certainly a counter for % Processor Time. This counter displays a single kind of detailed information and facts in regards to the Processor efficiency object (particularly, the quantity of total CPU time all the processes on the program are using). Situations Some counters will have instances. An instance additional identifies which perfor- mance par

<a href="http://www.mcitpking.com/">mcitp exams</a>

 ameter the counter is measuring. A very simple example is often a server with two CPUs. For those who choose that you simply prefer to monitor processor usage (using the Processor performance object) particularly, utilization (the %Total Utilization counter)you must nonetheless specify which CPU(s) you need to measure. In this example, you'd choose between monitoring either from the two CPUs or a total worth for both (making use of the Total instance). To specify which performance objects, counters, and situations you need to monitor, add them to Efficiency Monitor making use of the Add Counters dialog box. Figure 10.1 shows the var- ious on the market alternatives once you add new counters to monitor making use of Performance Monitor. The items that you simply is going to be in a position to monitor will probably be based on your hardware and software program configuration. For instance, in case you have not installed and configured the world wide web Knowledge Server (IIS) service, the solutions obtainable within the Web Server efficiency object will not be out there. Or, for those who have many network adapters or CPUs within the server, you are going to have the selection of viewing each instance separately or as part with the total value. Youll see which counters are commonly most helpful later in this chapter. The Windows Server 2008 Efficiency Monitor was designed to show information and facts in a clear and easy-to-understand format. Efficiency objects, counters, and instances may very well be displayed in each and every of 3 views. This flexibility will allow systems administrators to immediately and conveniently define the specifics they desire to see once then select how it'll be displayed based on spe- cific requires. Probably you will only use one view, but its helpful to understand what other views are out there according to what it is actually you will be wanting to assess.

[woodrowye-blog]

The Administrator account, however, is a far more powerful account that demands to become handled with care.

The Administrator account, however, is a far more powerful account that demands to become handled with care. This really is since the server could be effortlessly compromised if a hacker just com- promises the administrative credentials from the method. Therefore, it is essential for you to understand about this account and lock it down immediately following you finish installing the base NOS. To complete so, it is easy to rename the account with Group Policy or set it up as an account that's made use of only to log and audit attempts for use. If you happen to choose to produce a new Administrator account under a various name, be certain that you dont give out the new name and, also, be sure you secure it. Ordinarily, in smaller sized organizations, its simpler to just rename the account after which set it up as a trap, but undertaking so is up to you. At all times make an effort to generate a backup Administrator account and use it instead, but if you ever do, you need to make sure you by no means lock oneself out of the program. To stop this from happening, make certain you note what the new account will be named. In this chapter, we talked about organizing for and implementing security with Active Directory. You can't overlook security; its essential to constantly look at how security might possibly have an effect on your deployment or lack of ithow it is going to ultimately impact your program if it really is hacked. We also looked at the differences amongst security and distribution groups. Distribution groups are utilised for only 1 point: email distribution lists. These groups are utilized with email applications (for example Microsoft Exchange Server 2007) to send e-mail to the members in the group you develop. They'll not let you assign permissions, and mcitp exams you cannot use them to filter Group Policy settings. In the Windows Server 2008 operating system, security groups are applied to manage user account and laptop or computer account access to shared resources and to filter Group Policy settings. We also explained other fundamental items that pertain to security, that include what default groups are readily available following a base install with the operating system, and how you can secure essentially the most vulnerable accounts. We then examined how permissions are managed. You can actually alter permissions with Group Policy or simply by altering them correct on the object. We also covered how delegation of con- trol is often utilised to distribute administrative responsibilities. We wrapped up this chapter by discussed auditingwhy its essential and the way to get it performed. Thoroughly understanding each of those topics is important when youre implementing Active Directory within a business enterprise environment (and when youre preparing for the exam). Within the next chapter, we concentrate on Active Directory reliability and how to optimize it.

[woodrowye-blog]

We fully grasp that most of the people reading this book usually do not have a smart card reader just lying about

We fully grasp that most of the people reading this book usually do not have a smart card reader just lying about. If you ever don't possess a intelligent card reader, do as much with the workout as possible. This may still provide you with a feel for the approach. If you would prefer to practice on a intelligent card reader, you possibly can pick up a reader plus a card for really small revenue on an internet auction site.Inside the Certificate Request Wizard, pick the Enrollment Agent certificate template. Enter a name and description for the template. When prompted, click Install Certificate.After youve prepared the enrollment station to enroll intelligent cards certificates, it is possible to basically start writing certificate information and facts to the physical cards. Adhere to the actions in Exercising 9.six to enroll a intelligent card for user logon. Note which you have to total Physical exercise 9.five before continuing. In addition, you must have a intelligent card reader and at the least one blank smart card readily available.Inside the Address field, enter the address of the CA that issues intelligent card certificates and press Enter.Inside the Net Explorer (IE) window, click Request a Certificate, after which click Advanced Certificate Request. Click Request a certificate to get a intelligent card on behalf of yet another user using the intelligent card certificate enrollment station. If prompted, click Yes to accept the smart card sign- ing certificate.Click Intelligent Card Logon on the Smart Card Certificate Enrollment mcts windows 7 Station internet page.Below Certification Authority, choose the CA you want to problem the smart card certificate.Beneath Cryptographic Service Provider, select the cryptographic service provider from the smart cards manufacturer.Under Administrator Signing Certificate, click the Enrollment Agent certificate from the preceding workout.Under User To Enroll, click Select User. Pick the user to enroll and click Enroll.When prompted, insert the smart card in to the smart card reader and click OK. When prompted, enter a brand new PIN for the smart card. Configuring Group Policy Settings for Smart CardsNow that youve observed the way to configure a smart card enrollment station and setup smart cards for user logon, it is advisable to begin to consider Group Policy settings for enforcing intelligent card logon. A single from the most prevalent errors that administrators make when administering a smart card policy would be to not require intelligent card logon at all. This means that users with smart cards can log on with either their intelligent cards or by way of the common username and password process, which defeats the point of issuing intelligent cards within the very first location! Physical exercise 9.7 shows you find out how to configure Group Policy to require smart card authentication.

[woodrowye-blog]

The major tool you use to manage security permissions for users, groups, and computers would be the Active Directory Users And Computers tool

The major tool you use to manage security permissions for users, groups, and computers would be the Active Directory Users And Computers tool. Applying this tool, you're able to create and manage Active Directory objects and organize them based on your organization requires. Standard tasks for a large number of systems administrators may incorporate the following: Resetting a users password (for example, in circumstances where they forget their password) Developing new user accounts (when, for instance, a brand new employee joins the enterprise) Modifying group memberships depending on adjustments in job needs and functions Disabling user accounts (when, by way of example, users might be out of the office for long periods of time and will not call for network resource access)Once youve correctly grouped your users, you'll want to set the actual permissions that have an effect on the objects within Active Directory. The actual permissions readily available differ according to the kind of object. Table 9.1 gives an example of some of the permissions that you just can apply to a number of Active Directory objects and an explanation of what every permission does. Every object in Active Directory has an access manage list (ACL). The ACL is really a list of user accounts and groups which can be allowed to access the resource. For each ACL, there is an access control entry (ACE) that defines what a user or perhaps a group can really do with all the resource. Deny permissions are at all times listed first. This implies that if users have Deny permissions via user or group membership, they are going to not be allowed to access the object, even when they have explicit Allow permissions by means of other user or group permissions. Figure 9.7 shows an ACL for the Sales OU. The Security tab is only enabled for those who selected the Advanced Attributes mcts windows 7 solution from the View menu inside the Active Directory Users And Computer systems tool.You will be a new systems administrator for a medium-sized organization, and your network spans a single campus-type environment. The preceding administrator whom you replaced was the primary person who migrated the network from Windows 2000 to Windows Server 2008. Nobody is actually complaining concerning the network, and everyone seems happy with their new workstations. The atmosphere is especially collegial, with most employees on a first-name basis, along with a outstanding deal of one's job is completed in the hallway as you bump into people. As you familiarize yourself with all the network, you soon understand that the preceding administrator had an incredibly ad hoc approach to administration. A great number of in the permissions to resources had been given to person accounts as individuals asked for them. There doesnt appear to be any particular tactic in the style with the directory or the allocation of resources.

[woodrowye-blog]

You need to possess a security policy that states what's expected of every single laptop or computer user within your enterprise

You could continuously try to seek balanceto have enough security and, simultaneously, be somewhat transparent towards the finish users, who merely desire to do their jobs and not be both- ered by whats amongst the lines.You need to possess a security policy that states what's expected of every single laptop or computer user within your enterprise. Fine-tuning Active Directory to comply along with your security policy and permitting finish users to function devoid of an matter ought to be your aim. You need to know how you can use Active Directory to apply permissions to resources on the net- operate. An administrator need to spend specific attention for the evaluation of permissions when applied to unique groups along with the flow of permissions by means of the organizational units (OUs) via group policies. With all of this in mind, lets commence looking at how you are able to manage security within Active Directory. So that you can total the exercises in this chapter, you need to recognize the basics of working with mcse 2008 Active Directory objects. If you're not familiar with building and managing users, groups, computer systems, and OUs, it is advisable to review the information and facts in Chapter 7, Administering Active Directory, just before you continue. Among the basic style objectives for Active Directory would be to define a single, centralized repository of users and specifics resources. Active Directory records info about all the users, computers, and resources on your network. Each and every domain acts as a security bound- ary, and members from the domain (including workstations, servers, and domain controllers) share advice in regards to the objects within them. The material stored within Active Directory determines which resources are accessible to which users. By way of the use of permissions which can be assigned to Active Directory objects, it is possible to control all aspects of network security. All through this chapter, youll discover the specifics of security because it pertains to Active Directory. Note, but, that Active Directory security is only 1 aspect of general network security. You might want to also make sure which you have implemented suitable access manage settings for the filesystem, network devices, as well as other resources. Lets start out by looking at the many compo- nents of network security, which include things like working with security principals, and managing security and permissions, access control lists (ACLs), and access manage entries (ACEs).

[woodrowye-blog]

The Windows Installer supports a function identified as advertising

The Windows Installer supports a function identified as advertising. Advertising makes applica- tions seem to be out there via the Start out menu. However, the programs themselves may not in fact be installed on the system. When a user attempts to access an advertised application, the Windows Installer automatically downloads the necessary files from a server and installs the program. The finish outcome is that applications are installed only when they are necessary, along with the approach demands no intervention from the end user. Properly cover the facts of this approach later in this chapter. To any individual who has managed a number of software applications within a network atmosphere, all of mcse 2008 these features with the Windows Installer are most likely welcome ones. They also make life much easier for finish users and application developers who can concentrate on the true work their jobs demand. Windows Installer File Sorts When performing software program deployment with all the Windows Installer in Windows Server 2008, you could encounter numerous unique file forms: Microsoft Windows Installer (MSI) packages  In an effort to take full benefit of Windows Installer functionality, applications need to include things like Microsoft Windows Installer packages. These packages are generally designed by third-party application vendors and software developers, and they involve the info required to install and configure the application and any supporting files. Microsoft Transformation (MST) files Microsoft Transformation (MST) files are valuable once you are customizing the details of how applications are installed. When a systems administrator chooses to assign or publish an application, they may perhaps desire to specify extra possibilities for the package. If, for example, a systems administrator wants to permit users to install only the Microsoft Word and Microsoft PowerPoint elements of Workplace XP, they could specify these solutions within a transformation file. Then, when users install the application, they're going to be pro- vided with only the selections related to these components. Microsoft patches (MSP) In an effort to keep software program, patches are generally expected. Patches could possibly make Registry and/or filesystem modifications. Patch files are utilized for minor method adjustments and are subject to certain limitations. Particularly, a patch file can't get rid of any installed plan elements and cannot delete or modify any shortcuts designed by the user. Initialization files In order to deliver support for publishing nonCWindows Installer appli- cations, initialization files can be implemented. These files supply links to a normal executable file that is utilised to install an application. An instance may be \\server1\software\program1\ setup.exe . These files can then be published and advertised, and users can access the Add or Remove Programs icon to install them over the network.

[woodrowye-blog]

Once the domain tree is built into the DNS database

Once the domain tree is built into the DNS database, a special PTR record is added to asso- ciate the IP addresses to the corresponding hostnames. In other words, to find a hostname for the IP address 206.131.234.1, the resolver would query the DNS server for a PTR record for 1.234.131.206.in-addr.arpa . If this IP address is outside the local domain, the DNS server would start at the root and sequentially resolve the domain nodes until arriving at 234.131.206.in-addr.arpa , which would contain the PTR record for the desired host. When a name server is processing a recursive query, it may be required to send out several que- ries to find the definitive answer. Name servers, mcse acting as resolvers, are allowed to cache all the received information during this process; each record contains information called time to live (TTL). The TTL specifies how long the record will be held in the local cache until it must be resolved again. If a query comes in that can be satisfied by this cached data, the TTL thats returned with it equals the current amount of time left before the data is flushed. There is also a negative cache TTL. The negative cache TTL is used when an authoritative server responds to a query indicating that the record queried doesnt exist and indicates the amount of time that this negative answer may be held. Negative caching is quite helpful in pre- venting repeated queries for names that dont exist. The administrator for the DNS zone sets TTL values for the entire zone. The value can be the same across the zone or the administrator can

[woodrowye-blog]

an administrator will need to populate the DNS database manually

If you decide to use Non-Dynamic DNS, an administrator will need to populate the DNS database manually. Non-Dynamic DNS is a reasonable choice if your organization is small to mid-sized and you do not want extra network traffic (clients updating to the DNS server), or if you need to manually enter the computer due to strict security measures. Dynamic DNS has the ability to be secure, and the chances are slim that a rogue system (a computer that does not belong in your DNS database) could update to a secure DNS server. Nevertheless, some organizations have to fol- low stricter security measures and are not allowed to have dynamic updates. The major downside to manually entering records into DNS occurs ccna exam when the organization is using the Dynamic Host Configuration Protocol (DHCP) . When using DHCP, it is possible for users to end up with different TCP/IP addresses every day. This means that an administra- tor has to manually update DNS daily to keep it accurate. If you decide to allow Dynamic DNS, you need to decide how you want to set it up. When setting up dynamic updates on your DNS server, you have three choices (see Figure 2.3):NoneThis means your DNS server is Non-Dynamic.Nonsecure and secureThis means that any machine (even if it does not have a domain account) can register with DNS. Using this setting could allow rogue systems to enter records into your DNS server. Secure onlyThis means that only machines with accounts in Active Directory can register with DNS. Before DNS registers any account in its database, it checks Active Directory to make sure that account is an authorized domain computer.On a Microsoft Windows Server 2008 network, TCP/IP is the protocol used for network com- munications. Users have two ways to receive a TCP/IP number: Static (administrators manually enter the TCP/IP information) Dynamic (using DHCP)When an administrator sets up TCP/IP, DNS can also be configured.

[woodrowye-blog]

The Berkeley Internet Name Domain (BIND) was originally the only software for running the root servers on the Internet

The Berkeley Internet Name Domain (BIND) was originally the only software for running the root servers on the Internet. However, a few years ago the organizations responsible for the root servers undertook an effort to diversify the software running on these important machines. Today, root servers run multiple kinds of name server software. BIND is still primary, however, and it is the most popular for Internet providers as well. None of the root servers run Windows DNS. Any DNS server implementation supporting Service Location Resource Records (see RFC 2782) and Dynamic Updates (RFC 2136) is sufficient Mcsa Exams to provide the name service for any oper- ating system running Windows 2000 software and above.DNS client A DNS client is any machine that issues queries to a DNS server. The client host- name may or may not be registered in a DNS database. Clients issue DNS requests through pro- cesses called resolvers. Youll sometimes see the terms client and resolver used synonymously. Resolver Resolvers are software processes, sometimes implemented in software libraries, that handle the actual process of finding the answers to queries for DNS data. The resolver is also built into many larger pieces of software so that external libraries dont have to be called in order to make and process DNS queries. Resolvers can be what youd consider client com- puters or other DNS servers attempting to resolve an answer on behalf of a client. Query A query is a request for information sent to a DNS server. Three types of queries can be made to a DNS server: recursive, inverse, and iterative. Well discuss their differences in the following section. To help you understand the DNS process, we will start by covering the differences between Dynamic DNS and Non-Dynamic DNS. During this discussion you will learn how Dynamic DNS populates the DNS database. Youll also see how to implement security for Dynamic DNS. We will then talk about the workings of different types of DNS queries. Finally we will discuss caching and time to live (TTL). Youll learn how to determine the best setting for your organization.