Quiz Windows Server 2008 Active Directory, Configuring

Http://technet.microsoft.com/en-us/library/cc732095.aspx
Understanding Account Stores
Active Directory Federation Services (AD FS) uses account stores to log on users and extract security
claims for those users. You can configure multiple account stores for a single Federation Service. You can
also define their priority. The Federation Service uses Lightweight Directory Access Protocol (LDAP) to
communicate with account stores. AD FS supports the following two account stores:
Active Directory Domain Services (AD DS)
Active Directory Lightweight Directory Services (AD LDS)

Http://technet.microsoft.com/en-us/library/cc753343%28v=ws.10%29.aspx
Ntdsutil
Ntdsutil.exe is a command-line tool that provides management facilities for Active Directory Domain
Services (AD DS) and Active Directory Lightweight Directory Services (AD LDS). You can use the ntdsutil
commands to perform database maintenance of AD DS, manage and control single master operations, and
remove metadata left behind by domain controllers that were removed from the network without being
properly uninstalled. This tool is intended for use by experienced administrators.
..
Commands set DSRM password - Resets the Directory Services Restore Mode (DSRM) administrator
password.
Further information:
http://technet.microsoft.com/en-us/library/cc754363%28v=ws.10%29.aspx
Set DSRM password
Resets the Directory Services Restore Mode (DSRM) password on a domain controller. At the Reset DSRM
Administrator Password: prompt, type any of the parameters listed under "Syntax." This is a subcommand
of Ntdsutil and Dsmgmt. Ntdsutil and Dsmgmt are command-line tools that are built into Windows Server
2008 and Windows Server 2008 R2. Ntdsutil is available if you have the Active Directory Domain Services
(AD DS) or Active Directory Lightweight Directory Services (AD LDS) server role installed.
Dsmgmt is available if you have the AD LDS server role installed. These tools are also available if you
install the Active Directory Domain Services Tools that are part of the Remote Server Administration Tools
(RSAT).

Http://technet.microsoft.com/en-us/library/cc771150.aspx
Change the Zone Type
You can use this procedure to change make a zone a primary, secondary, or stub zone. You can also use it
to integrate a zone with Active Directory Domain Services (AD DS). http://technet.microsoft.com/en-us/
library/cc726034.aspx Understanding Active Directory Domain Services Integration The DNS Server service
is integrated into the design and implementation of Active Directory Domain Services (AD DS). AD DS
provides an enterprise-level tool for organizing, managing, and locating resources in a network.
Benefits of AD DS integration
For networks that deploy DNS to support AD DS, directory-integrated primary zones are strongly
recommended. They provide the following benefits:
DNS features multimaster data replication and enhanced security based on the capabilities of AD DS. In a
standard zone storage model, DNS updates are conducted based on a single-master update model. In this
model, a single authoritative DNS server for a zone is designated as the primary source for the zone. This
server maintains the master copy of the zone in a local file. With this model, the primary server for the zone
represents a single fixed point of failure. If this server is not available, update requests from DNS clients are
not processed for the zone. With directory-integrated storage, dynamic updates to DNS are sent to any AD
DS-integrated DNS server and are replicated to all other AD DS-integrated DNS servers by means of AD
DS replication. In this model, any AD DS-integrated DNS servercan accept dynamic updates for the zone.
Because the master copy of the zone is maintained in the AD DS database, which is fully replicated to all
domain controllers, the zone can be updated by the DNS servers operating at any domain controller for the
domain. With the multimaster update model of AD DS, any of the primary servers for the directoryintegrated
zone can process requests from DNS clients to update the zone as long as a domain controller is available
and reachable on the network.
..
Zones are replicated and synchronized to new domain controllers automatically whenever a new one is
added to an AD DS domain.
By integrating storage of your DNS zone databases in AD DS, you can streamline database replication
planning for your network.
Directory-integrated replication is faster and more efficient than standard DNS replication. http://
technet.microsoft.com/en-us/library/ee649124%28v=ws.10%29.aspx Deploy IPsec Policy to DNS Servers
You can deploy IPsec rules through one of the following mechanisms:
Domain Controllers organizational unit (OU): If the DNS servers in your domain are Active
Directoryintegrated, you can deploy IPsec policy settings using the Domain Controllers OU. This option is
recommended to make configuration and deployment easier. DNS Server OU or security group: If you have
DNS servers that are not domain controllers, then consider creating a separate OU or a security group with
the computer accounts of your DNS servers. Local firewall configuration: Use this option if you have DNS
servers that are not domain members or if you have a small number of DNS servers that you want to
configure locally. http://technet.microsoft.com/en-us/library/cc772661%28v=ws.10%29.aspx Deploying
Secure DNS
Protecting DNS Servers
When the integrity of the responses of a DNS server are compromised or corrupted, or when the DNS data
is tampered with, clients can be misdirected to unauthorized locations without their knowledge. After the
clients start communicating with these unauthorized locations, attempts can be made to gain access to
information that is stored on the client computers. Spoofing and cache pollution are examples of this type of
attack. Another type of attack, the denial-of-service attack, attempts to incapacitate a DNS server to make
DNS infrastructure unavailable in an enterprise. To protect your DNS servers from these types of attacks:
Use IPsec between DNS clients and servers.
Monitor network activity.
Close all unused firewall ports.
Implementing IPsec Between DNS Clients and Servers
IPsec encrypts all traffic over a network connection. Encryption minimizes the risk that data that is sent
between the DNS clients and the DNS servers can be scanned for sensitive information or tampered with
by anyone attempting to collect information by monitoring traffic on the network. When IPsec is enabled,
both ends of a connection are validated before communication begins. A client can be certain that the DNS
server with which it is communicating is a valid server. Also, all communication over the connection is
encrypted, thereby eliminating the possibility of tampering with client communication. Encryption prevents
spoofing attacks, which are false responses to DNS client queries by unauthorized sources that act like a
DNS server.
Further information:
http://technet.microsoft.com/en-us/library/cc771898.aspx Understanding Zone Types
The DNS Server service provides

Http://technet.microsoft.com/en-us/library/cc754956%28v=ws.10%29.aspx
RODC Frequently Asked Questions
What new attributes support the RODC Password Replication Policy? Password Replication Policy is the
mechanism for determining whether a user or computer's credentials are allowed to replicate from a
writable domain controller to an RODC. The Password Replication Policy is always set on a writable domain
controller running Windows Server 2008. What operations fail if the WAN is offline, but the RODC is online
in the branch office? If the RODC cannot connect to a writable domain controller running Windows Server
2008 in the hub, the following branch office operations fail:
Password changes
Attempts to join a computer to a domain
Computer rename
Authentication attempts for accounts whose credentials are not cached on the RODC Group Policy updates
that an administrator might attempt by running the gpupdate /force command What operations succeed if
the WAN is offline, but the RODC is online in the branch office? If the RODC cannot connect to a writable
domain controller running Windows Server 2008 in the hub, the following branch office operations succeed:
Authentication and logon attempts, if the credentials for the resource and the requester are already cached,
Local RODC server administration performed by a delegated RODC server administrator.

Http://technet.microsoft.com/en-us/library/cc753751.aspx
Allow Only Secure Dynamic Updates
Domain Name System (DNS) client computers can use dynamic update to register and dynamically update
their resource records with a DNS server whenever changes occur. This reduces the need for manual
administration of zone records, especially for clients that frequently move or change locations and use
Dynamic Host Configuration Protocol (DHCP) to obtain an IP address. Dynamic updates can be secure or
nonsecure. DNS update security is available only for zones that are integrated into Active Directory Domain
Services (AD DS). After you directory-integrate a zone, access control list (ACL) editing features are
available in DNS Manager so that you can add or remove users or groups from the ACL for a specified
zone or resource record.
Further information:
http://technet.microsoft.com/en-us/library/cc771255.aspx
Understanding Dynamic Update

Http://social.technet.microsoft.com/wiki/contents/articles/832.transferring-fsmo-roles-in-indows-server-
2008.aspx
Transferring FSMO Roles in Windows Server 2008
One of any system administrator duties, would be to upgrade a current domain controller to a new hardware
server. One of the crucial steps required to successfully migrate your domain controller, is to be able to
successfully transfer the FSMO roles to the new hardware server. FSMO stands for Flexible Single Master
Operations, and in a forest there are at least five roles.
The five FSMO roles are:
Schema Master
Domain Naming Master
Infrastructure Master
Relative ID (RID) Master
PDC Emulator
The first two roles above are forest-wide, meaning there is one of each for the entire forest. The last three
are domain-wide, meaning there is one of each per domain. If there is one domain in your forest, you will
have five FSMO roles. If you have three domains in your forest, there will be 11 FSMO roles.

Http://technet.microsoft.com/en-us/library/cc753011.aspx
Enable Key Archival for a CA
Before a key recovery agent can use a key recovery certificate, the key recovery agent must have enrolled
for the key recovery certificate and be registered as the recovery agent for the certification authority (CA).
You must be a CA administrator to complete this procedure.
To enable key archival for a CA:
1. Open the Certification Authority snap-in.
2. In the console tree, click the name of the CA.
3. On the Action menu, click Properties.
4. Click the Recovery Agents tab, and then click Archive the key.
5. In Number of recovery agents to use, type the number of key recovery agents that will be used to encrypt
the archived key.
The Number of recovery agents to use must be between one and the number of key recovery agent
certificates that have been configured.
6. Click Add. Then, in Key Recovery Agent Selection, click the key recovery certificates that are displayed,
and click OK.
7. The certificates should appear in the Key recovery agent certificates list, but their status is listed as Not
loaded.
8. Click OK or Apply. When prompted to restart the CA, click Yes. When the CA has restarted, the status of
the certificates should be listed as Valid.
Further information:
http://technet.microsoft.com/en-us/library/ee449489%28v=ws.10%29.aspx
Key Archival and Management in Windows Server 2008
http://technet.microsoft.com/en-us/library/cc730721.aspx
Managing Key Archival and Recovery

Http://technet.microsoft.com/en-us/library/cc730756.aspx
Understanding Forwarders
A forwarder is a Domain Name System (DNS) server on a network that forwards DNS queries for external
DNS names to DNS servers outside that network. You can also forward queries according to specific
domain names using conditional forwarders.
You designate a DNS server on a network as a forwarder by configuring the other DNS servers in the
network to forward the queries that they cannot resolve locally to that DNS server. By using a forwarder, you
can manage name resolution for names outside your network, such as names on the Internet, and improve
the efficiency of name resolution for the computers in your network. The following figure illustrates how
external name queries are directed with forwarders.

Tap the image to zoom
Conditional forwarders
A conditional forwarder is a DNS server on a network that forwards DNS queries according to the DNS
domain name in the query. For example, you can configure a DNS server to forward all the queries that it
receives for names ending with corp.contoso.com to the IP address of a specific DNS server or to the IP
addresses of multiple DNS servers.
Further information:
http://technet.microsoft.com/en-us/library/cc794735%28v=ws.10%29.aspx
Assign a Conditional Forwarder for a Domain Name
http://technet.microsoft.com/en-us/library/cc754941.aspx
Configure a DNS Server to Use Forwarders

Http://technet.microsoft.com/en-us/library/cc816720%28v=ws.10%29.aspx
Move the Directory Database and Log Files to a Local Drive You can use this procedure to move Active
Directory database and log files to a local drive. When you move the files to a folder on the local domain
controller, you can move them permanently or temporarily. Move the files to a temporary destination if you
need to reformat the original location, or move the files to a permanent location if you have additional disk
space. If you reformat the original drive, use the same procedure to move the files back after the reformat is
complete. Ntdsutil.exe updates the registry when you move files locally. Even if you are moving the files only
temporarily, use Ntdsutil.exe so that the registry is always current.
On a domain controller that is running Windows Server 2008, you do not have to restart the domain
controller in Directory Services Restore Mode (DSRM) to move database files. You can stop the Active
Directory Domain
Services (AD DS) service and then restart the service after you move the files to their permanent location.
To move the directory database and log files to a local drive:
..
7. At the ntdsutil prompt, type files, and then press ENTER.
8. To move the database file, at the file maintenance: prompt, use the following commands:
....
Further information:
http://servergeeks.wordpress.com/2013/01/01/moving-active-directory-database-and-logs/ Moving Active
Directory Database and Logs
Step 1
Start the server in Directory Services Restore Mode
Windows Server 2003/2008 Directory Service opens its files in exclusive mode. This means that the files
cannot be managed while the server is operating as a domain controller. To perform any files movement
related activities using ntdsutil, we need to start the server in Directory Services Restore Mode.
To start the server in Directory Services Restore mode, follow these steps:
Restart the computer.
After the BIOS information is displayed, press F8.
Use the DOWN ARROW to select Directory Services Restore Mode, and then press ENTER.

Tap the image to zoom
Log on with your local administrative account and password. (Not Domain Administrative account)

Tap the image to zoom
Note: using service control (SC.exe) you can verify quickly ntds services are running or stopped. In
command prompt type SC query ntds

Tap the image to zoom
Step 2
How to Move Active Directory Database and Logs
You can move the Ntds.dit data file to a new folder. If you do so, the registry is updated so that Directory
Service uses the new location when you restart the server. To move the data file to another folder, follow
these steps:
Click Start, click Run, type ntdsutil in the Open box, and then press ENTER.

Tap the image to zoom
At the Ntdsutil command prompt, type activate instance ntds, and then press ENTER.

Tap the image to zoom
At the Ntdsutil command prompt, type files, and then press ENTER.

Tap the image to zoom
At the file maintenance command prompt, type move DB to <new location> (where new location is an
existing folder that you have created for this purpose) and then press ENTER. In this case, the new location
for database is C:\AD\Database Now

Tap the image to zoom
Now to move logs , at the file maintenance command prompt, type move logs to <new location> (where
new location is an existing folder that you have created for this purpose) and then press ENTER. In our
case, the new location for database is C:\AD\Logs

Tap the image to zoom
To quit file maintenance, type quit. Again to Ntdsutil, type quit to close the prompt Restart the computer. AD
database and Logs are moved successfully to new location.

Http://technet.microsoft.com/en-us/library/dd349800%28v=ws.10%29.aspx
Audit Policy
Establishing an organizational computer system audit policy is an important facet of information security.
Configuring Audit policy settings that monitor the creation or modification of objects gives you a way to track
potential security problems, helps to ensure user accountability, and provides evidence in the event of a
security breach.
There are nine different kinds of events for which you can specify Audit Policy settings. If you audit any of
these kinds of events, Windows±® records the events in the Security log, which you can find in Event Viewer.
..
Object access. Audit this to record when someone has used a file, folder, printer, or other object.
..
Process tracking. Audit this to record when events such as program activation or a process exiting occur.
..
When you implement Audit Policy settings:
..
If you want to audit directory service access or object access, determine which objects you want to audit
access of and what type of access you want to audit. For example, if you want to audit all attempts by users
to open a particular file, you can configure audit policy settings in the object access event category so that
both successful and failed attempts to read a file are recorded.
Further information:
http://technet.microsoft.com/en-us/library/hh147307%28v=ws.10%29.aspx Group Policy for Beginners
Group Policy Links
At the top level of AD DS are sites and domains. Simple implementations will have a single site and a single
domain. Within a domain, you can create organizational units (OUs). OUs are like folders in Windows
Explorer.
Instead of containing files and subfolders, however, they can contain computers, users, and other objects.
For example, in Figure 1 you see an OU named Departments. Below the Departments OU, you see four
subfolders: Accounting, Engineering, Management, and Marketing. These are child OUs. Other than the
Domain Controllers OU that you see in Figure 1, nothing else in the figure is an OU. What does this have to
do with Group Policy links? Well, GPOs in the Group Policy objects folder have no impact unless you link
them to a site, domain, or OU. When you link a GPO to a container, Group Policy applies the GPO's
settings to the computers and users in that container.