Technical Interview Questions (Part 2/3) ACTIVE DIRECTOR ! Edited & Maintained by SYED JAHANZAIB / aacable@hotmail.

com

What is Active Directory?

An active directory is a directory structure used on Microsoft Windows based computers and servers to store information and data about networks and domains. It is primarily used for online information and was originally created in 1996. It was first used with Windows !!!. An active directory "sometimes referred to as an A#$ does a variety of functions including the ability to rovide information on ob%ects& helps organi'e these ob%ects for easy retrieval and access& allows access by end users and administrators and allows the administrator to set security up for the directory. Active #irectory is a hierarchical collection of network resources that can contain users& computers& printers& and other Active #irectories. Active #irectory (ervices "A#($ allow administrators to handle and maintain all network resources from a single location . Active #irectory stores information and settings in a central database

What is LDAP?

)he *ightweight #irectory Access +rotocol& or *#A+ & is an application protocol for ,uerying and modifying directory services running over )-+.I+. Although not yet widely implemented& *#A+ should eventually make it possible for almost any application running on virtually any computer platform to obtain directory information& such as email addresses and public keys. /ecause *#A+ is an open protocol& applications need not worry about the type of server hosting the directory.

Can you connect Active Directory to other 3rd-party Directory Services? Name a few options.

01es you can connect other vendors #irectory (ervices with Microsoft2s version. 01es& you can use dir3M* or *#A+ to connect to other directories "ie. 40directory from 5ovell or 5#( "5ovel directory (ystem$. 01es you can -onnect Active #irectory to other 6rd 0party #irectory (ervices such as dictonaries used by (A+& #omino etc with the help of MII( " Microsoft Identity Integration (erver $

Where is the AD data ase he!d? What other fo!ders are re!ated to AD?

A# #atabase is saved in 7systemroot7.ntds. 1ou can see other files also in this folder. )hese are the main files controlling the A# structure ntds.dit

edb.log res1.log res .log edb.chk When a change is made to the Win 8 database& triggering a write operation& Win 8 records the transaction in the log file "edb.log$. 9nce written to the log file& the change is then written to the A# database. (ystem performance determines how fast the system writes the data to the A# database from the log file. Any time the system is shut down& all transactions are saved to the database. #uring the installation of A#& Windows creates two files: res1.log and res .log. )he initial si'e of each is 1!M/. )hese files are used to ensure that changes can be written to disk should the system run out of free disk space. )he checkpoint file "edb.chk$ records transactions committed to the A# database "ntds.dit$. #uring shutdown& a ;shutdown< statement is written to the edb.chk file. )hen& during a reboot& A# determines that all transactions in the edb.log file have been committed to the A# database. If& for some reason& the edb.chk file doesn2t e=ist on reboot or the shutdown statement isn2t present& A# will use the edb.log file to update the A# database. )he last file in our list of files to know is the A# database itself& ntds.dit. /y default& the file is located in>5)#(& along with the other files we2ve discussed

What is the S"S#$L fo!der?

0 All active directory data base security related information store in (1(?9* folder and its only created on 5)@( partition. 0 )he (ysvol folder on a Windows domain controller is used to replicate file0based data among domain controllers. /ecause %unctions are used within the (ysvol folder structure& Windows 5) file system "5)@($ version A.! is re,uired on domain controllers throughout a Windows distributed file system "#@($ forest. )his is a ,uote from microsoft themselves& basically the domain controller info stored in files like your group policy stuff is replicated through this folder structure

Name the AD NCs and rep!ication issues for each NC

B(chema 5-& B-onfiguration 5-& #omain 5Schema NC )his 5- is replicated to every other domain controller in the forest. It contains information about the Active #irectory schema& which in turn defines the different ob%ect classes and attributes within Active #irectory. Confi%uration NC Also replicated to every other #- in the forest& this 5- contains forest0wide configuration information pertaining to the physical layout of Active #irectory& as well as

information about display specifiers and forest0wide Active #irectory ,uotas. Domain NC )his 5- is replicated to every other #- within a single Active #irectory domain. )his is the 5- that contains the most commonly0accessed Active #irectory data: the actual users& groups& computers& and other ob%ects that reside within a particular Active #irectory domain.

What are app!ication partitions? When do & use them

Application directory partitions: )hese are specific to Windows (erver !!6 domains. An application directory partition is a directory partition that is replicated only to specific domain controllers. A domain controller that participates in the replication of a particular application directory partition hosts a replica of that partition. 9nly #omain controllers running Windows (erver !!6 can host a replica of an application directory partition.

'ow do you create a new app!ication partition

http:..wiki.answers.com.C.DowEdoEyouEcreateEaEnewEapplicationEpartition

'ow do you view rep!ication properties for AD partitions and DCs?

/y using replication monitor go to start F run F type rep!mon

What is the (!o a! Cata!o%?

)he global catalog contains a complete replica of all ob%ects in Active #irectory for its Dost domain& and contains a partial replica of all ob%ects in Active #irectory for every other domain in the forest. )he global catalog is a distributed data repository that contains a searchable& partial representation of every ob%ect in every domain in a multidomain Active #irectory forest. )he global catalog is stored on domain controllers that have been designated as global catalog servers and is distributed through multimaster replication. (earches that are directed to the global catalog are faster because they do not involve referrals to different domain controllers. In addition to configuration and schema directory partition replicas& every domain controller in a Windows !!! (erver or Windows (erver !!6 forest stores a full& writable replica of a single domain directory partition. )herefore& a domain controller can locate only the ob%ects in its domain. *ocating an ob%ect in a different domain would re,uire the user or application to provide the domain of the re,uested ob%ect. )he global catalog provides the ability to locate ob%ects from any domain without having to know the domain name. A global catalog server is a domain controller that& in addition to its full& writable domain directory partition replica& also stores a partial& read0only replica of all other domain directory partitions in the forest. )he additional domain directory partitions are partial

because only a limited set of attributes is included for each ob%ect. /y including only the attributes that are most used for searching& every ob%ect in every domain in even the largest forest can be represented in the database of a single global catalog server.

'ow do you view a!! the (Cs in the forest?

-:>Frepadmin.showreps domainEcontroller 9G 1ou can use Geplmon.e=e for the same purpose. 9G A# (ites and (ervices and nslookup gc.Emsdcs.7H(4G#5(#9MAI57

Why not ma)e a!! DCs in a !ar%e forest as (Cs?

)he reason that all #-s are not I-s to start is that in large "or even Iiant$ forests the #-s would all have to hold a reference to every ob%ect in the entire forest which could be ,uite large and ,uite a replication burden. @or a few hundred& or a few thousand users even& this not likely to matter unless you have really poor WA5 lines.

*ryin% to !oo) at the Schema+ how can & do that?

adsiedit.e=e option to view the schema register schmmgmt.dll using this command c:>windows>system6 Fregsvr6 schmmgmt.dll 9pen mmc JF add snapin JF add Active directory schema name it as schema.msc 9pen administrative tool JF schema.msc

What are the Support *oo!s? Why do & need them?

(upport )ools are the tools that are used for performing the complicated tasks easily. )hese can also be the third party tools. (ome of the (upport tools include #ebug?iewer& #ependency?iewer& GegistryMonitor& etc. 0edit by -as,uehead I beleive this ,uestion is reffering to the Windows (erver !!6 (upport )ools& which are included with Microsoft Windows (erver !!6 (ervice +ack . )hey are also available for download here:

http:..www.microsoft.com.downloads.details.asp=KfamilyidL96A6A!110@#M60N19#0969/0 AOO 4A #@9!PdisplaylangLen 1ou need them because you cannot properly manage an Active #irectory network without them. Dere they are& it would do you well to familiari'e yourself with all of them. Acldiag.e=e Adsiedit.msc /itsadmin.e=e #cdiag.e=e #fsutil.e=e #nslint.e=e #sacls.e=e Iadstools.dll 8tpass.e=e *dp.e=e 5etdiag.e=e 5etdom.e=e 5tfrsutl.e=e +ort,ry.e=e Gepadmin.e=e Geplmon.e=e (etspn.e=e , What is -.PL/$N? What is ADS&.D&*? What is N.*D$/? What is -.PAD/&N? ADS&.dit is a Microsoft Management -onsole "MM-$ snap0in that acts as a low0level editor for Active #irectory. It is a Iraphical Hser Interface "IHI$ tool. 5etwork administrators can use it for common administrative tasks such as adding& deleting& and moving ob%ects with a directory service. )he attributes for each ob%ect can be edited or deleted by using this tool. A#(I4dit uses the A#(I application programming interfaces "A+Is$ to access Active #irectory. )he following are the re,uired files for using this tool: 0 ADS&.D&*.DLL 0 ADS&.D&*./SC Gegarding system re,uirements& a connection to an Active #irectory environment and Microsoft Management -onsole "MM-$ is necessary A1 -ep!mon is the first tool you should use when troubleshooting Active #irectory replication issues. As it is a graphical tool& replication issues are easy to see and somewhat easier to diagnose than using its command line counterparts. )he purpose of this document is to guide you in how to use it& list some common replication errors and show some e=amples of when replication issues can stop other network installation actions.

for more go to http:..www.techtutorials.net.articles.replmonEhowtoEa.html N.*D$/ is a command0line tool that allows management of Windows domains and trust relationships. It is used for batch management of trusts& %oining computers to domains& verifying trusts& and secure channels A: 4nables administrators to manage Active #irectory domains and trust relationships from the command prompt. Netdom is a command0line tool that is built into Windows (erver !!M. It is available if you have the Active #irectory #omain (ervices "A# #($ server role installed. )o use netdom& you must run the netdom command from an elevated command prompt. )o open an elevated command prompt& click Start& right0click Command Prompt& and then click -un as administrator. G4+A#MI5.434 is a command line tool used to monitor and troubleshoot replication on a computer running Windows. )his is a command line tool that allows you to view the replication topology as seen from the perspective of each domain controller. G4+A#MI5 is a built0in Windows diagnostic command0line utility that works at the Active #irectory level. Although specific to Windows& it is also useful for diagnosing some 4=change replication problems& since 4=change (erver is Active #irectory based. G4+A#MI5 doesn2t actually fi= replication problems for you. /ut& you can use it to help determine the source of a malfunction.

What are sites? What are they used for?

Active directory sites& which consist of well0connected networks defined by I+ subnets that help define the physical structure of your A#& give you much better control over replication traffic and authentication traffic than the control you get with Windows 5) N.! domains. Hsing Active #irectory& the network and its ob%ects are organi'ed by constructs such as domains& trees& forests& trust relationships& organi'ational units "9Hs$& and sites.

What2s the difference etween a site !in)2s schedu!e and interva!?

(chedule enables you to list weekdays or hours when the site link is available for replication to happen in the give interval. Interval is the re occurrence of the inter site replication in given minutes. It ranges from 1A J 1!&!M! mins. )he default interval is 1M! mins.

What is the 3CC?

)he 8-- is a built0in process that runs on all domain controllers and generates replication topology for the Active #irectory forest. )he 8-- creates separate replication topologies depending on whether replication is occurring within a site "intrasite$ or between sites "intersite$.

)he 8-- also dynamically ad%usts the topology to accommodate new domain controllers& domain controllers moved to and from sites& changing costs and schedules& and domain controllers that are temporarily unavailable.

What is the &S*(? Who has that ro!e y defau!t?

Intersite )opology Ienerator "I()I$& which is responsible for the connections among the sites. /y default Windows !!6 @orest level functionality has this role. /y #efault the first (erver has this role. If that server can no longer preform this role then the ne=t server with the highest IHI# then takes over the role of I()I.

What are the re4uirements for insta!!in% AD on a new server? Q An 5)@( partition with enough free space " A!M/ minimum$ Q An Administrator2s username and password Q )he correct operating system version Q A 5IQ +roperly configured )-+.I+ "I+ address& subnet mask and J optional J default gateway$ Q A network connection "to a hub or to another computer via a crossover cable$ Q An operational #5( server "which can be installed on the #- itself$ Q A #omain name that you want to use Q )he Windows !!! or Windows (erver !!6 -# media "or at least the i6M6 folder$ @rom the +etri I) 8nowledge base. @or more info& follow this link: http:..www.petri.co.il.activeEdirectoryEinstallationEre,uirements.htm

What can you do to promote a server to DC if you2re in a remote !ocation with s!ow WAN !in)?

@irst available in Windows !!6& you will create a copy of the system state from an e=isting #and copy it to the new remote server. Gun ;#cpromo .adv<. 1ou will be prompted for the location of the system state files

'ow can you forci !y remove AD from a server+ and what do you do !ater? 5 Can & %et user passwords from the AD data ase?

#emote the server using dcpromo .forceremoval& then remove the metadata from Active directory using ndtsutil. )here is no way to get user passwords from A# that I am aware of& but you should still be able to change them. Another way out too Gestart the #- is #(GM mode a. *ocate the following registry subkey: D841E*9-A*EMA-DI54>(1()4M>-urrent-ontrol(et>-ontrol>+roduct9ptions b. In the right0pane& double0click Product*ype. c. )ype ServerN* in the #a!ue data bo=& and then click $3. Gestart the server in normal mode its a member server now but A# entries are still there. +romote teh server to a fake domain say A/-.com and then remove gracefully using #-promo. 4lse after restart you can also use ntdsutil to do metadata as told in teh earlier post

What too! wou!d & use to try to %ra security re!ated pac)ets from the wire?

you must use sniffer-detectin% too!s to help stop the snoops. 6 A good packet sniffer would be ;ethereal< www.etherea!.com

Name some $7 desi%n considerations ?

9H design re,uires balancing re,uirements for delegating administrative rights J independent of Iroup +olicy needs J and the need to scope the application of Iroup +olicy. )he following 9H design recommendations address delegation and scope issues: App!yin% (roup Po!icy An 9H is the lowest0level Active #irectory container to which you can assign Iroup +olicy settings. De!e%atin% administrative authority usually don2t go more than 6 9H levels

What is tom stone !ifetime attri ute?

)he number of days before a deleted ob%ect is removed from the directory services. )his assists in removing ob%ects from replicated servers and preventing restores from reintroducing a deleted

ob%ect. )his value is in the #irectory (ervice ob%ect in the configuration 5I- by default !!! "6! days$ !!6 "1M! days$

What do you do to insta!! a new Windows 8993 DC in a Windows 8999 AD? If you plan to install windows !!6 server domain controllers into an e=isting windows !!! domain or upgrade a windows !!! domain controllers to windows server !!6& you first need to run the Adprep.e=e utility on the windows !!! domain controllers currently holding the schema master and infrastructure master roles. )he adprep . forestprer command must first be issued on the windows !!! server holding schema master role in the forest root doman to prepare the e=isting schema to support windows !!6 active directory. )he adprep .domainprep command must be issued on the sever holding the infrastructure master role in the domain where !!! server will be deployed.

What do you do to insta!! a new Windows 8993 -8 DC in a Windows 8993 AD?

A. If you2re installing Windows !!6 G on an e=isting Windows !!6 server with (+1 installed& you re,uire only the second G -#0G9M. Insert the second -# and the r auto.e=e will display the Windows !!6 G -ontinue (etup screen. If you2re installing G on a domain controller "#-$& you must first upgrade the schema to the G version "this is a minor change and mostly related to the new #fs replication engine$. )o update the schema& run the Adprep utility& which you2ll find in the -mpnents>r >adprep folder on the second -#0G9M. /efore running this command& ensure all #-s are running Windows !!6 or Windows !!! with (+ "or later$

'ow wou!d you find a!! users that have not !o%%ed on since !ast month? http:..wiki.answers.com.C.DowEwouldEyouEfindEallEusersEthatEhaveEnotEloggedEonEs inceElastEmonth What are the DScommands?

5ew DS "#irectory (ervice$ @amily of built0in command line utilities for Windows (erver !!6 Active #irectory 5ew #( built0in tools for Windows (erver !!6 )he #( "#irectory (ervice$ group of commands are split into two families. In one branch are #(add& #(mod& #(rm and #(Move and in the other branch are #(Cuery and #(Iet. When it comes to choosing a scripting tool for Active #irectory ob%ects& you really are spoilt for choice. )he the #( family of built0in command line e=ecutables offer alternative strategies to -(?#4& *#I@#4 and ?/(cript. *et me introduce you to the members of the #( family:

#(add J add Active #irectory users and groups #(mod J modify Active #irectory ob%ects #(rm J to delete Active #irectory ob%ects #(move J to relocate ob%ects #(Cuery J to find ob%ects that match your ,uery attributes #(get J list the properties of an ob%ect

What are the :S/$ ro!es? Who has them y defau!t? What happens when each one fai!s?

@(M9 stands for the @le=ible single Master 9peration It has A Goles: 0

Schema /aster1

)he schema master domain controller controls all updates and modifications to the schema. 9nce the (chema update is complete& it is replicated from the schema master to all other #-s in the directory. )o update the schema of a forest& you must have access to the schema master. )here can be only one schema master in the whole forest.

Domain namin% master1

)he domain naming master domain controller controls the addition or removal of domains in the forest. )his #- is the only one that can add or remove a domain from the directory. It can also add or remove cross references to domains in e=ternal directories. )here can be only one domain naming master in the whole forest.

&nfrastructure /aster1

When an ob%ect in one domain is referenced by another ob%ect in another domain& it represents the reference by the IHI#& the (I# "for references to security principals$& and the #5 of the ob%ect being referenced. )he infrastructure @(M9 role holder is the #- responsible for updating an ob%ect2s (I# and distinguished name in a cross0domain ob%ect reference. At any one time& there can be only one domain controller acting as the infrastructure master in each domain. 5ote: )he Infrastructure Master "IM$ role should be held by a domain controller that is not a Ilobal -atalog server "I-$. If the Infrastructure Master runs on a Ilobal -atalog server it will stop updating ob%ect information because it does not contain any references to ob%ects that it does not hold. )his is because a Ilobal -atalog server holds a partial replica of every ob%ect in the forest. As a result& cross0domain ob%ect references in that domain will not be updated and a warning to that effect will be logged on that #-2s event log. If all the domain controllers in a domain also host the global catalog& all the domain controllers have the current data& and it is not important which domain controller holds the infrastructure master role.

-e!ative &D ;-&D< /aster1

)he GI# master is responsible for processing GI# pool re,uests from all domain controllers in a particular domain. When a #- creates a security principal ob%ect such as a user or group& it attaches a uni,ue (ecurity I# "(I#$ to the ob%ect. )his (I# consists of a domain (I# "the same for all (I#s created in a domain$& and a relative I# "GI#$ that is uni,ue for each security principal (I# created in a domain. 4ach #- in a domain is allocated a pool of GI#s that it is allowed to assign to the security principals it creates. When a #-2s allocated GI# pool falls below a threshold& that #- issues a re,uest for additional GI#s to the domain2s GI# master. )he domain GI# master responds to the re,uest by retrieving GI#s from the domain2s unallocated GI# pool and assigns them to the pool of the re,uesting #-. At any one time& there can be only one domain controller acting as the GI# master in the domain.

PDC .mu!ator1

)he +#- emulator is necessary to synchroni'e time in an enterprise. Windows !!!. !!6 includes the W6 )ime "Windows )ime$ time service that is re,uired by the 8erberos authentication protocol. All Windows !!!. !!60based computers within an enterprise use a common time. )he purpose of the time service is to ensure that the Windows )ime service uses a hierarchical relationship that controls authority and does not permit loops to ensure appropriate common time usage. )he +#- emulator of a domain is authoritative for the domain. )he +#- emulator at the root of the forest becomes authoritative for the enterprise& and should be configured to gather the time from an e=ternal source. All +#- @(M9 role holders follow the hierarchy of domains in the selection of their in0bound time partner. :: In a Windows !!!. !!6 domain& the +#- emulator role holder retains the following functions: :: +assword changes performed by other #-s in the domain are replicated preferentially to the +#- emulator. Authentication failures that occur at a given #- in a domain because of an incorrect password are forwarded to the +#- emulator before a bad password failure message is reported to the user. Account lockout is processed on the +#- emulator. 4diting or creation of Iroup +olicy 9b%ects "I+9$ is always done from the I+9 copy found in the +#- 4mulator2s (1(?9* share& unless configured not to do so by the administrator. )he +#- emulator performs all of the functionality that a Microsoft Windows 5) N.! (erver0 based +#- or earlier +#- performs for Windows 5) N.!0based or earlier clients. )his part of the +#- emulator role becomes unnecessary when all workstations& member servers& and domain controllers that are running Windows 5) N.! or earlier are all upgraded to Windows !!!. !!6. )he +#- emulator still performs the other functions as described in a Windows !!!. !!6 environment.

What :S/$ p!acement considerations do you )now of?

Windows !!!. !!6 Active #irectory domains utili'e a (ingle 9peration Master method called @(M9 "@le=ible (ingle Master 9peration$& as described in Hnderstanding @(M9 Goles in Active #irectory. In most cases an administrator can keep the @(M9 role holders "all A of them$ in the same spot "or actually& on the same #-$ as has been configured by the Active #irectory installation process. Dowever& there are scenarios where an administrator would want to move one or more of the @(M9 roles from the default holder #- to a different #-. Windows (erver !!6 Active #irectory is a bit different than the Windows !!! version when dealing with @(M9 placement. In this article I will only deal with Windows (erver !!6 Active #irectory& but you should bear in mind that most considerations are also true when planning Windows !!! A# @(M9 roles

What2s the difference etween transferrin% a :S/$ ro!e and sei=in% one? Which one shou!d you N$* sei=e? Why?

-ertain domain and enterprise0wide operations that are not good for multi0master updates are performed by a single domain controller in an Active #irectory domain or forest. )he domain controllers that are assigned to perform these uni,ue operations are called operations masters or @(M9 role holders. )he following list describes the A uni,ue @(M9 roles in an Active #irectory forest and the dependent operations that they perform:

(chema master J )he (chema master role is forest0wide and there is one for each forest. )his role is re,uired to e=tend the schema of an Active #irectory forest or to run the adprep >domainprep command. #omain naming master J )he #omain naming master role is forest0wide and there is one for each forest. )his role is re,uired to add or remove domains or application partitions to or from a forest. GI# master J )he GI# master role is domain0wide and there is one for each domain. )his role is re,uired to allocate the GI# pool so that new or e=isting domain controllers can create user accounts& computer accounts or security groups. +#- emulator J )he +#- emulator role is domain0wide and there is one for each domain. )his role is re,uired for the domain controller that sends database updates to Windows 5) backup domain controllers. )he domain controller that owns this role is also targeted by certain administration tools and updates to user account and computer account passwords. Infrastructure master J )he Infrastructure master role is domain0wide and there is one for each domain. )his role is re,uired for domain controllers to run the adprep >forestprep command successfully and to update (I# attributes and distinguished name attributes for ob%ects that are referenced across domains.

)he Active #irectory Installation Wi'ard "#cpromo.e=e$ assigns all A @(M9 roles to the first domain controller in the forest root domain. )he first domain controller in each new child or tree domain is assigned the three domain0wide roles. #omain controllers continue to own @(M9 roles until they are reassigned by using one of the following methods:

An administrator reassigns the role by using a IHI administrative tool. An administrator reassigns the role by using the ntdsuti! >ro!es command. An administrator gracefully demotes a role0holding domain controller by using the Active #irectory Installation Wi'ard. )his wi'ard reassigns any locally0held roles to an e=isting domain controller in the forest. #emotions that are performed by using the dcpromo >forceremova! command leave @(M9 roles in an invalid state until they are reassigned by an administrator.

We recommend that you transfer @(M9 roles in the following scenarios:

)he current role holder is operational and can be accessed on the network by the new @(M9 owner. 1ou are gracefully demoting a domain controller that currently owns @(M9 roles that you want to assign to a specific domain controller in your Active #irectory forest. )he domain controller that currently owns @(M9 roles is being taken offline for scheduled maintenance and you need specific @(M9 roles to be assigned to a ;live< domain controller. )his may be re,uired to perform operations that connect to the @(M9 owner. )his would be especially true for the +#- 4mulator role but less true for the GI# master role& the #omain naming master role and the (chema master roles.

We recommend that you sei'e @(M9 roles in the following scenarios:

)he current role holder is e=periencing an operational error that prevents an @(M90 dependent operation from completing successfully and that role cannot be transferred. A domain controller that owns an @(M9 role is force0demoted by using the dcpromo >forceremova! command. )he operating system on the computer that originally owned a specific role no longer e=ists or has been reinstalled.

As replication occurs& non0@(M9 domain controllers in the domain or forest gain full knowledge of changes that are made by @(M90holding domain controllers. If you must transfer a role& the best candidate domain controller is one that is in the appropriate domain that last inbound0 replicated& or recently inbound0replicated a writable copy of the ;@(M9 partition< from the e=isting role holder. @or e=ample& the (chema master role0holder has a distinguished name path of -5Lschema&-5Lconfiguration&dcLRforest root domainF& and this mean that roles reside in and are replicated as part of the -5Lschema partition. If the domain controller that holds the (chema master role e=periences a hardware or software failure& a good candidate role0holder would be a domain controller in the root domain and in the same Active #irectory site as the

current owner. #omain controllers in the same Active #irectory site perform inbound replication every A minutes or 1A seconds. A domain controller whose @(M9 roles have been sei'ed should not be permitted to communicate with e=isting domain controllers in the forest. In this scenario& you should either format the hard disk and reinstall the operating system on such domain controllers or forcibly demote such domain controllers on a private network and then remove their metadata on a surviving domain controller in the forest by using the ntdsuti! >metadata c!eanup command. )he risk of introducing a former @(M9 role holder whose role has been sei'ed into the forest is that the original role holder may continue to operate as before until it inbound0replicates knowledge of the role sei'ure. 8nown risks of two domain controllers owning the same @(M9 roles include creating security principals that have overlapping GI# pools& and other problems.

*ransfer :S/$ ro!es

)o transfer the @(M9 roles by using the 5tdsutil utility& follow these steps: 1. *og on to a Windows !!! (erver0based or Windows (erver !!60based member computer or domain controller that is located in the forest where @(M9 roles are being transferred. We recommend that you log on to the domain controller that you are assigning @(M9 roles to. )he logged0on user should be a member of the 4nterprise Administrators group to transfer (chema master or #omain naming master roles& or a member of the #omain Administrators group of the domain where the +#- emulator& GI# master and the Infrastructure master roles are being transferred. . -lick Start& click -un& type ntdsutil in the $pen bo=& and then click $3. 6. )ype roles& and then press 45)4G.Note )o see a list of available commands at any one of the prompts in the 5tdsutil utility& type K& and then press 45)4G. N. )ype connections& and then press 45)4G. A. )ype connect to server servername& and then press 45)4G& where servername is the name of the domain controller you want to assign the @(M9 role to. 6. At the server connections prompt& type ,& and then press 45)4G. O. )ype transfer role& where role is the role that you want to transfer. @or a list of roles that you can transfer& type K at the fsmo maintenance prompt& and then press 45)4G& or see the list of roles at the start of this article. @or e=ample& to transfer the GI# master role& type transfer rid master. )he one e=ception is for the +#- emulator role& whose synta= is transfer pdc& not transfer pdc emulator. M. At the fsmo maintenance prompt& type ,& and then press 45)4G to gain access to the ntdsuti! prompt. )ype ,& and then press 45)4G to ,uit the 5tdsutil utility.

Sei=e :S/$ ro!es

)o sei'e the @(M9 roles by using the 5tdsutil utility& follow these steps:

1. *og on to a Windows !!! (erver0based or Windows (erver !!60based member computer or domain controller that is located in the forest where @(M9 roles are being sei'ed. We recommend that you log on to the domain controller that you are assigning @(M9 roles to. )he logged0on user should be a member of the 4nterprise Administrators group to transfer schema or domain naming master roles& or a member of the #omain Administrators group of the domain where the +#- emulator& GI# master and the Infrastructure master roles are being transferred. . -lick Start& click -un& type ntdsutil in the $pen bo=& and then click $3. 6. )ype roles& and then press 45)4G. N. )ype connections& and then press 45)4G. A. )ype connect to server servername& and then press 45)4G& where servername is the name of the domain controller that you want to assign the @(M9 role to. 6. At the server connections prompt& type ,& and then press 45)4G. O. )ype sei'e role& where role is the role that you want to sei'e. @or a list of roles that you can sei'e& type K at the fsmo maintenance prompt& and then press 45)4G& or see the list of roles at the start of this article. @or e=ample& to sei'e the GI# master role& type sei'e rid master. )he one e=ception is for the +#- emulator role& whose synta= is sei'e pdc& not sei'e pdc emulator. M. At the fsmo maintenance prompt& type ,& and then press 45)4G to gain access to the ntdsuti! prompt. )ype ,& and then press 45)4G to ,uit the 5tdsutil utility. Notes
o

Hnder typical conditions& all five roles must be assigned to ;live< domain controllers in the forest. If a domain controller that owns a @(M9 role is taken out of service before its roles are transferred& you must sei'e all roles to an appropriate and healthy domain controller. We recommend that you only sei'e all roles when the other domain controller is not returning to the domain. If it is possible& fi= the broken domain controller that is assigned the @(M9 roles. 1ou should determine which roles are to be on which remaining domain controllers so that all five roles are assigned to a single domain controller. @or more information about @(M9 role placement& click the following article number to view the article in the Microsoft 8nowledge /ase: 66N6 "http:..support.microsoft.com.kb. 66N6. $ @(M9 placement and optimi'ation on Windows !!! domain controllers If the domain controller that formerly held any @(M9 role is not present in the domain and if it has had its roles sei'ed by using the steps in this article& remove it from the Active #irectory by following the procedure that is outlined in the following Microsoft 8nowledge /ase article: 16N9M "http:..support.microsoft.com.kb. 16N9M. $ Dow to remove data in active directory after an unsuccessful domain controller demotion Gemoving domain controller metadata with the Windows !!! version or the Windows (erver !!6 build 6O9! version of the ntdsuti! >metadata c!eanup

command does not relocate @(M9 roles that are assigned to live domain controllers. )he Windows (erver !!6 (ervice +ack 1 "(+1$ version of the 5tdsutil utility automates this task and removes additional elements of domain controller metadata.
o

(ome customers prefer not to restore system state backups of @(M9 role0holders in case the role has been reassigned since the backup was made. #o not put the Infrastructure master role on the same domain controller as the global catalog server. If the Infrastructure master runs on a global catalog server it stops updating ob%ect information because it does not contain any references to ob%ects that it does not hold. )his is because a global catalog server holds a partial replica of every ob%ect in the forest.

)o test whether a domain controller is also a global catalog server: 1. -lick Start& point to Pro%rams& point to Administrative *oo!s& and then click Active Directory Sites and Services. . #ouble0click Sites in the left pane& and then locate the appropriate site or click Defau!tfirst-site-name if no other sites are available. 6. 9pen the (ervers folder& and then click the domain controller. N. In the domain controller2s folder& double0click N*DS Settin%s. A. 9n the Action menu& click Properties. 6. 9n the (enera! tab& view the (!o a! Cata!o% check bo= to see if it is selected. @or more information about @(M9 roles& click the following article numbers to view the articles in the Microsoft 8nowledge /ase:

'ow do you confi%ure a ?stand- y operation master@ for any of the ro!es?

1. 9pen Active Directory Sites and Services. . 4=pand the site name in which the standby operations master is located to display the Servers folder. 6. 4=pand the Servers folder to see a list of the servers in that site. N. 4=pand the name of the server that you want to be the standby operations master to display its 5)#( (ettings. A. Gight0click N*DS Settin%s& click New& and then click Connection. 6. In the :ind Domain Contro!!ers dialog bo=& select the name of the current role holder& and then click $3.

O. In the New $ Aect-Connection dialog bo=& enter an appropriate name for the -onnection ob%ect or accept the default name& and click $3.

'ow do you ac)up AD?

/acking up Active #irectory is essential to maintain an Active #irectory database. 1ou can back up Active #irectory by using the Iraphical Hser Interface "IHI$ and command0line tools that the Windows (erver !!6 family provides. 1ou fre,uently backup the system state data on domain controllers so that you can restore the most current data. /y establishing a regular backup schedule& you have a better chance of recovering data when necessary. )o ensure a good backup includes at least the system state data and contents of the system disk& you must be aware of the tombstone lifetime. /y default& the tombstone is 6! days. Any backup older than 6! days is not a good backup. +lan to backup at least two domain controllers in each domain& one of at least one backup to enable an authoritative restore of the data when necessary. System State Data (everal features in the windows server !!6 family make it easy to backup Active #irectory. 1ou can backup Active #irectory while the server is online and other network function can continue to function. (ystem state data on a domain controller includes the following components: Active #irectory system state data does not contain Active #irectory unless the server& on which you are backing up the system state data& is a domain controller. Active #irectory is present only on domain controllers. *he S"S#$L shared fo!der: )his shared folder contains Iroup policy templates and logon scripts. )he (1(?9* shared folder is present only on domain controllers. *he -e%istry: )his database repository contains information about the computer2s configuration. System startup fi!es: Windows (erver !!6 re,uires these files during its initial startup phase. )hey include the boot and system files that are under windows file protection and used by windows to load& configure& and run the operating system. *he C$/B C!ass -e%istration data ase: )he -lass registration is a database of information about -omponent (ervices applications. *he Certificate Services data ase: )his database contains certificates that a server running Windows server !!6 uses to authenticate users. )he -ertificate (ervices database is present only if the server is operating as a certificate server.

(ystem state data contains most elements of a system2s configuration& but it may not include all of the information that you re,uire recovering data from a system failure. )herefore& be sure to backup all boot and system volumes& including the (ystem (tate& when you back up your server. -estorin% Active Directory In Windows (erver !!6 family& you can restore the Active #irectory database if it becomes corrupted or is destroyed because of hardware or software failures. 1ou must restore the Active #irectory database when ob%ects in Active #irectory are changed or deleted. Active #irectory restore can be performed in several ways. Geplication synchroni'es the latest changes from every other replication partner. 9nce the replication is finished each partner has an updated version of Active #irectory. )here is another way to get these latest updates by /ackup utility to restore replicated data from a backup copy. @or this restore you don2t need to configure again your domain controller or no need to install the operating system from scratch. Active Directory -estore /ethods 1ou can use one of the three methods to restore Active #irectory from backup media: primary restore& normal "non authoritative$ restore& and authoritative restore. +rimary restore: )his method rebuilds the first domain controller in a domain when there is no other way to rebuild the domain. +erform a primary restore only when all the domain controllers in the domain are lost& and you want to rebuild the domain from the backup. Members of Administrators group can perform the primary restore on local computer& or user should have been delegated with this responsibility to perform restore. 9n a domain controller only #omain Admins can perform this restore. 5ormal restore: )his method reinstates the Active #irectory data to the state before the backup& and then updates the data through the normal replication process. +erform a normal restore for a single domain controller to a previously known good state. Authoritative restore: 1ou perform this method in tandem with a normal restore. An authoritative restore marks specific data as current and prevents the replication from overwriting that data. )he authoritative data is then replicated through the domain. +erform an authoritative restore individual ob%ect in a domain that has multiple domain controllers. When you perform an authoritative restore& you lose all changes to the restore ob%ect that occurred after the backup. 5tdsutil is a command line utility to perform an authoritative restore along with windows server !!6 system utilities. )he 5tdsutil command0line tool is an e=ecutable file that you use to mark Active #irectory ob%ects as authoritative so that they receive a higher version recently changed data on other domain controllers does not overwrite system state data during replication.

'ow do you restore AD?

-estorin% Active Directory 1

In Windows (erver !!6 family& you can restore the Active #irectory database if it becomes corrupted or is destroyed because of hardware or software failures. 1ou must restore the Active #irectory database when ob%ects in Active #irectory are changed or deleted. Active #irectory restore can be performed in several ways. Geplication synchroni'es the latest changes from every other replication partner. 9nce the replication is finished each partner has an updated version of Active #irectory. )here is another way to get these latest updates by /ackup utility to restore replicated data from a backup copy. @or this restore you don2t need to configure again your domain controller or no need to install the operating system from scratch. Active Directory -estore /ethods 1ou can use one of the three methods to restore Active #irectory from backup media: primary restore& normal "non authoritative$ restore& and authoritative restore. Primary restore: )his method rebuilds the first domain controller in a domain when there is no other way to rebuild the domain. +erform a primary restore only when all the domain controllers in the domain are lost& and you want to rebuild the domain from the backup. Members of Administrators group can perform the primary restore on local computer& or user should have been delegated with this responsibility to perform restore. 9n a domain controller only #omain Admins can perform this restore. Norma! restore: )his method reinstates the Active #irectory data to the state before the backup& and then updates the data through the normal replication process. +erform a normal restore for a single domain controller to a previously known good state. Authoritative restore: 1ou perform this method in tandem with a normal restore. An authoritative restore marks specific data as current and prevents the replication from overwriting that data. )he authoritative data is then replicated through the domain. +erform an authoritative restore individual ob%ect in a domain that has multiple domain controllers. When you perform an authoritative restore& you lose all changes to the restore ob%ect that occurred after the backup. 5tdsutil is a command line utility to perform an authoritative restore along with windows server !!6 system utilities. )he 5tdsutil command0line tool is an e=ecutable file that you use to mark Active #irectory ob%ects as authoritative so that they receive a higher version recently changed data on other domain controllers does not overwrite system state data during replication.

/.*'$D
A. 1ou can2t restore Active #irectory "A#$ to a domain controller "#-$ while the #irectory (ervice "#($ is running. )o restore A#& perform the following steps. Geboot the computer. At the boot menu& select Windows !!! (erver. #on2t press 4nter. Instead& press @M for advanced options. 1ou2ll see the following te=t. 9( *oader ?A.! Windows 5) Advanced 9ptions Menu +lease select an option:

(afe Mode (afe Mode with 5etworking (afe Mode with -ommand +rompt 4nable /oot *ogging 4nable ?IA Mode *ast 8nown Iood -onfiguration #irectory (ervices Gestore Mode "Windows 5) domain controllers only$ #ebugging Mode Hse S and S to move the highlight to your choice. +ress 4nter to choose. (croll down& and select #irectory (ervices Gestore Mode "Windows 5) domain controllers only$. +ress 4nter. When you return to the Windows !!! (erver boot menu& press 4nter. At the bottom of the screen& you2ll see in red te=t #irectory (ervices Gestore Mode "Windows 5) domain controllers only$. )he computer will boot into a special safe mode and won2t start the #(. /e aware that during this time the machine won2t act as a #- and won2t perform functions such as authentication. (tart 5) /ackup. (elect the Gestore tab. (elect the backup media& and select (ystem (tate. -lick (tart Gestore. -lick 98 in the confirmation dialog bo=. After you restore the backup& reboot the computer and start in normal mode to use the restored information. )he computer might hang after the restore completesT (ometimes it takes a 6!0 minute wait on some machines.

'ow do you chan%e the DS -estore admin password?

When you promote a Windows !!! (erver0based computer to a domain controller& you are prompted to type a #irectory (ervice Gestore Mode Administrator password. )his password is also used by Gecovery -onsole& and is separate from the Administrator password that is stored in Active #irectory after a completed promotion. )he Administrator password that you use when you start Gecovery -onsole or when you press @M to start #irectory (ervice Gestore Mode is stored in the registry0based (ecurity Accounts Manager "(AM$ on the local computer. )he (AM is located in the>(ystem6 >-onfig folder. )he (AM0based account and password are computer specific and they are not replicated to other domain controllers in the domain. @or ease of administration of domain controllers or for additional security measures& you can change the Administrator password for the local (AM. )o change the local Administrator

password that you use when you start Gecovery -onsole or when you start #irectory (ervice Gestore Mode& use the following method. 1. *og on to the computer as the administrator or a user who is a member of the Administrators group. . (hut down the domain controller on which you want to change the password. 6. Gestart the computer. When the selection menu screen is displayed during restar& press @M to view advanced startup options. N. -lick the Directory Service -estore /ode option. A. After you log on& use one of the following methods to change the local Administrator password: U At a command prompt& type the following command: net user administrator U Hse the *ocal Hser and Iroups snap0in "*usrmgr.msc$ to change the Administrator password. 6. (hut down and restart the computer. 1ou can now use the Administrator account to log on to Gecovery -onsole or #irectory (ervices Gestore Mode using the new password.

Why can2t you restore a DC that was ac)ed up C months a%o?

/ecause of the tombstone life which is set to only 6! days

What are (P$s?

Iroup +olicy gives you administrative control over users and computers in your network. /y using Iroup +olicy& you can define the state of a user2s work environment once& and then rely on Windows (erver !!6 to continually force the Iroup +olicy settings that you apply across an entire organi'ation or to specific groups of users and computers. Iroup +olicy Advantages 1ou can assign group policy in domains& sites and organi'ational units. All users and computers get reflected by group policy settings in domain& site and organi'ational unit. 5o one in network has rights to change the settings of Iroup policyT by default only administrator has full privilege to change& so it is very secure. +olicy settings can be removed and can further rewrite the changes. Where I+92s store Iroup +olicy Information Iroup +olicy ob%ects store their Iroup +olicy information in two locations: Iroup +olicy -ontainer: )he I+- is an Active #irectory ob%ect that contains I+9 status& version information& WMI filter information& and a list of components that have settings in the I+9. -omputers can access the I+- to locate Iroup +olicy templates& and domain controller does not have the most recent version of the I+9& replication occurs to obtain the latest version of the I+9. Iroup +olicy )emplate: )he I+) is a folder hierarchy in the shared (1(?9* folder on a domain controller. When you create I+9& Windows (erver !!6 creates the corresponding I+) which contains all Iroup +olicy settings and information& including administrative templates& security& software installation& scripts& and folder redirection settings. -omputers connect to the (1(?9* folder to obtain the settings.

)he name of the I+) folder is the Ilobally Hni,ue Identifier "IHI#$ of the I+9 that you created. It is identical to the IHI# that Active #irectory uses to identify the I+9 in the I+-. )he path to the I+) on a domain controller is systemroot>(1(?9*>sysvol. Managing I+9s )o avoid conflicts in replication& consider the selection of domain controller& especially because the I+9 data resides in (1(?9* folder and the Active #irectory. Active #irectory uses two independent replication techni,ues to replicate I+9 data among all domain controllers in the domain. If two administrator2s changes can overwrite those made by other administrator& depends on the replication latency. /y default the Iroup +olicy Management console uses the +#- 4mulator so that all administrators can work on the same domain controller. WMI @ilter WMI filters is use to get the current scope of I+9s based on attributes of the user or computer. In this way& you can increase the I+9s filtering capabilities beyond the security group filtering mechanisms that were previously available. *inking can be done with WMI filter to a I+9. When you apply a I+9 to the destination computer& Active #irectory evaluates the filter on the destination computer. A WMI filter has few ,ueries that active #irectory evaluates in place of WMI repository of the destination computer. If the set of ,ueries is false& Active #irectory does not apply the I+9. If set of ,ueries are true& Active #irectory applies the I+9. 1ou write the ,uery by using the WMI Cuery *anguage "WC*$T this language is similar to ,uerying (C* for WMI repository. +lanning a Iroup +olicy (trategy for the 4nterprise When you plan an Active #irectory structure& create a plan for I+9 inheritance& administration& and deployment that provides the most efficient Iroup +olicy management for your organi'ation. Also consider how you will implement Iroup +olicy for the organi'ation. /e sure to consider the delegation of authority& separation of administrative duties& central versus decentrali'ed administration& and design fle=ibility so that your plan will provide for ease of use as well as administration. +lanning I+9s -reate I+9s in way that provides for the simplest and most manageable design V one in which you can use inheritance and multiple links. Iuidelines for +lanning I+9s Apply I+9 settings at the highest level: )his way& you take advantage of Iroup +olicy inheritance. #etermine what common I+9 settings for the largest container are starting with the domain and then link the I+9 to this container. Geduce the number of I+9s: 1ou reduce the number by using multiple links instead of creating multiple identical I+9s. )ry to link a I+9 to the broadest container possible level to avoid creating multiple links of the same I+9 at a deeper level. -reate speciali'ed I+9s: Hse these I+9s to apply uni,ue settings when necessary. I+9s at a higher level will not apply the settings in these speciali'ed I+9s.

#isable computer or use configuration settings: When you create a I+9 to contain settings for only one of the two levels0user and computer0disable the logon and prevents accidental I+9 settings from being applied to the other area.

What is the order in which (P$s are app!ied?

*ocal& (ite& #omain& 9H Iroup +olicy settings are processed in the following order: 1:0 *ocal Iroup +olicy ob%ect0each computer has e=actly one Iroup +olicy ob%ect that is stored locally. )his processes for both computer and user Iroup +olicy processing. :0 (ite0Any I+9s that have been linked to the site that the computer belongs to are processed ne=t. +rocessing is in the order that is specified by the administrator& on the *inked Iroup +olicy 9b%ects tab for the site in Iroup +olicy Management -onsole "I+M-$. )he I+9 with the lowest link order is processed last& and therefore has the highest precedence. 6:0 #omain0processing of multiple domain0linked I+9s is in the order specified by the administrator& on the *inked Iroup +olicy 9b%ects tab for the domain in I+M-. )he I+9 with the lowest link order is processed last& and therefore has the highest precedence. N:0 9rgani'ational units0I+9s that are linked to the organi'ational unit that is highest in the Active #irectory hierarchy are processed first& then I+9s that are linked to its child organi'ational unit& and so on. @inally& the I+9s that are linked to the organi'ational unit that contains the user or computer are processed. At the level of each organi'ational unit in the Active #irectory hierarchy& one& many& or no I+9s can be linked. If several I+9s are linked to an organi'ational unit& their processing is in the order that is specified by the administrator& on the *inked Iroup +olicy 9b%ects tab for the organi'ational unit in I+M-. )he I+9 with the lowest link order is processed last& and therefore has the highest precedence. )his order means that the local I+9 is processed first& and I+9s that are linked to the organi'ational unit of which the computer or user is a direct member are processed last& which overwrites settings in the earlier I+9s if there are conflicts. "If there are no conflicts& then the earlier and later settings are merely aggregated.$

Name a few enefits of usin% (P/C.

Microsoft released the Iroup +olicy Management -onsole "I+M-$ years ago& which is an ama'ing innovation in Iroup +olicy management. )he tool provides control over Iroup +olicy in the following manner:

4asy administration of all I+9s across the entire Active #irectory @orest ?iew of all I+9s in one single list

Geporting of I+9 settings& security& filters& delegation& etc. -ontrol of I+9 inheritance with /lock Inheritance& 4nforce& and (ecurity @iltering #elegation model /ackup and restore of I+9s Migration of I+9s across different domains and forests

With all of these benefits& there are still negatives in using the I+M- alone. Iranted& the I+Mis needed and should be used by everyone for what it is ideal for. Dowever& it does fall a bit short when you want to protect the I+9s from the following:

Gole based delegation of I+9 management /eing edited in production& potentially causing damage to desktops and servers @orgetting to back up a I+9 after it has been modified -hange management of each modification to every I+9 'ow can you determine what (P$ was and was not app!ied for a user? Name a few ways to do that.

(imply use the Iroup +olicy Management -onsole created by M( for that very purpose& allows you to run simulated policies on computers or users to determine what policies are enforced. *ink in sources

What are administrative temp!ates?

Administrative *emp!ates are a feature of Iroup +olicy& a Microsoft technology for centralised management of machines and users in an Active #irectory environment. Administrative )emplates facilitate the management of registry0based policy. An A#M file is used to describe both the user interface presented to the Iroup +olicy administrator and the registry keys that should be updated on the target machines. An A#M file is a te=t file with a specific synta= which describes both the interface and the registry values which will be changed if the policy is enabled or disabled. A#M files are consumed by the Iroup +olicy 9b%ect 4ditor "I+4dit$. Windows 3+ (ervice +ack shipped with five A#M files "system.adm& inetres.adm& wmplayer.adm& conf.adm and wuau.adm$. )hese are merged into a unified ;namespace< in I+4dit and presented to the administrator under the Administrative )emplates node "for both machine and user policy$.

What2s the difference etween software pu !ishin% and assi%nin%?

ANS An administrator can either assign or publish software applications.

Assi%n 7sers )he software application is advertised when the user logs on. It is installed when the user clicks on the software application icon via the start menu& or accesses a file that has been associated with the software application. Assi%n Computers )he software application is advertised and installed when it is safe to do so& such as when the computer is ne=t restarted. Pu !ish to users )he software application does not appear on the start menu or desktop. )his means the user may not know that the software is available. )he software application is made available via the Add.Gemove +rograms option in control panel& or by clicking on a file that has been associated with the application. +ublished applications do not reinstall themselves in the event of accidental deletion& and it is not possible to publish to computers.

Can & dep!oy non-/S& software with (P$?

'ow to create a third-party /icrosoft &nsta!!er pac)a%e

http:..support.microsoft.com.kb. AOO1M.

"ou want to standardi=e the des)top environments ;wa!!paper+ /y Documents+ Start menu+ printers etc.< on the computers in one department. 'ow wou!d you do that?

*ogin on client as #omain Admin user change whatever you need add printers etc go to system0 Hser profiles copy this user profile to any location by select 4veryone in permitted to use after copy change ntuser.dat to ntuser.man and assgin this path under user profil