70-410- Active Directory Domain Services

Question 1

Forest

Answer 1

Forest is the top level container of Active Directory infrastructure. A forest can consist of one or more domains and those domains are connected through transitive trust. A forest shares a single schema database, single Exchange organization, single global address list and a security boundary. Note: You may allow access to resources of only those in the same forest. You may want multiple forest if you need:

• more than one Exchange organization
• different forest functional levels
• separate security boundary

Question 2

Domain

Answer 2

Domain is one level below Active Directory Forest. A domain can consist of one or more organization unit. A domain shares a single administrator group (Domain Admins security group) and same set of objects. Even when a domain shares a single administrator group, you may delegate control over each organization unit (OU).

Question 3

Domain controller:

Answer 3

Every domain consists of one or more domain controllers. Domain controller holds a directory database of its perspective domain. The directory database consists of user objects, computer objects and much more.

Question 4

Organization unit (OU)

Answer 4

is folder/container within a domain. OU can be used to organize set of computers or users. OUs are very useful when implementing different set of polices to a group of users or computers within a domain.

Question 5

Set-ADAccountControl

Answer 5

Detailed Description
The Set-ADAccountControl cmdlet modifies the user account control (UAC) values for an Active Directory user or computer account. UAC values are represented by cmdlet parameters. For example, set the PasswordExpired parameter to change whether an account is expired and to modify the ADS_UF_PASSWORD_EXPIRED UAC value.

Question 6

Set-ADGroup

Answer 6

Modifies an Active Directory group.

Modifi SAM Account

Question 7

Add-ADPrincipalGroupMembership

Answer 7

Adds a member to one or more Active Directory groups.

The Add-ADPrincipalGroupMembership cmdlet adds a user, group, service account, or computer as a new member to one or more Active Directory groups.

Question 8

Group Policy Inheritance

Answer 8

the ability to prevent an OU or domain from inheriting GPOs from any of its parent container. Note that Enforced GPO links will always be inherited.

Question 9

Enforcement GPO

Answer 9

(previously known as “No Override”) the ability to specify that a GPO should take precedence over any GPOs that are linked to child containers. Enforcing a GPO link works by moving that GPO to the end of the processing order.

Question 11

Instaling domain controler PS

Answer 11

First ad feature

Add-WindowsFeature -name ad-domain-services –IncludeManagementTools –Restart

Once the installation is complete your computer will reboot. We are now ready to install a new domain controller in a new forest, so open a new PowerShell Console. There are three PowerShell commands you can use to promote your server into a DC:

Question 12

• Install-ADDSDomainController

Answer 12

–Creates a new domain controller in an existing domain.

Question 13

• Install-ADDSDomain –

Answer 13

Creates a new domain in an existing forest.

Question 14

• Install-ADDSForest

Answer 14

–Creates a new forest.

Question 14

Universal Group

Answer 14

Assing permison

Any domain or forest

Question 15

Global

Answer 15

Assing permison

Member permissions can be assigned in any domain

Question 16

Domain local

Answer 16

Assing permison

Member permissions can be assigned only within the same domain as the parent domain local group

Question 17

The schema master

Answer 17

, which governs all changes to the schema.

Question 18

• The domain naming master

Answer 18

which adds and removes domains to and from the forest.

Question 19

• The primary domain controller (PDC) emulator.

Answer 19

The PDC emulator processes all replication requests from Microsoft WindowsNT4.0 backup domain controllers and processes all password updates for clients that are not running Active Directory–enabled client software.

Question 20

• The relative identifier (RID) master.

Answer 20

The RID master allocates RIDs to all domain controllers to ensure that all security principals have a unique identifier.

Question 21

• The infrastructure master.

Answer 21

The infrastructure master for a given domain maintains a list of the security principals from other domains that are members of groups within its domain.

Question 22

Domain Controller: –

Answer 22

A domain controller is a server that runs AD DS server role. The domain controller stores active directory database (NTDS.DIT) and SYSVOL (System Volume) folder. SYSVOL contains all the template settings for GPOs. Active Directory is a central database that stores user accounts, computer accounts, organizational units, active directory domains and forests, and so on. Managing users, computers, applying policies, and many other important stuffs are done centrally from Active Directory Domain Controller.

Question 23

Creating a new forest

Answer 23

When you create the first domain controller in your organization, you are creating the first domain (also called theforest rootdomain) and the first forest.
The top-level Active Directory container is called a forest. A forest consists of one or more domains that share a common schema and global catalog. An organization can have multiple forests.
A forest is the security and administrative boundary for all objects that reside within the forest. In contrast, a domain is the administrative boundary for managing objects, such as users, groups, and computers. In addition, each domain has individual security policies and trust relationships with other domains.

Question 23

Operations Master Roles and Functionality
Five operations master roles manage single-master operations in AD DS.
Two operations master roles exist in each forest:
The schema master, which governs all changes to the schema.
The domain naming manter

Answer 23

Operations Master Roles and Functionality
Five operations master roles manage single-master operations in AD DS.
Two operations master roles exist in each forest:
The schema master, which governs all changes to the schema.
The domain naming master, which adds and removes domains to and from the