Active Directory Domain Services Flashcards
Install, Configure, Manage, and Maintain Activity Directory Domain Services
What is IFM? When would you use it?
Installation from Media
Allows you to promote a server to an AD Domain Controller, using a seed of the AD database from a file that has been exported from another DC.
You would only use this if there is extremely low bandwidth between remote domain controllers. This option allows you to, for example, mail a hard drive containing the data.
Once the seed has been imported, it performs a sync to update any changes since the seed was created.
What does this stand for?
FSMO role
Flexible Single Master Operation role
What is an RODC, and when would you use it?
Read-Only Domain Controller
There is only a single use-case for this: If you have a remote site where the domain controller cannot be physically secured.
An RODC only gets passwords replicated to it for specified users and computers.
What are the uses of Organizational Units in AD?
The only function they serve is in application of Group Policy.
There is no other reason to separate users and computers out into OUs.
What are the FSMO roles?
There are five:
- PDC Emulator
- RID Master
- Infrastructure Master
- Schema Master
- Domain Naming Master
What is a SID?
Security ID
SIDs are numbers assocated with all AD objects.
What is a RID?
Relative ID
A RID is a superset of a SID; it consists of a sequential number that gets added onto each SID.
How do you join a computer to a domain, and rename the computer, with PowerShell?
Run this command on the computer to be joined to the domain and renamed:
Add-Computer -DomainName “example.local” -NewName Station01 -Restart
• This will also force a reboot, which is optional
What is command used to install AD?
PowerShell:
install-windowsfeature ad-domain-services
What is the command used to promote a server to a Domain Controller?
PowerShell:
Install-ADDSDomainController -DomainName “example.local” -Credential (Get-Credential example\administrator)
How do you use IFM to promote a server to a Domain Controller?
Add this option to the Install-ADDDSDomainController PowerShell command:
-InstallationMediaPath “c:\directory-of-IFM-data”
What is this command?
Get-ADDCCloningExcludedApplicationList
It will provide a list of all applications on the current machine that Windows has not positively verified to support cloning.
What is a GC?
Global Catalog
A partial, read-only copy of all the objects in the forest, intended to just hold the set of objects that are usually important. – For example, the schema attributes that an application or process is likely to need from some area elsewhere in the forest.
In a single-forest, single-domain setup; every DC tends to be a GC server. But, if you do have multiple domains in a forest, you may find not every DC is a GC.
What is this command, and how do you use it?
Move-ADDirectoryServerOperationMasterRole
This command is to gracefully transfer a FSMO role from one DC to another.
You would need the following parameters:
Move-ADDirectoryServerOperationMasterRole -Identity “newserver01” -OperationMasterRole [rolename]
Where [rolename] is the specific role you want to transfer, and newserver01 is the target server’s hostname.
How do you seize a FSMO role from one DC to another, and when would you do so?
Same cmdlet as the graceful transfer, except add this parameter:
-Force
- This will attempt to transfer gracefully, but will force it if it cannot.
- You can also use ntdsutil to seize roles.
- You would ONLY seize a FSMO role if a DC has failed and cannot be online for a graceful transfer.
How do you promote a server to an RODC?
Using the same command as normal promotion to a DC:
Install-ADDSDomainController -DomainName “example.local” -Credential (Get-Credential example\administrator)
and add this parameter into that command:
-ReadOnlyReplica
What is this?
DCDIAG
A command-line utility
- Has been around for a long time
- Performs several tests on your AD domain, for health diagnostics
- Allows you to analyze the state of DCs in a forest as an aid in troubleshooting.
How do you extend the AD Schema?
These four commands must be run in order, one after the other has completed.
- adprep /forestprep
- adprep /domainprep
- adprep /rodcprep (if you need to deploy an RODC)
- adprep /gpprep (if you also need to upgrade your Group Policy)
What are the possible Forest and Domain Functional Levels?
Windows Server 2008
Windows Server 2008 R2
Windows Server 2012
Windows Server 2012 R2
Windows Server 2016
How do you raise a domain and forest functional level?
Only after completing all prerequisite steps, the final step of actually raising the level
Right-click the domain in AD > Raise Domain Functional Level
Or, for the forest, it’s the same, except you right click the top level above the domain > Raise Forest Functional Level
How can you correct DNS errors regarding SRV records?
On the domain controller, run:
ipconfig -registerdns
Or, simply rebooting the server will also result in it re-registering its records with DNS.
What is ADAC?
Active Directory Administrative Center
The newer management interface for AD, based on Server Manager. Everything it does is actually running PowerShell commands underneath.
What is a template in AD?
A user that has been created and then disabled, which you use as a source to copy a new user from.
It’s an older method of simplifying user creation.
What fields can be preconfigured using a template in AD?
Group memberships
Home directories
Profile settings
Logon scripts
Logon hours
Password settings
Department name
Manager
How can you create a variable that can be used as a password when creating a new AD user in PowerShell?
$password = “passw0rd!” | ConvertTo-SecureString -AsPlainText -Force
The password must be contained in a secure string in order for it to be entered into the PowerShell cmdlet:
New-ADUser -Name jsmith -AccountPassword $password
How to use get-aduser cmdlet to determine inactive users?
get-aduser -filter * -Properties lastlogondate,passwordlastset | ft name,lastlogonedate,passwordlastset
get-aduser -filter {enabled -ne $true} | ft name
What are some useful parameters to use with the Search-ADAccount cmdlet?
- -AccountDisabled -usersonly
- AccountInactive -TimeSpan 30.00:00:00
- -PasswordExpired
- -PasswordNeverExpires
- -LockedOut
To any of these, add this to just get a simple list of names:
• | ft name
How do you implement an offline domain join?
On a domain controller, in Command Prompt:
djoin /provision /domain example.local /machine newstation01 /savefile c:\anyname.txt
- (Where domain is named example.local, and the computer to be joined is newstation01)
- This creates the necessary file to be transferred to newstation01, and pre-creates the necessary computer object in AD.
On the computer to be joined:
djoin /requesttodj /loadfile c:\anyname.txt c:/windows /localos
- Note, need to specify the Windows path on this machine, and specify that it is being performed on the local OS
- As always, a reboot is required to complete the join.
How do you delete an OU in ADUC?
Right-click and delete. Unless it was created with protection from accidental deletion, which is the DEFAULT setting.
In that case, go to View > Advanced Features, then right-click the OU > Properties > Object > uncheck “Protect from accidental deletion”, then right-click and delete.
Note, deleting an OU will delete all of the objects it contains, so you may want to remove all objects from it first.
What are redirusr and redircmp?
Redirects newly created AD objects to specified containers / OUs / domains.
These set what will become the default location for newly created user objects, and computer objects, respectively.
What is a Global Group, and how would you use one?
- Global Groups are visible throughout the forest, but can contain only accounts and global groups from the same domain.
- The group itself can be a member of Universal and Domain Local groups, and usually is.
- Typically used to organize users who share the same responsibilities, access permissions, are part of the same dept, etc.
- You tend not to assign permissions directly to Global Groups; rather, Domain Local groups are more appropriate for that.
What is a Domain Local Group, and how would you use one?
Domain Local Groups are only visible in their own domain.
- This is a way for you to single out objects that exist in a single domain, from objects that exist in other domains elsewhere in the forest.
- For this reason, Domain Local Groups are used to grant rights and privileges onto the resources that reside in the same domain where that Local Group is located.
- Domain Local Groups can contain other Domain Local Groups, but only from the same domain.
- Users, computers, and all other group types from the same domain, as well as any trusted domain elsewhere in the forest, can be contained in the Domain Local Group.
- Global Groups are generally for people, and Domain Local groups are generally for resources.
What is a Universal Group, and how would you use one?
- Visible throughout forest, and can contain accounts, Global Groups, and other Universal Groups from any domain in the forest.
- They cannot contain Domain Local Groups, because those are just local to an individual domain and are not visible elsewhere.
- When you create or make any changes to or within a Universal Group, a Global Catalog has to track the change and replicate it to all other Global Catalogs in the forest.
- For that reason, Universal Groups should tend to be used only for special cases where you need to nest Global Groups, like assigning permissions to resource in multiple domains.
- Universal Groups also tend to be used as Distribution groups, to create Dist. lists for Exchange for recipients across all domains in the forest.
What kinds of Groups are there?
There are 5.
2 Group Types:
- Security Groups
- Distribution Groups
And 3 Group Scopes:
- Global Groups
- Domain Local Groups
- Universal Groups
What does UGLA stand for?
Users, Global Groups, Local Groups, Access
It describes the best practice for group nesting:
- Users go in Global Groups
- Global Groups go in Domain Local Groups
- Assign permissions to Domain Local Groups
This best practice isn’t necessary for single-forest, single-domain environments, but if you ever need to expand past a single domain, you’ll need to be able to provide users from outside one domain with access to resources within that domain.
What can a Domain Local Group contain as members?
Domain Local Groups can contain:
- Domain Local Groups from the same domain
- Global Groups from any domain
- Universal Groups from any domain
- Accounts from any domain
What can a Universal Group contain as members?
Universal Groups can contain:
- Global Groups from any domain
- Universal Groups from any domain
- (No Domain Local Groups.)
What is Repadmin, and what are some things you can do with it?
A command that lets you configure, manage and troubleshoot AD DS replication.
- It can be used to force replication between two specific replication partners.
- It can also be used to force the Knowledge Consistency Checker (KCC) to recalculate replication topology for a DC.
- Can be used to find errors in replication, etc.
- Can configure PRP, the replication policy for passwords to RODCs.
What is KCC?
Knowledge Consistency Checker
Automatically calculates the replication topology for DCs.
Also involved in managing replication.
What is Wbadmin, and how would you use it with AD?
The Windows command-line backup and restore utility
- Can be used to perform non-authoritative restores for AD.
- With a non-authoritative restore, you restore from backup, but any updates made since the backup will be applied through replication.
- Wbadmin can be used to back up the entire server, or just the system state, which includes the AD data.
What is NtdsUtil?
A command-line management tool for AD DS and AD LDS.
- A Command Line tool that can perform several low-level tasks for configuring AD. (Low-level, meaning, fundamental and underlying, not basic.)
- It’s been around since the beginning of AD, and is sometimes called the Swiss Army Knife of AD.
What is the difference between an authoritative and a non-authoritative restore in AD?
- With a non-authoritative restore, you restore from backup, but any updates made since the backup will be applied through replication.
- Thus, items that have been deleted and need to be recovered cannot be restored non-authoritatively.
- Objects restored through an authoritative restore take precedence, so replication will not delete the container and objects after they are restore.
- So, generally: You can use a non-authoritative restore to recover a DC that has failed, to get it back up and running, and it will then be updated from other DCs. And an authoritative restore is useful for recovering objects and containers that have been deleted in error.
What is Dsmgmt?
A management utility for AD LDS.
For the -GroupCategory parameter, what type of group is identified as:
0
Distribution Group
For the -GroupCategory parameter, what type of group is identified as:
1
Security Group
For the -GroupScope parameter, what type of group is identified as:
0
Domain Local Group
For the -GroupScope parameter, what type of group is identified as:
1
Global Group
For the -GroupScope parameter, what type of group is identified as:
2
Universal Group
What is PRP, and how does it work?
Password Replication Policy
The PRP defines AD identities that are explicitly allowed or denied replication to a Read-Only Domain Controller.
Two domain groups exist by default: Allowed RODC Password Replication Group, and Denied RODC Password Replication Group. These groups can be modified, or existing users and groups added.
The Denied group contains, by default, Administrators, Backup Operators, Account Operators, and Server Operators.
What do you need to do before adding an RODC to your AD?
You must first extend the AD schema. This updates the AD application directory partitions to enable partition replication to RODCs.
• adprep /rodcprep
What is the dsrm command?
A Command Line utility to delete a specified AD object, including containers.
(It stands for Directory Service Remove)
What is an SPN?
Service Principal Name
- An SPN is the name by which a client uniquely identifies an instance of a service.
- If you install multiple instances of a service on computers throughout a forest, each service instance must have its own SPN.
- A particular service instance may also have multiple SPNs, if there are multiple names that clients might use for authentication
