Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AD > AD > Flashcards

AD Flashcards

1
Q

ADMX

A

IMPORTANT! For disabling web extensions and other cool administrative templates for Group Policy, look further into it!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

PAM (Privileged Access Management

A

Bastion Forest - Is a separate AD forest that is specifically set up for heightened security.

Shadow Security Principals (groups) - special SID that exists in the bastion? tf bitch ass mother fucker cunt?

Expiring Links - you can set links that expire that’s associated with specific Kerberos ticket item?? wtf bitch ass mother fucker what links you even talking about STUPID FUCKER

KDC TTL Enhancement - (Ticket-Granting Ticket Time-To-Live) is like an expiration date for the special “tickets” that computers use to prove their identity in a network.
In the computer world, when you log in and get a special “ticket” from the Key Distribution Center (KDC) through the Kerberos authentication system, that ticket has a TTL. This means it’s only valid for a specific period, like 8 hours. After 8 hours, the ticket expires, and you need to get a new one by re-authenticating.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is Kerberos?

A

is the Authentication Protocol

Here’s how Kerberos works:

Authentication: When you try to log into your computer or access a network resource, Kerberos checks your identity. It’s like showing your ID at the club entrance.

Ticket Granting Ticket (TGT): Once your identity is confirmed, Kerberos gives you a special ticket called a Ticket Granting Ticket (TGT). This ticket proves you’re allowed inside the club (network) for a certain period.

Ticket for Access: When you want to access specific resources (like files or databases) within the network, you don’t need to prove your identity each time. Instead, you use your TGT to get a shorter-term ticket for that specific resource. It’s like getting a stamp on your hand so you can move around the club freely without showing your ID at every door.

Encryption: All these tickets and communications between your computer and the network are encrypted, meaning they’re scrambled and secure from prying eyes. This keeps your data safe while it’s traveling across the network.

In Windows Server, Kerberos is kind of like the VIP security system running behind the scenes. You won’t see it as a separate program or window. It’s integrated into the authentication process, making sure that only authorized users and computers can access the resources they’re allowed to, all while keeping everything secure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

learn port #’s

A

20

File Transfer Protocol (FTP) Data Transfer

21

File Transfer Protocol (FTP) Command Control

22

Secure Shell (SSH)

23

Telnet - Remote login service, unencrypted text messages

25 (same port for scan to email m365)

Simple Mail Transfer Protocol (SMTP) E-mail Routing

53

Domain Name System (DNS) service

80

Hypertext Transfer Protocol (HTTP) used in World Wide Web

110

Post Office Protocol (POP3) used by e-mail clients to retrieve e-mail from a server

119

Network News Transfer Protocol (NNTP)

123

Network Time Protocol (NTP)

143

Internet Message Access Protocol (IMAP) Management of Digital Mail

161

Simple Network Management Protocol (SNMP)

194

Internet Relay Chat (IRC)

443

HTTP Secure (HTTPS) HTTP over TLS/SSL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

When installing Roles to AD on a NEW DC what option do you choose?

A

Add a new forest..

Why? Ur not adding another DC to an existing domain or forest.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Make sure to keep password to AD DS safe for DSRM, what is DSRM?

A

Directory Services Restore Mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

After creating your new AD DS you’ll be asked to Create a DNS delegation, do you click it or skip it?

A

Skip it, because were creating the root of a new DNS. It wouldn’t have the ability to be found by any external DNS servers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is a NetBIOS domain name?

A

Nuggetlab dude just put NUGGETLAB

NetBIOS domain names provide a more human-readable way for computers to find and interact with each other.

This is especially useful in the context of Active Directory, where it helps organize and manage resources like user accounts, computers, and other network-related entities.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How do you make a child domain?

A

Get another DC (just like at work how we have a redudant dc for our main pdc).

Click the flag with the yellow caution sign > Add a new domain to an existing forest > Child Domain > put parent domain name in ph.local > New domain name (ph2) dont put .local?

Make sure to click “Change” and enter in credentials

Make sure DNS is enabled and GC, then put in credentials.

Make sure DNS Delegation is applied as well.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

If you have a forest root domain of nuggetlab.com, it will be impossible to install a domain named accusource.net into the same forest because the names are not hierarchical. True or false?

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

AD DS clients locate domain controllers by using: (2 things)

A

SRV Records (SRV (Service) record is like a signpost in the internet’s address book (DNS). It helps computers find specific services, like email or domain controllers in an Active Directory network.

Imagine you’re looking for the post office in a city. The SRV record is like a sign telling you where to find it. It says things like:

“For email service (_imap) use this server at this address.”
“For domain controller service (_ldap) use this server at this address and port.”
So, when your computer needs to find a specific service, it checks the SRV records in DNS to get the right directions. It’s a way computers navigate the internet efficiently by knowing where to find the services they need.)

&
Active Directory-Integrated DNS Servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

RRAS

A

Routing and Remote Access Service (not as stable as a VPN but is a VPN???)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is pivoting in hacking terms?

A

When a hacker gains access to 1 machine then pivots and gains access to another machine. (PDC to Synology) or (PC to PDC).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

DMZ is also knows as?

A

perimeter network.

A DMZ is like having 2 firewalls and in between is your web server?

Intranet - Firewall Webserver Firewall -Internet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Where is AD data stored?

A

C:\Windows\System32\NTDS.dit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What makes up the AD Partitions?

A
  • NTDS.dit,
  • Configuration (contains info about the forest)
  • Schema
  • Domain (contains all domain info)
  • Application (This is a custom partition that you create and choose which DC’s get a copy of the info).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Global Catalog

A

Purpose - computers can locate objects within the domains

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

To install Active Directory how do you install it?

A

Manage > Next > Next > Active Directory Domain Services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How do you promote a server to a domain controller?

A

Click the yellow caution flag (to the left of Manage).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What deployment do you choose for your very first PDC?

A

Add a new forest

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is DSRM?

A

Domain Services Restore Mode (this is the password you will setup to restore AD from backup). This is during the initial installation when you try to add the server to a domain controller

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is NetBIOS?

A

is an old ass bitch ass legacy name for older devices that need to be able to interact with.

In production you should disable NetBIOS because its really for devices in the 1999s and older and could be a security risk. Bitch

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Where is group policy info stored in the C: Drive?

A

C\WIndows\SYSVOL

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Does putting your AD DS database logs on a seperate drive make your server run faster?

A

(probably dont need to do this) yes, put your database on one SSD, and put your logs on a different SSD.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

When you first setup your redudant DC and need to domain join it to your existing PDC you’ll need to change…

A

Your DNS to what the primary is if the auto one doesn’t work kinda like what happened at work

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Where are virtual machines located in Azure?

A

Resource Groups

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What version OS and hardware is your PDC at work running?

A

2022 STANDARD.. Not datacenter..

32GB RAM, CPU: Intel Xeon CPU E5-2623 (3ghz, 4 cores, 8 logical processors).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

When making a virtual machine in Azure what is a “availability zone?”

A

Having your virtual machine replicated to other data centers in Azure cloud so that if one data center goes down, you’ve got a replica of your virtual machine in another data center.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Wondering about pricing in Azure or anything microsoft? They have “pricing calculators.”

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is the port # for RDP?

A

TCP 3389

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Don’t allow RDP port from the outside open on the server because hackers could do a port scan (nmap), then ggs. Setup VPN instead

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

How are RODC passwords stored?

A

cache, mother fucker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

How do you pre-stage a DC to be RODC?

A

go to users and computers, right click on the Domain Controller container and click pre-create Read only domain controller account..

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Once you pre-stage the RODC what is next?

A

Have someone login to the DC with their credentials and it will activate?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

If you need to adjust the password replication policy how do you do this? Also what is this?

A

Right click on the RODC in the domain controller container in users and computers. Go to Properties, then Password Replication Policy.

Password Replication Policy is which accounts are able to cache for their passwords.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What service needs to be running to remote into the DC via powershell (PS)

A

WinRM (windows remote management)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What port number does WinRM use?

A

HTTP: 5985

HTTPS: 5986

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What powershell command can i use to see if the ports are listening to WinRM?

A

winrm quickconfig (use this on the DC, not your laptop) so used this command on the device you’re trying to connect to, not from the device.

Fuck it just do it on both devices, who cares.

39
Q

what ps command can you use to create a new folder?

A

mkdir

40
Q

What is FSMO?

A

Flexible Single Master Operations

FSMO (Flexible Single Master Operations) encompasses these five crucial roles:

In the forest you have these 2 domain level roles:

Schema Master
Domain Naming Master

Doman level roles:

RID Master
Primary DC Emulator
Infrastructure Master

“Brian: this is important when you decommision a server and migrate those rules to a new one to make it seamless”

41
Q

For FSMO in AD where can you find RID Master, PDC, and Infrastructure Master?

A

In AD Users and Computers right click on your DC (ph.local) and click Operations Master.

42
Q

For FSMO in AD where can you find Domain Naming Master?

A

Go to AD Domains and Trusts, right click the VERY top icon and click Operations Master.

43
Q

How do you enable the recycling bin in AD?

A

You can only do this in the Administrative Center…
Right click on ph.local domain and enable recycling bin

44
Q

what does the nmap command do?

A

Scans ports, you DUMB FUCK. Network scans

45
Q

When you setup a domain as part of a forest there is a automatic trust relationship called what?

A

Two way Transitive Trust

Two way means it goes both ways, like a trans fag goes both ways bc they are mentally ill.

46
Q

When doing outgoing and ingoing trusts what name on the server side do you need?

A

our name is ph.local so we would type in ph2.local or ph2.com whatever.

https://docs.google.com/document/d/1hqPpOOErMRnu4oiMvQH_oLAl8SOK3wwd4EPZf9FhBNk/edit

47
Q

a Bridgehead is what?

A

is a server that is mainly used for intersite replication.

48
Q

by default how often does a replication occur in a Bridgehead?

A

180 minutes (3 hours)

49
Q

KCC

A

Knowledge Consistency Checker.

A built-in process in Windows Server that ensures replication consistency within Active Directory by dynamically generating and maintaining the replication topology.

50
Q

With site link costs you want to have faster connections to have what?

A

Lower cost…. fast = low cost? wtf does that even mean.

51
Q

Inter-site replication replicates how many hours BY DEFAULT?

A

3 hours (180 minutes) You dont want it to be this long i guess, ur instructor set it to 60 minutes but this is just default (180 min).

52
Q

What is Bridge Head?

A

A bridgehead server is a server that is mainly used for intersite replication. You can configure a bridgehead server for every site that is created for each intersite replication protocol. This helps to control the server that is used to replicate information to other servers.

53
Q

Every site must have a unique..

A

IP address, there can not be duplicate IP’s. Obviously because public IP’s dont duplicate in the first place unless somethin is fucked up.

54
Q

powershell command to show replication in sites status?

A

repadmin /showrepl

55
Q

command line to check Active Directory issues?

A

dcdiag

Also use dcdiag /fix to make safe repairs.

Also use dcdiag /? for the help directory list of the command and what it can do.

56
Q

What does GPO stand for?

A

Group Policy Objects… RETARD

57
Q

What is the UPN logon and what does it stand for?

A

first.lastname (the account username) User Principal Name

58
Q

ACL

A

Access Control List

59
Q

A CID, or Computer ID, is:

A

a unique 10-digit, alphanumeric number that identifies a computer or workstation that gives direction to find out what permissions are supposed to be given to a certain user?

60
Q

A —> G —> DL —-> P

A

Accounts go into Global groups
Global groups go into Domain Local groups
Domain Local groups GET permissions to resources.

61
Q

Domain local groups cannot travel they’re cemented to the ground.. unlike what can travel..

A

Global groups

Domain local groups can contain links for objects in other domains. BUT they themselves cannot travel.

62
Q

When you create a group there is a Group Scope and a Group Type. What are those?

A

Group scope:

Domain Local
Global
Universal

Group TYPE:
Security
Distribution

63
Q

UGMC

A

Universal Group Membership Caching

Every 8 hours the list gets cached.

64
Q

Where is UGMC located?

A

sites and services, right click site, properties > at the bottom there’s a check box, check that shit and where it says default change that shit.

65
Q

a Terminal Server is also known as?

A

RDS (Remote Desktop Services)

66
Q

Azure ADDS is seperate from what?

A

Azure

67
Q

What is AADDS-NSG?

A

USE A VPN, Dont ever do this for RDP.. BUT it is
An inbound security rule that is not a firewall but filters packets (you will need to go in here to let you RDP into the server)

68
Q

When you setup a fresh Azure server users need to…

A

reset their passwords?

69
Q

Whats the difference between a Global group vs a Universal Group

A

Global is for single domains and Universal is for across domains within a forest

70
Q

Where can you add different UPNs? (like if you have Primalhealthlp.com and want to add befulfilledsystems.com

A

Domains and Trusts > Right click the very top thing (AD domains and trust), click properties

71
Q

Before you join your on prem server, enable SSPR (self service password reset), then reset your password and you should be able to join your on prem to Azure AD?

A
72
Q

Where do you add a @domain.com for the UPN?

A

Domains and Trusts > Right click on the bitch > Properties

73
Q

What 2 ways can you verify that you actually own a domain name? (primalhealthlp.com)

A

TXT record or an MX record

74
Q

What is a CNAME?

A

A canonical name (CNAME) serves as an ALIAS for domain names that share an IP address. For example, in the diagram ‘Searchsecurity.techtarget.com’ is an alias for ‘Techtarget.com. ‘ Both point to the same IP address.

75
Q

What are two types of managed authentication in Azure:

A

Password hash synchronization (PHS)
Azure AD performs the authentication itself.

Pass-through authentication (PTA)
Azure AD has AD DS perform the authentication.

76
Q

What is federation?

A

“federation” refers to setting up a trust relationship between two separate identity management systems. This allows a user in one domain to access resources in another domain without having to create a new account or password.

77
Q

because of HIPPA bullshit you can or can’t have ur Azure AD password sync hashed to the cloud?

A

NOPE you can’t. You would need to do Federation (old stuff) or pass-through auth?

78
Q

what tool do you download to clean up your AD users?

A

Idfix

79
Q

Your password policies are configured in the cloud or on-prem?

A

on prem, NOT the cloud. Everything is configured in GPO.

80
Q

What is the hierechal of GPO’s?

A

Local Computer, Site, Domain, OU

If you apply policies at any other level, then they will always overrule the local computer GPO

In business it will go from Site > Domain > OU

81
Q

True or False? When you block inheritance on an Organizational Unit (OU), it prevents GPOs linked to parent OUs from being applied to the child OU. However, certain settings, such as the password policy, are considered to be “critical” and are always enforced, even if inheritance is blocked.

A

True, Password Policy will always apply bc security reasons dumbass

82
Q

True or False? Block Inheritance cannot block the ENFORCED, but it can still block things from the site?

A

True

83
Q

Where are DEFAULT domain policies located?

A

In Group Policy Objects (the folder thats in gpmc.msc (group policy)

84
Q

What is the difference between a Default Domain Controllers Policy vs a Default Domain Policy?

A

The Default Domain Controllers Policy is specifically for domain controllers and contains settings relevant to their role (like kerberos?),

While the Default Domain Policy is for (everything?) and all computers and users in the domain and contains settings that apply to the entire domain.

85
Q

How do you create a new GPO?

A

right click on Group Policy Objects, and click New

86
Q

You can assign software to people, which forces it on people’s
computers, or you can publish it to people which makes it where they can go into control panel and it’ll be available, but the software is not installed?

A
87
Q

If you put a gpo underneath your ph.local will it affect everyone?

A

yes

88
Q

So when enforce conflicts with block inheritance it will
override block inheritance.

A
89
Q

it’s important to note that if there are other policies linked at lower levels (like specific Organizational Units or OUs), those can potentially override the domain-level policies based on the order of precedence.

A

Click on the OU in the GPO and it will tell you the precedence (hierarchy)

90
Q

gpresult /r /scope computer

A

This will show you what the computer GPO is applied to. Very helpful, remember this.

91
Q

NTUSER.DAT does what?

A

This is a hidden file in C:\Users\username This stores user profile settings from Windows registry so that they’re preserved between restarts.

You can edit it to restrict access to certain things in windows, but you adjust it in Regedit ?

92
Q

In GPO you have Policies and Preferences. Which one is set in stone to where the user can’t change the settings?

A

Policies

93
Q

Does Enforce a GPO override Block inheritance?

A

Yes

AD (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions