Annex F04 Microsoft AD Physical Structure

Question 0

Create a name for a Microsoft Domain Controller

Answer 0

NIPR designator-NameN01C
SIPR designator-NameS01C

I.e. 1MEBN01C, 1MEBN02C

Question 1

Domain Controller (DC)

Answer 1

Server in an AD forest that is running Windows Server 2003 or better (2008/2012) and is actively providing directory services known as a domain controller

Has a complete copy of every object in the domain

Question 2

Relationship between Domain Controller (DC) and Flexible Single Master Operations (FSMO) Roles

Answer 2

5 FSMO roles, 2 unique to forest, 3 unique in each domain

Two unique forest roles

- Schema Master(SM)
- Domain Naming Master (DM)

Three roles unique to domain

- Relative ID Master (RID master)
- Primary Domain  Controller Emulator (PDC emulator)
- Infrastructure Master (IM)

Question 3

Schema Master

Answer 3

Forest level FSMO Role

Usually found on the first DC in forest

Controls the master list of objects and attributes in the AD structure

Schema is how you describe objects (name, rank, etc)

Question 4

Domain Naming Master

Answer 4

Forest level FSMO role

Records the addition and deletion of domains in the forest

New domains cannot be added or removed if the domain naming master is unavailable

Question 5

Relative ID Master (RID)

Answer 5

Domain level FSMO role

Every objects has a unique Security ID (SID), the RID master assigns the second half of the SID

Question 6

Primary DC Emulator

Answer 6

Domain level FSMO role

Processes password changes

Manages group policy updates within a domain

Provides a master time source for the domain

Acts as domain master browser

Question 7

Infrastructure Master (IM)

Answer 7

Domain level FSMO role

Master catalog of all objects in the domain

All changes and additions are reported to the IM

Without IM, new objects cannot be added to the domain

Question 8

Global Catalog (GC)

Answer 8

Maintains complete replica of every object in its own domain as well as the most commonly used objects from the entire forest

Two primary functions- authentication for all users in the forest and to allow users to locate objects within AD w/o adding overhead to the network

Question 9

Site

Answer 9

Interface between the logical and physical structure of AD

Site in AD is defined as a group of servers connected by a fast, reliable, high speed connection

A domain can have any number of sites

Site in AD should exist where a LAN exists

Question 10

Site Link

Answer 10

Mirror of WAN links

Site links control time and type of replication taking place across WAN links

Question 11

Replication Process

Answer 11

Domain controllers will replicate freely to each other only if they are placed in the same site

IP bridgehead will consolidate all of the changes and then send them across the WAN links to other sites

IP bridgehead receives changes from the other sites and then replicate those changes to the domain partition of all the DCs in its site

Question 12

Bridgehead Server

Answer 12

Controls replication into and out of site

Question 13

Knowledge Consistency Checker (KCC)

Answer 13

Controls replication topology
Service that runs inside every AD DC
Detwermines how AD is going to replicate both inter and intra site
Replicates topology to all DCs every 15 minutes
Builds replication connectors between bridgehead serves in different sites when site links are created

Question 14

Directory Service Remote Procedure Call (DS-RPC)

Answer 14

Intra site replication uses DS-RPC and is the default, preferred replication protocol in DC’s running Server 2008

Question 15

Inter Site Messaging- Simple Mail Transfer Protocol (ISM-SMTP)

Answer 15

Used for inter site replications to replicate between separate domains

Can only be used w/o employing advanced certificate authority settings in AD infrastructure