Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Windows Hybrid Admin > Chapter 9 and further > Flashcards

Chapter 9 and further Flashcards

1
Q

Remove ADDS from a server so you can install windows admin center

A

Remove Roles and Features > Uncheck AD > Demote this domain controller > force removal of domain controller > proceed with removal > enter admin pass > demote.

Manage romve roles and features
uncheck ADDS > next > remove > restart

Go to your DC > tools AD Users and Computers > delete SVR1 from Domain Controllers > delete this domain controller anyway…

Assign domain again

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is Windows Admin Center used for?

A

Manage things on premise and Azure -> WAC

Web Browser > google search Windows Admin Center > scroll to bottom and click download

Wizard > At the end you can copy the url to go to the Admin Center

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is a WAC gateway?

A

Multiple admins can connect to admin multiple on prem servers as well as AD

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is a target server?
How would you add it to WAC?

A

Server you can manage via Windows Admin Center

+ ADD
Server
Enter name of server
put in admin creds
Add
Click on it and you will connect

There’s a roles and features tab that lets you install things on the server

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Open powershell via WAC

A

Click your server that you want on WAC > Powershell > this connects with powershell

WINRM must be running 5985 < http and 5986 < https

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the Second hop problem?
Does second hop remoting have to be enabled on both sides?

A

Second Hop Problem:
You can remote to one server with your creds, but if the new server needs to access resources on behalf of you, it won’t work.

Two Second Hop Problem Options:

MUST BE ENABLED ON BOTH SIDES!

CredSSP - > Credential Security Support Provider - caches creds on remote server and it can pass it on to the next server. If remote computer is compromised you’re f*cked though.

Kerberos Delegation
Has to be 2012 and above server
You would configure server C to specify where it accepts delegated credentials. Less Vulnerable - PTA request basically - CREDS AREN’T STORED!
Doesn’t need domain admin rights

MUST BE ENABLED ON BOTH SIDES!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

activate credssp

A

CredSSP - Credential Security Support

SERVER A:
Enable-WSManCredSSP -Role Client -DelegateComputer #.examlabpractice.com -Force

SERVER B:
Enable_WSMaCredSSP -Role Server -Force

https://devblogs.microsoft.com/scripting/enable-powershell-second-hop-functionality-with-credss/

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Difference between CredSSP and Kerberos delegation

A

Kerberos Delegation -
Creds not stored
Configured via powershell
Doesn’t require domain admin creds
Works across domains and forests
requires server 2012 or later
Does not support the second hop for WinRM
Requires rights to update object and Service Principal Names <- you have to delegate rights to do this

CredSSP
Caches creds on server and passes them on

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is JEA?
What version of powershell is required?
What is file and folder is required to use this?
Show your powershell version

A

JEA - Just enough administration
Allows us to control what commands are available to admins at certain times

powershell 5 or later

$PSVersionTable

Role Capability File - also needs a couple folder

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Allow the ability to restart using JEA
Allow the whoami command

Section 9 part 76

A

SET UP YOUR Role Capability FIle:

File explorer > This pc > C: > Program Files > WindowsPowerShell > Modules > New folder “dctest”

dctest > new folder “roleCapabilities”

via powershell >
New-PSRoleCapabilityFile -Path C:\Program Files\WindowsPowerShell\Modules\dctest\roleCapabilities\dcrole.psrc

Open your roleCapabilities file > Cmdlets to make visibile when applied to a session > add a line below > “VisibleCmdlets = ‘Restart-Computer’

External commands…. > add line > “VisibleExternalCommands= ‘c:\windows\system32\whoami.exe’”

via powershell
New-PSSessionConfigurationFile -Path c:\dctest.pssc

To view the config file
File > open dctest >
SessionType = ‘RestrictedRemotServer’
Turn on TranscriptDirectory by uncommenting <- records all commands that user types
RunAsVirtualAccount = $true <- when someone authenticates they’ll get a virtual account that is gotten rid of after they’re don
Uncomment RoleDefinictions, change sql admins to gamesharks\administrator
role capabilities = “DCrole”}}

Save script - now you can register it
type
register-pssessionconfiguration -name = DCadmin -path ‘C:\dctest.pssc’

restart-service winrm

enter-pssession -computername nyc-dc1 -configurationname DCAdmin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Manage Windows Servers by using ARC

A

ARC is used for managing servers on prem and on azure in one place.

portal.azure.com > lookup arc and click on it > + add > copy script and run it on the server you want to bring into ARC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Deploy policy setting out to your ARC servers

Can you assign multiple policies at a time?

A

Arc > click on the server you added > Go to policies in the left-hand corner > assign policy > policy definition click the elipsis and search for server and pick on you want > make sure it’s enforced > next > go to remediation > create a managed identity > system assigned > next >

remediation - turn something on or off or tell you something’s not compliant. If this feature isn’t turned on you can force it on.

Create a managed identity >

initiative - group of policies to assign

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are extensions?
Create a custom script from extentions

A

Extra software or agents for your servers, like an extra feature that the server doesn’t support

create powershell script on server
installwindowsfeature -name dns > save to desktop

Arc > server > go to your server > extension on left > +Add >Custom > create > browse > create storage account > > click on storage account created > + container and call it scripts > create > select the container > upload the script that’s stored on your computer

storage account - stores info

container - folder for storage account to be stored in

installwindowsfeature -name dns > save to desktop

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Deploy updates to on prem and azure boxes on arc

What are the three things that are required to do this?

A

Automation account, a log analytics workspace (stores logs), and an agent ()

You’ll need an automation account
Search automation accounts in the search > +create > review and create > now you can get a Log analytics workspace which stores your log info (this costs money) > go to resource > click update mgmt > Drop down log Analytics workspace and “Create new workspace” >

create an agent:
Open your server connected to arc > go to portal.azure.com > resource groups > go to the one with the log analytics workspace > overview > Click on “Windows and Linux Agents Mgmt” under “Connect a data source” > Download the windows agent 64-bit > install that to your machine.

Wizard:
Select the box that connect the agent to Azure Log Analytics
DON’T select Connect the agent to System Center Operations Manager - this is an on premise analytic server that can gather data. > Copy and paste all the info from portal.azure.com > Use microsoft update when I check for updates

To change which log analytics workspace you’re connected to:
Control panel on server > Large Icons > Microsoft monitoring agents > Azure Login analytics > add

Open resource group where automation account is and click on it > click on inventory if you want to verify what workspace this is connected to. > click update management > click to manage machines > enable and wait from 15 minutes to an hour

Arc > server > your server > update Management > if there’s any missing updates you can decide here what to deploy

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Integrate Windows servers with Defender for Cloud

A

Drop down hamburger menu top left > Azure Active Directory > Security on left > Click Security Center on left > Click the Windows Defender for Cloud hyperlink

Secure score can give you a score compared to others with how good your security is.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Created a nested virtualization instance of Hyper-V

A

From the host
Set-VMProcessor -VMName NYC-SVR1 -ExposeVirtualizationExtensions $true

From Guest
Add roles and features
add role -> Hyper-V
Check off you want a virtual switch
You can store this somewhere easier to find

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is enhanced session mode in Hyper-V?

Enable it

A

Allows us to utilize local resource on our local host machine on our virtual machine.

Hyper-V settings
Allow enhanced session mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How do you connect to a virtual machine?

A

vmconnect

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How can you connect to your VM via powershell

A

Powershell direct <- needs winrm service running

enter-pssession -vmname nyc-svr1

20
Q

Show all the vms you have available to you
show the state of nyc-svr1
stop this same server

What else can you do here?

A

hvc - hyper-v cli

hvc list

hvc state nyc-svr1

hvc stop -f nyc-svr1

ssh, look at ip, restart, etc.

21
Q

What option do you use in hyper-v to share info from host to guest

A

Settings > integration services

22
Q

What is DDA
What are the three steps to use it

A

Discrete Device Assignement
Pass a PCIe device to a VM and let it control it.

Configure the VM for DDA
Dismount the Device from the Host
Assign the device to the guest VM

VM MUST BE OFF

23
Q

IMPORTANT!

The VM that you want to enable DDA on is powered down.
Configure it so it will use your GPU

A

PERFORM WRITE COMBINING

Configure 32 bit MMIO space
set-vm -guestcontrolledcachetypes $true -vmname nyc-svr1

Configure greater than 32 bit MMIO sapce
set-vm -lowmemorymappediospace 3gb -vmname nyc-svr1

Next Locate the graphics adapter on the host:
Device manager
properties
details
copy the path

Assign device to guestvm
add-vmassignabledevice -locationpath /dev/location/path -vmname nyc-svr1

TO REMOVE
remove-vmassignabledevice -locationpath $locationPath -vmname vmname

mount -vmhostassignabledevice -locationpath $locationpath

24
Q

What are the two types of groupings for Hyper-V VMs?

A

VMCollection group - perform actions on all vms in this group

Management Collection Group - Group collections together in a large group. This is a parent group

25
Q

Create two collection groups
One Management group
add a vm to the collection
add the collection group to the mgmt group
Add collection to mgmt group

A

Collection group:
new-vmgroup -name “vmgroup1” -grouptype vmcollectionType

new-vmgroup -name “vmgroup2” -grouptype vmcollectionType

Mgmt group:
new-vmgroup -name “mgmtgroup” -grouptype ManagementcollectionType

Adding VMs to collection:
Add-VMGroupMember -name “vmgroup1” -VM (Get-Vm “nyc-svr1)

Adding collection to mgmt:
Add-VMGroupMember -Name “mgmtgroup” -VMGroupMember (Get-VMGroup “vmgroup1”)

26
Q

View your Hype-V groups
This will show what’s in your group

A

Get-VMGroup -Name “vmgroup”
Get-VMGroup -Name “mgmtgroup”

27
Q

What are virtual processors?
What are cpu groups?

A

With hyper v you get 8 virtual processors per core.

So if you have 4 cores you’‘ll have 32 virtual cpus

So if you have 4 cpus on your motherboard you’d 128 virtual cpus

CPU groups allow you to group these virtual processors together to assign later.

28
Q

What is NUMA?

A

Non uniform memory access or allocation

Your processor sockets can have dedicated RAM.
NUMA divides busses up (wires on mother board) so you get memory closest to your processor socket. You get better performance.

29
Q

What is a thread?

A

Pathways that computer has to process information, they’re like Logical Cores.

When your cpu has 4 cores and 8 threads, that’s like if your core was a worker in a factory and he had two assembly lines to use.

So if a core has two jobs it’s working on, what it will do is work on one and when there’s down time because something is caching or doing something else it will go back and forth between two threads.

30
Q

Via CPUGroups.exe, how would you:
Show the cpu topology
Create a cpu group

A

/path/to/cpugroups.exe getcputopology

/path/to/cpugroups.exe CreateGroup /GroupId:3333-33333-33333-333333333

31
Q

What is hypervisor scheduling types/modes?

What is a vm partition?

What is the root partition

A

Determine how hyper-v allocates and manages work across virtual processors

VM Partition - group of resources

Root Partition - Talks to physical hardware. Provides mgmt services that control all guest vms. Don’t associate anything directly to this, use scheduling types/modes

32
Q

What are the three types of scheduler types/mode?

A

Classic - Round robin, first come first served

Core - Put security boundary around vm. Used for sandboxing. You can make SMT groups (semetric multi threading) Multiple threads can be divided amongst virtual CPUs. Can use for load balancing.

Root - For sandboxing, used with WDAG (Windows defender application guard) < - geared towards certain applications.

33
Q

Set one of the scheduler types

A

bcdedit /set hypervisorschedulertype Classic/Core/Root

34
Q

What’s a checkpoint?
What’s a differencing disk?
What’s a VHD?

A

Snapshot

New virtual hard drive that stores new data, created by checkpoint.

Hurts performance, the more you have the slower it gets.

VHD - virtual hard drive

35
Q

Find your checkpoints and make a new one

What types of checkpoints are there?

Reverse to a checkpoint

How do you know a VHD file is a checkpoint?

Merge checkpoint so it doesn’t slow you down

A

Settings
Checkpoints

Production checkpoint - regular backups for dbs and applications. Has to be checkpoint aware.

Standard checkpoint - older style, you can use this for apps that don’t support production checkpoints or provide production application info into the checkpoint.

Automatic - periodically triggers checkpoint

Right click Now < - revert
or
Right click checkpoint server < - apply

it will be .avhdx file <- this is a differencing disk

MERGING
Click server
Click “Edit Disk” to the right
Browse for your checkpoint when prompted to choose hard disk file location.
Merge

Merge all child’s with parents until you are finished.

36
Q

Setup a vm to failover to

A

THIS WORKS GOING FROM ONE SERVER TO ANOTHER IN THE SAME DOMAIN, WHERE THEY’LL BE ABLE TO FAILOVER TO VMS ON DIFFERENT MACHINES

On the right Hyper-V settings
Replication Configuration

Enable Kerberos because this will need to get ahold of DC.
Better with a Digital cert
Allow replication from a specified server. Add..

Server Manager
Tools
Windows Defender
Right click “Inbound rules
New Rule
Predefined
Hyper-V replica HTTP Listerner (TCP-in)

Right click you VM
Enable Replication
The Replica server “NYC-DC1”

37
Q

What additional options do you get if you create a vm hard disk ahead of time?

A

Right side
New Hard Disk
VHDX < - new

38
Q

When you create a differencing disk as a child of a parent. What permissions does the parent get?

A

Read-only

39
Q

Powershell - show VHD info
Create a differencing disk via powershell

A

Get-VHD -Path C:\VHDs\disk.vhdx
New-VHD -Path C:\VHDs\newvhd.vhdx -SizeBytes 10GB -Differencing

40
Q

What is VMQ?

A

VM Queueing
This is where, if your hardware is setup for it, traffic will not pass through the host to get to the VM, it will go directly to it.

41
Q

Team your NICS

A

If Hyper-V
Settings for VM
Click the network adapters
check teaming
Virtual Switch -> not connected

Server Manager
Local Server
NIC TEAMING click DISABLED
TASK
new team
select adapters

Go back to settings on the net adapters
Virtual Swithc -> External Internet_switch

42
Q

Describe the three types of virtual switches

A

You can configure these on the right hand side via Virtual Switch Manager

External - Will link us to our external NICs

Private - VMs can only communicate with each other. Also can’t communicate with host.

Internal - VMs can communicate with each other and the host itself.

You could have two vNICS, one that does one thing, one that does another

43
Q

What is Kubernetes

A

Developed by google, used to deploy and manage containers

Micrsoft made AKS for this, (Azure Kubernetes Service)

44
Q

Install support for container images

Install Docker

A

Add features
check containers

Install docker desktop for windows via browser

Settings
Continer Terminal -> System default

cd /
cd Program Files
cd Docker
DockerCli.exe -SwitchDaemon

45
Q

Do a google search for what windows images you have available.

A

windows base container images

hub.docker.com - looks at windows containers

46
Q

For your container,
Show what windows features are available
install the Web-Server feature
Show all “net” powershell commands

A

Get-WindowsFeature
Install-WindowsFeature Web-Server
get-command -noun “net”

Windows Hybrid Admin (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions