Maintaining AD DS Flashcards
1
Q
What are the two ways to enable the Active Directory Recycle Bin?
A
- ADAC (Active Directory Administrative Center)
- Select the Domain
- Click Enable Recycle Bin
- Click Okay
- PowerShell
- Enable-ADOptionalFeature -Identity ‘CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=contoso,DC=com’ -Scope ForestOrConfigurationSet -Target <domain>
</domain><p> </p></domain>
- Enable-ADOptionalFeature -Identity ‘CN=Recycle Bin Feature,CN=Optional Features,CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=contoso,DC=com’ -Scope ForestOrConfigurationSet -Target <domain>
2
Q
Where do Password Setting Objects Live?
A
System -> Password Settings Container
3
Q
- Can you view PSO (Password Setting Objects) in Active Directory Users and Computers?
- Where can you create a PSO?
A
- Yes
- ADSI Edit and ADAC (Active Directory Administrative Center)
4
Q
How do PSO apply?
What happens if there are no PSOs?
A
- A PSO that is linked directly to the user object takes predence
- If no PSO is linked directly to the user object, then PSO linked via gloabl group membership are evaluated. The PSO with the lowest precedence value is applied.
- If no PSO is obtained from conditions (1) and (2), the Default Domain Policy is applied.
5
Q
What two PowerShell cmdlets do you need to run to create a PSO and apply it to a group?
(Note: You do not need to give the parameters just the cmdlets)
A
- New-ADFineGrainedPasswordPolicy
- Add-ADFineGrainedPasswordPolicySubject
Example:
- New-ADFineGrainedPasswordPolicy TestPswd -ComplexityEnabled:$true -LockoutDuration:”00:30:00” -LockoutObservationWindow:”00:30:00” -LockoutThreshold:”0” -MaxPasswordAge:”42.00:00:00” -MinPasswordAge:”1.00:00:00” -MinPasswordLength:”7” -PasswordHistoryCount:”24” -Precedence:”1” -ReversibleEncryptionEnabled:$false -ProtectedFromAccidentalDeletion:$true
- Add-ADFineGrainedPasswordPolicySubject TestPswd -Subjects group1
6
Q
How do you set up a RODC?
A
- Open ADUC (AD Users and Computers) or ADAC (Active Directory Administrative Center)
- Select the Domain Controller OU
- Right-Click, Select Pre-Create Read-only Domain Controller Account..
- Enter the Computer Name
- Select Additional Options
- DNS Server
- Global catalog
- Select a Group or user for administration (if desired)
7
Q
- How would you change who the user or group Administer of an RODC Server?
- How do you set up a password to be replicated to an RODC?
- How do you block a password from being replicated to an RODC?
A
- Right-Click the computer policy, Select Properties
- On the Managed By tab
- Click Change and select a new user or group
- Right-Click the computer policy, Select Properties
- On the Password Replication Policy tab
- Click Add, Select to allow passwords for the account to replicate to this RODC, click ok
- Select a user or group
- Right-Click the computer policy, Select Properties
- On the Password Replication Policy tab
- Click Add, Select to deny passwords for the account to replicate to this RODC, click ok
- Select a user or group
8
Q
How do users passwords get replicated/cached to the RODC ?
A
They are apart of a group that is replicating their password to the RODC and are not in a Deny group.
The groups that allow and deny password replication is on the Read-Only DC Computer Object on the Password Replication Policy
9
Q
What are the requirements for Cloning a DC?
A
- PDC emulator FSMO role hosted on a Windows Server 2012 DC
- PDC emulator available during cloning operations
- Virtualization host platform supports VM-Generation ID (VMGID)
- at least Windows Server 2012 Server to clone from
10
Q
How do you create a Clone fo a DC?
A
- Add the Server 2012 DC to the Cloneable Domain Controllers group
- Run: Get-ADDCCloningExcludedApplicationList
- Any programs or services previously returned by Get-ADDCCloningExcludedApplicationList - and not added to the CustomDCCloneAllowList.xml - must be removed prior to cloning. Uninstalling the application or service is the recommended method.
- Warning: Any incompatible program or service not uninstalled or added to the CustomDCCloneAllowList.xml prevents cloning.
- Run Get-ADDCCloningExcludedApplicationList -GenerateXml -Path C:\Windows\NTDS -force
- Generates the excluded application list as a file named CustomDCCloneAllowList.xml at the specified folder path (C:\Windows\NTDS) and forces overwrite if a file by that name is found to already exist at that path location.
- Run New-ADDCCloneConfigFile
- Shut down the DC
- Run Export-VM -Name <name> -Path <path> (on the host)</path></name>
- Run: $<somevariable> = Import-VM -path <path> -VhdDestinationPath <path> -Copy -GenerateNewId</path></path></somevariable>
- Rename-VM $<somevariable> -NewName <new></new></somevariable>
11
Q
How can you Transfer FSMO Roles?
- PowerShell
- CMD
A
- PowerShell
- Move-ADDirectoryServerOperationMasterRole -Identity < Name of DC/Server > -OperationMasterRole < FSMO Role seperated by comma>
- CMD
- ntdsutil
- roles
- connections
- connect to server
- q
- Transfer < FSMO Role seperated by comma>
12
Q
How do you seize a FSMO Role via
- PowerShell
- CMD
A
- PowerShell
- Move-ADDirectoryServerOperationMasterRole -Identity < Name of DC/Server > -OperationMasterRole < FSMO Role seperated by comma> -Force
- CMD
- ntdsutil
- roles
- connections
- connect to server
- q
- seize < FSMO Role seperated by comma>
13
Q
How would you restore a user that has been deleted? Active Directory Recycle Bin is Enabled.
2 ways
A
- By finding the user in the AD recycle bin and restoring the object
- PowerShell
- Restore-ADOject -Identity
14
Q
How do you create an Active Directory SnapShot?
A
- ntdsutil
- activate instance ntds
- snapshot
- create
- (q or quit) x2
15
Q
How do you mount an Active Directory Snapshot?
A
- ntdsutil
- activate instance ntds
- snapshot
- mount <guid></guid>
- dsamain -dbpath <path> -ldaport 50000</path>
