Home > Articles > Microsoft > MCSE

  • Print
  • + Share This
Like this article? We recommend Exam Objectives

Exam Objectives

This exam is broken up into five different categories. We will look at what you have to know in each category to pass the exam.

Planning and Implementing an Active Directory Infrastructure

  • Plan a strategy for placing global catalog servers.
  • A global catalog server is a domain controller that provides the ability to locate objects from any domain without having to know the domain name. Global catalog servers can use a lot of bandwidth because of replication.

    • Evaluate network traffic considerations when placing global catalog servers.
    • You should not place a global catalog server where there is already network congestion. It will not be able to respond to queries in a timely fashion.

    • Evaluate the need to enable universal group caching.
    • Universal group caching can be enabled in lieu of a global catalog server for smaller networks or if bandwidth is an issue.

  • Plan flexible operations master role placement.
    • Plan for business continuity of operations master roles.
    • The servers that function as the schema master, PDC emulator, domain naming master, infrastructure master and RID master require a single server approach.

    • Identify operations master role dependencies.
  • Implement an Active Directory directory service forest and domain structure.
    • Set an Active Directory forest and domain functional level based on requirements.
    • The highest-level container in Active Directory is the forest. A single forest is the simplest model. Because forests can contain millions of objects, there are few technical reasons why the majority of organizations cannot deploy a single forest to meet their needs.

    • Establish trust relationships. Types of trust relationships might include external trusts, shortcut trusts, and cross-forest trusts.
    • Create the forest root domain.
    • The first domain created by default is the forest root domain. All objects in a single forest are listed in the global catalog.

    • Create a child domain.
    • A child domain is a new domain under the parent. It will share a contiguous namespace with the parent domain. You create the child domain using the Active Directory Installation Wizard.

    • Create and configure Application Data Partitions.
    • NtdsUtil is a command line utility that can be used to create application directory partitions.

    • Install and configure an Active Directory domain controller.
    • Installing an AD domain controller is an important step that requires a lot of planning. Small organizations may only need one domain controller, but should have two for redundancy. To promote a member server to a domain controller, run the command line utility DCpromo.exe

  • Implement an Active Directory site topology.
    • Configure site links.
    • Site Links are created to link sites. Replication traffic will travel these links. Every site must be included in a site link in order for changes to be replicated between domain controllers.

    • Configure preferred bridgehead servers.
    • Assigning a bridgehead server manually can create problems.

      The Knowledge Consistency Checker (KCC) automatically assigns one or more bridgehead servers to make sure that changes in Active Directory are replicated across a site link one at a time.

  • Plan an administrative delegation strategy.
  • Administration of Active Directory components can be delegated allowing for decentralized management.

    • Plan an organizational unit (OU) structure based on delegation requirements.
    • You can use OUs to delegate administration to a group or an individual allowing for management of local data and resources.

    • Plan a security group hierarchy based on delegation requirements.
    • The three types of security groups are domain local, global and universal.

Managing and Maintaining an Active Directory Infrastructure

  • Manage an Active Directory forest and domain structure.
    • Manage schema modifications.
    • There can only be one schema per forest. The attributes that are defined in the forest affect all domains and OUs. There are default attributes that cannot be modified and there are others that can be added or deleted.

    • Add or remove a UPN suffix.
    • A User Principal Name is added through the Active Directory Domains and Trusts.

  • Manage an Active Directory site.
  • As mentioned before, the Knowledge Consistency Checker (KCC) is responsible by default for setting up replication inside and outside the site. Inside replication will be optimized for speed and outside replication will be optimized for bandwidth.

    • Configure replication schedules.
    • Replication should be configured to occur during off hours, which is usually at night.

    • Configure site link costs.
    • You may have several links that can be used for replication. Active Directory Sites and Services can be used for assigning costs to those links. The Knowledge Consistency Checker will use this information and will avoid links that have a high cost associated with it.

    • Configure site boundaries.
    • You need to consider what will happen if connectivity between sites is disrupted. If your site does not have its own domain controller, data servers, DHCP servers, etc., it will not be able to function.

  • Monitor Active Directory replication failures. Tools might include Replication Monitor, Event Viewer, and support tools.
    • Monitor Active Directory replication.
    • To monitor replication, you would use the Directory Service Event Log in Event Viewer, Repadmin.exe or Dcdiag.exe.

    • Monitor File Replication service (FRS) replication.
    • To monitor FRS replication you can use Event Viewer events associated with the File Replication Service or use FRSDiag.exe, which is a command line utility.

  • Restore Active Directory services.
    • Perform an authoritative restore operation.
    • An authoritative restore is most commonly used in cases in which a change was made within the directory that must be reversed, such as deleting an OU by mistake.

    • Perform a nonauthoritative restore operation.
    • A nonauthoritative restore is most commonly used in cases when a DC fails because of a hardware or software related reasons.

  • Troubleshoot Active Directory.
  • Some of the new tools in Windows 2003 that can be used to troubleshoot AD are: Dsadd.exe, Dsget.exe, Dsmod.exe, Dsmove.exe, DSQuery.exe and DSrm.exe

    • Diagnose and resolve issues related to Active Directory replication.
    • A system administrator needs to review the Directory Service Log frequently to stay on top of replication problems.

    • Diagnose and resolve issues related to operations master role failure.
    • If a current operations master has become unavailable, you can use the Ntdsutil.exe utility to seize the operations master role.

    • Diagnose and resolve issues related to the Active Directory database.
    • Once again, Event Viewer will help you to troubleshoot and diagnose problems relate to the Active Directory database.

Planning and Implementing User, Computer, and Group Strategies

  • Plan a security group strategy.
  • Organizing users or computers into groups makes your life as an administrator much easier. Instead of assigning permissions to dozens of users individually, you can create a group containing those users and assign permissions to the group. The four types of groups are Local, Domain Local, Global and Universal.

  • Plan a user authentication strategy.
  • There are many attributes that can be assigned to a user account: Account Expiration, Logon Hours, Enable/Disable, Locked Out, Must Change Password at next Logon, Cannot Change Password, Password Never Expires.

    • Plan a smart card authentication strategy.
    • A smart card allows a user to login using their card and a PIN. Smart cards store certificates, public and private keys, and passwords.

    • Create a password policy for domain users.
    • Passwords have become much more complex since users started logging in. You must determine how you will setup the password requirements in your organization. You can set your password length, require it to have upper and lower case, require it to have a number and require it to have special characters.

  • Plan an OU structure.
  • An Organizational Unit is used to delegate and decentralize control in your organization.

    • Analyze the administrative requirements for an OU.
    • An Organization Unit is the smallest unit to which a Group Policy can be applied. Group Policies can be set to control the behavior of security and desktop configurations. Group Policies are applied in the following order: Local, Site, Domain, Parent and Child.

  • Analyze the Group Policy requirements for an OU structure.
  • Implement an OU structure.
    • Create an OU.
    • You create an OU using Active Directory Computers and Users. You simply right-click on the location where you want a new OU and then choose New, Organization Unit.

    • Delegate permissions for an OU to a user or to a security group.
    • The Delegation of Control Wizard is used to delegate control of an OU to a specific user or group.

    • Move objects within an OU hierarchy.
    • The easiest way to move an OU to a different location in Active Directory is to simply drag and drop. You can also right-click on the OU and choose move or use the Dsmove.exe command line utility.

Planning and Implementing Group Policy

  • Plan Group Policy strategy.
    • Plan a Group Policy strategy by using Resultant Set of Policy (RSoP) Planning mode.
    • Group Policies should not be taken lightly. Applying a poorly conceived GP can create many problems for you. Resultant Set of Policy (RSoP) is a tool that allows you to review and test new policies before implementation.

    • Plan a strategy for configuring the user environment by using Group Policy.
    • These settings are used to configure policies which affect users. The computer which the user is logging on to does not influence whether these settings are applied. User configuration settings are applied when a user logs on to the computer.

    • Plan a strategy for configuring the computer environment by using Group Policy.
      • Computer startup and shutdown
      • User logon and logoff
      • Registry based policy settings
      • Security settings
      • Scripts
      • Folder Replication
      • Application deployment and management
  • Configure the user environment by using Group Policy.
    • Distribute software by using Group Policy.
    • One key design feature of Active Directory is to ease the process of deploying software within an organization. Microsoft included the ability to deploy and distribute software using Group Policy. You can assign an application, which causes it to be installed automatically or you can publish an application, which allows the user to decide if the application should be installed.

    • Automatically enroll user certificates by using Group Policy.
    • You need to be familiar with Public Key Infrastructure, Encrypted Files Systems, Automatic Certificate Requests and Trusted Root Certificate Authorities.

    • Redirect folders by using Group Policy.
    • Folder Redirection Group Policy Object can be used to redirect folders. You would use this if you wanted all of your users’ folders to point to a server. This would prevent users from saving data locally where it would probably not get backed up regularly.

    • Configure user security settings by using Group Policy.
    • Security policies can affect Password Policy, Account Lockout Policy, Group Membership, User Rights Assignment, Authentication, Available Resources and Security Options.

  • Deploy a computer environment by using Group Policy.
  • Group Policies can dictate a users wallpaper, desktop, available applications, standardized messages, etc.

    • Distribute software by using Group Policy.
    • As mentioned earlier, Group Policy can distribute mandatory software or make optional software available.

    • Automatically enroll computer certificates by using Group Policy.
    • This is similar to automatically enrolling user certificates in that you need to be familiar with Public Key Infrastructure, Encrypted Files Systems, Automatic Certificate Requests and Trusted Root Certificate Authorities.

    • Configure computer security settings by using Group Policy.
    • This too is similar to configuring user security settings. The types of things you can control with Group Policy are Password Policy, Account Lockout Policy, Kerberos Policy, User Rights Assignment and Security Options.

Managing and Maintaining Group Policy

  • Troubleshoot issues related to Group Policy application deployment. Tools might include RSoP and the gpresult command.
  • Maintain installed software by using Group Policy.
  • Just as you can distribute software using Group Policy, you can use Group Policy to make changes to the original deployment. You can even remove software with Group Policy.

    • Distribute updates to software distributed by Group Policy.
    • Configure automatic updates for network clients by using Group Policy.
  • + Share This
  • 🔖 Save To Your Account