Home > Articles > Microsoft > MCSE

  • Print
  • + Share This
Like this article? We recommend Exam Objectives

Exam Objectives

This exam is broken up into five different categories. We will look at what you have to know in each category to pass the exam.

Planning and Implementing an Active Directory Infrastructure

  • Plan a strategy for placing global catalog servers.
  • A global catalog server is a domain controller that provides the ability to locate objects from any domain without having to know the domain name. Global catalog servers can use a lot of bandwidth because of replication.

    • Evaluate network traffic considerations when placing global catalog servers.
    • You should not place a global catalog server where there is already network congestion. It will not be able to respond to queries in a timely fashion.

    • Evaluate the need to enable universal group caching.
    • Universal group caching can be enabled in lieu of a global catalog server for smaller networks or if bandwidth is an issue.

  • Plan flexible operations master role placement.
    • Plan for business continuity of operations master roles.
    • The servers that function as the schema master, PDC emulator, domain naming master, infrastructure master and RID master require a single server approach.

    • Identify operations master role dependencies.
  • Implement an Active Directory directory service forest and domain structure.
    • Set an Active Directory forest and domain functional level based on requirements.
    • The highest-level container in Active Directory is the forest. A single forest is the simplest model. Because forests can contain millions of objects, there are few technical reasons why the majority of organizations cannot deploy a single forest to meet their needs.

    • Establish trust relationships. Types of trust relationships might include external trusts, shortcut trusts, and cross-forest trusts.
    • Create the forest root domain.
    • The first domain created by default is the forest root domain. All objects in a single forest are listed in the global catalog.

    • Create a child domain.
    • A child domain is a new domain under the parent. It will share a contiguous namespace with the parent domain. You create the child domain using the Active Directory Installation Wizard.

    • Create and configure Application Data Partitions.
    • NtdsUtil is a command line utility that can be used to create application directory partitions.

    • Install and configure an Active Directory domain controller.
    • Installing an AD domain controller is an important step that requires a lot of planning. Small organizations may only need one domain controller, but should have two for redundancy. To promote a member server to a domain controller, run the command line utility DCpromo.exe

  • Implement an Active Directory site topology.
    • Configure site links.
    • Site Links are created to link sites. Replication traffic will travel these links. Every site must be included in a site link in order for changes to be replicated between domain controllers.

    • Configure preferred bridgehead servers.
    • Assigning a bridgehead server manually can create problems.

      The Knowledge Consistency Checker (KCC) automatically assigns one or more bridgehead servers to make sure that changes in Active Directory are replicated across a site link one at a time.

  • Plan an administrative delegation strategy.
  • Administration of Active Directory components can be delegated allowing for decentralized management.

    • Plan an organizational unit (OU) structure based on delegation requirements.
    • You can use OUs to delegate administration to a group or an individual allowing for management of local data and resources.

    • Plan a security group hierarchy based on delegation requirements.
    • The three types of security groups are domain local, global and universal.

Managing and Maintaining an Active Directory Infrastructure

  • Manage an Active Directory forest and domain structure.
    • Manage schema modifications.
    • There can only be one schema per forest. The attributes that are defined in the forest affect all domains and OUs. There are default attributes that cannot be modified and there are others that can be added or deleted.

    • Add or remove a UPN suffix.
    • A User Principal Name is added through the Active Directory Domains and Trusts.

  • Manage an Active Directory site.
  • As mentioned before, the Knowledge Consistency Checker (KCC) is responsible by default for setting up replication inside and outside the site. Inside replication will be optimized for speed and outside replication will be optimized for bandwidth.

    • Configure replication schedules.
    • Replication should be configured to occur during off hours, which is usually at night.

    • Configure site link costs.
    • You may have several links that can be used for replication. Active Directory Sites and Services can be used for assigning costs to those links. The Knowledge Consistency Checker will use this information and will avoid links that have a high cost associated with it.

    • Configure site boundaries.
    • You need to consider what will happen if connectivity between sites is disrupted. If your site does not have its own domain controller, data servers, DHCP servers, etc., it will not be able to function.

  • Monitor Active Directory replication failures. Tools might include Replication Monitor, Event Viewer, and support tools.
    • Monitor Active Directory replication.
    • To monitor replication, you would use the Directory Service Event Log in Event Viewer, Repadmin.exe or Dcdiag.exe.

    • Monitor File Replication service (FRS) replication.
    • To monitor FRS replication you can use Event Viewer events associated with the File Replication Service or use FRSDiag.exe, which is a command line utility.

  • Restore Active Directory services.
    • Perform an authoritative restore operation.
    • An authoritative restore is most commonly used in cases in which a change was made within the directory that must be reversed, such as deleting an OU by mistake.

    • Perform a nonauthoritative restore operation.
    • A nonauthoritative restore is most commonly used in cases when a DC fails because of a hardware or software related reasons.

  • Troubleshoot Active Directory.
  • Some of the new tools in Windows 2003 that can be used to troubleshoot AD are: Dsadd.exe, Dsget.exe, Dsmod.exe, Dsmove.exe, DSQuery.exe and DSrm.exe

    • Diagnose and resolve issues related to Active Directory replication.
    • A system administrator needs to review the Directory Service Log frequently to stay on top of replication problems.

    • Diagnose and resolve issues related to operations master role failure.
    • If a current operations master has become unavailable, you can use the Ntdsutil.exe utility to seize the operations master role.

    • Diagnose and resolve issues related to the Active Directory database.
    • Once again, Event Viewer will help you to troubleshoot and diagnose problems relate to the Active Directory database.

Planning and Implementing User, Computer, and Group Strategies

  • Plan a security group strategy.
  • Organizing users or computers into groups makes your life as an administrator much easier. Instead of assigning permissions to dozens of users individually, you can create a group containing those users and assign permissions to the group. The four types of groups are Local, Domain Local, Global and Universal.

  • Plan a user authentication strategy.
  • There are many attributes that can be assigned to a user account: Account Expiration, Logon Hours, Enable/Disable, Locked Out, Must Change Password at next Logon, Cannot Change Password, Password Never Expires.

    • Plan a smart card authentication strategy.
    • A smart card allows a user to login using their card and a PIN. Smart cards store certificates, public and private keys, and passwords.

    • Create a password policy for domain users.
    • Passwords have become much more complex since users started logging in. You must determine how you will setup the password requirements in your organization. You can set your password length, require it to have upper and lower case, require it to have a number and require it to have special characters.

  • Plan an OU structure.
  • An Organizational Unit is used to delegate and decentralize control in your organization.

    • Analyze the administrative requirements for an OU.
    • An Organization Unit is the smallest unit to which a Group Policy can be applied. Group Policies can be set to control the behavior of security and desktop configurations. Group Policies are applied in the following order: Local, Site, Domain, Parent and Child.

  • Analyze the Group Policy requirements for an OU structure.
  • Implement an OU structure.
    • Create an OU.
    • You create an OU using Active Directory Computers and Users. You simply right-click on the location where you want a new OU and then choose New, Organization Unit.

    • Delegate permissions for an OU to a user or to a security group.
    • The Delegation of Control Wizard is used to delegate control of an OU to a specific user or group.

    • Move objects within an OU hierarchy.
    • The easiest way to move an OU to a different location in Active Directory is to simply drag and drop. You can also right-click on the OU and choose move or use the Dsmove.exe command line utility.

Planning and Implementing Group Policy

  • Plan Group Policy strategy.
    • Plan a Group Policy strategy by using Resultant Set of Policy (RSoP) Planning mode.
    • Group Policies should not be taken lightly. Applying a poorly conceived GP can create many problems for you. Resultant Set of Policy (RSoP) is a tool that allows you to review and test new policies before implementation.

    • Plan a strategy for configuring the user environment by using Group Policy.
    • These settings are used to configure policies which affect users. The computer which the user is logging on to does not influence whether these settings are applied. User configuration settings are applied when a user logs on to the computer.

    • Plan a strategy for configuring the computer environment by using Group Policy.
      • Computer startup and shutdown
      • User logon and logoff
      • Registry based policy settings
      • Security settings
      • Scripts
      • Folder Replication
      • Application deployment and management
  • Configure the user environment by using Group Policy.
    • Distribute software by using Group Policy.
    • One key design feature of Active Directory is to ease the process of deploying software within an organization. Microsoft included the ability to deploy and distribute software using Group Policy. You can assign an application, which causes it to be installed automatically or you can publish an application, which allows the user to decide if the application should be installed.

    • Automatically enroll user certificates by using Group Policy.
    • You need to be familiar with Public Key Infrastructure, Encrypted Files Systems, Automatic Certificate Requests and Trusted Root Certificate Authorities.

    • Redirect folders by using Group Policy.
    • Folder Redirection Group Policy Object can be used to redirect folders. You would use this if you wanted all of your users’ folders to point to a server. This would prevent users from saving data locally where it would probably not get backed up regularly.

    • Configure user security settings by using Group Policy.
    • Security policies can affect Password Policy, Account Lockout Policy, Group Membership, User Rights Assignment, Authentication, Available Resources and Security Options.

  • Deploy a computer environment by using Group Policy.
  • Group Policies can dictate a users wallpaper, desktop, available applications, standardized messages, etc.

    • Distribute software by using Group Policy.
    • As mentioned earlier, Group Policy can distribute mandatory software or make optional software available.

    • Automatically enroll computer certificates by using Group Policy.
    • This is similar to automatically enrolling user certificates in that you need to be familiar with Public Key Infrastructure, Encrypted Files Systems, Automatic Certificate Requests and Trusted Root Certificate Authorities.

    • Configure computer security settings by using Group Policy.
    • This too is similar to configuring user security settings. The types of things you can control with Group Policy are Password Policy, Account Lockout Policy, Kerberos Policy, User Rights Assignment and Security Options.

Managing and Maintaining Group Policy

  • Troubleshoot issues related to Group Policy application deployment. Tools might include RSoP and the gpresult command.
  • Maintain installed software by using Group Policy.
  • Just as you can distribute software using Group Policy, you can use Group Policy to make changes to the original deployment. You can even remove software with Group Policy.

    • Distribute updates to software distributed by Group Policy.
    • Configure automatic updates for network clients by using Group Policy.
  • + Share This
  • 🔖 Save To Your Account

Pearson IT Certification Promotional Mailings & Special Offers

I would like to receive exclusive offers and hear about products from Pearson IT Certification and its family of brands. I can unsubscribe at any time.


Pearson Education, Inc., 221 River Street, Hoboken, New Jersey 07030, (Pearson) presents this site to provide information about Pearson IT Certification products and services that can be purchased through this site.

This privacy notice provides an overview of our commitment to privacy and describes how we collect, protect, use and share personal information collected through this site. Please note that other Pearson websites and online products and services have their own separate privacy policies.

Collection and Use of Information

To conduct business and deliver products and services, Pearson collects and uses personal information in several ways in connection with this site, including:

Questions and Inquiries

For inquiries and questions, we collect the inquiry or question, together with name, contact details (email address, phone number and mailing address) and any other additional information voluntarily submitted to us through a Contact Us form or an email. We use this information to address the inquiry and respond to the question.

Online Store

For orders and purchases placed through our online store on this site, we collect order details, name, institution name and address (if applicable), email address, phone number, shipping and billing addresses, credit/debit card information, shipping options and any instructions. We use this information to complete transactions, fulfill orders, communicate with individuals placing orders or visiting the online store, and for related purposes.


Pearson may offer opportunities to provide feedback or participate in surveys, including surveys evaluating Pearson products, services or sites. Participation is voluntary. Pearson collects information requested in the survey questions and uses the information to evaluate, support, maintain and improve products, services or sites; develop new products and services; conduct educational research; and for other purposes specified in the survey.

Contests and Drawings

Occasionally, we may sponsor a contest or drawing. Participation is optional. Pearson collects name, contact information and other information specified on the entry form for the contest or drawing to conduct the contest or drawing. Pearson may collect additional personal information from the winners of a contest or drawing in order to award the prize and for tax reporting purposes, as required by law.


If you have elected to receive email newsletters or promotional mailings and special offers but want to unsubscribe, simply email information@informit.com.

Service Announcements

On rare occasions it is necessary to send out a strictly service related announcement. For instance, if our service is temporarily suspended for maintenance we might send users an email. Generally, users may not opt-out of these communications, though they can deactivate their account information. However, these communications are not promotional in nature.

Customer Service

We communicate with users on a regular basis to provide requested services and in regard to issues relating to their account we reply via email or phone in accordance with the users' wishes when a user submits their information through our Contact Us form.

Other Collection and Use of Information

Application and System Logs

Pearson automatically collects log data to help ensure the delivery, availability and security of this site. Log data may include technical information about how a user or visitor connected to this site, such as browser type, type of computer/device, operating system, internet service provider and IP address. We use this information for support purposes and to monitor the health of the site, identify problems, improve service, detect unauthorized access and fraudulent activity, prevent and respond to security incidents and appropriately scale computing resources.

Web Analytics

Pearson may use third party web trend analytical services, including Google Analytics, to collect visitor information, such as IP addresses, browser types, referring pages, pages visited and time spent on a particular site. While these analytical services collect and report information on an anonymous basis, they may use cookies to gather web trend information. The information gathered may enable Pearson (but not the third party web trend services) to link information with application and system log data. Pearson uses this information for system administration and to identify problems, improve service, detect unauthorized access and fraudulent activity, prevent and respond to security incidents, appropriately scale computing resources and otherwise support and deliver this site and its services.

Cookies and Related Technologies

This site uses cookies and similar technologies to personalize content, measure traffic patterns, control security, track use and access of information on this site, and provide interest-based messages and advertising. Users can manage and block the use of cookies through their browser. Disabling or blocking certain cookies may limit the functionality of this site.

Do Not Track

This site currently does not respond to Do Not Track signals.


Pearson uses appropriate physical, administrative and technical security measures to protect personal information from unauthorized access, use and disclosure.


This site is not directed to children under the age of 13.


Pearson may send or direct marketing communications to users, provided that

  • Pearson will not use personal information collected or processed as a K-12 school service provider for the purpose of directed or targeted advertising.
  • Such marketing is consistent with applicable law and Pearson's legal obligations.
  • Pearson will not knowingly direct or send marketing communications to an individual who has expressed a preference not to receive marketing.
  • Where required by applicable law, express or implied consent to marketing exists and has not been withdrawn.

Pearson may provide personal information to a third party service provider on a restricted basis to provide marketing solely on behalf of Pearson or an affiliate or customer for whom Pearson is a service provider. Marketing preferences may be changed at any time.

Correcting/Updating Personal Information

If a user's personally identifiable information changes (such as your postal address or email address), we provide a way to correct or update that user's personal data provided to us. This can be done on the Account page. If a user no longer desires our service and desires to delete his or her account, please contact us at customer-service@informit.com and we will process the deletion of a user's account.


Users can always make an informed choice as to whether they should proceed with certain services offered by Adobe Press. If you choose to remove yourself from our mailing list(s) simply visit the following page and uncheck any communication you no longer want to receive: www.pearsonitcertification.com/u.aspx.

Sale of Personal Information

Pearson does not rent or sell personal information in exchange for any payment of money.

While Pearson does not sell personal information, as defined in Nevada law, Nevada residents may email a request for no sale of their personal information to NevadaDesignatedRequest@pearson.com.

Supplemental Privacy Statement for California Residents

California residents should read our Supplemental privacy statement for California residents in conjunction with this Privacy Notice. The Supplemental privacy statement for California residents explains Pearson's commitment to comply with California law and applies to personal information of California residents collected in connection with this site and the Services.

Sharing and Disclosure

Pearson may disclose personal information, as follows:

  • As required by law.
  • With the consent of the individual (or their parent, if the individual is a minor)
  • In response to a subpoena, court order or legal process, to the extent permitted or required by law
  • To protect the security and safety of individuals, data, assets and systems, consistent with applicable law
  • In connection the sale, joint venture or other transfer of some or all of its company or assets, subject to the provisions of this Privacy Notice
  • To investigate or address actual or suspected fraud or other illegal activities
  • To exercise its legal rights, including enforcement of the Terms of Use for this site or another contract
  • To affiliated Pearson companies and other companies and organizations who perform work for Pearson and are obligated to protect the privacy of personal information consistent with this Privacy Notice
  • To a school, organization, company or government agency, where Pearson collects or processes the personal information in a school setting or on behalf of such organization, company or government agency.


This web site contains links to other sites. Please be aware that we are not responsible for the privacy practices of such other sites. We encourage our users to be aware when they leave our site and to read the privacy statements of each and every web site that collects Personal Information. This privacy statement applies solely to information collected by this web site.

Requests and Contact

Please contact us about this Privacy Notice or if you have any requests or questions relating to the privacy of your personal information.

Changes to this Privacy Notice

We may revise this Privacy Notice through an updated posting. We will identify the effective date of the revision in the posting. Often, updates are made to provide greater clarity or to comply with changes in regulatory requirements. If the updates involve material changes to the collection, protection, use or disclosure of Personal Information, Pearson will provide notice of the change through a conspicuous notice on this site or other appropriate way. Continued use of the site after the effective date of a posted revision evidences acceptance. Please contact us if you have questions or concerns about the Privacy Notice or any objection to any revisions.

Last Update: November 17, 2020