Transcript
Page 1: Interview Questions & Answers

SCCM / SMS Interview Questionssecondary site to a primary site?No. A secondary site is always a secondary site. It cannot be upgraded, moved, or changed without deleting it and reinstalling it. If you delete and reinstall, you lose all secondary site data.Can you distribute a package to a computer without making it a member of a collection?No. To distribute software you must have a package, a program and an advertisement. Advertisements can only be sent to collections, not to computers. If you want to distribute a package to a single computer, you must create a collection for that computer.

What is Secondary Site?

Four Main characteristics:

A Secondary Site does not have access to a Microsoft SQL Database Secondary Sites are ALWAYS a Child Site of a Primary Site and can only be administered via a Primary

Site Secondary Sites cannot have Child Sites of their own Clients cannot be assigned directly to the Site

What is CENTRAL SITE?

A Central Site is a Configuration Manager Primary Site that resides at the top of the Configuration Manager hierarchy. All Database information rolls from the child to the parent and is collected by the Central Site’s Configuration Manager Database. The Central Site can administer any site below it in the hierarchy and can send data down to those sites as well.

What is PRIMARY SITE?

Four main characteristics:

The Site has access to a Microsoft SQL Server Database Can administer or be administered via the Configuration Manager Console It can be a child of other Primary Sites and can have Child Sites of its own Clients can be assigned directly to the Site

How do you install and configure Secondary site server

http://exchangeserverinfo.com/2008/05/02/installation-and-configuration-of-secondary-site-server.aspxHow do you create a package for Adobe?

the command line  msiexec.exe /q ALLUSERS=2 /m MSIHPSJR /i “AcroRead.msi” TRANSFORMS=mytransform.mst

How do you distribute a package?

create a package in SCCM, pointing it to the installation sources, and in the package create an install program (you may have already done this?)

assign Distribution Points to your package so the contents get synched. create a Collection containing the objects (users/computers) that are allowed to receive the package. create an Advertisement for the distribution, linking the package you created to the collection, decide

whether the Adverisement is mandatory (installation enforced) or not (users have to go to the “Run Advertised Programs” dialog in Windows and select to install the program)

How SCCM download the patches?

You need to add the Software Update Point site role to the site, configure the software update point as active, configure the products, classifications, sync settings, etc. in the Software Update Point properties.  THEN, you

Page 2: Interview Questions & Answers

can go to the Update Repository node and run the Run Synchronization action from the central primary site. Once synchronization completes, you will see the metadata in the Configuration Manager console.

How do you configure the SUP? In the Configuration Manager console, navigate to System CenterConfiguration Manager / Site Database /Site Management / &lt;site code> – <site name> / Site Settings / Site SystemsRight-click the site system server name, and then click New Roles.Select Software update point, and then click Next.Specify whether the site server will use a proxy server when connecting to the software update point, and then clickNext.Select Use this server as the active software update point, and then specify the port settings configured for the WSUS Web site on this site system.Specify the synchronization source for the active software update point using one of the following settings: like Synchronize from Microsoft Update or Synchronize from an upstream update serverKeep the default setting Do not create WSUS reporting events, and then click NextSpecify whether to synchronize software updates on a schedule by selecting Enable synchronization on a scheduleSpecify the update classifications for which the software updates will be synchronized, and then click Next.Specify the products for which the software updates will be synchronized, and then click Next.Open SUPSetup.log in <InstallationPath>\Logs to monitor the installation progress for the software update point. When the installation completes, Installation was successful is written to the log file.Open WCM.log in <InstallationPath>\Logs to verify that the connection to the WSUS server was successful.How do you Backup SCCM Server?

To create a scheduled backup task, expand the Site Settings node and expand the Site Maintenance node, click on Tasks.

For Manual backup – Start SMS_SITE_BACKUP serviceWhat are the client deployments methods? 

Client Push Installion, Software update point based installation, Group Policy Installation, Logon Script Installation, Manual Installation, Upgrade Installation(software Distribution)

Can you discover clients those are in different AD forest? 

yes.Internet-based client management, which supports the following site systems installed in a separate forest to the site server:Management pointDistribution pointSoftware update pointFallback status point

What are the prerequisite for Software Update Point?  Windows Server Update Services (WSUS) 3.0, WSUS 3.0 Administration Console, Windows Update Agent (WUA) 3.0,Site server communication to the active software update point,Network Load Balancing (NLB),Background Intelligent Transfer Server (BITS) 2.5,Windows InstallerWhat is SMS Provider?

The SMS Provider is a WMI provider that allows both read and write access to the Configuration Manager 2007 site database. The SMS Provider is used by the Configuration Manager consoleThe SMS Provider can be installed on the site database server computer, site server computer or another server class third computer during Configuration Manager 2007 Setup. After setup has completed, the current installed location of the SMS Provider is displayed on the site properties general tab

What is ITMU?SMS 2003 Inventory Tool for Microsoft UpdatesWhat is the use of WSUS (Windows Server Update Service)?

It enables administrators to deploy the latest Microsoft product updates to computers that are running the Windows operating system.

Difference between SMS 2003 and SCCM 2007

Page 3: Interview Questions & Answers

What is WMI (indows Management Instrumentation)?You can write WMI scripts or applications to automate administrative tasks on remote computersWhat is SUP ( Software Update Point)?

This is required component of software updates, and after it is installed, the SUP is displayed as a site system role in the Configuration Manager console. The software update point site system role must be created on a site system server that has Windows Server Update Services (WSUS) 3.0 installed.

You want specific users\groups to run specific custom reports. What should you do?Navigate to “System Center Configuration Manager – Site Database – Security Rights – Users”Right click on “Users” and select “Manage ConfigMgr Users”Navigate to the “SCCM Support” group you created earlier

1. For “Collection” – “(All Instances)” add the following:- “Delete resource”- “Modify resource”- “Read”- “Read resource”- “Use remote tools”

2. For “Report” – “(All Instances)” add the following:- “Read”

3. For “Computer association” – “(All Instances)” add the following:- “Create”- “Delete”- “Read”- “Recover user state”

4. Click “Next”5. Click “Next”6. Click “Close”

You have been provided with permissions on the SCCM console to create, distribute, modify and delete packages? However, when distributing a package there is no Distribution points listed  in the Distribution Point Wizard. What should you do?To designate a distribution point on a new server or server share

1. In the Configuration Manager console, navigate to System CenterConfiguration Manager / Site Database / Site Management / <site name> / Site Settings.

2. Right-click Site Systems, point to New, and then click Server or Server Share, depending on which you want to create.

3. If you are creating a new server, use the New Site System Server Wizard to create the site system server, and select the Distribution Point check box from the Available Roles on the System Role Selection page to designate this server as a distribution point.

What are the required ports used by Configuration Manager?http://technet.microsoft.com/en-us/library/bb632618.aspx

You distributed a software application to some systems in your environment and few are failed, how do u troubleshoot the failure? what steps you will follow on client side and site server side? How SCCM clients come to know that they have to use SCCM WSUS?How certificates created in SCCM and what they called?How SCCM Communicate securely between sites? And where do you define that setting?  what you will keep in mind before configuring SCCM server to manage clients.What are the causes for a slow Configuration Manager Console connection and what would you do to make your Configuration Manager Console users’ experience better?Hope these SCCM / SMS Interview Questions with Answers will be helpful for you to prepare for SCCM /SMS Interviews.

This is how People come here Searching:

sccm administrator interview questions sccm deployment interview questions Question: What is SMS provider and what it does.=

Answer: The SMS Provider is a WMI provider that allows both read and write access to the Configuration Manager 2007 site database. The SMS Provider is used by the Configuration Manager

Page 4: Interview Questions & Answers

console, Resource Explorer, tools, and custom scripts used by Configuration Manager 2007 administrators to access site information stored in the site database. The SMS Provider also helps ensure that Configuration Manager 2007 object security is enforced by only returning site information that the user account running the Configuration Manager console is authorized to view. More on SMS provider…

Question: Can we upgrade SCCM secondary site to primary site?Answer: Yes we can do. More on upgrading secondary sites…..

Question: Can you change a secondary site to a primary site?Answer:  No. A secondary site is always a secondary site. It cannot be upgraded, moved, or changed without deleting it and reinstalling it. If you delete and reinstall, you lose all secondary site data.

Question: Can you distribute a package to a computer without making it a member of a collection?Answer:  No. To distribute software you must have a package, a program and an advertisement. Advertisements can only be sent to collections, not to computers. If you want to distribute a package to a single computer, you must create a collection for that computer.

Question: Can a site have more than one default management point?Answer:  No. You can configure more than one management points in a site, but only one of those management points can be configured as the default management point to support intranet clients in the site. If you are concerned about performance, you can configure more than one management point, configure them to be part of a Network Load Balancing (NLB) cluster, and them configure the NLB cluster as the default management point.

Question: Can a secondary site have child sites?Answer: No. A secondary site cannot have a primary or secondary site reporting to it. Secondary sites are always child sites to a primary site.

Question: Can you install the Configuration Manager client components without discovering the computer first?Answer: Yes. Client Push Installation is the only client installation method that requires clients to be discovered first.

Question: Does Configuration Manager 2007 mixed mode require a public key infrastructre (PKI)?Answer:  No. Configuration Manager 2007 native mode requires a PKI, but Configuration Manager 2007 does not. PKI authentication helps provide a greater level of security, but Configuration Manager 2007 does not help you install or configure the PKI infrastructure. If you do not already have the expertise to install and configure the PKI infrastructure, you can start with mixed mode and then change to native mode later.

Question: Can computers show up in the Configuration Manager console before they have the Configuration Manager client installed?Answer:  Yes. If you use a discovery method, Configuration Manager can find many resources and create data discovery records (DDRs) for them, and those DDRs are stored in the database. However, you cannot use Configuration Manager features such as software distribution, software updates management, and inventory until you install the client components.

Question: Can you assign clients to a secondary site?Answer:  No.If you have a secondary site, the client must be assigned to the primary parent of the secondary site. However, Configuration Manager knows how to manage clients at the child secondary site. If there is a distribution point at the secondary site that has the content the clients need, the clients will probably get the content from the local distribution point instead of crossing the WAN link to the primary site.

Question: Can Configuration Manager 2007 be used to package software for distribution?Answer:  No. Configuration Manager 2007 delivers command lines to clients and can force those command lines to run with administrative rights using the Local System account. Configuration Manager 2007 command lines can be batch files, scripts, Windows Installer files with .msi extensions, executable files – any file that the operating system can run, Configuration Manager 2007 can distribute. However, Configuration Manager 2007 does not actually package any software for distribution.

Basic DNS Interview Questions and AnswersQ1. What is DNS?Domain Name System is a service that can be installed on any windows server operating system to resolve the Name to IPAddress and vice-versa. TCP/IP networks, such as the Internet, use DNS to locate computers and services through user-friendly names

Page 5: Interview Questions & Answers

Q2. What is DDNS?Dynamic DNS or DDNS is a method of updating, in real time, a Domain Name System to point to a changing IP address on the Internet. This is used to provide a persistent domain name for a resource that may change location on the network.

Q3. What are the resource records in DNS?

A (Address) Maps a host name to an IP address. When a computer has multiple adapter cards and IP addresses, it should have multiple address records.

CNAME (Canonical Name) Sets an alias for a host name. For example, using this record, zeta.tvpress.com can have an alias as www.tvpress.com.

MX (Mail Exchange) Specifies a mail exchange server for the domain, which allows mail to be delivered to the correct mail servers in the domain.

NS (Name Server) Specifies a name server for the domain, which allows DNS lookups within various zones. Each primary and secondary name server should be declared through this record.

PTR (Pointer) Creates a pointer that maps an IP address to a host name for reverse lookups. SOA (Start of Authority) Declares the host that is the most authoritative for the zone and, as such, is

the best source of DNS information for the zone. Each zone file must have an SOA record (which is created automatically when you add a zone).

Q4. What are a Forward and Reverse Lookup?

Forward Lookup: When a name query is send to the DNS server against to IP address, it is generally said a forward lookup.

Reverse Lookup: DNS also provides a reverse lookup process, enabling clients to use a known IP address during a name query and look up a computer name based on its address.

Q5. What is Primary zone?This is the read and writable copy of a zone file in the DNS namespace. This is primary source for information about the zone and it stores the master copy of zone data in a local file or in AD DS. Dy default the primary zone file is named as zone_name.dns in %windir%\System32\DNS folder on the server.

Q6. What id Secondary zone?This is the read only copy of a zone file in the DNS namespace. This is secondary source for information about the zone and it get the updated information from the master copy of primary zone. The network access must be available to connect with primary server. As secondary zone is merely a copy of a primary zone that is hosted on another server, it cannot be stored in AD DS.

Q7. What is stub Zone?A stub zone is a read only copy of a zone that contains only those resource records which are necessary to identify the authoritative DNS servers for that particular zone. A stub zone is practically used to resolve names between separate DNS namespaces. This type of zone is generally created when a corporate merger or acquire and DNS servers for two separate DNS namespaces resolve names for clients in both namespaces.

A stub zone contains:The start of authority (SOA) resource record, name server (NS) resource records, and the glue A resource records for the delegated zone.The IP address of one or more master servers that can be used to update the stub zone.

Q8. What is Caching Only Server?Caching-only servers are those DNS servers that only perform name resolution queries, cache the answers, and return the results to the client. Once the query is stored in cache, next time the query in resolved locally from cached instead of going to the actual site.

Q9. What is Aging and Scavenging?DNS servers running Windows Server support aging and scavenging features. These features are provided as a mechanism to perform cleanup and removal of stale resource records from the server and zone. This feature removes the dynamically created records when they are stamped as stale.

By default, the aging and scavenging mechanism for the DNS Server service is disabled.

Scavenging and aging must be enabled both at the DNS server and on the zone

Page 6: Interview Questions & Answers

Q10. What is SRV record in DNS?The SRV record is a resource record in DNS that is used to identify or point to a computer that host specific services i.e Active directory.

Q11. What is Forwarding in DNS?A forwarder is a feature in DNS server that is used to forward DNS queries for external DNS names to DNS servers outside of that network. We ca configure a DNS server as a forwarder to forward the name query to other DNS servers in the network when they cannot resolve locally to that DNS server.

Q12. What is Conditional Forwarding in DNS?We can configure the DNS server to forward queries according to specific domain names using conditional forwarders. In this case query is forward to an IP address against a DNS domain name.

Q13. What are Queries types in DNS?

Recursive Query: This name queries are generally made by a DNS client to a DNS server or by a DNS server that is configured to pass unresolved name queries to another DNS server, in the case of a DNS server configured to use a forwarder.

Iterative Query: An iterative name query is one in which a DNS client allows the DNS server to return the best answer it can give based on its cache or zone data. If the queried DNS server does not have an exact match for the queried name, the best possible information it can return is a referral. The DNS client can then query the DNS server for which it obtained a referral. It continues this process until it locates a DNS server that is authoritative for the queried name, or until an error or time-out condition is met.

Q14. What are Tools for troubleshooting of DNS?DNS Console, NSLOOKUP, DNSCMD, IPCONFIG, DNS Logs.

Q15. How to check DNS health?Using the DCdiag.i.e. (dcdiag /test:dns /v /e)

Windows DNS Server Interview Questions – Part 1What is the main purpose of a DNS server?DNS servers are used to resolve FQDN hostnames into IP addresses and vice versa.

What is the port no of dns ?53.

What is a Forward Lookup?Resolving Host Names to IP Addresses.

What is Reverse Lookup?It?s a file contains host names to IP mapping information.

Page 7: Interview Questions & Answers

What is a Resource Record?It is a record provides the information about the resources available in the N/W infrastructure.

What are the diff. DNS Roles?Standard Primary, Standard Secondary, & AD Integrated.

What is a Zone?Zone is a sub tree of DNS database.

Secure services in your network require reverse name resolution to make it more difficult to launch successful attacks against the services. To set this up, you configure a reverse lookup zone and proceed to add records. Which record types do you need to create?PTR Records

SOA records must be included in every zone. What are they used for ?SOA records contain a TTL value, used by default in all resource records in the zone. SOA records contain the e-mail address of the person who is responsible for maintaining the zone. SOA records contain the current serial number of the zone, which is used in zone transfers.

By default, if the name is not found in the cache or local hosts file, what is the first step the client takes to resolve the FQDN name into an IP address ? Performs a recursive search through the primary DNS server based on the network interface configuration .

What is primary, Secondary, stub & AD Integrated Zone?Primary Zone: – zone which is saved as normal text file with filename (.dns) in DBS folder. Maintains a read, write copy of zone database.

Secondary Zone: – maintains a read only copy of zone database on another DNS server. Provides fault tolerance and load balancing by acting as backup server to primary server.

Stub zone: – contains a copy of name server and SOA records used for reducing the DNS search orders. Provides fault tolerance and load balancing.

How do you manually create SRV records in DNS? This is on windows server go to run —> dnsmgmt.msc rightclick on the zone you want to add srv record to and choose “other new record” and choose service location(srv).

What is the main purpose of SRV records ? SRV records are used in locating hosts that provide certain network services.

Before installing your first domain controller in the network, you installed a DNS server and created a zone, naming it as you would name your AD domain. However, after the installation of the domain controller, you are unable to locate infrastructure SRV records anywhere in the zone. What is the most likely cause of this failure ?The zone you created was not configured to allow dynamic updates. The local interface on the DNS server was not configured to allow dynamic updates.

Which of the following conditions must be satisfied to configure dynamic DNS updates for legacy clients ? The zone to be used for dynamic updates must be configured to allow dynamic updates. The DHCP server must support, and be configured to allow, dynamic updates for legacy clients.

At some point during the name resolution process, the requesting party received authoritative reply. Which further actions are likely to be taken after this reply ?After receiving the authoritative reply, the resolution process is effectively over.

Name 3 benefits of using AD-integrated zones. Active Directory integrated DNS enables Active Directory storage and replication of DNS zone databases. Windows 2000 DNS server, the DNS server that is included with Windows 2000 Server, accommodates storing zone data in Active Directory.

Page 8: Interview Questions & Answers

When you configure a computer as a DNS server, zones are usually stored as text files on name servers that is, all of the zones required by DNS are stored in a text file on the server computer.

These text files must be synchronized among DNS name servers by using a system that requires a separate replication topology and schedule called a zone transfer However, if you use Active Directory integrated DNS when you configure a domain controller as a DNS name server, zone data is stored as an Active Directory object and is replicated as part of domain replication.

Windows DNS Server Interview Questions – Part 2Your company uses ten domain controllers, three of which are also used as DNS servers. You have one companywide AD-integrated zone, which contains several thousand resource records. This zone also allows dynamic updates, and it is critical to keep this zone up-to-date. Replication between domain controllers takes up a significant amount of bandwidth. You are looking to cut bandwidth usage for the purpose of replication. What should you do?

Change the replication scope to all DNS servers in the domain.

You are administering a network connected to the Internet. Your users complain that everything is slow. Preliminary research of the problem indicates that it takes a considerable amount of time to resolve names of resources on the Internet. What is the most likely reason for this?

DNS servers are not caching replies.. Local client computers are not caching replies… The cache.dns file may have been corrupted on the server.

What are the benefits of using Windows 2003 DNS when using AD-integrated zones?

If your DNS topology includes Active Directory, use Active Directory integrated zones. Active Directory integrated zones enable you to store zone data in the Active Directory database.Zone information about any primary DNS server within an Active Directory integrated zone is always replicated.

Because DNS replication is single-master, a primary DNS server in a standard primary DNS zone can be a single point of failure. In an Active Directory integrated zone, a primary DNS server cannot be a single point of failure because Active Directory uses multimaster replication.

Updates that are made to any domain controller are replicated to all domain controllers and the zone information about any primary DNS server within an Active Directory integrated zone is always replicated.Active Directory integrated zones: Enable you to secure zones by using secure dynamic update.

Provide increased fault tolerance. Every Active Directory integrated zone can be replicated to all domain controllers within the Active Directory domain or forest. All DNS servers running on these domain controllers can act as primary servers for the zone and accept dynamic updates.

Enable replication that propagates changed data only, compresses replicated data, and reduces network traffic. If you have an Active Directory infrastructure, you can only use Active Directory integrated zones on Active Directory domain controllers.If you are using Active Directory integrated zones, you must decide whether or not to store Active Directory integrated zones in the application directory partition.

You can combine Active Directory integrated zones and file-based zones in the same design. For example, if the DNS server that is authoritative for the private root zone is running on an operating system other than Windows Server 2003 or Windows 2000, it cannot act as an Active Directory domain controller. Therefore, you must use file-based zones on that server. However, you can delegate this zone to any domain controller running either Windows Server 2003 or Windows 2000.

You installed a new AD domain and the new (and first) DC has not registered its SRV records in DNS. Name a few possible causes.

The machine cannot be configured with DNS client her own .The DNS service cannot be run.

What are the benefits and scenarios of using Stub zones?

Page 9: Interview Questions & Answers

Understanding stub zones A stub zone is a copy of a zone that contains only those resource records necessary to identify the authoritative Domain Name System (DNS) servers for that zone.A stub zone is used to resolve names between separate DNS namespaces. This type of resolution may be necessary when a corporate merger requires that the DNS servers for two separate DNS namespaces resolve names for clients in both namespaces.

A stub zone consists of:

The start of authority (SOA) resource record, name server (NS) resource records, and the glue A resource records for the delegated zone. The IP address of one or more master servers that can be used to update the stub zone. The master servers for a stub zone are one or more DNS servers authoritative for the child zone, usually the DNS server hosting the primary zone for the delegated domain name.

Use stub zones to:Keep delegated zone information current.By updating a stub zone for one of its child zones regularly, the DNS server hosting both the parent zone and the stub zone will maintain a current list of authoritative DNS servers for the child zone.

Improve name resolution.Stub zones enable a DNS server to perform recursion using the stub zone’s list of name servers without needing to query the Internet or internal root server for the DNS namespace.

Simplify DNS administration.By using stub zones throughout your DNS infrastructure, you can distribute a list of the authoritative DNS servers for a zone without using secondary zones. However, stub zones do not serve the same purpose as secondary zones and are not an alternative when considering redundancy and load sharing.

There are two lists of DNS servers involved in the loading and maintenance of a stub zone:

 The list of master servers from which the DNS server loads and updates a stub zone. A master server may be a primary or secondary DNS server for the zone. In both cases, it will have a complete list of the DNS servers for the zone.

 The list of the authoritative DNS servers for a zone. This list is contained in the stub zone using name server (NS) resource records. When a DNS server loads a stub zone, such as widgets.example.com, it queries the master servers, which can be in different locations, for the necessary resource records of the authoritative servers for the zone widgets.example.com. The list of master servers may contain a single server or multiple servers and can be changed anytime.

What are the benefits and scenarios of using Conditional Forwarding? Rather than having a DNS server forward all queries it cannot resolve to forwarders, the DNS server can forward queries for different domain names to different DNS servers according to the specific domain names that are contained in the queries. Forwarding according to these domain-name conditions improves conventional forwarding by adding a second condition to the forwarding process.

A conditional forwarder setting consists of a domain name and the IP address of one or more DNS servers. To configure a DNS server for conditional forwarding, a list of domain names is set up on the Windows Server 2003-based DNS server along with the DNS server IP address. When a DNS client or server performs a query operation against a Windows Server 2003- based DNS server that is configured for forwarding, the DNS server looks to see if the query can be resolved by using its own zone data or the zone data that is stored in its cache, and then, if the DNS server is configured to forward for the domain name that is designated in the query (a match), the query is forwarded to the IP address of a DNS Server that is associated with the domain name. If the DNS server has no domain name listed for the name that is designated in the query, it attempts to resolve the query by using standard recursion.

 What is the 224.0.1.24 address used for?

WINS server group address. Used to support auto discovery and dynamic configuration of replication for WINS servers. For more information, see WINS replication overview WINS server group address. Used to support auto discovery and dynamic configuration of replication for WINS servers.

Describe the importance of DNS to AD ?When Microsoft began development on Active Directory, full compatibility with the domain name system (DNS)

Page 10: Interview Questions & Answers

was a critical priority. Active Directory was built from the ground up not just to be fully compatible with DNS but to be so integrated with it that one cannot exist without the other. Microsoft’s direction in this case did not just happen by chance, but because of the central role that DNS plays in Internet name resolution and Microsoft’s desire to make its product lines embrace the Internet.

While fully conforming to the standards established for DNS, Active Directory can expand upon the standard feature set of DNS and offer some new capabilities such as AD-Integrated DNS, which greatly eases the administration required for DNS environments. In addition, Active Directory can easily adapt to exist in a foreign DNS environment, such as Unix BIND, as long as the BIND version is 8.2.x or higher. When Microsoft began development on Active Directory, full compatibility with the domain name system (DNS) was a critical priority.

Active Directory was built from the ground up not just to be fully compatible with DNS but to be so integrated with it that one cannot exist without the other. Microsoft’s direction in this case did not just happen by chance, but because of the central role that DNS plays in Internet name resolution and Microsoft’s desire to make its product lines embrace the Internet.

While fully conforming to the standards established for DNS, Active Directory can expand upon the standard feature set of DNS and offer some new capabilities such as AD-Integrated DNS, which greatly eases the administration required for DNS environments. In addition, Active Directory can easily adapt to exist in a foreign DNS environment, such as Unix BIND, as long as the BIND version is 8.2.x or higher.

Windows DNS Server Interview Questions – Part 3What is the “.” zone in my forward lookup zone?This setting designates the Windows 2000 or Windows Server 2003 DNS server to be a root hint server and is usually deleted. If you do not delete this setting, you may not be able to perform external name resolution to the root hint servers on the Internet.

Do I need to configure forwarders in DNS?No. By default, Windows 2000 DNS uses the root hint servers on the Internet; however, you can configure forwarders to send DNS queries directly to your ISP’s DNS server or other DNS servers. Most of the time, when you configure forwarders, DNS performance and efficiency increases, but this configuration can also introduce a point of failure if the forwarding DNS server is experiencing problems.

The root hint server can provide a level of redundancy in exchange for slightly increased DNS traffic on your Internet connection. Windows Server 2003 DNS will query root hints servers if it cannot query the forwarders.

Should I point the other Windows 2000-based and Windows Server 2003-based computers on my LAN to my ISP’s DNS servers? No. If a Windows 2000-based or Windows Server 2003-based server or workstation does not find the domain controller in DNS, you may experience issues joining the domain or logging on to the domain. A Windows 2000-based or Windows Server 2003-based computer’s preferred DNS setting should point to the Windows 2000 or Windows Server 2003 domain controller running DNS.

If you are using DHCP, make sure that you view scope option #15 for the correct DNS server settings for your LAN.

Do I need to point computers that are running Windows NT 4.0 or Microsoft Windows 95, Microsoft Windows 98, or Microsoft Windows 98 Second Edition to the Windows 2000 or Windows Server 2003 DNS server?Legacy operating systems continue to use NetBIOS for name resolution to find a domain controller; however it is recommended that you point all computers to the Windows 2000 or Windows Server 2003 DNS server for name resolution.

What if my Windows 2000 or Windows Server 2003 DNS server is behind a proxy server or firewall?If you are able to query the ISP’s DNS servers from behind the proxy server or firewall, Windows 2000 and Windows Server 2003 DNS server is able to query the root hint servers. UDP and TCP Port 53 should be open on the proxy server or firewall.

What should I do if the domain controller points to itself for DNS, but the SRV records still do not appear in the zone?Check for a disjointed namespace, and then run Netdiag.exe /fix.

Page 11: Interview Questions & Answers

You must install Support Tools from the Windows 2000 Server or Windows Server 2003 CD-ROM to run Netdiag.exe.

How do I set up DNS for a child domain?To set up DNS for a child domain, create a delegation record on the parent DNS server for the child DNS server. Create a secondary zone on the child DNS server that transfers the parent zone from the parent DNS server.

Note Windows Server 2003 has additional types of zones, such as Stub Zones and forest-level integrated Active Directory zones, that may be a better fit for your environment. Set the child domain controller to point to itself first. As soon as an additional domain controller is available, set the child domain controller to point to this domain controller in the child domain as its secondary.

What are the types of SRV records?MSDCS:Contains DCs information.TCP:Contains Global Catalog, Kerberos & LDAP information.UDP:Contains Sites information.Sites:Contains Sites information.Domain DNS Zone:Conations domain?s DNS specific information.Forest DNS zone:Contains Forest?s Specific Information.

Where does a Host File Reside?c:\windows\system32\drivers\etc.

What is SOA?Start of Authority: useful when a zone starts. Provides the zone startup information.

What is a query?A request made by the DNS client to provide the name server information.

What are the diff. types of Queries?Recursion, iteration.

Tools for troubleshooting DNS?DNS Console, NSLOOKUP, DNSCMD, IPCONFIG, Logs.

What is WINS server? where we use WINS server? difference between DNS and WINS?WINS is windows internet name service used to resolve the NetBIOS(computer name)name to IP address.This is proprietary for Windows.You can use in LAN.DNS is a Domain Naming System, which resolves Host names to IP addresses. It uses fully qualified domain names. DNS is an Internet standard used to resolve host names.

What is new in Windows Server 2003 regarding the DNS management?When DC promotion occurs with an existing forest, the Active Directory Installation Wizard contacts an existing DC to update the directory and replicate from the DC the required portions of the directory.

If the wizard fails to locate a DC, it performs debugging and reports what caused the failure and how to fix the problem. In order to be located on a network, every DC must register in DNS DC locator DNS records. The Active Directory Installation Wizard verifies a proper configuration of the DNS infrastructure. All DNS configuration debugging and reporting activity is done with the Active Directory Installation Wizard.

SOA records must be included in every zone. What are they used for?SOA records contain a TTL value, used by default in all resource records in the zone. SOA records contain the e-mail address of the person who is responsible for maintaining the zone. SOA records contain the current serial number of the zone, which is used in zone transfers.

By default, if the name is not found in the cache or local hosts file, what is the first step the client takes to resolve the FQDN name into an IP address? Performs a recursive search through the primary DNS server based on the network interface configuration.

How do I clear the DNS cache on the DNS server? Go to cmd prompt and type ipconfig /flushdns .

Page 12: Interview Questions & Answers

What is the main purpose of SRV records?SRV records are used in locating hosts that provide certain network services.

Before installing your first domain controller in the network, you installed a DNS server and created a zone, naming it as you would name your AD domain. However, after the installation of the domain controller, you are unable to locate infrastructure SRV records anywhere in the zone. What is the most likely cause of this failure?The zone you created was not configured to allow dynamic updates. The local interface on the DNS server was not configured to allow dynamic updates.

What does a zone consist of & why do we require a zone?Zone consists of resource records and we require zone for representing sites.

What is Caching Only Server?When we install 2000 & 2003 server it is configured as caching only server where it maintains the frequently accessed sites information and again when we access the same site for next time it is obtain from cached information instead of going to the actual site.

What is forwarder?When one DNS server can?t receive the query it can be forwarded to another DNS once configured as forwarder.

What is secondary DNS Server?It is backup for primary DNS where it maintains a read only copy of DNS database.

How to enable Dynamic updates in DNS? Start>Program>Admin tools> DNS >Zone properties.

What are the properties of DNS server? INTERFACES, FORWARDERS, ADVANCED, ROUTINGS, SECURITY, MONITORING, LOGGING, DEBUG LOGGING.

Properties of a Zone ? General, SOA, NAMESERVER, WINS, Security, and ZONE Transfer.

What is scavenging?Finding and deleting unwanted records.

What are SRV records? SRV are the service records, there are 6 service records. They are useful for locating the services.

What are the requirements from DNS to support AD? When you install Active Directory on a member server, the member server is promoted to a domain controller. Active Directory uses DNS as the location mechanism for domain controllers, enabling computers on the network to obtain IP addresses of domain controllers. During the installation of Active Directory, the service (SRV) and address (A) resource records are dynamically registered in DNS, which are necessary for the successful functionality of the domain controller locator (Locator) mechanism.To find domain controllers in a domain or forest, a client queries DNS for the SRV and A DNS resource records of the domain controller, which provide the client with the names and IP addresses of the domain controllers. In this context, the SRV and A resource records are referred to as Locator DNS resource records.

When adding a domain controller to a forest, you are updating a DNS zone hosted on a DNS server with the Locator DNS resource records and identifying the domain controller. For this reason, the DNS zone must allow dynamic updates (RFC 2136) and the DNS server hosting that zone must support the SRV resource records (RFC 2782) to advertise the Active Directory directory service. For more information about RFCs, see DNS RFCs.

If the DNS server hosting the authoritative DNS zone is not a server running Windows 2000 or Windows Server 2003, contact your DNS administrator to determine if the DNS server supports the required standards. If the server does not support the required standards, or the authoritative DNS zone cannot be configured to allow dynamic updates, then modification is required to your existing DNS infrastructure.

Page 13: Interview Questions & Answers

For more information, see Checklist: Verifying DNS before installing Active Directory and Using the Active Directory Installation Wizard.

ImportantThe DNS server used to support Active Directory must support SRV resource records for the Locator mechanism to function. For more information, see Managing resource records. It is recommended that the DNS infrastructure allows dynamic updates of Locator DNS resource records (SRV and A) before installing Active Directory, but your DNS administrator may add these resource records manually after installation. After installing Active Directory, these records can be found on the domain controller in the following location: systemroot\System32\Config\Netlogon.dns .

Windows Server DHCP Interview QuestionsBelow is the list of Basic Windows Server DHCP Interview Questions asked in Interviews for the post of Windows System Administrator/ L1/L2/L3 Windows Support Engineer.

What is dhcp ?Dynamic Host Configuration Protocol (DHCP) is a network protocol that enables a server to automatically assign an IP address to a computer from a defined range of numbers (i.e., a scope) configured for a given network.

 What is the dhcp process for client machine?1. A user turns on a computer with a DHCP client.2. The client computer sends a broadcast request (called a DISCOVER or DHCPDISCOVER), looking for a

Page 14: Interview Questions & Answers

DHCP server to answer.3. The router directs the DISCOVER packet to the correct DHCP server.4. The server receives the DISCOVER packet. Based on availability and usage policies set on the server, the server determines an appropriate address (if any) to give to the client. The server then temporarily reserves that address for the client and sends back to the client an OFFER (or DHCPOFFER) packet, with that address information. The server also configures the client’s DNS servers, WINS servers, NTP servers, and sometimes other services as well.5. The client sends a REQUEST (or DHCPREQUEST) packet, letting the server know that it intends to use the address.6. The server sends an ACK (or DHCPACK) packet, confirming that the client has a been given a lease on the address for a server-specified period of time.

 What is dhcp scope ?DHCP scopes are used to define ranges of addresses from which a DHCP server can assign IP addresses to clients.

Types of scopes in windows dhcp ?Normal Scope – Allows A, B and C Class IP address ranges to be specified including subnet masks, exclusions and reservations. Each normal scope defined must exist within its own subnet.Multicast Scope – Used to assign IP address ranges for Class D networks. Multicast scopes do not have subnet masks, reservation or other TCP/IP options.Multicast scope address ranges require that a Time To Live (TTL) value be specified (essentially the number of routers a packet can pass through on the way to its destination).Superscope – Essentially a collection of scopes grouped together such that they can be enabled and disabled as a single entity.

What is Authorizing DHCP Servers in Active Directory ?If a DHCP server is to operate within an Active Directory domain (and is not running on a domain controller) it must first be authorized.This can be achieved either as part of the DHCP Server role installation, or subsequently using either DHCP console or at the command prompt using the netsh tool.If the DHCP server was not authorized during installation, invoke the DHCP console (Start -> All Programs -> Administrative Tools -> DHCP),right click on the DHCP to be authorized and select Authorize. To achieve the same result from the command prompt, enter the following command:netsh dhcp server serverID initiate authIn the above command syntax, serverID is replaced by the IP address or full UNC name of system on which the DHCP server is installed.

What ports are used by DHCP and the DHCP clients ? Requests are on UDP port 68, Server replies on UDP 67 .

List some Benefits of using DHCP DHCP provides the following benefits for administering your TCP/IP-based network:Safe and reliable configuration.DHCP avoids configuration errors caused by the need to manually type in values at each computer. Also, DHCP helps prevent address conflicts caused by a previously assigned IP address being reused to configure a new computer on the network.Reduces configuration management.

Using DHCP servers can greatly decrease time spent to configuring and reconfiguring computers on your network. Servers can be configured to supply a full range of additional configuration values when assigning address leases. These values are assigned using DHCP options. Also, the DHCP lease renewal process helps assure that where client configurations need to be updated often (such as users with mobile or portable computers who change locations frequently), these changes can be made efficiently and automatically by clients communicating directly with DHCP servers.

The following section covers issues that affect the use of the DHCP Server service with other services or network configurations. Using DNS servers with DHCP Using Routing and Remote Access servers with DHCP Multihomed DHCP servers.

Describe the process of installing a DHCP server in an AD infrastructure ?Open Windows Components Wizard. Under Components , scroll to and click Networking Services. Click Details . Under Subcomponents of Networking Services , click Dynamic Host Configuration Protocol (DHCP) and then click OK .

Page 15: Interview Questions & Answers

Click Next . If prompted, type the full path to the Windows Server 2003 distribution files, and then click Next. Required files are copied to your hard disk.

How to authorize a DHCP server in Active Directory Open DHCP ?. In the console tree, click DHCP. On the Action menu, click Manage authorized servers.. The Manage Authorized Servers dialog box appears. Click Authorize.. When prompted, type the name or IP address of the DHCP server to be authorized, and then click OK.

What is DHCPINFORM? DHCPInform is a DHCP message used by DHCP clients to obtain DHCP options. While PPP remote access clients do not use DHCP to obtain IP addresses for the remote access connection, Windows 2000 and Windows 98 remote access clients use the DHCPInform message to obtain DNS server IP addresses, WINS server IP addresses, and a DNS domain name.

The DHCPInform message is sent after the IPCP negotiation is concluded. The DHCPInform message received by the remote access server is then forwarded to a DHCP server. The remote access server forwards DHCPInform messages only if it has been configured with the DHCP Relay Agent.

Describe the integration between DHCP and DNS? Traditionally, DNS and DHCP servers have been configured and managed one at a time. Similarly, changing authorization rights for a particular user on a group of devices has meant visiting each one and making configuration changes.

DHCP integration with DNS allows the aggregation of these tasks across devices, enabling a company’s network services to scale in step with the growth of network users, devices, and policies, while reducing administrative operations and costs. This integration provides practical operational efficiencies that lower total cost of ownership.

Creating a DHCP network automatically creates an associated DNS zone, for example, reducing the number of tasks required of network administrators. And integration of DNS and DHCP in the same database instance provides unmatched consistency between service and management views of IP address-centric network services data.

Windows Server Group Policy Interview QuestionsBelow is the list of Windows Server Group Policy Interview Questions Asked in Windows System Administrator / L1/l2/l3 Support Engineer Interviews.

What is group policy in active directory ? What are Group Policy objects (GPOs)?Group Policy objects, other than the local Group Policy object, are virtual objects. The policy setting information of a GPO is actually stored in two locations: the Group Policy container and the Group Policy template.

The Group Policy container is an Active Directory container that stores GPO properties, including information on version, GPO status, and a list of components that have settings in the GPO.

The Group Policy template is a folder structure within the file system that stores Administrative Template-based policies, security settings, script files, and information regarding applications that are available for Group Policy Software Installation.

Page 16: Interview Questions & Answers

The Group Policy template is located in the system volume folder (Sysvol) in the \Policies subfolder for its domain.

What is the order in which GPOs are applied ?Group Policy settings are processed in the following order:1.Local Group Policy object : Each computer has exactly one Group Policy object that is stored locally. This �processes for both computer and user Group Policy processing.

2.Site : Any GPOs that have been linked to the site that the computer belongs to are processed next. Processing �is in the order that is specified by the administrator, on the Linked Group Policy Objects tab for the site in Group Policy Management Console (GPMC). The GPO with the lowest link order is processed last, and therefore has the highest precedence.

3.Domain: Processing of multiple domain-linked GPOs is in the order specified by the administrator, on the �Linked Group Policy Objects tab for the domain in GPMC. The GPO with the lowest link order is processed last, and therefore has the highest precedence.

4.Organizational units : GPOs that are linked to the organizational unit that is highest in the Active Directory �hierarchy are processed first, then POs that are linked to its child organizational unit, and so on. Finally, the GPOs that are linked to the organizational unit that contains the user or computer are processed.

At the level of each organizational unit in the Active Directory hierarchy, one, many, or no GPOs can be linked. If several GPOs are linked to an organizational unit, their processing is in the order that is specified by the administrator, on the Linked Group Policy Objects tab for the organizational unit in GPMC.

The GPO with the lowest link order is processed last, and therefore has the highest precedence.This order means that the local GPO is processed first, and GPOs that are linked to the organizational unit of which the computer or user is a direct member are processed last, which overwrites settings in the earlier GPOs if there are conflicts. (If there are no conflicts, then the earlier and later settings are merely aggregated.)

How to backup/restore Group Policy objects ? Begin the process by logging on to a Windows Server 2008 domain controller, and opening the Group Policy Management console. Now, navigate through the console tree to Group Policy Management | Forest: | Domains | | Group Policy Objects.

When you do, the details pane should display all of the group policy objects that are associated with the domain. In Figure A there are only two group policy objects, but in a production environment you may have many more. The Group Policy Objects container stores all of the group policy objects for the domain.

Now, right-click on the Group Policy Objects container, and choose the Back Up All command from the shortcut menu. When you do, Windows will open the Back Up Group Policy Object dialog box.

As you can see in Figure B, this dialog box requires you to provide the path to which you want to store the backup files. You can either store the backups in a dedicated folder on a local drive, or you can place them in a folder on a mapped network drive. The dialog box also contains a Description field that you can use to provide a description of the backup that you are creating.

You must provide the path to which you want to store your backup of the group policy objects.To initiate the backup process, just click the Back Up button. When the backup process completes, you should see a dialog box that tells you how many group policy objects were successfully backed up. Click OK to close the dialog box, and you’re all done.

When it comes to restoring a backup of any Group Policy Object, you have two options. The first option is to right-click on the Group Policy Object, and choose the Restore From Backup command from the shortcut menu. When you do this, Windows will remove all of the individual settings from the Group Policy Object, and then implement the settings found in the backup.

Your other option is to right-click on the Group Policy Object you want to restore, and choose the Import Settings option. This option works more like a merge than a restore.Any settings that presently reside within the Group Policy Object are retained unless there is a contradictory settings within the file that is being imported.

Page 17: Interview Questions & Answers

You want to standardize the desktop environments (wallpaper, My Documents, Start menu, printers etc.) on the computers in one department. How would you do that? go to Start->programs->Administrative tools->Active Directory Users and ComputersRight Click on Domain->click on preopertiesOn New windows Click on Group PolicySelect Default Policy->click on Editon group Policy consolego to User Configuration->Administrative Template->Start menu and TaskbarSelect each property you want to modify and do the same

What?s the difference between software publishing and assigning?Assign Users :The software application is advertised when the user logs on. It is installed when the user clicks on the software application icon via the start menu, or accesses a file that has been associated with the software application.

Assign Computers :The software application is advertised and installed when it is safe to do so, such as when the computer is next restarted.

Publish to users : The software application does not appear on the start menu or desktop. This means the user may not know that the software is available. The software application is made available via the Add/Remove Programs option in control panel, or by clicking on a file that has been associated with the application. Published applications do not reinstall themselves in the event of accidental deletion, and it is not possible to publish to computers.

What are administrative templates? Administrative Templates are a feature of Group Policy, a Microsoft technology for centralised management of machines and users in an Active Directory environment. Administrative Templates facilitate the management of registry-based policy. An ADM file is used to describe both the user interface presented to the Group Policy administrator and the registry keys that should be updated on the target machines.

An ADM file is a text file with a specific syntax which describes both the interface and the registry values which will be changed if the policy is enabled or disabled.

ADM files are consumed by the Group Policy Object Editor (GPEdit). Windows XP Service Pack 2 shipped with five ADM files (system.adm, inetres.adm, wmplayer.adm, conf.adm and wuau.adm). These are merged into a unified “namespace” in GPEdit and presented to the administrator under the Administrative Templates node (for both machine and user policy).

Can I deploy non-MSI software with GPO?create the fiile in .zap extension.

Name some GPO settings in the computer and user parts ?Group Policy Object (GPO) computer=Computer Configuration, User=User ConfigurationName some GPO settings in the computer and user parts.

A user claims he did not receive a GPO, yet his user and computer accounts are in the right OU, and everyone else there gets the GPO. What will you look for? make sure user not be member of loopback policy as in loopback policy it doesn’t effect user settings only computer policy will applicable. if he is member of gpo filter grp or not?You may also want to check the computers event logs. If you find event ID 1085 then you may want to download the patch to fix this and reboot the computer.

How can I override blocking of inheritance ?

What can I do to prevent inheritance from above?

Name a few benefits of using GPMC.

How frequently is the client policy refreshed ?90 minutes give or take.

Page 18: Interview Questions & Answers

Where is secedit ?It’s now gpupdate.

What can be restricted on Windows Server 2003 that wasn’t there in previous products ?Group Policy in Windows Server 2003 determines a users right to modify network and dial-up TCP/IP properties. Users may be selectively restricted from modifying their IP address and other network configuration parameters.

You want to create a new group policy but do not wish to inherit.Make sure you check Block inheritance among the options when creating the policy.

How does the Group Policy ‘No Override’ and ‘Block Inheritance’ work ?

Group Policies can be applied at multiple levels (Sites, domains, organizational Units) and multiple GP’s for each level. Obviously it may be that some policy settings conflict hence the application order of Site – Domain – Organization Unit and within each layer you set order for all defined policies but you may want to force some polices to never be overridden (No Override) and you may want some containers to not inherit settings from a parent container (Block Inheritance).

A good definition of each is as follows:

No Override – This prevents child containers from overriding policies set at higher levels

Block Inheritance – Stops containers inheriting policies from parent containers

No Override takes precedence over Block Inheritance so if a child container has Block Inheritance set but on the parent a group policy has No Override set then it will get applied.

Also the highest No Override takes precedence over lower No Override’s set.

To block inheritance perform the following:

1. Start the Active Directory Users and Computer snap-in (Start – Programs – Administrative Tools – Active Directory Users and Computers)

2. Right click on the container you wish to stop inheriting settings from its parent and select3. Select the ‘Group Policy’ tab4. Check the ‘Block Policy inheritance’ option5. Click Apply then OK

To set a policy to never be overridden perform the following:

1. Start the Active Directory Users and Computer snap-in (Start - - Administrative Tools – Active Directory Users and Computers)

2. Right click on the container you wish to set a Group Policy to not be overridden and select Properties3. Select the ‘Group Policy’ tab4. Click Options5. Check the ‘No Override’ option6. Click OK7. Click Apply then OK

Page 20: Interview Questions & Answers

Active Directory Interview Questions & Answers

What is Active Directory ? Active Directory is a Meta Data. Active Directory is a data base which store a data base like your user information, computer information and also other network object info. It has capabilities to manage and administor the complite Network which connect with AD.

What is domain ? Windows NT and Windows 2000, a domain is a set of network resources (applications, printers, and so forth) for a group of users. The user need only to log in to the domain to gain access to the resources, which may be located on a number of different servers in the network. The ‘domain’ is simply your computer address not to confused with an URL. A domain address might look something like 211.170.469.

What is domain controller ? A Domain controller (DC) is a server that responds to security authentication requests (logging in, checking permissions, etc.) within the Windows Server domain. A domain is a concept introduced in Windows NT whereby a user may be granted access to a number of computer resources with the use of a single username and password combination.

What is LDAP ? Lightweight Directory Access Protocol LDAP is the industry standard directory access protocol, making Active Directory widely accessible to management and query applications. Active Directory supports LDAPv3 and LDAPv2.

What is KCC ? KCC ( knowledge consistency checker ) is used to generate replication topology for inter site replication and for intrasite replication.with in a site replication traffic is done via remote procedure calls over ip, while between site it is done through either RPC or SMTP.

Where is the AD database held? What other folders are related to AD?The AD data base is store in c:\windows\ntds\NTDS.DIT.

What is the SYSVOL folder?The sysVOL folder stores the server’s copy of the domain’s public files. The contents such as group policy, users etc of the sysvol folder are replicated to all domain controllers in the domain.

What are the Windows Server 2003 keyboard shortcuts ?Winkey opens or closes the Start menu. Winkey + BREAK displays the System Properties dialog box. Winkey + TAB moves the focus to the next application in the taskbar. Winkey + SHIFT + TAB moves the focus to the previous application in the taskbar. Winkey + B moves the focus to the notification area. Winkey + D shows the desktop. Winkey + E opens Windows Explorer showing My Computer. Winkey + F opens the Search panel. Winkey + CTRL + F opens the Search panel with Search for Computers module selected. Winkey + F1 opens Help. Winkey + M minimizes all. Winkey + SHIFT+ M undoes minimization. Winkey + R opens Run dialog. Winkey + U opens the Utility Manager. Winkey + L locks the computer.

Where are the Windows NT Primary Domain Controller (PDC) and its Backup Domain Controller (BDC) in Server 2003 ?The Active Directory replaces them. Now all domain controllers share a multimaster peer-to-peer read and write relationship that hosts copies of the Active Directory.

I am trying to create a new universal user group. Why can’t I ?Universal groups are allowed only in native-mode Windows Server 2003 environments. Native mode requires that all domain controllers be promoted to Windows Server 2003 Active Directory.

What is LSDOU ? It’s group policy inheritance model, where the policies are applied toLocal machines, Sites, Domains and Organizational Units.

Why doesn’t LSDOU work under Windows NT ?If the NTConfig.pol file exist, it has the highest priority among the numerous policies.

Page 21: Interview Questions & Answers

What’s the number of permitted unsuccessful logons on Administrator account? Unlimited. Remember, though, that it’s the Administrator account, not any account that’s part of the Administrators group.

What’s the difference between guest accounts in Server 2003 and other editions?More restrictive in Windows Server 2003.

How many passwords by default are remembered when you check “Enforce Password History Remembered”?User’s last 6 passwords.

Can GC Server and Infrastructure place in single server If not explain why ?No, As Infrastructure master does the same job as the GC. It does not work together.

Which is service in your windows is responsible for replication of Domain controller to another domain controller.KCC generates the replication topology.Use SMTP / RPC to replicate changes.

What Intrasite and Intersite Replication ?Intrasite is the replication with in the same site & intersite the replication between sites.

What is lost & found folder in ADS ?It’s the folder where you can find the objects missed due to conflict.Ex: you created a user in OU which is deleted in other DC & when replication happed ADS didn’t find the OU then it will put that in Lost & Found Folder.

What is Garbage collection ?Garbage collection is the process of the online defragmentation of active directory. It happens every 12 Hours.

What System State data contains ?Contains Startup files,RegistryCom + Registration DatabaseMemory Page fileSystem filesAD informationCluster Service informationSYSVOL Folder

What is the difference between Windows 2000 Active Directory and Windows 2003 Active Directory? Is there any difference in 2000 Group Polices and 2003 Group Polices? What is meant by ADS and ADS services in Windows 2003?Windows 2003 Active Directory introduced a number of new security features, as well as convenience features such as the ability to rename a domain controller and even an entire domainWindows Server 2003 also introduced numerous changes to the default settings that can be affected by Group Policy – you can see a detailed list of each available setting and which OS is required to support it by downloading the Group Policy Settings Reference.

ADS stands for Automated Deployment Services, and is used to quickly roll out identically-configured servers in large-scale enterprise environments. You can get more information from the ADS homepage.

I want to setup a DNS server and Active Directory domain. What do I do first? If I install the DNS service first and name the zone ‘name.org’ can I name the AD domain ‘name.org’ too?Not only can you have a DNS zone and an Active Directory domain with the same name, it’s actually the preferred way to go if at all possible. You can install and configure DNS before installing Active Directory, or you can allow the Active Directory Installation Wizard (dcpromo) itself install DNS on your server in the background.

How do I determine if user accounts have local administrative access?You can use the net localgroup administrators command on each workstation (probably in a login script so that it records its information to a central file for later review). This command will enumerate the members of the Administrators group on each machine you run it on. Alternately, you can use the Restricted Groups feature of Group Policy to restrict the membership of Administrators to only those users you want to belong.

Page 22: Interview Questions & Answers

Why am I having trouble printing with XP domain users?In most cases, the inability to print or access resources in situations like this one will boil down to an issue with name resolution, either DNS or WINS/NetBIOS. Be sure that your Windows XP clients’ wireless connections are configured with the correct DNS and WINS name servers, as well as with the appropriate NetBIOS over TCP/IP settings. Compare your wireless settings to your wired LAN settings and look for any discrepancies that may indicate where the functional difference may lie.

What is the ISTG? Who has that role by default?Windows 2000 Domain controllers each create Active Directory Replication connection objects representing inbound replication from intra-site replication partners. For inter-site replication, one domain controller per site has the responsibility of evaluating the inter-site replication topology and creating Active Directory Replication Connection objects for appropriate bridgehead servers within its site. The domain controller in each site that owns this role is referred to as the Inter-Site Topology Generator (ISTG).

What is difference between Server 2003 vs 2008?1. Virtualization. (Windows Server 2008 introduces Hyper-V (V for Virtualization) but only on 64bit versions. More and more companies are seeing this as a way of reducing hardware costs by running several ‘virtual’ servers on one physical machine.)2. Server Core (provides the minimum installation required to carry out a specific server role, such as for a DHCP, DNS or print server)3. Better security.4. Role-based installation.5. Read Only Domain Controllers (RODC).6. Enhanced terminal services.7. Network Access Protection – Microsoft’s system for ensuring that clients connecting to Server 2008 are patched, running a firewall and in compliance with corporate security policies.8. PowerShell – Microsoft’s command line shell and scripting language has proved popular with some server administrators.9. IIS 7 .10. Bitlocker – System drive encryption can be a sensible security measure for servers located in remote branch offices. >br> The main difference between 2003 and 2008 is Virtualization, management. 2008 has more in-build components and updated third party drivers.11. Windows Aero.

What are the requirements for installing AD on a new server?1 The Domain structure.2 The Domain Name .3 storage location of the database and log file.4 Location of the shared system volume folder.5 DNS config Methode.6 DNS configuration.

What is LDP? LDP : Label Distribution Protocol (LDP) is often used to establish MPLS LSPs when traffic engineering is not required. It establishes LSPs that follow the existing IP routing, and is particularly well suited for establishing a full mesh of LSPs between all of the routers on the network.

What are the Groups types available in active directory ?Security groups: Use Security groups for granting permissions to gain access to resources. Sending an e-mail message to a group sends the message to all members of the group. Therefore security groups share the capabilities of distribution groups.

Distribution groups: Distribution groups are used for sending e-main messages to groups of users. You cannot grant permissions to security groups. Even though security groups have all the capabilities of distribution groups, distribution groups still requires, because some applications can only read distribution groups.

Explain about the groups scope in AD ? Domain Local Group: Use this scope to grant permissions to domain resources that are located in the same domain in which you created the domain local group. Domain local groups can exist in all mixed, native and interim functional level of domains and forests. Domain local group memberships are not limited as you can add members as user accounts, universal and global groups from any domain. Just to remember, nesting cannot be done in domain local group. A domain local group will not be a member of another Domain Local or any other groups in the same domain.

Page 23: Interview Questions & Answers

Global Group: Users with similar function can be grouped under global scope and can be given permission to access a resource (like a printer or shared folder and files) available in local or another domain in same forest. To say in simple words, Global groups can be use to grant permissions to gain access to resources which are located in any domain but in a single forest as their memberships are limited. User accounts and global groups can be added only from the domain in which global group is created. Nesting is possible in Global groups within other groups as you can add a global group into another global group from any domain. Finally to provide permission to domain specific resources (like printers and published folder), they can be members of a Domain Local group. Global groups exist in all mixed, native and interim functional level of domains and forests.

Universal Group Scope: These groups are precisely used for email distribution and can be granted access to resources in all trusted domain as these groups can only be used as a security principal (security group type) in a windows 2000 native or windows server 2003 domain functional level domain. Universal group memberships are not limited like global groups. All domain user accounts and groups can be a member of universal group. Universal groups can be nested under a global or Domain Local group in any domain.

What is REPLMON ?The Microsoft definition of the Replmon tool is as follows; This GUI tool enables administrators to view the low-level status of Active Directory replication, force synchronization between domain controllers, view the topology in a graphical format, and monitor the status and performance of domain controller replication.

What is ADSIEDIT ? ADSIEDIT :ADSIEdit is a Microsoft Management Console (MMC) snap-in that acts as a low-level editor for Active Directory. It is a Graphical User Interface (GUI) tool. Network administrators can use it for common administrative tasks such as adding, deleting, and moving objects with a directory service. The attributes for each object can be edited or deleted by using this tool. ADSIEdit uses the ADSI application programming interfaces (APIs) to access Active Directory. The following are the required files for using this tool: ADSIEDIT.DLL ADSIEDIT.

What is NETDOM ?NETDOM is a command-line tool that allows management of Windows domains and trust relationships. It is used for batch management of trusts, joining computers to domains, verifying trusts, and secure channels.

What is REPADMIN?This command-line tool assists administrators in diagnosing replication problems between Windows domain controllers.Administrators can use Repadmin to view the replication topology (sometimes referred to as RepsFrom and RepsTo) as seen from the perspective of each domain controller. In addition, Repadmin can be used to manually create the replication topology (although in normal practice this should not be necessary), to force replication events between domain controllers, and to view both the replication metadata and up-to-dateness vectors.

How to take backup of AD ?For taking backup of active directory you have to do this : first go START -> PROGRAM ->ACCESORIES -> SYSTEM TOOLS -> BACKUP OR Open run window and ntbackup and take systemstate backup when the backup screen is flash then take the backup of SYSTEM STATE it will take the backup of all the necessary information about the syatem including AD backup , DNS ETC.

What are the DS* commands ?The following DS commands: the DS family built in utility .DSmod – modify Active Directory attributes.DSrm – to delete Active Directory objects.DSmove – to relocate objectsDSadd – create new accountsDSquery – to find objects that match your query attributes.DSget – list the properties of an object

What are the requirements for installing AD on a new server? An NTFS partition with enough free space.An Administrator’s username and password.The correct operating system version.A NIC Properly configured TCP/IP (IP address, subnet mask and – optional – default gateway).A network connection (to a hub or to another computer via a crossover cable) .An operational DNS server (which can be installed on the DC itself) .A Domain name that you want to use .The Windows 2000 or Windows Server 2003 CD media (or at least the i386 folder) .

Page 24: Interview Questions & Answers

Explain about Trusts in AD ?To allow users in one domain to access resources in another, Active Directory uses trusts. Trusts inside a forest are automatically created when domains are created.

The forest sets the default boundaries of trust, not the domain, and implicit, transitive trust is automatic for all domains within a forest. As well as two-way transitive trust, AD trusts can be a shortcut (joins two domains in different trees, transitive, one- or two-way), forest (transitive, one- or two-way), realm (transitive or nontransitive, one- or two-way), or external (nontransitive, one- or two-way) in order to connect to other forests or non-AD domains.

Trusts in Windows 2000 (native mode)One-way trust – One domain allows access to users on another domain, but the other domain does not allow access to users on the first domain.Two-way trust – Two domains allow access to users on both domains.Trusting domain – The domain that allows access to users from a trusted domain.Trusted domain – The domain that is trusted; whose users have access to the trusting domain.Transitive trust – A trust that can extend beyond two domains to other trusted domains in the forest.Intransitive trust – A one way trust that does not extend beyond two domains.Explicit trust – A trust that an admin creates. It is not transitive and is one way only.Cross-link trust – An explicit trust between domains in different trees or in the same tree when a descendant/ancestor (child/parent)- relationship does not exist between the two domains.Windows 2000 Server – supports the following types of trusts:Two-way transitive trusts.One-way intransitive trusts.Additional trusts can be created by administrators. These trusts can be:ShortcutWindows Server 2003 offers a new trust type – the forest root trust. This type of trust can be used to connect Windows Server 2003 forests if they are operating at the 2003 forest functional level. Authentication across this type of trust is Kerberos based (as opposed to NTLM). Forest trusts are also transitive for all the domains in the forests that are trusted. Forest trusts, however, are not transitive.

Difference between LDIFDE and CSVDE?CSVDE is a command that can be used to import and export objects to and from the AD into a CSV-formatted file. A CSV (Comma Separated Value) file is a file easily readable in Excel. I will not go to length into this powerful command, but I will show you some basic samples of how to import a large number of users into your AD. Of course, as with the DSADD command, CSVDE can do more than just import users. Consult your help file for more info.

LDIFDE is a command that can be used to import and export objects to and from the AD into a LDIF-formatted file. A LDIF (LDAP Data Interchange Format) file is a file easily readable in any text editor, however it is not readable in programs like Excel. The major difference between CSVDE and LDIFDE (besides the file format) is the fact that LDIFDE can be used to edit and delete existing AD objects (not just users), while CSVDE can only import and export objects.

What is tombstone lifetime attribute ?The number of days before a deleted object is removed from the directory services. This assists in removing objects from replicated servers and preventing restores from reintroducing a deleted object. This value is in the Directory Service object in the configuration NIC.

What are application partitions? When do I use them ?AN application diretcory partition is a directory partition that is replicated only to specific domain controller.Only domain controller running windows Server 2003 can host a replica of application directory partition.Using an application directory partition provides redundany,availability or fault tolerance by replicating data to specific domain controller pr any set of domain controllers anywhere in the forest.

How do you create a new application partition ?Use the DnsCmd command to create an application directory partition.To do this, use the following syntax:DnsCmd ServerName /CreateDirectoryPartition FQDN of partition

How do you view all the GCs in the forest? C:\>repadmin /showreps domain_controller where domain_controller is the DC you want to query to determine whether it?s a GC.The output will include the text DSA Options: IS_GC if the DC is a GC.

Page 25: Interview Questions & Answers

Can you connect Active Directory to other 3rd-party Directory Services? Name a few options. Yes, you can use dirXML or LDAP to connect to other directories.In Novell you can use E-directory.

What is IPSec PolicyIPSec provides secure gateway-to-gateway connections across outsourced private wide area network (WAN) or Internet-based connections using L2TP/IPSec tunnels or pure IPSec tunnel mode. IPSec Policy can be deployed via Group policy to the Windows Domain controllers 7 Servers.

What are the different types of Terminal Services ?User Mode & Application Mode.

What is RsOPRsOP is the resultant set of policy applied on the object (Group Policy).

What is the System Startup process ?Windows 2K boot process on a Intel architecture.

1. Power-On Self Tests (POST) are run.

2. The boot device is found, the Master Boot Record (MBR) is loaded into memory, and its program is run.

3. The active partition is located, and the boot sector is loaded.

4. The Windows 2000 loader (NTLDR) is then loaded.

The boot sequence executes the following steps:

1. The Windows 2000 loader switches the processor to the 32-bit flat memory model.

2. The Windows 2000 loader starts a mini-file system.

3. The Windows 2000 loader reads the BOOT.INI file and displays the operating system selections (boot loader menu).

4. The Windows 2000 loader loads the operating system selected by the user. If Windows 2000 is selected, NTLDR runs NTDETECT.COM. For other operating systems, NTLDR loads BOOTSECT.DOS and gives it control.

5. NTDETECT.COM scans the hardware installed in the computer, and reports the list to NTLDR for inclusion in the Registry under the HKEY_LOCAL_MACHINE_HARDWARE hive.

6. NTLDR then loads the NTOSKRNL.EXE, and gives it the hardware information collected by NTDETECT.COM. Windows NT enters the Windows load phases.

How do you change the DS Restore admin password ?

In Windows 2000 Server, you used to have to boot the computer whose password you wanted to change in Directory Restore mode, then use either the Microsoft Management Console (MMC) Local User and Groups snap-in or the command net user administrator * to change the Administrator password.Win2K Server Service Pack 2 (SP2) introduced the Setpwd utility, which lets you reset the Directory Service Restore Mode password without having to reboot the computer. (Microsoft refreshed Setpwd in SP4 to improve the utility?s scripting options.)

In Windows Server 2003, you use the Ntdsutil utility to modify the Directory Service Restore Mode Administrator password.

Page 26: Interview Questions & Answers

To do so, follow these steps:1. Start Ntdsutil (click Start, Run; enter cmd.exe; then enter ntdsutil.exe).2. Start the Directory Service Restore Mode Administrator password-reset utility by entering the argument ?set dsrm password? at the ntdsutil prompt: ntdsutil: set dsrm password.3. Run the Reset Password command, passing the name of the server on which to change the password, or use the null argument to specify the local machine.For example, to reset the password on server testing, enter the following argument at the Reset DSRM Administrator Password prompt: Reset DSRM Administrator Password: reset password on server testing

To reset the password on the local machine, specify null as the server name:Reset DSRM Administrator Password: reset password on server null

4. You?ll be prompted twice to enter the new password. You?ll see the following messages:5. Please type password for DS Restore Mode Administrator Account:6. Please confirm new password:Password has been set successfully.7. Exit the password-reset utility by typing ?quit? at the following prompts:8. Reset DSRM Administrator Password: quitntdsutil: quit

am upgrading from NT to 2003. The only things that are NT are the PDC and BDCs; everything else is 2000 or 2003 member servers. My question is, when I upgrade my NT domain controllers to 2003, will I need to do anything else to my Windows 2000/2003 member servers that were in the NT domain?Your existing member servers, regardless of operating system, will simply become member servers in your upgraded AD domain. If you will be using Organizational Units and Group Policy (and I hope you are), you’ll probably want to move them to a specific OU for administration and policy application, since they’ll be in the default “Computers” container immediately following the upgrade.

How do I use Registry keys to remove a user from a group?In Windows Server 2003, you can use the dsmod command-line utility with the -delmbr switch to remove a group member from the command line. You should also look into the freeware utilities available from www.joeware.net . ADFind and ADMod are indispensable tools in my arsenal when it comes to searching and modifying Active Directory.

Why are my NT4 clients failing to connect to the Windows 2000 domain?Since NT4 relies on NetBIOS for name resolution, verify that your WINS server (you do have a WINS server running, yes?) contains the records that you expect for the 2000 domain controller, and that your clients have the correct address configured for the WINS server.

How to add your first Windows 2003 DC to an existing Windows 2000 domain ?

The first step is to install Windows 2003 on your new DC. This is a straighforward process, so we aren?t going to discuss that here.

Because significant changes have been made to the Active Directory schema in Windows 2003, we need to make our Windows 2000 Active Directory compatible with the new version. If you already have Windows 2003 DCs running with Windows 2000 DCs, then you can skip down to the part about DNS.

Before you attempt this step, you should make sure that you have service pack 4 installed on your Windows 2000 DC. Next, make sure that you are logged in as a user that is a member of the Schema Admin and Enterprise Admin groups.

Next, insert the Windows 2003 Server installation CD into the Windows 2000 Server.Bring up a command line and change directories to the I386 directory on the installation CD. At the command prompt, type: Code :adprep /forestprep After running this command, make sure that the updates have been replicated to all existing Windows 2000 DCs in the forest. Next, we need to run the following command: Code : adprep /domainprep

The above command must be run on the Infrastructure Master of the domain by someone who is a member of the Domain Admins group.Once this is complete, we move back to the Windows 2003 Server. Click ?start? then ?run? – type in dcpromo and click OK. During the ensuing wizard, make sure that you select that you are adding this DC to an existing domain.

Page 27: Interview Questions & Answers

After this process is complete, the server will reboot. When it comes back online, check and make sure that the AD database has been replicated to your new server.Next, you will want to check and make sure that DNS was installed on your new server.

If not, go to the control panel,click on ?Add or Remove Programs?, and click the ?Add/Remove Windows Components? button.In the Windows Components screen, click on ?Networking Services? and click the details button.

In the new window check ?Domain Name System (DNS)? and then click the OK button. Click ?Next? in the Windows Components screen.This will install DNS and the server will reboot. After reboot, pull up the DNS Management window and make sure that your DNS settings have replicated from the Windows 2000 Server. You will need to re-enter any forwarders or other properties you had set up, but the DNS records should replicate on their own.

The next 2 items, global catalog and FSMO roles, are important if you plan on decomissioning your Windows 2000 server(s). If this is the case, you need to tansfer the global catalog from the old server to the new one.

First, let?s create a global catalog on our new server. Here are the steps:

1. On the domain controller where you want the new global catalog, start the Active Directory Sites and Services snap-in.To start the snap-in, click ?Start?, point to ?Programs?, point to ?Administrative Tools?, and then click ?Active Directory Sites and Services?.2. In the console tree, double-click ?Sites?, and then double-click ?sitename?.

3. Double-click ?Servers?, click your domain controller, right-click ?NTDS Settings?, and then click ?Properties?.4. On the General tab, click to select the Global catalog check box to assign the role of global catalog to this server.5. Restart the domain controller.

Make sure you allow sufficient time for the account and the schema information to replicate to the new global catalog server before you remove the global catalog from the original DC or take the DC offline.

After this is complete, you will want to transfer or seize the FSMO roles for your new server.For instructions, read Using Ntdsutil.exe to transfer or seize FSMO roles to a domain controller.After this step is complete, we can now run DCPROMO on the Windows 2000 Servers in order to demote them.

Once this is complete, copy over any files you need to your new server and you should have successfully replaced your Windows 2000 server(s) with a new Windows 2003 server.

What is the default size of ntds.dit ?10 MB in Server 2000 and 12 MB in Server 2003 .

Where is the AD database held and What are other folders related to AD ?AD Database is saved in %systemroot%/ntds. You can see other files also in this folder. These are the main files controlling the AD structure.

ntds.ditedb.logres1.logres2.logedb.chk

When a change is made to the Win2K database, triggering a write operation, Win2K records the transaction in the log file (edb.log). Once written to the log file, the change is then written to the AD database. System performance determines how fast the system writes the data to the AD database from the log file. Any time the system is shut down, all transactions are saved to the database.

During the installation of AD, Windows creates two files: res1.log and res2.log. The initial size of each is 10MB. These files are used to ensure that changes can be written to disk should the system run out of free disk space. The checkpoint file (edb.chk) records transactions committed to the AD database (ntds.dit). During shutdown, a “shutdown” statement is written to the edb.chk file.

Page 28: Interview Questions & Answers

Then, during a reboot, AD determines that all transactions in the edb.log file have been committed to the AD database. If, for some reason, the edb.chk file doesn’t exist on reboot or the shutdown statement isn’t present, AD will use the edb.log file to update the AD database. The last file in our list of files to know is the AD database itself, ntds.dit. By default, the file is located in\NTDS, along with the other files we’ve discussed

What FSMO placement considerations do you know of ?Windows 2000/2003 Active Directory domains utilize a Single Operation Master method called FSMO (Flexible Single Master Operation), as described in Understanding FSMO Roles in Active Directory.

In most cases an administrator can keep the FSMO role holders (all 5 of them) in the same spot (or actually, on the same DC) as has been configured by the Active Directory installation process.

However, there are scenarios where an administrator would want to move one or more of the FSMO roles from the default holder DC to a different DC.Windows Server 2003 Active Directory is a bit different than the Windows 2000 version when dealing with FSMO placement.

In this article I will only deal with Windows Server 2003 Active Directory, but you should bear in mind that most considerations are also true when planning Windows 2000 AD FSMO roles

What do you do to install a new Windows 2003 R2 DC in a Windows 2003 AD?If you’re installing Windows 2003 R2 on an existing Windows 2003 server with SP1 installed, you require only the second R2 CD-ROM.

Insert the second CD and the r2auto.exe will display the Windows 2003 R2 Continue Setup screen. If you’re installing R2 on a domain controller (DC), you must first upgrade the schema to the R2 version (this is a minor change and mostly related to the new Dfs replication engine).

To update the schema, run the Adprep utility, which you’ll find in the Components\r2\adprep folder on the second CD-ROM.Before running this command, ensure all DCs are running Windows 2003 or Windows 2000 with SP2 (or later).

Here’s a sample execution of the Adprep /forestprepcommand:D:\CMPNENTS\R2\ADPREP>adprep /forestprepADPREP WARNING:Before running adprep, all Windows 2000 domain controllers in the forest should be upgraded to Windows 2000 Service Pack 1 (SP1) with QFE 265089, or to Windows 2000 SP2 (or later).

QFE 265089 (included in Windows 2000 SP2 and later) is required to prevent potential domain controller corruption.[User Action] If ALL your existing Windows 2000 domain controllers meet this requirement, type C and then press ENTER to continue. Otherwise, type any other key and press ENT ER to quit.C Opened Connection to SAV

DALDC01 SSPI Bind succeeded Current Schema Version is 30 Upgrading schema to version 31 Connecting to “SAVDALDC01″ Logging in as current user using SSPI Importing directory from file “C:\WINDOWS\system32\sch31.ldf” Loading entries… 139 entries modified successfully.

The command has completed successfully Adprep successfully updated the forest-wide information.After running Adprep, install R2 by performing these steps:

1. Click the “Continue Windows Server 2003 R2 Setup” link, as the figureshows.2. At the “Welcome to the Windows Server 2003 R2 Setup Wizard” screen, click Next.3. You’ll be prompted to enter an R2 CD key (this is different from your existing Windows 2003 keys) if the underlying OS wasn’t installed from R2 media (e.g., a regular Windows 2003 SP1 installation).Enter the R2 key and click Next. Note: The license key entered for R2 must match the underlying OS type, which means if you installed Windows 2003 using a volume-license version key, then you can’t use a retail or Microsoft Developer Network (MSDN) R2 key.4. You’ll see the setup summary screen which confirms the actions to be performed (e.g., Copy files). Click Next.5. After the installation is complete, you’ll see a confirmation dialog box. Click Finish

Page 29: Interview Questions & Answers

What is OU ?Organization Unit is a container object in which you can keep objects such as user accounts, groups, computer, printer . applications and other (OU).In organization unit you can assign specific permission to the user’s. organization unit can also be used to create departmental limitation.

Name some OU design considerations ?OU design requires balancing requirements for delegating administrative rights – independent of Group Policy needs – and the need to scope the application of Group Policy.

The following OU design recommendations address delegation and scope issues:Applying Group Policy An OU is the lowest-level Active Directory container to which you can assign Group Policy settings.Delegating administrative authorityusually don’t go more than 3 OU levels

How do you view replication properties for AD partitions and DCs?By using replication monitorgo to start > run > type repadmingo to start > run > type replmon

Why can’t you restore a DC that was backed up 4 months ago?Because of the tombstone life which is set to only 60 days.

Different modes of AD restore ? A nonauthoritative restore is the default method for restoring Active Directory. To perform a nonauthoritative restore, you must be able to start the domain controller in Directory Services Restore Mode. After you restore the domain controller from backup, replication partners use the standard replication protocols to update Active Directory and associated information on the restored domain controller.

An authoritative restore brings a domain or a container back to the state it was in at the time of backup and overwrites all changes made since the backup. If you do not want to replicate the changes that have been made subsequent to the last backup operation, you must perform an authoritative restore. In this one needs to stop the inbound replication first before performing the An authoritative restore.

How do you configure a stand-by operation master for any of the roles? # Open Active Directory Sites and Services.# Expand the site name in which the standby operations master is located to display the Servers folder.# Expand the Servers folder to see a list of the servers in that site.# Expand the name of the server that you want to be the standby operations master to display its NTDS Settings.# Right-click NTDS Settings, click New, and then click Connection.# In the Find Domain Controllers dialog box, select the name of the current role holder, and then click OK.# In the New Object-Connection dialog box, enter an appropriate name for the Connection object or accept the default name, and click OK.

What’s the difference between transferring a FSMO role and seizing ? Seizing an FSMO can be a destructive process and should only be attempted if the existing server with the FSMO is no longer available.

If you perform a seizure of the FSMO roles from a DC, you need to ensure two things:the current holder is actually dead and offline, and that the old DC will NEVER return to the network. If you do an FSMO role Seize and then bring the previous holder back online, you’ll have a problem.

An FSMO role TRANSFER is the graceful movement of the roles from a live, working DC to another live DC During the process, the current DC holding the role(s) is updated, so it becomes aware it is no longer the role holder

I want to look at the RID allocation table for a DC. What do I do?dcdiag /test:ridmanager /s:servername /v (servername is the name of our DC)

What is BridgeHead Server in AD ?A bridgehead server is a domain controller in each site, which is used as a contact point to receive and replicate data between sites. For intersite replication, KCC designates one of the domain controllers as a bridgehead

Page 30: Interview Questions & Answers

server. In case the server is down, KCC designates another one from the domain controller. When a bridgehead server receives replication updates from another site, it replicates the data to the other domain controllers within its site.

What is sites ? What are they used for ?One or more well-connected (highly reliable and fast) TCP/IP subnets.A site allows administrators to configure Active Directory access and replication topology to take advantage of the physical network.

A Site object in Active Directory represents a physical geographic location that hosts networks. Sites contain objects called Subnets.

Sites can be used to Assign Group Policy Objects, facilitate the discovery of resources, manage active directory replication, and manage network link traffic.Sites can be linked to other Sites. Site-linked objects may be assigned a cost value that represents the speed, reliability, availability, or other real property of a physical resource. Site Links may also be assigned a schedule.

Trying to look at the Schema, how can I do that ?register schmmgmt.dll using this commandc:\windows\system32>regsvr32 schmmgmt.dllOpen mmc –> add snapin –> add Active directory schemaname it as schema.mscOpen administrative tool –> schema.msc

What is the port no of Kerbrose ?88

What is the port no of Global catalog ? 3268

What is the port no of LDAP ?389

Explain Active Directory Schema ? Windows 2000 and Windows Server 2003 Active Directory uses a database set of rules called “Schema”. The Schema is defines as the formal definition of all object classes, and the attributes that make up those object classes, that can be stored in the directory. As mentioned earlier, the Active Directory database includes a default Schema, which defines many object classes, such as users, groups, computers, domains, organizational units, and so on.

These objects are also known as “Classes”. The Active Directory Schema can be dynamically extensible, meaning that you can modify the schema by defining new object types and their attributes and by defining new attributes for existing objects. You can do this either with the Schema Manager snap-in tool included with Windows 2000/2003 Server, or programmatically.

How can you forcibly remove AD from a server, and what do you do later? ? Can I get user passwords from the AD database? Dcpromo /forceremoval , an administrator can forcibly remove Active Directory and roll back the system without having to contact or replicate any locally held changes to another DC in the forest. Reboot the server then After you use the dcpromo /forceremoval command, all the remaining metadata for the demoted DC is not deleted on the surviving domain controllers, and therefore you must manually remove it by using the NTDSUTIL command.

In the event that the NTDS Settings object is not removed correctly you can use the Ntdsutil.exe utility to manually remove the NTDS Settings object. You will need the following tool: Ntdsutil.exe, Active Directory Sites and Services, Active Directory Users and Computers

What are the FSMO roles? Who has them by default? What happens when each one fails? Flexible Single Master Operation (FSMO) role. Currently there are five FSMO roles:Schema masterDomain naming masterRID masterPDC emulatorInfrastructure master

Page 31: Interview Questions & Answers

What is domain tree ? Domain Trees: A domain tree comprises several domains that share a common schema and configuration, forming a contiguous namespace. Domains in a tree are also linked together by trust relationships. Active Directory is a set of one or more trees.Trees can be viewed two ways. One view is the trust relationships between domains. The other view is the namespace of the domain tree.

What is forests ? A collection of one or more domain trees with a common schema and implicit trust relationships between them. This arrangement would be used if you have multiple root DNS addresses.

How to Select the Appropriate Restore Method ?You select the appropriate restore method by considering:Circumstances and characteristics of the failure. The two major categories of failure, From an Active Directory perspective, are Active Directory data corruption and hardware failure.

Active Directory data corruption occurs when the directory contains corrupt data that has been replicated to all domain controllers or when a large portion of the Active Directory hierarchy has been changed accidentally (such as deletion of an OU) and this change has replicated to other domain controllers.

Where are the Windows NT Primary Domain Controller (PDC) and its Backup Domain Controller (BDC) in Server 2003?The Active Directory replaces them. Now all domain controllers share a multimaster peer-to-peer read and write relationship that hosts copies of the Active Directory.

 What is Global Catalog?

The Global Catalog authenticates network user logons and fields inquiries about objects across a forest or tree. Every domain has at least one GC that is hosted on a domain controller. In Windows 2000, there was typically one GC on every site in order to prevent user logon failures across the network.

 How long does it take for security changes to be replicated among the domain controllers?

Security-related modifications are replicated within a site immediately. These changes include account and individual user lockout policies, changes to password policies, changes to computer account passwords, and modifications to the Local Security Authority (LSA).

When should you create a forest?Organizations that operate on radically different bases may require separate trees with distinct namespaces. Unique trade or brand names often give rise to separate DNS identities. Organizations merge or are acquired and naming continuity is desired. Organizations form partnerships and joint ventures. While access to common resources is desired, a separately defined tree can enforce more direct administrative and security restrictions.

 Describe the process of working with an external domain name ?

If it is not possible for you to configure your internal domain as a subdomain of your external domain, use a stand-alone internal domain. This way, your internal and external domain names are unrelated. For example, an organization that uses the domain name contoso.com for their external namespace uses the name corp.internal for their internal namespace.

The advantage to this approach is that it provides you with a unique internal domain name. The disadvantage is that this configuration requires you to manage two separate namespaces. Also, using a stand-alone internal domain that is unrelated to your external domain might create confusion for users because the namespaces do not reflect a relationship between resources within and outside of your network.

In addition, you might have to register two DNS names with an Internet name authority if you want to make the internal domain publicly accessible.

What is Active Directory?

Page 32: Interview Questions & Answers

An active directory is a directory structure/service used on Microsoft Windows based computers and servers to store information and data about networks and domains.A directory is similar to a dictionary; it enables the look up of a name and information associated with that name.There is support for the Lightweight Directory Access Protocol (LDAP) to enable inter-directory operabilityDistribution: Distribution groups are intended to be used solely as email distribution listsSecurity: Security groups allow you to manage user and computer access to shared resources.In order to synchronize the time on your Windows computer with main Active Directory domain controllers, use the following command at a command prompt: net time \\ads.iu.edu /set /y

What is LDAP?

LDAP is an Internet standard protocol used by applications to access information in a directory. It runs directly over TCP, and can be used to access a standalone LDAP directory service or to access a directory service that is back-ended by X.500.The LDAP directory service model is based on entries. An entry is a collection of attributes that describing it. Each attribute has a name, type and one or more values.LDAP based implementations are:Edirectory,Red Had Directory server,Apples open Directory, Apache Directory Server, Oracle Internet Directory, CA Directory, Sun Java System Directory Server, IBM Tivoli Directory Server ,Windows NT Directory Services (NTDS)

Can you connect Active Directory to other 3rd-party Directory Services? Name a few options.

Yes you can connect other vendors Directory Services with Microsoft’s version.Yes. Microsoft Identity Integration Server (MIIS) is used to connect Active Directory to other 3rd-party Directory Services (including directories used by SAP, Domino, etc).

Where is Active Directory database held? What other folders are related to AD?

AD Database is saved in %systemroot%/ntds. You can see other files also in this folder.

These are the main files controlling the AD structure• ntds.dit• edb.log• res1.log• res2.log• edb.chk

When a change is made to the Win2K database, triggering a write operation, Win2K records the transaction in the log file (edb.log). Once written to the log file, the change is then written to the AD database. System performance determines how fast the system writes the data to the AD database from the log file. Any time the system is shut down, all transactions are saved to the database.During the installation of AD, Windows creates two files: res1.log and res2.log. The initial size of each is 10MB. These files are used to ensure that changes can be written to disk should the system run out of free disk space. The checkpoint file (edb.chk) records transactions committed to the AD database (ntds.dit). During shutdown, a “shutdown” statement is written to the edb.chk file. Then, during a reboot, AD determines that all transactions in the edb.log file have been committed to the AD database. If, for some reason, the edb.chk file doesn’t exist on reboot or the shutdown statement isn’t present, AD will use the edb.log file to update the AD database.The last file in our list of files to know is the AD database itself, ntds.dit. By default, the file is located in\NTDS, along with the other files we’ve discussed

What is the SYSVOL folder?

The Windows Server 2003 System Volume (SYSVOL) is a collection of folders and reparse points in the file systems that exist on each domain controller in a domain. SYSVOL provides a standard location to store important elements of Group Policy objects (GPOs) and scripts so that the File Replication service (FRS) can distribute them to other domain controllers within that domain.You can go to SYSVOL folder by typing : %systemroot%/sysvol

Page 33: Interview Questions & Answers

Name the AD NCs [naming contexts] and replication issues for each NC*Schema NC, *Configuration NC, * Domain NCSchema NC This NC is replicated to every other domain controller in the forest. It contains information about the Active Directory schema, which in turn defines the different object classes and attributes within Active Directory.Configuration NC Also replicated to every other DC in the forest, this NC contains forest-wide configuration information pertaining to the physical layout of Active Directory, as well as information about display specifiers and forest-wide Active Directory quotas.Domain NC This NC is replicated to every other DC within a single Active Directory domain. This is the NC that contains the most commonly-accessed Active Directory data: the actual users, groups, computers, and other objects that reside within a particular Active Directory domain.

What are application partitions? When do I use them

An application directory partition is a directory partition that is replicated only to specific domain controllers. A domain controller that participates in the replication of a particular application directory partition hosts a replica of that partition. Only domain controllers running Windows Server 2003 can host a replica of an application directory partition.Application directory partitions are usually created by the applications that will use them to store and replicate data. For testing and troubleshooting purposes, members of the Enterprise Admins group can manually create or manage application directory partitions using the Ntdsutil command-line tool.One of the benefits of an application directory partition is that, for redundancy, availability, or fault tolerance, the data in it can be replicated to different domain controllers in a forest


Top Related