2412 Identity with Windows Server 2016

Réussis tes devoirs et examens dès maintenant avec Quizwiz!

User properties include what 8 categories?

-Account -Organization -Member of -Password Settings -Profile -Policy -Silo -Extensions

User accounts can be created by using: - - - -

-Active Directory Users and Computers -Active Directory Administrative Center -Windows PowerShell -Directory command line tool dsadd

To clone a source domain controller:

-Add the domain controller to the Cloneable Domain Controllers group -Verify app and service compatibility -Create a DCCloneConfig.xml file -Export it once, and then create as many clones as needed -Start the clones

User accounts - - -

-Allow or deny access to sign into computers -Grant access to processes and services -Manage access to network resources

Important Special Identities include: (6)

-Anonymous Logon -Authenticated Users -Everyone -Interactive -Network -Creator Owner

A computer account begins its lifecycle when you create it and join it to your domain. Thereafter, day-to-day administrative tasks include:

-Configuring computer properties -Moving the computer between OUs -Managing the computer itself -Renaming, resetting, disabling, enabling, and eventually deleting the computer object

Considerations for naming users include: - -

-Naming formats -UPN suffixes

What are some of the terms that are used for single master operations in AD DS

-Operations master (or operations master role) -Single master role -Flexible single master operations (FSMO)

Transferring a FSMO role is:

-Planned -Done with the latest data -Performed through snap-ins, Windows PowerShell, or ntdsutil.exe

You might clone domain controllers for:

-Rapid deployment -Private clouds -Recover strategies

three scenarios in which a secure channel might be broken

-Reinstalling a computer, even with the same name, generates a new SID and password -Restoring a computer from an old backup or rolling back a computer to an old snapshot -the computer and domain disagreeing about what the password is

Computers, like users, are security principals, in that:

-They have an account with logon name and password that Windows Server Changes automatically on a periodic basis. -They authenticate with the domain -They can belong to groups and have access to resources, and you can configure them by using Group Policy

Carefully manage the default groups that provide administrative privileges, because these groups: - -

-Typically have broader privileges than are necessary for most delegated environments -Often apply protection to their members

Seizing a FSMO role is:

-Unplanned and a last resort -Done with incomplete or out-of-date data -Performed through Windows PowerShell or ntdsutil.exe

Sometimes you need to install additional domain controllers in your Windows Server 2016 domain, for reasons such as:

-You need additional resources at a site because the existing domain controllers are overworked -You are opening a new remote office that requires you to deploy one or more domain controllers -You are creating an off-site disaster recover location

Best practices for domain controller virtualization

-avoid single points of failure -use the time services -use virtualization technology with the virtual machine generation identifier feature -avoid or disable checkpoints -be aware of improving security -consider taking advantage of cloning in your deployment or recovery strategy -start a maximum number of 10 new clones ad the same time -consider using virtualization technologies that allow virtual machine guests to move between sites -adjust your naming strategy to allow for domain controller clones

divide OUs - -

-by administration -to facilitate configuration with group policy

Options for resetting the secure channel: (6)

-nltest -netdom -Active Directory Users and Computers -Active Directory Administrative Center -Windows PowerShell -dsmod

What is a global catalog?

...

What are three things you can do with a user account?

1. Allow or deny users permissions to sign in to computers 2. Grant users access to processes and servers 3. Manage users' access to network resources

Steps to installing a domain controller on a Server Core installation of Windows Server 2016 using Server Manager:

1. Install the AD DS role 2. Run the Active Directory Domain Services Configuration Wizard

Steps to installing a domain controller on a Server Core installation of Windows Server 2016 using Windows PowerShell

1. Install the files by running the command: Install-WindowsFeature AD-Domain-Services 2. Install the domain controller role by running the command Install-ADDSDomainController

AD DS sign-in process

1. The user account is authenticated to the domain controller 2. The domain controller returns a TGT back to client 3. The client uses the TGT to apply for access to the workstation 4. The domain controller grants access to the workstation 5. The client uses the TGT to apply for access to the server 6. The domain controller returns access to the server

List the AD DS sign-in process steps in order

1. The user account is authenticated to the domain controller 2. The domain controller returns a TGT back to the client 3. The client uses the TGT to apply for access to the workstation 4. The domain controller grants access to the workstation 5. The client uses the TGT to apply for access to the server 6. The domain controller returns access to the server

The results of DNS queries for domain controllers are returned in this order:

1. same site 2. next closest site 3. a random list

What is an SRV record?

A Service record (SRV record) is a specification of data in the DNS defining the location (ie hostname and port number) of servers for specified services.

What is SYSVOL

A shared folder that contains Group Policy Objects and scripts

describe this cmdlet: Add-ADPrincipalGroupMembership

Adds group membership to objects

describe this cmdlet: Add-ADGroupMember

Adds members to groups

Benefit and risk of performing an in-place upgrade to Windows Server 2016

Benefit: Except for the Prerequisite checks, all the files and programs stay in place, and no additional work is required Risk: it might leave obsolete files and dynamic-link libraries (DLLs)

Benefit and risk of Introducing a new server running Windows Server 2016 and promoting it to be a domain controller

Benefit: The new server has no obsolete files and settings Risk: It might require additional work to migrate administrators' files and settings

Account Operators Group location