0
Active Directory
Active Directory is a set of networking services made by Microsoft. Questions about using and configuring Active Directory belong here.
849 Questions
How can you backup active directory?
Backing up Active Directory is essential to maintain an Active Directory database. You can back up Active Directory by using the Graphical User Interface (GUI) and command-line tools that the Windows Server 2003 family provides.
You frequently backup the system state data on domain controllers so that you can restore the most current data. By establishing a regular backup schedule, you have a better chance of recovering data when necessary. To ensure a good backup includes at least the system state data and contents of the system disk, you must be aware of the tombstone lifetime. By default, the tombstone is 60 days. Any backup older than 60 days is not a good backup. Plan to backup at least two domain controllers in each domain, one of at least one backup to enable an authoritative restore of the data when necessary. System State Data
Several features in the windows server 2003 family make it easy to backup Active Directory. You can backup Active Directory while the server is online and other network function can continue to function. System state data on a domain controller includes the following components: Active Directory system state data does not contain Active Directory unless the server, on which you are backing up the system state data, is a domain controller. Active Directory is present only on domain controllers.
The SYSVOL shared folder: This shared folder contains Group policy templates and logon scripts. The SYSVOL shared folder is present only on domain controllers.
The Registry: This database repository contains information about the computer's configuration.
System startup files: Windows Server 2003 requires these files during its initial startup phase. They include the boot and system files that are under windows file protection and used by windows to load, configure, and run the operating system.
The COM+ Class Registration database: The Class registration is a database of information about Component Services applications.
The Certificate Services database: This database contains certificates that a server running Windows server 2003 uses to authenticate users. The Certificate Services database is present only if the server is operating as a certificate server.
System state data contains most elements of a system's configuration, but it may not include all of the information that you require recovering data from a system failure. Therefore, be sure to backup all boot and system volumes, including the System State, when you back up your server. Restoring Active Directory
In Windows Server 2003 family, you can restore the Active Directory database if it becomes corrupted or is destroyed because of hardware or software failures. You must restore the Active Directory database when objects in Active Directory are changed or deleted. Active Directory restore can be performed in several ways. Replication synchronizes the latest changes from every other replication partner. Once the replication is finished each partner has an updated version of Active Directory. There is another way to get these latest updates by Backup utility to restore replicated data from a backup copy. For this restore you don't need to configure again your domain controller or no need to install the operating system from scratch. Active Directory Restore Methods
You can use one of the three methods to restore Active Directory from backup media: primary restore, normal (non authoritative) restore, and authoritative restore. Primary restore: This method rebuilds the first domain controller in a domain when there is no other way to rebuild the domain. Perform a primary restore only when all the domain controllers in the domain are lost, and you want to rebuild the domain from the backup.
Members of Administrators group can perform the primary restore on local computer, or user should have been delegated with this responsibility to perform restore. On a domain controller only Domain Admins can perform this restore.
Normal restore: This method reinstates the Active Directory data to the state before the backup, and then updates the data through the normal replication process. Perform a normal restore for a single domain controller to a previously known good state.
Authoritative restore: You perform this method in tandem with a normal restore. An authoritative restore marks specific data as current and prevents the replication from overwriting that data. The authoritative data is then replicated through the domain.
Perform an authoritative restore individual object in a domain that has multiple domain controllers. When you perform an authoritative restore, you lose all changes to the restore object that occurred after the backup. Ntdsutil is a command line utility to perform an authoritative restore along with windows server 2003 system utilities. The Ntdsutil command-line tool is an executable file that you use to mark Active Directory objects as authoritative so that they receive a higher version recently changed data on other domain controllers does not overwrite system state data during replication.
What are the logical and physical components of ADS?
Logical components:
Domains, OU, Trees & Forest
Physical Components:
Domain Controllers & Sites
Regards
Ashok Makkar
Aricent
Ad lds
What DNS resource record type identifies the resource authoritative name server?
SOA Resource Records
Every zone contains a Start of Authority (SOA) resource record at the beginning of the zone. SOA resource records include the following fields:
*
The Owner , TTL , Class , and Type fields, as described in "Resource Record Format" earlier in this chapter.
*
The authoritative server field shows the primary DNS server authoritative for the zone.
*
The responsible person field shows the e-mail address of the administrator responsible for the zone. It uses a period (.) instead of an at symbol (@).
*
The serial number field shows how many times the zone has been updated. When a zone's secondary server contacts the master server for that zone to determine whether it needs to initiate a zone transfer, the zone's secondary server compares its own serial number with that of the master. If the serial number of the master is higher, the secondary server initiates a zone transfer.
*
The refresh field shows how often the secondary server for the zone checks to see whether the zone has been changed.
*
The retry field shows how long after sending a zone transfer request the secondary server for the zone waits for a response from the master server before retrying.
*
The expire field shows how long after the previous zone transfer the secondary server for the zone continues to respond to queries for the zone before discarding its own zone as invalid.
*
The minimum TTL field applies to all the resource records in the zone whenever a time to live value is not specified in a resource record. Whenever a resolver queries the server, the server sends back resource records along with the minimum time to live. Negative responses are cached for the minimum TTL of the SOA resource record of the authoritative zone.
Are users part of the active directory?
yes users are the important part of active directory as the users are assigned the permission to use the resources, groups, printers .We can assign users to a group and apply permission on them we can put them in OU and apply restriction /permission etc.Without users there is no meaning of resources.
Where does a DNS server look first to resolve a query?
Local DNS cache of client computer, then the hosts file on the local PC finally going to the assigned DNS servers the computer is pointing to
What is the command to restart Server Core?
To shut down a Windows 2008 Server Core System, at the command prompt type:
Shutdown -s -t xx
where
-s = shut down
-t xx = time to wait before shutting down in seconds, where xx =0 to 600
To shut down a Windows 2008 Server Core System immediately, at the command prompt type:
Shutdown -s -t 0
where 0 = wait zero seconds (shut down immediately)
To restart a Windows 2008 Server Core System, at the command prompt type:
Shutdown -r -t xx
where
-r = reboot
-t xx = time to wait before shutting down in seconds, where xx = 0 to 600
To restart a Windows 2008 Server Core System immediately, at the command prompt type:
Shutdown -r -t 0
where 0 = wait zero seconds (reboot immediately)
What is a standard primary zone in ad?
Primary zone
When a zone that this DNS server hosts is a primary zone, the DNS server is the primary source for information about this zone, and it stores the master copy of zone data in a local file or in AD DS. When the zone is stored in a file, by default the primary zone file is named zone_name.dns and it is located in the %windir%\System32\Dns folder on the server.
What is the command line syntax to install dhcp on windows server 2008 server core is?
That question doesn't end with the word "is".
In regards to your question:
Start /w ocsetup DHCPServerCore
c). Dsmove
What is the purpose of a root server in DNS?
If a DNS server cannot find the answer to the DNS Query in its own database it will first query the forwarders (if there are any configured) and then ask the root server. root servers (by default) are the master DNS servers of the Internet.
The are called A, B, C, ...
These are the highest level of the DNS hierarchy. Ultimately, any DNS request that can't be solved at a lower level (through the use of a cache) is traced back to those 13 root servers.
Them root server in general is
.
.com,.org etc
but in your domain the first dc in the forest/domain is the one
cyberspace
dynamic
The Active Directory schema defines the kinds of objects, the types of information about those
objects, and the default security configuration for those objects that can be stored in Active
Directory.
The Active Directory schema contains the formal definitions of all objects, such as users,
computers, and printers that are stored in Active Directory. On domain controllers running
either Windows 2000 or Windows Server 2003, there is only one schema for an entire forest.
This way, all objects that are created in Active Directory conform to the same rules.
The schema has two types of definitions: object classes and attributes.
Object classes such as user, computer, and printer describe the possible directory objects that
you can create. Each object class is a collection of attributes. Attributes are defined separately
from object classes. Each attribute is defined only once and can be used in multiple object
classes. For example, the Description attribute is used in many object classes, but is defined
only once in the schema to ensure consistency.
A computer network can be segmented physically but also logically. A collision domain is one of the logical network segments in which the data packets can collide to each other. One of the most common protocols used when referring to a collision domain is the Ethernet protocol. Collision domains are often referred as 'Ethernet segments'.
The term of 'collision domain' is also used when describing the circumstances in which a single network device sends packets throughout a network segment and forces every other device in that network segment to pay attention to those packets.
What does ISTG do in active directory?
ISTG is used for replication between sites ie intersite replication . it selects the bridge head server automatically which willl be authorised to replicate information to other bridge head server of other site. If the bridge head server goes down then due to ISTG a new server takes its place and administrator need not to intervene and there is no problem in replication.
What is GCs and Universal Groups?
Every domain controller in a forest stores three full writable directory partitions: a domain directory partition, a schema directory partition, and a configuration directory partition. A Global Catalog is a domain controller that stores these writable directory partitions, as well as a partial, read-only copy of all other domain directory partitions in the forest. The additional directory partitions are "partial" because, although they collectively contain every object in the directory, only a limited set of specific attributes are included for each object. The Global Catalog is built automatically by the Active Directory replication system.
All of the directory partitions on a Global Catalog server, whether full or partial partitions, are stored in a single directory database (Ntds.dit) on that server. There is no separate storage area for Global Catalog attributes; they are treated as additional information in the domain controller directory database.
When a new domain is added to the forest, the information about the new domain is stored in the configuration directory partition, which reaches the Global Catalog server (and all domain controllers) through replication of forest-wide information. When a new Global Catalog server is designated, this information is also stored in the configuration directory partition and replicated to all domain controllers in the forest.
Universal Group MembershipThe reason that a Global Catalog must be available for the domain logon process is that the membership for universal groups is not stored on all domain controllers. Because the membership of all universal groups is replicated to Global Catalog servers, the complete universal group membership of a user can be determined by querying a Global Catalog server.Universal groups are available only when a domain is in native mode.
During the logon process, a security token that contains the groups to which the user belongs is associated with the user. Because universal group membership is stored only on Global Catalog servers, only these servers can identify a user as having membership in a specific universal group. If a universal group is present as an access control entry in an access control list on a specific directory object, the access token associated with the user during the logon session must contain that group in order for the Allow or Deny access permission to be applied to the user. Otherwise, a user could be granted access (on the basis of another group membership) to an object that is specifically denied that user as a member of the universal group. Similarly, this user would not be able to gain access to resources to which he or she has legitimate access as a member of the universal group.
What is the difference between kerberos v4 and v5?
Here are the new changes that are made in version 5 * The key salt algorithm has been changed to use the entire principal name. * The network protocol has been completely redone and now uses ASN.1 encoding everywhere. * There is now support for forwardable, renewable, and postdatable tickets. * Kerberos tickets can now contain multiple IP addresses and addresses for different types of networking protocols. * A generic crypto interface module is now used, so other encryption algorithms beside DES can be used. * There is now support for replay caches, so authenticators are not vulnerable to replay. * There is support for transitive cross-realm authentication.
How can active directory work without DHCP?
Active directory and DHCP are not the same services; they are intended to do different things. DHCP manages IP addressing and AD manages accounts, groups, users, etc. They don't need to work together.
