Errata

The reader is instructed, "In addition, make sure that the Domain Users group is a member of the Print Operators group, which can be found in the Builtin container. This will enable all sample users in the practice domain to log on to the SERVER01 domain controller."

While this will allow the sample users to log on, the Print Operators group is protected by the AdminSDHolder thread, which will periodically reset permissions for nested members of protected groups and disable inheritance. This will effectively prevent the users from logging on.

Instead, the reader should add Domain Users to the "Allow Log on locally" user right in the Default Domain Controller Policy. Of course, as the text says, "this is important for the practices in this training kit, but you should not allow users to log on to domain controllers in your production environment, so do not make Domain Users members of the Print Operators group in your production environment."

The following blog post discusses this issue: http://msmvps.com/blogs/ulfbsimonweidner/archive/2005/05/29/49659.aspx

The line below does not work.
dsrm user "cn=Mike Fitzmaurice, ou=People, dc=contoso,dc=com"

I tried a number of combination and the only one that did the trick is
dsrm "cn=Mike Fitzmaurice, ou=Peopl e, dc=contoso,dc=com"

to remove a user from an OU.


Thanks.

The paragraph states:

"Unfortunately, neither the command line nor Windows Powershell provides a native tool for unlocking accounts."

Correction:

You can use the following dsmod command to unlock an account:

dsmod user userDN -disabled no

This step tells you to click on the Profile tab and configure the Home Folder. First it leaves out a step and secondly the path isn't valid for a home folder. Follow these steps for correct completion of task.

1. Make sure to click the checkbox for the Home Folder option. Next select the radio button for "Local Path".

2. The book tells you to enter the following below...Please "DO NOT" use this path as its a network path and "NOT" a local path and thus "WONT" work.

Original = \\server01\%username%\documents

Corrected = C:\Users\%username%\Documents

Please note that the C:\ drive assumes you installed Server 2008 using the default drive which is the C drive.

Note that the local path of a users home directory in this case is the C:\ drive. Each user profile is stored within the Users directory. The "%username%" variable specifies that the specific users account name will be used. The last part is to specify that the users home folder will be the Documents folder.

Once you completed the steps and you view each users properties you will notice that under the local path it would show the following...

C:\Users\april.stewart\Documents (within April Stewart's properties)
C:\Users\scott.mitchell\Documents (within Scott Mitchell's properties)
C:\Users\linda.mitchell\Documents (within Linda Mitchell's properties)

I hope this helps you understand a bit more about how variables are used to provide batch configuration for local path folders.

When creating the excel spreadsheet your instructed to create several columns.

If you type "DistinguishedName" without the quotes as your first column you will cause the entire process to fail. You must type "DN" without quotes for everything to work. So the sample excel file would contain columns such as these.

Column 1...
DN
cn=Bob Jones,ou=People,dc=contoso,dc=com

Column 2...
objectClass
user

Column 3...
givenName
Bob

Column 4...
sn
Jones

Column 5...
sAMAccountName
bob.jones

Hope this helps.

Paragraph 2:

"These groups are not security enabled; they do not have SIDs,..."

ALL objects of group class have SIDs. It is a required attribute. Whena group is not security enabled, the SID is not added to a members token during interactive logon. A group is security enabled when the leftmost bit of the groupType attribute is set.

Paragraph 3:

"Otherwise, the group is assigned a SID...."

Text doesn't mention the confirmation dialog that appears when the user clicks "Apply" or what to do about it.

The Clients and Servers OUs cannot be created. They already exist, having been created in an earlier exercise.

DESTOP101 cannot be created. It already exists, having been created in an earlier exercise.

SERVER02 cannot be created in the Servers OU because it already exists in the Computers container from a previous exercise.

Linda Mitchell cannot logon to SERVER01 due to "Log On To" restriction set in an earlier exercise. Logon time restrictions are also in effect from an earlier exercise.

The user was instructed in Exercise 3, step 12 on page 200, to jump ahead and perform this exercise. DESKTOP152, therefore, already exists.

SERVER02 already exists; created in a previous exercise.

The second-last line of code should be two separate lines:

cn: SERVER11
userAccountControl: 4096

Change "... the GPME loads the ADM from the GPC" to "... from the GPT". As explained on the previous page, ADMs are stored in the GPT, not the GPC.

The new group policy setting may take effect before the user checks the screen saver settings, so the user may not observe the behaviour specified in this step.

The last sentence, "This log will not be available until after you use the Group Policy Modeling Wizard initially", must not be true, because the log is available and viewed in Exercise 3 on page 283.

The Help Desk group cannot be created because a group with that name already exists under the Admins\Groups OU from a previous exercise. (This exercise indicates that an Admin Groups OU should be created under Admins, though an OU named Groups was already created there for a similar purpose in a previous exercise.)

DESKTOP101 already exists in the Clients OU from a previous exercise. Choose a new name or instruct that it may need to be moved from Clients OU.

Previous exercises have created and linked GPOs that will throw off the intended results of these practices.

This step does not indicate which optional attribute should be selected to modify, and does not instruct the user to click the "Set" button.

One critical step in the exercise is NOT mentioned, the selection of the correct optional attribute name.
Between 10. and 11. a extra step should be added and step 11 should be corrected as follows:

10a. Select a property to view: msDS-PSOAppliesTo
11. In the Edit Attributes box, type CN=Domain Admins,CN=Users,DC=contoso,DC=com
Click Add, Click OK.
Click Finish.

The msDS-ResultantPSO is displayed as "<not set>", because the user was not instructed to select the correct optional attribute and click the "Set" button in the previous exercise.

there's a step missing between the second and the third paragraphs :

if you do the procedure as given, when you'll enter dnscmd .../recordadd....correspondingdnsname you'll got an error.

to avoid this, you need to create a primary zone in the FLZ after enabling the global names support ; then you'll be able to create cnames in the zone...

Please, find more about it in the Microsoft's document named "DNS Server GlobalNames Zone Deployment" (release june 2007)

The steps outlined in chapter 15 to correct the Enterprise PKI errors do not correct it. The delta CRL location 2 and the CDP location 2 errors do not go away.

Number 10 on page 803, SERVER03 should be SERVER04

Under "Exercise 5 Install an AD RMS Root Cluster
it says under 1. Log on to SERVER03 this should be Logon to SERVER04 and install the AD RMS Root Cluster on that server, because you prepared SERVER04 for installation by issuing a Web Server certificate

Page 884
Error In the book ? Chapter 4: Case Scenario Anwers ? Incorrect spelling
Corrections ? Chapter 4: Case Scenario ?Answers?

Page 884
Error In the book ? Chapter 5: Lesson review Answers ? Answer ?C? is Inorrect
Corrections ? Answers ?C? should be spell ?Incorrect?

Page 887
Error in the Book - Chapter 6: Lesson Review Answer
Lesson 1 ? Answer 2 on page 888
Answer 2 on page 888 is the same answer that is on page 887 to answer #1
Page 888 Answer 2 does not supply any explanation to question #2 that is on page 254.