Errata

If you type cd windows\adam you get error message that states there is no such path available.

Line should be:
cd %systemroot%\adam
or the original line with backslash
cd \windows\adam

Note from the Author or Editor:
Yes, indeed. The command should be cd \windows\adam. Thanks

On step 9 and step 10, we are told to click the X button at the end, but the button we are supposed to click is Enter

Note from the Author or Editor:
This button is indeed Enter.

The book states:

Enterprise CAs can run only on Windows Server 2008 R2 Enterprise edition or Windows Server 2008 R2 Datacenter edition.

This is not correct. You can use Windows 2008 R2 Standard edition, but you will not have access to all features.

Note from the Author or Editor:
Yes indeed, you can use the Standard Edition to run an Enterprise CA with limited functionality. Our recommendation would be to use this as a root CA only.

States that 'md' is an alias for the New-Item cmdlet. However, 'md' is an alias for the mkdir command, seen by <get-alias md> and 'ni' is the only alias for the New-Item cmdlet. A bit confusing and misleading as <get-help md> exposes the New-Item documentation.

It also seems that the parameter -itemtype in not optional as suggested, and an error will result if this is not specified

eg. ni -name "OU=test12" organizationalunit gives an error

Not sure if I have lost the plot here, and happy to be corrected :) If it is valid perhaps categorize this as Minor Technical Mistake.

Note from the Author or Editor:
You are partially correct, and to make the issue more confusing, what you are really spotting here is a change from PowerShell v1 (in Windows Server 2008, when the book was originally authored) and v2 (in R2, for this revision) that we missed.

md is an alias for the mkdir *function* (not command). The -itemtype is optional (you can validate this by typing md NewDirectory). New-Item (NI) is a cmdlet and requires the -itemtype parameter. mkdir, as a function, calls new-item and adds the -itemtype parameter as Directory. You can see this by typing gc function:\mkdir and examining the function itself.

Confused? You're not alone ;-)
There's a nice blog entry on the issue at
http://powershell.com/cs/blogs/aleksandar/archive/2009/02/06/do-you-know-the-aliases-for-the-new-item-cmdlet.aspx

REVISION REQUEST for next reprint:
Page 113
Formatting: follow example in current printing

To create a new OU for Contractors in the User Accounts OU, type the following:
md "ou=Contractors"
Md is an alias for the mkdir function, which itself is a wrapper around the New-Item cmdlet. The syntax is familiar to anyone who has used Command Prompt. But the result is a new OU named Contractors in the User Accounts OU.

Exercise 1, Step 8 says:

"Under Group Or User Names, click the computer name you just added, and then, in the Permissions section of the dialog box, select the Read, Enroll, and Autoenroll permissions in the Allow column."

As per a previous correction of this step in the lesson, the Autoenroll permission should not be set.

Note from the Author or Editor:
Remove Autoenroll.

at page 810 , at the end of the step 8 it reads :

"....... select Read . enroll and Autoenroll permissions in Allow column "

we should not Assign Autoenroll permission to the Online responder computers According to this important note :

Windows server 2008 PKI and Certificate Security by Brian komar , page 220 :
" do not Assign the Autoenroll permission to the online responder computer Accounts. An online responder will request multiple OCSP signing certificates (one per revocation provider). the default autoenrollment protocol would renew only one of the OCSP Response signing certificates and archive the rest, rendering them unusable. "

Note from the Author or Editor:
Permissions should be only Read and Enroll. Online Responders should not use Autoenroll. See http://technet.microsoft.com/en-us/library/cc770413(v=ws.10).aspx.

Suggested command to move a computer is the following:
dsmove "CN=DESKTOP153,OU=Computers,DC=contoso,DC=com" -newparent "OU=Clients,DC=contoso,DC=
com"
dsmove failed:CN=DESKTOP153,OU=Computers,DC=contoso,DC=com:Directory object not found.

However the Computers container should be referenced by CN not as an OU otherwise the command will fail:
dsmove "CN=DESKTOP153,CN=Computers,DC=contoso,DC=com" -newparent "O
U=clients,dc=contoso,dc=com"
dsmove succeeded:CN=DESKTOP153,CN=Computers,DC=contoso,DC=com

Note from the Author or Editor:
Page 234, code sample at top of page, change
OU=Computers
to
CN=Computers

Page 953, question 3, explanation C should be:
Windows Server 2008 domain level or higher is required for fine-grained password policies. When you raise the forest functional level, you must also raise the domain functional level, making answer C the best answer.

On page 514, in the first instance of step 2, change \Sources\Adprep to Support\Adprep
On page 514, in the second instance of step 2, change \Sources\Adprep to Support\Adprep

On page 513, in the last paragraph, change \Sources\Adprep to Support\Adprep

Adding Domain Users to Print Operators flags accounts with adminSDHolder. It is better to use Group Policy to grant log on locally rights to Domain Users for the purposes of the book practices.

Note from the Author or Editor:
This is an error that must be corrected in the book. Details will be forthcoming.

I am submitting this errata entry to test the functionality of the Errata site and responses.

Exercise 1 is done on SERVER10, which is a DC in the treyresearch.net domain. Step 6 requests that you use CONTOSO\Administrator. Should this instead be TREYRESEARCH.NET\Administrator?

Note from the Author or Editor:
The login name should be TreyResearch\Administrator in step 6.

The group that has been granted read permissions on the ACL for the 3 folders in Fugure 4-5 is Sales, but should be ACL_Sales Folders_Read group.

Note from the Author or Editor:
The reader is correct that the screenshots show the incorrect group name. It should be the ACL_Sales Folders_Read group, rather than the Sales group, in the screenshot.

Screenshots will be revised in the next edition of the book.

at page 807 , step 8 , 5th line in second bullet point , it reads :

"Also, use encryption to send the key to the CA." in win2008 R2 , this sentence has changed . so

change :

" use encryption to send the key to the CA "

to

" Use advanced Symmetric Algorithm to send the key to the CA "

Note from the Author or Editor:
Good catch. The proposed change is correct.

at page 107 , second paragraph from the bottom

" For example, to get help, including examples, about the New-ADGroupMember cmdlet..."

to

" For example, to get help, including examples, about the Get-ADGroupMember cmdlet..."

the questions is

Your company is conducting a meeting for a special project. The data is particularly confidential. The team is meeting in a conference room, and you have configured a folder on the conference room computer that grants permission to the team members. You want to ensure that team members access the data only while logged on to the computer in the conference room, not from other computers in the enterprise. What must you do?

My questions is:

The folder on conference room computer its a shared folder?
If not then why you says access only while logged on to computer and not from other computers?
Don't supposed that information is only on this computer?

Do you can explain more specificly the question?

I can't understand the example.

Note from the Author or Editor:
Change text on page 200 to:
Your company is conducting a meeting for a special project. The data is particularly confidential. The team is meeting in a conference room, and you have configured a folder on the conference room computer that grants permission to the team members. The folder is a subfolder of a shared folder to which all employees have access. You want to ensure that team members access the data only while logged on to the computer in the conference room, not from other computers in the enterprise. What must you do?

The task says
To delegate the ability to manage membership for all groups in an OU, perform the following steps:

1. In the Active Directory Users And Computers snap-in, click the View menu and make sure Advanced Features is selected.
2. Right-click the group?s name and choose Properties.

In this point say Group's but the exercise is for all Groups of the OU

The point 2 must be change by:

2. Right-click on the OU name that you want delegate to manage membership for all gropus inside this OU and choose Properties.

Note from the Author or Editor:
Thank you for writing. You are correct.

Step 2 on page 192 should read:

2. Right-click the OU and choose Properties.

Thanks for writing!

I suggest to type the following command to find the name of the interface, previous to point 2 from exercise

netsh interface show interface

Sometimes it can exist more than one interface or the name could be in other language

Note from the Author or Editor:
Thank you for writing. You are correct--especially with non-English versions of Windows, the name could be different.

Add the following text below the code blocks in Step 2, prior to Step 3:

If you receive an error, check that your network interface is called "Local Area Connection" by typing netsh interface show interface. Replace "Local Area Connection" in the commands shown above with the correct name of your network connection.

SEE FORMATTING AND STYLES IN ERRATA WORD DOCUMENT.

In the example of syntax of DSMOD say:

dsmod user UserDN [-upn UPN][-fn FirstName][-mi Initial][-ln LastName][-dn DisplayName] [-email EmailAddress]

but -dn does not exist as dsmod command line, this must be:

[ -display Displayname ]

Like this example:

dsmod user <UserDN> ... [-upn <UPN>] [-fn <FirstName>] [-mi <Initial>] [-ln <LastName>] [-display <DisplayName>] ......

Note from the Author or Editor:
Thank you for writing! You are correct.

The sample code in the middle of page 133 that currently reads
[-dn DisplayName]
should be
[-display DisplayName]

and in the first line of the following parpagraph the following change must be made:

Each parameter, -display for example,

The section that reads:
"For example, if the treyresearch.net forest contains two domains, treyresearch.net and antarctica.treyresearch.net, those domains constitute a contiguous portion of the DNS namespace, so they are a single tree. If, conversely, the two domains are treyresearch.net and proseware.com, which are not contiguous in the DNS namespace, the domain is considered to have two trees."

Needs to have its last sentenced changed to read:
"If, conversely, the two domains are treyresearch.net and proseware.com, which are not contiguous in the DNS namespace, the FOREST is considered to have two trees."

This is because a DOMAIN cannot be made up of multiple trees, only a FOREST can be made up of multiple trees.

Note from the Author or Editor:
The errata item is valid.

Change:
... the domain is considered to have two trees.
to
... the forest is considered to have two trees.

Thanks for writing!

at page 516 , second line under " installing a new windows server 2008 child domain, it reads :
" If you have an existing domain, you can create a new child domain by creating a Windows Server 2008 R2 domain controller. Before you do, however, you must run Adprep /forestprep,as described in the ?Installing the First Windows Server 2008 R2 Domain Controller in an Existing Forest or Domain? section. "

this general sentence is not true. only if we have one or more windows 2003 domain controllers in our AD network ,we should perform Adprep /forestprep . so it will be better to change that sentence to this :

" If you have an existing domain, you can create a new child domain by creating a Windows Server 2008 R2 domain controller. Before you do, however,if you have one or more windows 2003 domain controllers in your AD network, you must run Adprep /forestprep,as described in the ?Installing the First Windows Server 2008 R2 Domain Controller in an Existing Forest or Domain? section. "

Note from the Author or Editor:
Thank you for writing! The errata item is valid.

Change the first paragraph on page 516 to:

If you have an existing domain, you can create a new child domain by creating a Windows Server 2008 R2 domain controller. Before you do, however, if you have one or more Windows Server 2003 domain controllers in your forest, you must run adprep /forestprep,
as described in the ?Installing the First Windows Server 2008 R2 Domain Controller in an Existing Forest or Domain? section.

Passwords cannot be reset or entered via Windows PowerShell using the "Set-ADUser cmdlet?s &#8209;AccountPassword ".

On page 115 of your book you state the correct method, Set-ADAccountPassword.

Note from the Author or Editor:
Change text on page 137
To reset a user?s password by using Windows PowerShell, use the Set-AccountPassword cmdlet, as explained in Lesson 2.

Practice 2 asks for Barbara Mayer of the Help desk group to reset a password of a user in the same OU as her (User Accounts) - this is expected to work since Help Desk group was delegated Reset Password permissions on the User Accounts OU. However, the book (bottom of page 85) asks to add Domain Users to the Print Operators group so they can log onto Domain Controllers; by doing this, every domain user is now in a protected group and therefore user ACLs no longer inherit from their parent OU (this takes a few minutes to take effect). In this case, the ACL does not contain the Help Desk group anymore and therefore Barbara does not have the permissions to reset passwords - this exercise will fail. Removing domain users from the Print Operators group fixes issue. (resetting acls to default as well).

Note from the Author or Editor:
Readers: see note at http://oreilly.com/catalog/errata.csp?isbn=0790145314413 listed for Page 1.

The Suggested Practice 2 is written

"Run Adprep /forest and Adprep /domain /gpprep from the Windows Server 2008 R2 instalation DVD \Sources\Adprep folder."

It's incorrect "\Sources\Adprep" should be "\Support\Adprep"

Note from the Author or Editor:
On page 554, in the paragraph for Practice 2, change \Sources\Adprep to Support\Adprep
On page 513, in the last paragraph, change \Sources\Adprep to Support\Adprep
On page 514, in the first instance of step 2, change \Sources\Adprep to Support\Adprep
On page 514, in the second instance of step 2, change \Sources\Adprep to Support\Adprep

at page 159 , under the understanding Group Types , in line 4, about Distribution groups , we read :
" they do not have SIDs "

but when we get properties on a distribution Group , on attribute editor tab we see that there is objectSid attribute which has value.

Note from the Author or Editor:
On page 159, in the second paragraph under ?Understanding Group Types,? remove the following text:
?they do not have SIDs?

as you know , universal groups can have permissions to resources located in other forests so
at page 163 , in line 9 (Availability section ) ,

change

Additionally, a universal group can be used to manage
resources?for example, to assign permissions?anywhere in the forest.

to

Additionally, a universal group can be used to manage
resources?for example, to assign permissions?anywhere in the forest and also trusted forests.

Note from the Author or Editor:
Change text on page 163:
Additionally, a universal group can be used to manage resources?for example, to assign permissions?anywhere in the forest and in trusting forests.

at page 692, at the end of step 3 it reads :

"You can restore the data either through the command line or with Windows Server Backup. Note, however, that when you want to restore directory data, you must perform a System State restore and, to do so, you must use the command line."

as we see in windows server 2008 R2, windows server backup GUI has the option to system state restore , so there is no necessity to use only command line. we can user Windows Server Backup GUI to do this restore as well. but the matter is by using windows server backup GUI, we can't make only a portion of directory as authoritative and so unable to restore only a portion of database via windows server backup GUI .

Note from the Author or Editor:
Yes indeed, in WS08 R2, you can use the graphical interface to perform the restore.

On page 413 in point #2, it states...

"2. Right-click the name of the forest and choose Properties."

The word forest should be replaced by domain.

Note from the Author or Editor:
Change page 413, step 2, to the following:
In the console tree, right-click the root node, Active Directory Domains And Trusts [Server Name], and then click Properties.

on page 595 , first paragraph we read :

" By default, Repadmin.exe shows only intersite connections. Add the /repsto argument to see intersite connections as well."

note that both words are written " intersite " which is not true.

Note from the Author or Editor:
On page 595, change the first two bullets to the following:
? Displaying replication status &#8195;To display the status of inbound replication of a domain controller, type repadmin /showrepl DSA_LIST.
? Displaying connection objects for a domain controller&#8195;Type repadmin /showconn DSA_LIST to show the connection objects for a domain controller.
SEE FORMATTING AND STYLES IN ERRATA WORD DOCUMENT

RFC has been updated.

The Sentence "The underscore characters are a requirement of RFC 2052"

Should be changed to "The underscore characters are a requirement of RFC 2782"

When referring to the checkbox "Allow administrator interaction when the private key is accessed by the CA":

"The last option on the page provides further protection for the root CA. By selecting this option, you ensure that use of the CA will require administrative access and will work only with this level of access."

This explanation seems to be incorrect, and the option should not be selected for this lab.

http://technet.microsoft.com/en-us/library/ee126140(WS.10).aspx:
"If you are using a custom CSP that requires strong private key protection, click Allow administrator interaction when the private key is accessed by the CA. The CSPs included with Windows Server do not require this setting to be enabled."

Note from the Author or Editor:
Using this option will allow administrators to work with third-party CSPs.

OU Employees already exsists Command will not complete successfully

Note from the Author or Editor:
In Step 5, change
"ou=Employees"
to
"ou=New Hires"

in Step 8, change
Employees and Contractors
to
Employees, Contractors and New Hires

in page 219 in the 3rd bullet point , 2nd line it states :
"_for example, CN=Client Computers,DC=contoso,DC=com."

as we know , we can't creat any container ( for example Client computers container ) in active directory. we can just creat OUs, so change
" CN=Client Computers,DC=contoso,DC=com."
to
" OU=Client Computers,DC=contoso,DC=com."

Note from the Author or Editor:
The errata is reasonable and worth changing.

change
--for example, CN=Client Computers
to
--for example, OU=Client Computers

On page 954, in question 2 , the correct answer is just D not C. Answer C of question 2 is incorrectly marked as correct, so
Change:
"C. Correct: The /verify parameter verifies the health of an existing trust relationship. Some trusted users are able to access the resources, so the trust relationship is known to be healthy."

To:
"C. Incorrect: The /verify parameter verifies the health of an existing trust relationship. Some trusted users are able to access the resources, so the trust relationship is known to be healthy."

Note from the Author or Editor:
The errata is correct. Changes below:

Page 953, Question 2
2. Correct Answers: C and D
should be
2. Correct Answer: D

Page 954, continuation of Question 2
C. Correct
should be
C. Incorrect

On page 953, answer C to quesiton 3 has an incorrect explanation.

Change:
"C. Correct: Windows Server 2008 forest functional level is required for fine-grained password policies."

To:
"C. Correct: Windows Server 2008 domain functional level is required for fine-grained password policies."

Note from the Author or Editor:
The erratum is correct, and the suggested change is correct.

On page 30, in Step 3 of Exercise 3 the command to add and configure the AD DS role is partially incorrect.

Change:
"dcpromo /unattend /replicaOrNewDomain:replica /replicaDomainDNSName:contoso.com /ConfirmGC:Yes /UserName:CONTOSO\Adminsitrator /Password:* /safeModeAdminPassword:P@ssword"

To:
"dcpromo /unattend /replicaornewdomain:replica /replicaDomainDNSName:contoso.com /ConfirmGC:Yes /UserName:Administrator /userDomain:Contoso /Password:* /safeModeAdminPassword:P@ssword"

Note from the Author or Editor:
While the command works as written, the following change should be made to conform with Technet documentation for dcpromo.exe syntax

Change:
"dcpromo /unattend /replicaOrNewDomain:replica /replicaDomainDNSName:contoso.com /ConfirmGC:Yes /UserName:CONTOSO\Adminsitrator /Password:* /safeModeAdminPassword:P@ssword"

To:

"dcpromo /unattend /replicaornewdomain:replica /replicaDomainDNSName:contoso.com /ConfirmGC:Yes /UserName:Administrator /userDomain:Contoso /Password:* /safeModeAdminPassword:P@ssword"

On page 28, steps 4 and 7 in Exercise 2 include invalid command line swtiches for the shutdown command.

Change:
"4. Restart by typing shutdown ?r ?t 0."

To:
"4. Restart by typing shutdown /r /t0."

Change:
"7. Restart by typing shutdown ?r ?t 0, and then log on again as Administrator."

To:
"7. Restart by typing shutdown /r /t0, and then log on again as Administrator."

Note from the Author or Editor:
Correct as suggested

Suggested Practices - Practice 2
The second cammand ask you to perform a query and then do a dsmod to add the users from that query to the All Users group you created in Line 1.

Written
dsmod group "CN=User Accounts,OU=Groups,DC=contoso,DC=com" -addmbr

It should say
dsmod group "CN=All Users,OU=Groups,DC=contoso,DC=com" -addmbr

Note from the Author or Editor:
Thank you for the feedback! You are absolutely correct!

NOTE FROM THE AUTHOR:

Question 2 is incorrect. The question was intended to be about Active Directory Federated Services (AD FS):

Correction (page 31, Lesson 2, Question 2)
SERVER02 is running Server Core. It is already configured with the AD DS role. You want to add Active Directory Federated Services (AD FS) to the server. What must you do?

Answer options remain the same.

For the correct answer (so I don't spoil the surprise), see the errata for page 922.

Note from the Author or Editor:
This errata was submitted by the author. It is correct.

Original text:
Three settings are related to account lockout. The first of these settings, Account Lockout
Threshold, determines the number of invalid logon attempts permitted within a time
specified by the second of these settings, Account Lockout Duration. If an attack results
in more unsuccessful logons within that time frame, the user account is locked out. When
an account is locked out, Active Directory denies logon to that account, even if the correct
password is specified.
An administrator can unlock a locked user account by following the procedure you learned
in Chapter 3. You can also configure Active Directory to automatically unlock the account
after a delay specified by a third setting, the Reset Account Lockout Counter After policy
setting.

Should be:
Three settings are related to account lockout. The first of these settings, Account Lockout
Threshold, determines the number of invalid logon attempts permitted within a time
specified by the second of these settings, Reset Account Lockout Counter After. If an attack results
in more unsuccessful logons within that time frame, the user account is locked out. When
an account is locked out, Active Directory denies logon to that account, even if the correct
password is specified.
An administrator can unlock a locked user account by following the procedure you learned
in Chapter 3. You can also configure Active Directory to automatically unlock the account
after a delay specified by a third setting, the Account Lockout Duration policy setting.

Note from the Author or Editor:
The errata and suggested correction is accurate.

In the book we can read the following statement:

Note that to stop the AD DS service, the DC must be able to communicate with another DC that is running the service. If it cannot, you will not be able to stop the service. AD DS includes automatic checks and verifications that ensure that at least one DC is available at all times; otherwise, no one will be able to log on to the network.

As my testing, I can successfully disable or stop the service if the DC cannot access another Domain Controller.

Note from the Author or Editor:
In Windows Server 2008 R2, you can stop the AD DS service if another domain controller is not present, however, if another domain controller is not present, you will not be able to log on to the DC with the stopped AD DS service with domain credentials should the session be closed or locked due to a screen saver. You will also not be to use the local Domain Services Restore Mode (DSRM) password unless you previously modified the default HKLM\System\CurrentControlSet\Control\Lsa\DSRMAdminLogonBehavior Registry key settings. For more information on the restartable AD DS service, go to http://technet.microsoft.com/en-us/library/cc732714%28WS.10%29.aspx.