Errata

If yout type only what the book says: netdom join %computername% /domain:contoso.com
the comand not works and fail, you must add user and password of the domain in Server01 pc:
netdom join %computername% /domain:contoso.com /userd:contoso.com\administrator /passwordd:P@assword

If you use the command as typed in step 6,you will get an error message saying "unknown username or bad password".This is because the command is missing the parameter to specify the domain user account and password.

The technet documentation has been followed to the tee. If I browse to the Domain Users Group and add it, an error is generated. The error says - "Windows cannot process the object with the name "Domain Users" because of the following error - The specified domain either does not exist or could not be contacted. If I type in "CONTOSO\Domain Users" manually and also add Administrators manually, the information saves but when I try and logon as bmayer, I see the error message "You cannot log on because the log on method you are using is not allowed on this computer. Please see your network administrator for more information.

This is obviously going to hold me up for the remaining 900 pages as it says you need to log on locally for many exercises. Need a fix for this ASAP as just spent the last hour trying to sort it but to no avail.

So the technet article isn't good enough. Why Oh Why haven't the instructions been included in detail in the book???

As someone who is fairly new to all this I expect everything to be layed out precisely and not have to find stuff on the internet.

In Practice 1 first error is that you have to log on to CONTOSO domain as barbara mayer (CONTOSO\bmayer), in SERVER01 as the book says yo can't log on (SERVER01\bmayer).

Second error is that if you try to reset the password of any user you get an 'Access denied' error due to in page 85 the book says that you add Domain Users group to Print Operators group. When you do that all users get an extra protection even if you leave the print operators group. Solution: just add only barbara mayer to print operators group (in order to can logon to CONTOSO), create a new user un User accounts OU and then try to reset their password--> now works.

at page 106 , at 5th paragraph ,

change :

" To list all processes running on a computer, type the following command: Get-Service "

to

" To list all processes running on a computer, type the following command: Get-Process "

The book states that "In Windows PowerShell, you can use the Move-ADObject or Move-Item cmdlets to move
a user to another OU." But, Move-Item cannot be used for Active Directroy items.

Table 4-1 states that Global group can contain users, computers, and Global groups from the same domain.

Answers for question 3 on page 927 state that users from a different domain in the same forest and users from a trusted external domain can be members of Global group.

Which is right?

The section titled "Creating Computers with NetDom" does not contain any information regarding this command. Instead, it contains the corrected information for the section titled "Creating Computers with DSAdd" which was a result of the errata submitted by Chris on September 12, 2011, and supposedly "corrected" on February 17, 2012. The publisher placed the corrected information in the wrong section, and removed the instruction material for using NetDom to create computers in AD.

The previously suggested corrections for the:
Creating Computers with DSAdd section

have been applied to the:

Creating Computers with NetDom section.

This has resulted in duplicate material for the DSAdd process, and no information at all for the NetDom process.

The text (page 228 - paragraphs above "Creating Computers with Windows PowerShell) also includes commentary unlikely to have been intended for inclusion in the instructions.

Found in a revised and updated version with errata changes included (purchased 2013)

Under the Creating Computers with NetDom title the same text from above in the section titled Creating Computers with DSAdd repeats itself.

I have been also referring to an older PDF version of the 70-640 (2008 R2) and the NetDom section is correct in this.

Surprised to see this considering was correct in an older version.

Thanks.

The exercise instructs the user to perform the New-ADComputer cmdlet in Windows Powershell to add a computer named "DESKTOP154".

The command will fail at in the standard Powershell window. The user must either start the Active Directory Module for Windows Powershell, or run the 'import-module activedirectory' cmdlet first, in order for the command to work.

When you say "A GPO that is applied later in the process, because it has higher precedence, overrides settings applied earlier in the process. This default order of applying GPOs is illustrate in Figure 6-8.". it's wrong. It's exactly the opposite. And also the figure confirm this.

I've send you this wrong errata warning:

-----------------------------------------------------------------------------------------
"When you say "A GPO that is applied later in the process, because it has higher precedence, overrides settings applied earlier in the process. This default order of applying GPOs is illustrate in Figure 6-8.". it's wrong. It's exactly the opposite."
-----------------------------------------------------------------------------------------

The text is ok, sorry.

But the figure is wrong.
ERRATA:
GPO processing order for Contractors OU = 1,2,3,4,5

CORRECT:
GPO processing order for Contractors OU = 5,4,3,2,1

ERRATA:
GPO processing order for Laptops OU = 1,2,6,7

CORRECT:
GPO processing order for Laptops OU = 7,6,2,1


Otherwise, by reading the uncorrect text, it seems that first domain policy setting are applied, and local gpo's are applied later.

Thanks and sorry again.

I was too tired, i don't know how to excuse me again. Please delete the warning from "anonymous" about page 281, 3rd paragraph, 12 Dec 2012. There aren't errors in this page.
Thanks.

The wrong crictical statement on page 286:
NOTE USE GLOBAL SECURITY GROUPS TO FILTER GPOs
GPOs can be filtered only with global security groups?not with domain local security groups.
Page 299 - Lesson Summary, fifth point - Only global security groups can be used to filter GPOs.

You could filter GPO with all 3 security group scopes (Domain Local, Global, Universal) in parent domain of Group. For Example, in test domain Adatum.com, 3 different GPOs, each filters with different Security Scope Group. All GPOs work fine and applied!

The suggested method to prevent a domain level GPO (CONTOSO Standards) from applying a screen saver by denying the computer account the Apply Group Policy permission, will not have the suggested/desired effect.

The domain level GPO is still inherited by the computer account and therefore one of it's GPOs. While the computer account is unable to apply the domain level GPO (as expected) the user that logs on WILL be able to apply the domain level GPO. Thus the screen saver policy will still take effect. This can be verified by explicitly denying a test user permission to apply the domain level GPO.

The computer OU either needs to block inheritance or otherwise not inherit the domain level GPO (i.e. move it to the user accounts OU). Alternatively overriding the settings for the screensaver in the computer OU GPO to 'disabled' would have the same effect as it has a higher precedence in this example (i.e. no enforcement).

In any of the mentioned situations, denying the computer account 'apply' permissions will have no real effect as the user is the security principle that provides authentication for GPO application.

Question 1.
There is not correct answer, because questions are wrong.
The end of answer B should be ".... Default Domain Controllers Policy GPO".

All options, A/B/C/D, for question 1 mention defining an Audit Policy in the Default Domain Policy GPO, however as answers A and B mention auditing Account Logon Events, the setting should be defined in the Default Domain CONTROLLERS Policy GPO, as is suggested as a best practice in the Training Kit.

Answers A and B in question 1 should be changed to:

"... in the Default Domain Controllers Policy GPO."

on page 425 5th paragraph the autor writes about Managed Service Accounts:

After you create a domain account for a service, you can assign the account to the service on more than one system. For example, an enterprise backup service can be configured to run on multiple servers under a single domain account.

MSA can be linked only to one computer at time, as described by the autor on page 429 2nd paragraph:

Each managed service account can be used on only one computer. Services on multiple computers cannot use a single managed service account

I just found out how to solve the problem; I justed the same MS HYPER-V VHD Files to "clone" the servers used in the excersize.

"This problem occurs when you are using cloned virtual machines that have the same SID. You can renew your SID using a tool. Please consult this website: http://technet.microsoft.com/en-us/s.../bb897418.aspx

Could be interesting to notice ;-)

Greetings
Rienus van Hees

To perform this exercise, you need a second server running Windows Server 2008 full installation. The server must be named SERVER02, and it should be joined to the contoso.com
domain. Its configuration should be as follows:
- Computer Name: SERVER02
- Domain Membership: contoso.com
- IPv4 address: 10.0.0.12
- Subnet Mask: 255.255.255.0
- Default Gateway: 10.0.0.1
- DNS Server: 10.0.0.11

The problem is that this exercise should be performed on a member server, not a domain controller. Running dcpromo on a domain controller will not allow you to create an answer file, it will demote the domain controller.

The second paragraph lists the following supported OS's

The Windows 2000 Native domain functional level
===============================================
Supported operating systems:
Windows 2000 Server
Windows Server 2003 ******************
Windows Server 2008
Windows Server 2008 R2

##################################################

The third paragraph lists the following supported OS's

Windows Server 2003 domain functional level
===============================================
Supported operating systems:
Windows Server 2003 ******************
Windows Server 2003 R2 ******************
Windows Server 2008
Windows Server 2008 R2
##################################################

It is very unlikely that "Windows Server 2003 R2" is not supported in "Windows 2000 Native" domain functional level so it should either not have been mentioned in paragraph 3 or it should have been mentioned in paragraph 2, to mention it in one but not in the other is misleading.

On this Microsoft Technet web page:
http://technet.microsoft.com/en-us/library/understanding-active-directory-functional-levels%28v=ws.10%29.aspx
Windows Server 2003 is the only "2003" server OS mentioned, they choose not to mention 2003 R2.

Hope this helps someone.

Rob. (Scotland)

I'm not sure if I am doing something wrong. The issue may be that I am using Windows Server 2008 R2 and the text is reflecting instructions for (and showing screenshots of) Windows Server 2008. In my installation of R2 I am not finding Reliability Monitor "located under the Diagnostic\Reliability and Performance\Monitoring Tools node in Server Manager"

"Reliability and Performance" appears to have been replaced with "Performance"

I have Performance Monitor listed under Monitoring Tools, but Reliability Monitor is absent.

The tool can still be accessed by typing "reliability" into the START searchbox, or by going through Control Panel and clicking the link for "View Reliability History" in Action Center.

The book says that answer 'a' is incorrect because the users are in two OUs. However, you can update the description field on objects that are in different OUs as along as you do it from the query section of ADUC.

In fact, this is the only field that you can update from the queries section which made this question seem as if it were testing for knowledge of that fact.

I add a detail to errata reported by Abraham Guerrero. If the answer 'a' was really incorrect, It's necessary to correct also the section "Managing Attributes of Multiple Users" at page 128 because it's written
"Be certain that you select only objects of one class, such as users" and not "Be certain that you select only objects of one class and of one OU"

Wrong answer.
The right answare should be A,B,C,D.
Members of Account Operators group can log on locally to domain controllers in the domain and shut them down.