book

Self-Paced Training Kit (Exam 70-640): Configuring Windows Server® 2008 Active Directory® (2nd Edition)

Name: Self-Paced Training Kit (Exam 70-640): Configuring Windows Server® 2008 Active Directory® (2nd Edition)
Author: Nelson Ruest Dan Holme Danielle Ruest, and Jason Kellington
ISBN: 9780735663046

by Nelson Ruest Dan Holme Danielle Ruest, and Jason Kellington

June 2011

Intermediate to advanced

1040 pages

36h 30m

English

Microsoft Press

Read now

Unlock full access

Self-Paced Training Kit (Exam 70-640): Configuring Windows Server® 2008 Active Directory® (2nd Edition)
A Note Regarding Supplemental Files
Introduction
System RequirementsHardware RequirementsSoftware RequirementsUsing the Companion CDHow to Install the Practice TestsHow to Use the Practice TestsLesson Review OptionsPractice Test OptionsHow to Uninstall the Practice TestsAcknowledgmentsSupport & FeedbackErrataWe Want to Hear from YouStay in Touch
Preparing for the Exam
1. Creating an Active Directory Domain
Before You BeginLesson 1: Installing Active Directory Domain ServicesActive Directory, Identity and AccessBeyond Identity and AccessComponents of an Active Directory InfrastructurePreparing to Create a New Windows Server 2008 ForestAdding the AD DS Role Using the Windows InterfaceCreating a Domain ControllerPractice Creating a Windows Server 2008 R2 ForestPractice Creating a Windows Server 2008 R2 ForestLesson SummaryLesson ReviewLesson 2: Active Directory Domain Services on Server CoreUnderstanding Server CoreInstalling Server CorePerforming Initial Configuration TasksServer ConfigurationAdding AD DS to a Server Core InstallationRemoving Domain ControllersPractice Installing a Server Core Domain ControllerPractice Installing a Server Core Domain ControllerLesson SummaryLesson ReviewChapter ReviewChapter SummaryKey TermsCase ScenarioCase Scenario: Creating an Active Directory ForestTake a Practice Test
2. Administering Active Directory Domain Services
Before You BeginLesson 1: Working with Active Directory Snap-insUnderstanding the Microsoft Management ConsoleActive Directory Administration ToolsFinding the Active Directory Administrative ToolsAdding the Administrative Tools to Your Start MenuCreating a Custom Console with Active Directory Snap-insRunning Administrative Tools with Alternate CredentialsSaving and Distributing a Custom ConsolePractice Creating and Managing a Custom MMCPractice Creating and Managing a Custom MMCLesson SummaryLesson ReviewLesson 2: Creating Objects in Active DirectoryCreating an Organizational UnitCreating a User ObjectCreating a Group ObjectCreating a Computer ObjectFinding Objects in Active DirectoryUsing the Select Users, Contacts, Computers, Or Groups Dialog BoxControlling the View of Objects in the Active Directory Users And Computers Snap-inUsing the Find CommandsDetermining Where an Object Is LocatedUsing Saved QueriesUnderstanding DNs, RDNs, and CNsFinding Objects by Using DsqueryPractice Creating and Locating Objects in Active DirectoryPractice Creating and Locating Objects in Active DirectoryLesson SummaryLesson ReviewLesson 3: Delegation and Security of Active Directory ObjectsUnderstanding DelegationViewing the ACL of an Active Directory ObjectProperty Permissions, Control Access Rights, and Object PermissionsAssigning a Permission Using the Advanced Security Settings Dialog BoxUnderstanding and Managing Permissions with InheritanceDelegating Administrative Tasks with the Delegation Of Control WizardReporting and Viewing PermissionsRemoving or Resetting Permissions on an ObjectUnderstanding Effective PermissionsDesigning an OU Structure to Support DelegationPractice Delegating Administrative TasksPractice Delegating Administrative TasksLesson SummaryLesson ReviewChapter ReviewChapter SummaryKey TermsCase ScenarioCase Scenario: Managing Organizational Units and DelegationSuggested PracticesMaintain Active Directory AccountsTake a Practice Test
3. Administering User Accounts
Before You BeginLesson 1: Automating the Creation of User AccountsCreating Users with TemplatesUsing Active Directory Command-Line ToolsCreating Users with DSAddExporting Users with CSVDEImporting Users with CSVDEImporting Users with LDIFDEPractice Automating the Creation of User AccountsPractice Automating the Creation of User AccountsLesson SummaryLesson ReviewLesson 2: Administering with Windows PowerShell and Active Directory Administrative CenterIntroducing Windows PowerShellPreparing to Administer Active Directory Using Windows PowerShellcmdletsParametersGet-HelpObjectsVariablesPipelineExtend the Pipeline to More than One LineAliasesNamespaces, Providers, and PSDrivesThe Active Directory PowerShell ProviderCreating a User with Windows PowerShellPopulating User AttributesImporting Users from a Database with Windows PowerShellThe Active Directory Administrative CenterPractice Creating Users with Windows PowerShellPractice Creating Users with Windows PowerShellLesson SummaryLesson ReviewLesson 3: Supporting User Objects and AccountsManaging User Attributes with Active Directory Users And ComputersViewing All AttributesManaging Attributes of Multiple UsersManaging User Attributes with DSMod and DSGetDSModPiping Multiple DNs to DSModDSGetManaging User Attributes with Windows PowerShellUnderstanding Name and Account AttributesUser Object NamesRename a User AccountAccount PropertiesAdministering User AccountsResetting a User’s PasswordUnlocking an AccountDisabling and Enabling a User AccountDeleting a User AccountMoving a User AccountPractice Supporting User Objects and AccountsLesson SummaryLesson ReviewChapter ReviewChapter SummaryKey TermsCase ScenarioCase Scenario: Import User AccountsSuggested PracticesAutomate the Creation of User AccountsMaintain Active Directory AccountsUse the Active Directory Administrative ConsoleTake a Practice Test
4. Managing Groups
Before You BeginLesson 1: Managing an Enterprise with GroupsUnderstanding the Importance of GroupsChallenges of Managing Without GroupsGroups Add ManageabilityGroups Add ScalabilityOne Type of Group Is Not EnoughRole-Based Management: Role Groups and Rule GroupsDefining Group Naming ConventionsUnderstanding Group TypesUnderstanding Group ScopeLocal GroupsDomain Local GroupsGlobal GroupsUniversal GroupsSummarizing Group Membership PossibilitiesConverting Group Scope and TypeManaging Group MembershipThe Members TabThe Member Of TabThe Add To A Group CommandThe Member and MemberOf AttributesHelping Membership Changes Take Effect QuicklyDeveloping a Group Management StrategyPractice Creating and Managing GroupsPractice Creating and Managing GroupsLesson SummaryLesson ReviewLesson 2: Automating the Creation and Management of GroupsCreating Groups with DSAddImporting Groups with CSVDEImporting Groups with LDIFDEModifying Group Membership with LDIFDERetrieving Group Membership with DSGetChanging Group Membership with DSModCopying Group MembershipMoving and Renaming Groups with DSMoveDeleting Groups with DSRmManaging Groups with Windows PowerShellPractice Automating the Creation and Management of GroupsPractice Automating the Creation and Management of GroupsLesson SummaryLesson ReviewLesson 3: Administering Groups in an EnterpriseBest Practices for Group AttributesProtecting Groups from Accidental DeletionDelegating the Management of Group MembershipDelegating Membership Management with the Managed By TabDelegating Membership Management Using Advanced Security SettingsUnderstanding Shadow GroupsDefault GroupsSpecial IdentitiesPractice Administering Groups in an EnterprisePractice Administering Groups in an EnterpriseLesson SummaryLesson ReviewChapter ReviewChapter SummaryKey TermsCase ScenarioCase Scenario: Implementing a Group StrategySuggested PracticesAutomate Group Membership and Shadow GroupsTake a Practice Test
5. Configuring Computer Accounts
Before You BeginLesson 1: Creating Computers and Joining the DomainUnderstanding Workgroups, Domains, and TrustsIdentifying Requirements for Joining a Computer to the DomainThe Computers Container and OUsThe Default Computers ContainerOUs for ComputersDelegating Permission to Create ComputersPrestaging a Computer AccountJoining a Computer to the DomainSecure Computer Creation and JoinsPrestaging Computer ObjectsConfiguring the Default Computer ContainerRestricting the Ability of Users to Create ComputersOffline Domain JoinPrepare for Offline Domain JoinProvision a Computer in Active Directory for Offline Domain JoinPerform an Offline Domain JoinPractice Creating Computers and Joining the DomainLesson SummaryLesson ReviewLesson 2: Automating the Creation of Computer ObjectsImporting Computers with CSVDEImporting Computers with LDIFDECreating Computers with DSAddCreating Computers with NetDomCreating Computers with Windows PowerShellPractice Automating the Creation of Computer ObjectsPractice Automating the Creation of Computer ObjectsLesson SummaryLesson ReviewLesson 3: Supporting Computer Objects and AccountsConfiguring Computer PropertiesConfiguring Computer Attributes with DSMod and Windows PowerShellMoving a ComputerManaging a Computer from the Active Directory Users And Computers Snap-InUnderstanding the Computer’s Logon and Secure ChannelRecognizing Computer Account ProblemsResetting a Computer AccountRenaming a ComputerDisabling and Enabling Computer AccountsDeleting Computer AccountsRecycling Computer AccountsPractice Supporting Computer Objects and AccountsPractice Supporting Computer Objects and AccountsLesson SummaryLesson ReviewChapter ReviewChapter SummaryKey TermCase ScenariosCase Scenario 1: Creating Computer Objects and Joining the DomainCase Scenario 2: Automating the Creation of Computer ObjectsSuggested PracticesCreate and Maintain Computer AccountsTake a Practice Test
6. Implementing a Group Policy Infrastructure
Before You BeginLesson 1: Implementing Group PolicyWhat Is Configuration Management?An Overview and Review of Group PolicyPolicy SettingsConfiguring Policy SettingsGroup Policy ObjectsCreating and Managing GPOsEditing a GPOGPO ScopeGroup Policy Client and Client-Side ExtensionsGroup Policy RefreshResultant Set of PolicySlow Links and Disconnected SystemsGroup Policy ObjectsLocal GPOsDomain-Based GPOsCreating, Linking, and Editing GPOsManage GPOs and Their SettingsGPO StorageGPO ReplicationPolicy SettingsComputer Configuration and User ConfigurationSoftware Settings NodeWindows Settings NodeAdministrative Templates NodePreferences NodeRegistry Policies in the Administrative Templates NodeFiltering Administrative Template Policy SettingsManaged and Unmanaged Policy SettingsTemplatesCentral StoreCommentingStarter GPOsPractice Implementing Group PolicyLesson SummaryLesson ReviewLesson 2: Managing Group Policy ScopeGPO LinksLinking a GPO to Multiple OUsDeleting or Disabling a GPO LinkGPO Inheritance and PrecedencePrecedence of Multiple Linked GPOsBlocking InheritanceEnforcing a GPO LinkUsing Security Filtering to Modify GPO ScopeFiltering a GPO to Apply to Specific GroupsFiltering a GPO to Exclude Specific GroupsWMI FiltersEnabling or Disabling GPOs and GPO NodesTargeting PreferencesGroup Policy ProcessingLoopback Policy ProcessingPractice Configuring Group Policy ScopePractice Configuring Group Policy ScopeLesson SummaryLesson ReviewLesson 3: Supporting Group PolicyUnderstanding When Settings Take EffectResultant Set Of PolicyGenerating RSOP Reports with the Group Policy Results WizardGenerating RSOP Reports with Gpresult.exeTroubleshooting Group Policy with the Group Policy Results Wizard and Gpresult.exePerforming What-If Analyses with the Group Policy Modeling WizardExamining Policy Event LogsPractice Configuring Group Policy ScopePractice Configuring Group Policy ScopeLesson SummaryLesson ReviewChapter ReviewChapter SummaryKey TermsCase ScenarioCase Scenario: Implementing Group PolicySuggested PracticesCreate and Apply GPOsTake a Practice Test

7. Managing Enterprise Security and Configuration with Group Policy Settings
Before You BeginLesson 1: Delegating the Support of ComputersUnderstanding Restricted Groups PoliciesDelegating Administration Using Restricted Groups Policies with the Member Of SettingDelegating Administration Using Restricted Groups Policies with the Members Of This Group SettingDefining Group Membership with Group Policy PreferencesPractice Delegating the Support of ComputersLesson SummaryLesson ReviewLesson 2: Managing Security SettingsWhat Is Security Policy Management?Configuring the Local Security PolicyManaging Security Configuration with Security TemplatesUsing the Security Templates Snap-inDeploying Security Templates by Using Group Policy ObjectsSecurity Configuration And Analysis ToolApplying Database Settings to a ComputerAnalyzing the Security Configuration of a ComputerCorrecting Security Setting DiscrepanciesCreating a Security TemplateSecedit.exeThe Security Configuration WizardCreating a Security PolicyEditing a Security PolicyApplying a Security PolicyRolling Back an Applied Security PolicyModifying Settings of an Applied Security PolicyDeploying a Security Policy Using Group PolicySettings, Templates, Policies, and GPOsPractice Managing Security SettingsPractice Managing Security SettingsLesson SummaryLesson ReviewLesson 3: Managing Software with Group PolicyUnderstanding Group Policy Software InstallationWindows Installer PackagesSoftware Deployment OptionsAssigning ApplicationsAssigning ApplicationsPublishing ApplicationsPreparing an SDPCreating a Software Deployment GPOManaging the Scope of a Software Deployment GPOMaintaining Applications Deployed with Group PolicyGPSI and Slow LinksUnderstanding AppLockerPractice Managing Software with Group PolicyPractice Managing Software with Group PolicyLesson SummaryLesson ReviewLesson 4: Implementing an Audit PolicyAudit PolicyAuditing Access to Files and FoldersSpecifying Auditing Settings on a File or FolderEnabling Audit PolicyEvaluating Events in the Security LogAuditing Directory Service ChangesEnabling Directory Service Changes AuditingSpecifying Auditing Settings for Directory Service ChangesViewing Audited Events in the Security LogPractice Implementing an Audit PolicyLesson SummaryLesson ReviewChapter ReviewChapter SummaryKey TermsCase ScenariosCase Scenario 1: Installing Software with Group Policy Software InstallationCase Scenario 2: Configuring SecuritySuggested PracticesConfigure Restricted GroupsManage Security ConfigurationTake a Practice Test
8. Improving the Security of Authentication in an AD DS Domain
Before You BeginLesson 1: Configuring Password and Lockout PoliciesUnderstanding Password PoliciesUnderstanding Account Lockout PoliciesConfiguring the Domain Password and Lockout PolicyFine-Grained Password and Lockout PolicyUnderstanding Password Settings ObjectsPSO Precedence and Resultant PSOPSOs and OUsPractice Configuring Password and Lockout PoliciesPractice Configuring Password and Lockout PoliciesLesson SummaryLesson ReviewLesson 2: Auditing AuthenticationAccount Logon and Logon EventsConfiguring Authentication-Related Audit PoliciesScoping Audit PoliciesViewing Logon EventsPractice Auditing AuthenticationPractice Auditing AuthenticationLesson SummaryLesson ReviewLesson 3: Configuring Read-Only Domain ControllersAuthentication and Domain Controller Placement in a Branch OfficeRead-Only Domain ControllersDeploying an RODCVerifying and Configuring Forest Functional Level of Windows Server 2003 or HigherRunning ADPrep /RODCPrepPlacing a Writable Windows Server 2008 or Windows Server 2008 R2 Domain ControllerInstalling an RODCPassword Replication PolicyConfiguring Domain-Wide Password Replication PolicyConfiguring RODC-Specific Password Replication PolicyAdministering RODC Credentials CachingAdministrative Role SeparationPractice Configuring Read-Only Domain ControllersPractice Configuring Read-Only Domain ControllersLesson SummaryLesson ReviewLesson 4: Managing Service AccountsUnderstanding Managed AccountsRequirements for Managed Service AccountsCreating and Configuring a Managed Service AccountInstalling and Using a Managed Service AccountManaging Delegation and PasswordsLimitations of Managed Service AccountsPractice Managing Service AccountsLesson SummaryLesson ReviewChapter ReviewChapter SummaryKey TermsCase ScenariosCase Scenario 1: Increasing the Security of Administrative AccountsCase Scenario 2: Increasing the Security and Reliability of Branch Office AuthenticationSuggested PracticesConfigure Multiple Password Settings ObjectsRecover from a Stolen Read-Only Domain ControllerTake a Practice Test
9. Integrating Domain Name System with AD DS
Before You BeginLesson 1: Understanding and Installing Domain Name SystemDNS and IPv6The Peer Name Resolution ProtocolDNS StructuresThe Split-Brain SyndromeUnderstanding DNSWindows Server 2008 R2 DNS FeaturesIntegration with AD DSNew DNS Features in Windows Server 2008 R2DNS Security ExtensionsDNS Cache LockingDNS Socket PoolDNS DevolutionPractice Installing the DNS ServiceLesson SummaryLesson ReviewLesson 2: Configuring and Using Domain Name SystemConfiguring DNSSecurity Considerations for the DNS Server RoleWorking with DNS Server SettingsConfiguring Scavenging for All ZonesConfiguring Scavenging for All ZonesFinalizing FLZ ConfigurationCreating a Responsible Person RecordCreating Reverse Lookup ZonesCreating Custom RecordsForwarders vs. Root HintsSingle-Label Name ManagementDNS and WINSDNS and DHCP ConsiderationsWorking with Application Directory PartitionsCreating and Assigning Custom Application Directory PartitionsAdministering DNS ServersPractice Finalizing a DNS Server Configuration in a ForestPractice Finalizing a DNS Server Configuration in a ForestLesson SummaryLesson ReviewChapter ReviewChapter SummaryKey TermsCase ScenarioCase Scenario: Blocking Specific DNS NamesSuggested PracticesWork with DNSTake a Practice Test
10. Administering Domain Controllers
Before You BeginLesson 1: Deploying Domain ControllersInstalling a Domain Controller with the Windows InterfaceUnattended Installation Options and Answer FilesInstalling a New Windows Server 2008 R2 ForestInstalling Additional Domain Controllers in a DomainInstalling the First Windows Server 2008 R2 Domain Controller in an Existing Forest or DomainInstalling an Additional Domain ControllerInstalling a New Windows Server 2008 Child DomainInstalling a New Domain TreeStaging the Installation of an RODCCreating the Prestaged Account for the RODCAttaching a Server to the RODC AccountInstalling AD DS from MediaRemoving a Domain ControllerPractice Deploying Domain ControllersPractice Deploying Domain ControllersLesson SummaryLesson ReviewLesson 2: Managing Operations MastersUnderstanding Single Master OperationsForest-Wide Operations Master RolesDomain Naming Master RoleSchema Master RoleDomain-Wide Operations Master RolesRID Master RoleInfrastructure Master RolePDC Emulator RoleOptimizing the Placement of Operations MastersIdentifying Operations MastersTransferring Operations Master RolesRecognizing Operations Master FailuresSeizing Operations Master RolesReturning a Role to Its Original HolderPractice Transferring Operations Master RolesPractice Transferring Operations Master RolesLesson SummaryLesson ReviewLesson 3: Configuring DFS Replication of SYSVOLRaising the Domain Functional LevelUnderstanding Migration StagesMigrating SYSVOL Replication to DFS-RPractice Configuring DFS Replication of SYSVOLPractice Configuring DFS Replication of SYSVOLLesson SummaryLesson ReviewChapter ReviewChapter SummaryKey TermCase ScenarioCase Scenario: Upgrading a DomainSuggested PracticesUpgrade a Windows Server 2003 DomainTake a Practice Test
11. Managing Sites and Active Directory Replication
Before You BeginLesson 1: Configuring Sites and SubnetsUnderstanding SitesReplication TrafficService LocalizationPlanning SitesConnection SpeedService PlacementUser PopulationSummarizing Site Planning CriteriaCreating SitesManaging Domain Controllers in SitesUnderstanding Domain Controller LocationService Locator RecordsDomain Controller LocationSite CoveragePractice Configuring Sites and SubnetsLesson SummaryLesson ReviewLesson 2: Configuring the Global Catalog and Application Directory PartitionsReviewing Active Directory PartitionsUnderstanding the Global CatalogPlacing Global Catalog ServersConfiguring a Global Catalog ServerUniversal Group Membership CachingUnderstanding Application Directory PartitionsPractice Replication and Directory PartitionsPractice Replication and Directory PartitionsLesson SummaryLesson ReviewLesson 3: Configuring ReplicationUnderstanding Active Directory ReplicationConnection ObjectsThe Knowledge Consistency CheckerIntrasite ReplicationNotificationPollingSite LinksReplication Transport ProtocolsBridgehead ServersPreferred Bridgehead ServersConfiguring Intersite ReplicationSite Link TransitivitySite Link BridgesSite Link CostsReplication FrequencyReplication SchedulesMonitoring ReplicationRepadmin.exeDcdiag.exePractice Configuring ReplicationLesson SummaryLesson ReviewChapter ReviewChapter SummaryKey TermsCase ScenarioCase Scenario: Configuring Sites and SubnetsSuggested PracticesMonitor and Manage ReplicationTake a Practice Test
12. Managing Multiple Domains and Forests
Before You BeginLesson 1: Configuring Domain and Forest Functional LevelsUnderstanding Functional LevelsDomain Functional LevelsWindows 2000 NativeWindows Server 2003Windows Server 2008Windows Server 2008 R2Raising the Domain Functional LevelForest Functional LevelsWindows 2000Windows Server 2003Windows Server 2008Windows Server 2008 R2Raising the Forest Functional LevelPractice Raising the Domain and Forest Functional LevelsLesson SummaryLesson ReviewLesson 2: Managing Multiple Domains and Trust RelationshipsDefining Your Forest and Domain StructureDedicated Forest Root DomainSingle-Domain ForestMultiple-Domain ForestsMultiple TreesMultiple ForestsMoving Objects Between Domains and ForestsUnderstanding the Active Directory Migration ToolSecurity Identifiers and MigrationGroup MembershipOther Migration ConcernsUnderstanding Trust RelationshipsTrust Relationships Within a DomainTrust Relationships Between DomainsCharacteristics of Trust RelationshipsHow Trusts WorkAuthentication Protocols and Trust RelationshipsKerberos Authentication Within a DomainKerberos Authentication Across Domains in a ForestManual TrustsCreating Manual Trust RelationshipsShortcut TrustsExternal TrustsRealm TrustsForest TrustsAdministering TrustsResource Access for Users from Trusted DomainsDomain QuarantineAuthenticated UsersMembership in Domain Local GroupsACLsTransitivitySelective AuthenticationPractice Administering a Trust RelationshipLesson SummaryLesson ReviewChapter ReviewChapter SummaryCase ScenarioCase Scenario: Managing Multiple Domains and ForestsSuggested PracticesConfigure a Forest or DomainTake a Practice Test
13. Directory Business Continuity
Before You BeginLesson 1: Proactive Directory Maintenance and Data Store ProtectionTwelve Categories of AD DS AdministrationUsing Specops GpupdateUsing AD DS Administration ToolsPerforming Online MaintenancePerforming Offline MaintenanceRelying on Built-in Directory Protection MeasuresProtecting AD DS ObjectsAuditing Directory ChangesUsing the AD Recycle BinRestoring Deleted Objects with LDP.exeUsing Quest Object Restore for Active DirectoryRelying on Windows Server Backup to Protect the DirectoryWorking with the System State OnlyCreating Installation From Media Data SetsPerforming a Full System BackupCreating an Interactive Full System Backup with Windows Server BackupCreating an Interactive Full System Backup with Windows Server BackupCreating an Interactive Full System Backup with Wbadmin.exeScheduling a Backup with Windows Server BackupScheduling a Backup with Wbadmin.exePerforming Proactive RestoresRestarting in DSRMIdentifying the Appropriate Backup Data SetPerforming Nonauthoritative or Authoritative RestoresRestoring from a Complete BackupPerforming a Graphical Full Server RecoveryPerforming a Graphical Full Server RecoveryPerforming a Command-Line Full Server RecoveryProtecting DCs as Virtual MachinesPractice Working with the AD DS DatabasePractice Working with the AD DS DatabaseLesson SummaryLesson ReviewLesson 2: Proactive Directory Performance ManagementManaging System ResourcesUsing Task ManagerWorking with Event ViewerWorking with Windows Reliability MonitorWorking with Windows Performance MonitorCreating Baselines for AD DS and DNSWorking with Windows System Resource ManagerPractice AD DS Performance AnalysisPractice AD DS Performance AnalysisLesson SummaryLesson ReviewChapter ReviewChapter SummaryKey TermsCase ScenarioCase Scenario: Working with Lost and Found DataSuggested PracticesPractice Proactive Directory MaintenanceTake a Practice Test
14. Active Directory Lightweight Directory Services
Before You BeginLesson 1: Understanding and Installing AD LDSUnderstanding AD LDSAD LDS ScenariosNew AD LDS Features in Windows Server 2008 R2Installing AD LDSIdentifying AD LDS RequirementsInstalling AD LDS on Server CorePractice Installing AD LDSLesson SummaryLesson ReviewLesson 2: Configuring and Using AD LDSWorking with AD LDS ToolsCreating AD LDS InstancesPreparing for AD LDS Instance CreationPerforming an Unattended AD LDS Instance CreationMigrating a Previous LDAP Instance to AD LDSEnabling the AD Recycle Bin in AD LDSWorking with AD LDS InstancesUsing ADSI Edit to Work with InstancesUsing LDP.exe to Work with InstancesUsing the Schema Snap-in to Work with InstancesUsing Active Directory Sites And Services to Work with InstancesUsing Active Directory Module for Windows PowerShell to Work with InstancesPractice Working with AD LDS InstancesLesson SummaryLesson ReviewChapter ReviewChapter SummaryKey TermsCase ScenarioCase Scenario: Determining AD LDS Instance PrerequisitesSuggested PracticesWork with AD LDS InstancesTake a Practice Test
15. Active Directory Certificate Services and Public Key Infrastructures
Before You BeginLesson 1: Understanding and Installing Active Directory Certificate ServicesUnderstanding AD CSStand-alone vs. Enterprise CAsCreating the CA HierarchyBest Practices for AD CS DeploymentsAdditional Planning RequirementsNew AD CS Features in Windows Server 2008 R2New AD CS Web ServicesEnrollment across ForestsHigh-Volume CAsInstalling AD CSPreparing for AD CS InstallationPractice Installing a CA HierarchyLesson SummaryLesson ReviewLesson 2: Configuring and Using Active Directory Certificate ServicesFinalizing the Configuration of an Issuing CACreating a Revocation Configuration for a CAConfiguring and Personalizing Certificate TemplatesFinalizing the Configuration of an Online ResponderAdding a Revocation Configuration for an Online ResponderConsiderations for the Use and Management of AD CSWorking with Enterprise PKIProtecting Your AD CS ConfigurationPractice Configuring and Using AD CSPractice Configuring and Using AD CSLesson SummaryLesson ReviewChapter ReviewChapter SummaryKey TermsCase ScenarioCase Scenario: Managing Certificate RevocationSuggested PracticesWork with AD CSTake a Practice Test
16. Active Directory Rights Management Services
Before You BeginLesson 1: Understanding and Installing Active Directory Rights Management ServicesUnderstanding AD RMSAD RMS FeaturesAD RMS Installation ScenariosInstalling Active Directory Rights Management ServicesPreparing AD RMS Installation PrerequisitesUnderstanding AD RMS CertificatesInstallation ProcedureMoving AD RMS to Windows Server 2008 R2Working with Windows PowerShellPractice Installing AD RMSLesson SummaryLesson ReviewLesson 2: Configuring and Using Active Directory Rights Management ServicesConfiguring AD RMSCreating an Extranet URLConfiguring Trust PoliciesExporting the Server Licensor CertificatePreparing AD RMS CertificatesPreparing Exclusion PoliciesPreparing Accounts and Access RightsPreparing Policy TemplatesWorking with AD RMS ClientsManaging DatabasesPractice Creating a Rights Policy TemplateLesson SummaryLesson ReviewChapter ReviewChapter SummaryKey TermsCase ScenarioCase Scenario: Preparing to Work with an External AD RMS ClusterSuggested PracticesWork with AD RMSTake a Practice Test
17. Active Directory Federation Services
The Purpose of a FirewallActive Directory Federation ServicesBefore You BeginLesson 1: Understanding Active Directory Federation ServicesWorking with AD FS DesignsUnderstanding AD FS ComponentsUnderstanding AD FS TerminologyCore AD FS ComponentsThe AD FS Attribute StoreThe AD FS Configuration DatabaseClaimsClaim RulesUnderstanding AD FS CertificatesAD FS 2.0 vs. AD FS 1.1Installing Active Directory Federation Services 2.0AD FS Installation RequirementsPractice Prepare an AD FS DeploymentLesson SummaryLesson ReviewLesson 2: Configuring and Using Active Directory Federation ServicesFinalizing the Configuration of AD FSUsing and Managing AD FSWorking with Windows PowerShellOngoing AD FS 2.0 AdministrationPractice Finalizing the AD FS 2.0 ConfigurationLesson SummaryLesson ReviewChapter ReviewChapter SummaryKey TermsCase ScenarioCase Scenario: Choosing the Right AD TechnologySuggested PracticesPrepare for AD FSTake a Practice Test
A. Answers
Chapter 1Lesson 1Lesson 2Case Scenario: Creating an Active Directory ForestChapter 2Lesson 1Lesson 2Lesson 3Case Scenario: Managing Organizational Units and DelegationChapter 3Lesson 1Lesson 2Lesson 3Case Scenario: Import User AccountsChapter 4Lesson 1Lesson 2Lesson 3Case Scenario: Implementing a Group StrategyChapter 5Lesson 1Lesson 2Lesson 3Case Scenario 1: Creating Computer Objects and Joining the DomainCase Scenario 2: Automating the Creation of Computer ObjectsChapter 6Lesson 1Lesson 2Lesson 3Case Scenario: Implementing Group PolicyChapter 7Lesson 1Lesson 2Lesson 3Lesson 4Case Scenario 1: Installing Software with Group Policy Software InstallationCase Scenario 2: Configuring SecurityChapter 8Lesson 1Lesson 2Lesson 3Lesson 4Case Scenario 1: Increasing the Security of Administrative AccountsCase Scenario 2: Increasing the Security and Reliability of Branch Office AuthenticationChapter 9Lesson 1Lesson 2Case Scenario: Blocking Specific DNS NamesChapter 10Lesson 1Lesson 2Lesson 3Case Scenario: Upgrading a DomainChapter 11Lesson 1Lesson 2Lesson 3Case Scenario: Configuring Sites and SubnetsChapter 12Lesson 1Lesson 2Case Scenario: Managing Multiple Domains and ForestsChapter 13Lesson 1Lesson 2Case Scenario: Working with Lost and Found DataChapter 14Lesson 1Lesson 2Case Scenario: Determining AD LDS Instance PrerequisitesChapter 15Lesson 1Lesson 2Case Scenario: Managing Certificate RevocationChapter 16Lesson 1Lesson 2Case Scenario: Preparing to Work with an External AD RMS ClusterChapter 17Lesson 1Lesson 2Case Scenario: Choosing the Right AD Technology
Index
About the Authors
Copyright

Content preview from Self-Paced Training Kit (Exam 70-640): Configuring Windows Server® 2008 Active Directory® (2nd Edition)

Chapter 8. Improving the Security of Authentication in an AD DS Domain

When a user logs on to an Active Directory Domain Services (AD DS) domain, she enters her user name and password, and the client uses those credentials to authenticate the user—to validate the user’s identity against her Active Directory account. In Chapter 3, you learned how to create and manage user accounts and their properties, including their passwords. In this chapter, you will explore the domain-side components of authentication, including the policies that specify password requirements and the auditing of authentication-related activities. You will also discover three new options to improve the security of accounts and authentication: managed service accounts’ password ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

MCTS Self-Paced Training Kit (Exam 70-643): Configuring Windows Server® 2008 Applications Infrastructure

Publisher Resources

ISBN: 9780735663046Purchase book

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Self-Paced Training Kit (Exam 70-640): Configuring Windows Server® 2008 Active Directory® (2nd Edition)

by Nelson Ruest Dan Holme Danielle Ruest, and Jason Kellington

Chapter 8. Improving the Security of Authentication in an AD DS Domain

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.