Windows server 2008 操作指南

【实例截图】Configuring Windows Server 2008 Active Directory

【核心代码】

Contents
Introduction xxvii
System Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxvii
Hardware Requirements xxviii
Software Requirements xxix
Using the Companion CD. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxx
How to Install the Practice Tests xxx
How to Use the Practice Tests xxxi
How to Uninstall the Practice Tests xxxii
Acknowledgments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxxii
Support & Feedback. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxxii
Errata xxxiii
We Want to Hear from You xxxiii
Stay in Touch xxxiii
Chapter 1 Creating an Active Directory Domain 1
Before You Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
Lesson 1: Installing Active Directory Domain Services. . . . . . . . . . . . . . . . . . 3
Active Directory, Identity and Access 3
Beyond Identity and Access 8
Components of an Active Directory Infrastructure 9
Preparing to Create a New Windows Server 2008 Forest 12
Adding the AD DS Role Using the Windows Interface 12
Creating a Domain Controller 13
Lesson Summary 21
Lesson Review 22
What do you think of this book? We want to hear from you!
Microsoft is interested in hearing your feedback so we can continually improve our
books and learning resources for you. To participate in a brief online survey, please visit:
www.microsoft.com/learning/booksurvey/
viii Contents
Lesson 2: Active Directory Domain Services on Server Core. . . . . . . . . . . 23
Understanding Server Core 23
Installing Server Core 24
Performing Initial Configuration Tasks 25
Server Configuration 26
Adding AD DS to a Server Core Installation 27
Removing Domain Controllers 27
Lesson Summary 30
Lesson Review 30
Chapter Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Chapter Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Case Scenario. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Case Scenario: Creating an Active Directory Forest 33
Take a Practice Test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Chapter 2 Administering Active Directory Domain Services 35
Before You Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Lesson 1: Working with Active Directory Snap-ins. . . . . . . . . . . . . . . . . . . . 37
Understanding the Microsoft Management Console 37
Active Directory Administration Tools 39
Finding the Active Directory Administrative Tools 39
Adding the Administrative Tools to Your Start Menu 40
Creating a Custom Console with Active Directory Snap-ins 40
Running Administrative Tools with Alternate Credentials 41
Saving and Distributing a Custom Console 42
Lesson Summary 47
Lesson Review 48
Lesson 2: Creating Objects in Active Directory. . . . . . . . . . . . . . . . . . . . . . . 49
Creating an Organizational Unit 49
Creating a User Object 51
Creating a Group Object 53
Creating a Computer Object 55
Finding Objects in Active Directory 57
Contents ix
Understanding DNs, RDNs, and CNs 63
Finding Objects by Using Dsquery 63
Lesson Summary 70
Lesson Review 71
Lesson 3: Delegation and Security of Active Directory Objects. . . . . . . . . 72
Understanding Delegation 72
Viewing the ACL of an Active Directory Object 73
Property Permissions, Control Access Rights,
and Object Permissions 75
Assigning a Permission Using the Advanced Security
Settings Dialog Box 76
Understanding and Managing Permissions with Inheritance 76
Delegating Administrative Tasks with the Delegation
Of Control Wizard 77
Reporting and Viewing Permissions 78
Removing or Resetting Permissions on an Object 78
Understanding Effective Permissions 79
Designing an OU Structure to Support Delegation 80
Lesson Summary 82
Lesson Review 83
Chapter Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Chapter Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Case Scenario. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Case Scenario: Managing Organizational Units and Delegation 84
Suggested Practices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Maintain Active Directory Accounts 85
Take a Practice Test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86
Chapter 3 Administering User Accounts 87
Before You Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Lesson 1: Automating the Creation of User Accounts. . . . . . . . . . . . . . . . . 89
Creating Users with Templates 89
Using Active Directory Command-Line Tools 91
x Contents
Creating Users with DSAdd 92
Exporting Users with CSVDE 92
Importing Users with CSVDE 93
Importing Users with LDIFDE 94
Lesson Summary 100
Lesson Review 100
Lesson 2: Administering with Windows PowerShell and Active
Directory Administrative Center. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Introducing Windows PowerShell 102
Preparing to Administer Active Directory Using
Windows PowerShell 103
cmdlets 105
Parameters 107
Get-Help 107
Objects 108
Variables 108
Pipeline 109
Aliases 111
Namespaces, Providers, and PSDrives 112
The Active Directory PowerShell Provider 113
Creating a User with Windows PowerShell 113
Populating User Attributes 115
Importing Users from a Database with
Windows PowerShell 116
The Active Directory Administrative Center 117
Lesson Summary 123
Lesson Review 124
Lesson 3: Supporting User Objects and Accounts. . . . . . . . . . . . . . . . . . . . 125
Managing User Attributes with Active Directory
Users And Computers 125
Managing User Attributes with DSMod and DSGet 129
Managing User Attributes with Windows PowerShell 131
Understanding Name and Account Attributes 131
Administering User Accounts 135
Lesson Summary 143
Lesson Review 143
Contents xi
Chapter Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Chapter Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Case Scenario. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 145
Case Scenario: Import User Accounts 146
Suggested Practices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146
Automate the Creation of User Accounts 146
Maintain Active Directory Accounts 146
Use the Active Directory Administrative Console 147
Take a Practice Test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
Chapter 4 Managing Groups 149
Before You Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149
Lesson 1: Managing an Enterprise with Groups. . . . . . . . . . . . . . . . . . . . . 151
Understanding the Importance of Groups 151
Defining Group Naming Conventions 157
Understanding Group Types 159
Understanding Group Scope 160
Converting Group Scope and Type 165
Managing Group Membership 166
Developing a Group Management Strategy 169
Lesson Summary 173
Lesson Review 173
Lesson 2: Automating the Creation
and Management of Groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
Creating Groups with DSAdd 175
Importing Groups with CSVDE 176
Importing Groups with LDIFDE 177
Retrieving Group Membership with DSGet 178
Changing Group Membership with DSMod 179
Copying Group Membership 179
Moving and Renaming Groups with DSMove 179
Deleting Groups with DSRm 180
Managing Groups with Windows PowerShell 181
xii Contents
Lesson Summary 184
Lesson Review 185
Lesson 3: Administering Groups in an Enterprise. . . . . . . . . . . . . . . . . . . . 186
Best Practices for Group Attributes 186
Protecting Groups from Accidental Deletion 188
Delegating the Management of Group Membership 189
Understanding Shadow Groups 193
Default Groups 194
Special Identities 196
Lesson Summary 199
Lesson Review 199
Chapter Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
Chapter Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201
Case Scenario. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
Case Scenario: Implementing a Group Strategy 202
Suggested Practices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
Automate Group Membership and Shadow Groups 202
Take a Practice Test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203
Chapter 5 Configuring Computer Accounts 205
Before You Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206
Lesson 1: Creating Computers and Joining the Domain. . . . . . . . . . . . . . 207
Understanding Workgroups, Domains, and Trusts 207
Identifying Requirements for Joining a Computer
to the Domain 208
The Computers Container and OUs 208
Delegating Permission to Create Computers 210
Prestaging a Computer Account 210
Joining a Computer to the Domain 211
Secure Computer Creation and Joins 214
Offline Domain Join 217
Lesson Summary 223
Lesson Review 224
Contents xiii
Lesson 2: Automating the Creation of Computer
Objects. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225
Importing Computers with CSVDE 225
Importing Computers with LDIFDE 226
Creating Computers with DSAdd 227
Creating Computers with NetDom 227
Creating Computers with Windows PowerShell 228
Lesson Summary 230
Lesson Review 230
Lesson 3: Supporting Computer Objects and Accounts. . . . . . . . . . . . . . 232
Configuring Computer Properties 232
Moving a Computer 233
Managing a Computer from the Active Directory Users
And Computers Snap-In 234
Understanding the Computer’s Logon and Secure
Channel 234
Recognizing Computer Account Problems 234
Resetting a Computer Account 235
Renaming a Computer 236
Disabling and Enabling Computer Accounts 238
Deleting Computer Accounts 238
Recycling Computer Accounts 239
Lesson Summary 241
Lesson Review 241
Chapter Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243
Chapter Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243
Key Term. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243
Case Scenarios. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243
Case Scenario 1: Creating Computer Objects and Joining
the Domain 244
Case Scenario 2: Automating the Creation of Computer
Objects 244
Suggested Practices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
Create and Maintain Computer Accounts 244
Take a Practice Test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 245
xiv Contents
Chapter 6 Implementing a Group Policy Infrastructure 247
Before You Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
Lesson 1: Implementing Group Policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249
What Is Configuration Management? 249
An Overview and Review of Group Policy 250
Group Policy Objects 256
Policy Settings 262
Registry Policies in the Administrative Templates Node 265
Lesson Summary 275
Lesson Review 276
Lesson 2: Managing Group Policy Scope. . . . . . . . . . . . . . . . . . . . . . . . . . . 278
GPO Links 278
GPO Inheritance and Precedence 280
Using Security Filtering to Modify GPO Scope 285
WMI Filters 288
Enabling or Disabling GPOs and GPO Nodes 290
Targeting Preferences 291
Group Policy Processing 292
Loopback Policy Processing 294
Lesson Summary 299
Lesson Review 300
Lesson 3: Supporting Group Policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301
Understanding When Settings Take Effect 301
Resultant Set Of Policy 303
Troubleshooting Group Policy with the Group Policy
Results Wizard and Gpresult.exe 306
Performing What-If Analyses with the Group Policy
Modeling Wizard 306
Examining Policy Event Logs 307
Lesson Summary 311
Lesson Review 311
Chapter Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313
Chapter Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313
Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313
Contents xv
Case Scenario. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313
Case Scenario: Implementing Group Policy 314
Suggested Practices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314
Create and Apply GPOs 314
Take a Practice Test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315
Chapter 7 Managing Enterprise Security and Configuration
with Group Policy Settings 317
Before You Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317
Lesson 1: Delegating the Support of Computers. . . . . . . . . . . . . . . . . . . . 319
Understanding Restricted Groups Policies 319
Delegating Administration Using Restricted Groups
Policies with the Member Of Setting 322
Delegating Administration Using Restricted Groups
Policies with the Members Of This Group Setting 322
Lesson Summary 327
Lesson Review 327
Lesson 2: Managing Security Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 330
What Is Security Policy Management? 330
Configuring the Local Security Policy 331
Managing Security Configuration with Security Templates 333
The Security Configuration Wizard 339
Settings, Templates, Policies, and GPOs 345
Lesson Summary 351
Lesson Review 352
Lesson 3: Managing Software with Group Policy. . . . . . . . . . . . . . . . . . . . 353
Understanding Group Policy Software Installation 353
Preparing an SDP 356
Creating a Software Deployment GPO 356
Managing the Scope of a Software Deployment GPO 358
Maintaining Applications Deployed with Group Policy 359
GPSI and Slow Links 360
Understanding AppLocker 361
Lesson Summary 364
Lesson Review 365
xvi Contents
Lesson 4: Implementing an Audit Policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . 367
Audit Policy 367
Auditing Access to Files and Folders 370
Auditing Directory Service Changes 374
Lesson Summary 379
Lesson Review 380
Chapter Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 382
Chapter Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 382
Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 382
Case Scenarios. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 383
Case Scenario 1: Installing Software with Group
Policy Software Installation 383
Case Scenario 2: Configuring Security 383
Suggested Practices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 384
Configure Restricted Groups 384
Manage Security Configuration 386
Take a Practice Test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 387
Chapter 8 Improving the Security of Authentication in
an AD DS Domain 389
Before You Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 390
Lesson 1: Configuring Password and Lockout Policies. . . . . . . . . . . . . . . . 392
Understanding Password Policies 392
Understanding Account Lockout Policies 394
Configuring the Domain Password and Lockout Policy 395
Fine-Grained Password and Lockout Policy 395
Understanding Password Settings Objects 397
PSO Precedence and Resultant PSO 398
PSOs and OUs 398
Lesson Summary 402
Lesson Review 403
Lesson 2: Auditing Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404
Account Logon and Logon Events 404
Configuring Authentication-Related Audit Policies 405
Contents xvii
Scoping Audit Policies 406
Viewing Logon Events 407
Lesson Summary 408
Lesson Review 408
Lesson 3: Configuring Read-Only Domain Controllers. . . . . . . . . . . . . . . 410
Authentication and Domain Controller Placement
in a Branch Office 410
Read-Only Domain Controllers 411
Deploying an RODC 412
Password Replication Policy 416
Administering RODC Credentials Caching 418
Administrative Role Separation 419
Lesson Summary 422
Lesson Review 423
Lesson 4: Managing Service Accounts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 425
Understanding Managed Accounts 425
Requirements for Managed Service Accounts 426
Creating and Configuring a Managed Service
Account 427
Installing and Using a Managed Service Account 427
Managing Delegation and Passwords 428
Lesson Summary 432
Lesson Review 432
Chapter Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 434
Chapter Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 434
Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 434
Case Scenarios. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 435
Case Scenario 1: Increasing the Security of Administrative
Accounts 435
Case Scenario 2: Increasing the Security and Reliability
of Branch Office Authentication 435
Suggested Practices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 436
Configure Multiple Password Settings Objects 436
Recover from a Stolen Read-Only Domain Controller 436
Take a Practice Test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 437
xviii Contents
Chapter 9 Integrating Domain Name System
with AD DS 439
Before You Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 441
Lesson 1: Understanding and Installing
Domain Name System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 444
DNS and IPv6 445
The Peer Name Resolution Protocol 446
DNS Structures 448
The Split-Brain Syndrome 449
Understanding DNS 452
Windows Server 2008 R2 DNS Features 459
Integration with AD DS 461
New DNS Features in Windows
Server 2008 R2 463
Lesson Summary 478
Lesson Review 478
Lesson 2: Configuring and Using
Domain Name System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 480
Configuring DNS 480
Forwarders vs. Root Hints 488
Single-Label Name Management 490
DNS and DHCP Considerations 492
Working with Application Directory Partitions 494
Administering DNS Servers 497
Lesson Summary 501
Lesson Review 502
Chapter Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504
Chapter Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504
Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505
Case Scenario. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505
Case Scenario: Blocking Specific DNS Names 505
Suggested Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505
Work with DNS 505
Take a Practice Test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506
Contents xix
Chapter 10 Administering Domain Controllers 507
Before You Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 508
Lesson 1: Deploying Domain Controllers. . . . . . . . . . . . . . . . . . . . . . . . . . . 509
Installing a Domain Controller with the Windows Interface 509
Unattended Installation Options and Answer Files 510
Installing a New Windows Server 2008 R2 Forest 512
Installing Additional Domain Controllers in a Domain 513
Installing a New Windows Server 2008 Child Domain 516
Installing a New Domain Tree 517
Staging the Installation of an RODC 518
Installing AD DS from Media 520
Removing a Domain Controller 521
Lesson Summary 525
Lesson Review 526
Lesson 2: Managing Operations Masters. . . . . . . . . . . . . . . . . . . . . . . . . . . 527
Understanding Single Master Operations 527
Forest-Wide Operations Master Roles 529
Domain-Wide Operations Master Roles 529
Optimizing the Placement of Operations Masters 532
Identifying Operations Masters 533
Transferring Operations Master Roles 535
Recognizing Operations Master Failures 536
Seizing Operations Master Roles 536
Returning a Role to Its Original Holder 538
Lesson Summary 541
Lesson Review 541
Lesson 3: Configuring DFS Replication of SYSVOL. . . . . . . . . . . . . . . . . . . 543
Raising the Domain Functional Level 543
Understanding Migration Stages 544
Migrating SYSVOL Replication to DFS-R 545
Lesson Summary 551
Lesson Review 551
Chapter Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 553
Chapter Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 553
xx Contents
Key Term. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 553
Case Scenario. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 553
Case Scenario: Upgrading a Domain 554
Suggested Practices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 554
Upgrade a Windows Server 2003 Domain 554
Take a Practice Test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 555
Chapter 11 Managing Sites and Active Directory Replication 557
Before You Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 558
Lesson 1: Configuring Sites and Subnets. . . . . . . . . . . . . . . . . . . . . . . . . . . 559
Understanding Sites 559
Planning Sites 560
Creating Sites 562
Managing Domain Controllers in Sites 565
Understanding Domain Controller Location 566
Lesson Summary 570
Lesson Review 570
Lesson 2: Configuring the Global
Catalog and Application Directory Partitions. . . . . . . . . . . . . . . . . . . . 572
Reviewing Active Directory Partitions 572
Understanding the Global Catalog 573
Placing Global Catalog Servers 573
Configuring a Global Catalog Server 574
Universal Group Membership Caching 574
Understanding Application Directory Partitions 576
Lesson Summary 579
Lesson Review 579
Lesson 3: Configuring Replication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 581
Understanding Active Directory Replication 581
Connection Objects 582
The Knowledge Consistency Checker 583
Intrasite Replication 584
Site Links 586
Bridgehead Servers 588
Contents xxi
Configuring Intersite Replication 590
Monitoring Replication 594
Lesson Summary 598
Lesson Review 598
Chapter Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 601
Chapter Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 601
Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 601
Case Scenario. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 602
Case Scenario: Configuring Sites and Subnets 602
Suggested Practices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 603
Monitor and Manage Replication 603
Take a Practice Test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 604
Chapter 12 Managing Multiple Domains and Forests 605
Before You Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605
Lesson 1: Configuring Domain and Forest
Functional Levels. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 607
Understanding Functional Levels 607
Domain Functional Levels 608
Forest Functional Levels 611
Lesson Summary 616
Lesson Review 616
Lesson 2: Managing Multiple Domains
and Trust Relationships. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 618
Defining Your Forest and Domain Structure 618
Moving Objects Between Domains and Forests 623
Understanding Trust Relationships 627
How Trusts Work 629
Manual Trusts 632
Shortcut Trusts 636
Administering Trusts 639
Resource Access for Users from Trusted Domains 640
Lesson Summary 649
Lesson Review 650
xxii Contents
Chapter Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 652
Chapter Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 652
Case Scenario. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 653
Case Scenario: Managing Multiple Domains and Forests 653
Suggested Practices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 653
Configure a Forest or Domain 653
Take a Practice Test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 654
Chapter 13 Directory Business Continuity 655
Before You Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 656
Lesson 1: Proactive Directory Maintenance and
Data Store Protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 658
Twelve Categories of AD DS Administration 660
Performing Online Maintenance 667
Performing Offline Maintenance 669
Relying on Built-in Directory Protection Measures 669
Relying on Windows Server Backup to Protect the Directory 678
Performing Proactive Restores 687
Protecting DCs as Virtual Machines 697
Lesson Summary 705
Lesson Review 706
Lesson 2: Proactive Directory Performance Management. . . . . . . . . . . . 707
Managing System Resources 707
Working with Windows System Resource Manager 718
Lesson Summary 727
Lesson Review 727
Chapter Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 728
Chapter Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 728
Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 729
Case Scenario. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 729
Case Scenario: Working with Lost and Found Data 729
Suggested Practices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 729
Practice Proactive Directory Maintenance 729
Take a Practice Test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 730
Contents xxiii
Chapter 14 Active Directory Lightweight Directory Services 731
Before You Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 733
Lesson 1: Understanding and Installing AD LDS. . . . . . . . . . . . . . . . . . . . . 736
Understanding AD LDS 736
AD LDS Scenarios 738
New AD LDS Features in Windows Server 2008 R2 740
Installing AD LDS 741
Lesson Summary 745
Lesson Review 746
Lesson 2: Configuring and Using AD LDS. . . . . . . . . . . . . . . . . . . . . . . . . . . 747
Working with AD LDS Tools 747
Creating AD LDS Instances 749
Working with AD LDS Instances 755
Lesson Summary 766
Lesson Review 766
Chapter Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 767
Chapter Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 767
Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 767
Case Scenario. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 768
Case Scenario: Determining AD LDS Instance Prerequisites 768
Suggested Practices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 768
Work with AD LDS Instances 768
Take a Practice Test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 769
Chapter 15 Active Directory Certificate Services and Public
Key Infrastructures 771
Before You Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 775
Lesson 1: Understanding and Installing Active Directory
Certificate Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 778
Understanding AD CS 779
New AD CS Features in Windows Server 2008 R2 788
Installing AD CS 791
Lesson Summary 801
Lesson Review 802
xxiv Contents
Lesson 2: Configuring and Using Active Directory
Certificate Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 804
Finalizing the Configuration of an Issuing CA 804
Finalizing the Configuration of an Online Responder 810
Considerations for the Use and Management of AD CS 814
Working with Enterprise PKI 816
Protecting Your AD CS Configuration 818
Lesson Summary 826
Lesson Review 827
Chapter Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 828
Chapter Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 828
Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 829
Case Scenario. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 829
Case Scenario: Managing Certificate Revocation 829
Suggested Practices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 830
Work with AD CS 830
Take a Practice Test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 831
Chapter 16 Active Directory Rights Management Services 833
Before You Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 835
Lesson 1: Understanding and Installing Active Directory
Rights Management Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 837
Understanding AD RMS 837
Installing Active Directory Rights Management Services 844
Lesson Summary 860
Lesson Review 860
Lesson 2: Configuring and Using Active Directory Rights
Management Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 862
Configuring AD RMS 863
Lesson Summary 873
Lesson Review 873
Chapter Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 875
Chapter Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 875
Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 876
Contents xxv
Case Scenario. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 876
Case Scenario: Preparing to Work with an External AD RMS
Cluster 876
Suggested Practices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 876
Work with AD RMS 876
Take a Practice Test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 877
Chapter 17 Active Directory Federation Services 879
The Purpose of a Firewall. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 880
Active Directory Federation Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 881
Before You Begin. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 883
Lesson 1: Understanding Active Directory
Federation Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 885
Working with AD FS Designs 886
Understanding AD FS Components 888
Installing Active Directory Federation Services 2.0 897
Lesson Summary 902
Lesson Review 903
Lesson 2: Configuring and Using Active Directory
Federation Services. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 904
Finalizing the Configuration of AD FS 904
Using and Managing AD FS 905
Lesson Summary 915
Lesson Review 915
Chapter Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 917
Chapter Summary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 917
Key Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 917
Case Scenario. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 918
Case Scenario: Choosing the Right AD Technology 918
Suggested Practices. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 918
Prepare for AD FS 918
Take a Practice Test. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 919
Answers 921
Index 963