Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comMicrosoft Windows 2000 Active Directory®What is LDAP?LDAP is the directory service protocol that is used to query and update AD. LDAP namingpaths are used to access AD objects and include the following: • Distinguished names • Relative Distinguished namesDistinguished name gives the complete path of the objectE.g. CN=Sanjo Thomas,OU=India,DC=Microsoft,DC=comRelative Distinguished name is the portion of the distinguished name that uniquely identifiesthe object.E.g. CN=Sanjo Thomas OR OU= IndiaWhat is Active Directory?AD is the directory service in Windows2000 network. AD is a hierarchical database. Adirectory service stores information about network resources and make the resourcesaccessible to users and computers. It helps to centrally manage, organize and control accessto resources. AD objects include users, groups, computers, printers, etc. Servers, domainsand sites are also considered as AD objects.Minimum Requirement for Installing AD 1. Windows Server, Advanced Server, Datacenter Server 2. Minimum Disk space of 200MB for AD and 50MB for log files 3. NTFS partition 4. TCP/IP Installed and Configured to use DNS 5. Administrative privilege for creating a domain in existing networkHow will you verify whether the AD installation is proper? 1. Verify SRV Resource Records After AD is installed, the DC will register SRV records in DNS when it restarts. We can check this using DNS MMC or nslookup command. Using MMC If the SRV records are registered, the following folders will be there in the domain folder in Forward Lookup Zone.
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.com • msdes • sites • tcp • adp Using nslookup >nslookup >ls –t SRV Domain If the SRV records are properly created, they will be listed. 2. Verifying SYSVOL If SYSVOL folder is not properly created data stores in SYSVOL such are scripts, GPO, etc will not be replicated between DCs. First verify the following folder structure is created in SYSVOL Domain Staging Staging areas Sysvol Then verify necessary shares are created. >net share It should show two shares, NETLOGON and SYSVOL 3. Verifying Database and Log files Make sure that the following files are there at %systemroot%ntds Ntds.dit, Edb.*, Res*.logExplain about ADS DatabaseActive Directory includes 4 files.1. NTDS.DITThis is the AD database and stores all AD objects. Default location isSystemRoot%ntdsNTDS.DIT.Active Directorys database engine is the Extensible Storage Engine which is based on the Jetdatabase and can grow up to 16 TB.NTDS.DIT, consists of the following tables • Schema Table The types of objects that can be created in the Active Directory, relationships between
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.com them, and the attributes on each type of object. This table is fairly static and much smaller than the data table. • Link Table contains linked attributes, which contain values referring to other objects in the Active Directory. Take the MemberOf attribute on a user object. That attribute contains values that reference groups to which the user belongs. This is also far smaller than the data table. • Data Table users, groups, application-specific data, and any other data stored in the Active Directory.From a different perspective, Active Directory has three types of data • Schema information Definitional details about objects and attributes that one CAN store in the AD. Replicates to all DCs. Static in nature • Configuration information Configuration data about forest and trees. Replicates to all DCs. Static as your forest is. • Domain information Object information for a domain. Replicates to all DCs within a domain. The object portion becomes part of GC. The attribute values only replicates within the domain.2. EDB.LOGThis is the transaction log file (10 MB). When EDB.LOG is full, it is renamed to EDBnnnn.log.Where nnnn is the increasing number starting from 13. EDB.CHKThis is the checkpoint file used to track the data not yet written to database file. Thisindicates the starting point from which data is to be recovered from the logfile, in case offailure.4. Res1.log and Res2.logThis is reserved transaction log files of 20 MB (10 MB each) which provides the transaction logfiles enough room to shutdown if the other spaces are being used.Explain ADS Database Garbage Collection Process?Garbage Collection is a process that is designed to free space within the Active Directorydatabase. This process runs independently on every DC with a default lifetime interval of 12hours.The Garbage Collection process has 3 main steps1. Removing "tombstones" from the database. Tombstones are remains of objects that havebeen previously deleted.
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.com(**When an object is deleted, it is not actually removed from the Active Directory database. It ismarked for deletion at a later date. This then gets replicated to other DCs. When thetombstoneLifetime is over, the object is deleted.)2. Deletion of any unnecessary log files.3. The process launches a defragmentation thread to claim additional free space.There are two ways to defragment the Active Directory database in Windows 2000.Online Defragmentation method that runs as part of the garbage collection process. The onlyadvantage to this method is that the server does not need to be taken offline for it to run.However, this method does not shrink the Active Directory database file (Ntds.dit).Offline Defragmentation: This is done by taking the server offline and use Ntdsutil.exe todefragment the database. This approach requires that the ADS database be started in repairmode. The advantage to this method is that the database is resized, unused space isremoved, and the size is reflected by the Ntds.dit file.How will you do an Offline Defragmentation of Active Directory?Active Directory routinely performs online database defragmentation, but this is limited to thedisposal of tombstoned objects. The database file cannot be compacted while Active Directoryis mounted. To defrag ntds.dit offline: • Back up System State in the backup wizard. • Reboot and select Directory Services Restore Mode • At the command prompt: Ntdsutil Files InfoThis will display current information about the path and size of the Active Directory databaseand its log files. Compact to D:DbBackupYou must specify a directory path and if the path name has spaces, the command will notwork unless you use quotation marks Quit (till you reach the command prompt)A new compacted database named Ntds.dit can be found in D:DbBackupCopy the new ntds.dit file over the old ntds.dit file. You have successfully compacted theActive Directory database.Introducing domain trees and forestsTREESTree is a hierarchical arrangement of W2K domains that share a contiguous name space. Thefirst domain in a domain tree is called the root domain. Additional domains in the samedomain tree are child domains. A domain immediately above another domain in the samedomain tree is referred to as the parent of the child domain.
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comThe name of the chills domain is combined with its parent domain to form its DNS name.Every child domain has a two two-way, transitive trust relationship with its parent domainBecause these trust relationships are two-way and transitive, a Windows 2000 domain newlycreated in a domain tree or forest immediately has trust relationships established with everyother Windows 2000 domain in the domain tree or forest.These trust relationships allow a single logon process to authenticate a user on all domains inthe domain tree or forest. This does not necessarily mean that the authenticated user hasrights and permissions in all domains in the domain tree. Because a domain is a securityboundary, rights and permissions must be assigned on a per-domain basis.FORESTSA forest consists of multiple domain trees. The domain trees in a forest do not form acontiguous namespace but share a common schema and GC.The forest root domain is the first domain created in the forest. The root domains of alldomain trees in the forest establish transitive trust relationships with the forest root domain.This is necessary for the purposes of establishing trust across all the domain trees in theforest.All of the Windows 2000 domains in all of the domain trees in a forest share the followingtraits: • Transitive trust relationships between the domains • Transitive trust relationships between the domain trees • A common schema • Common configuration information • A common global catalogUsing both domain trees and forests provides you with the flexibility of both contiguous andnoncontiguous naming conventions. This can be useful in, for example, companies withindependent divisions that must each maintain their own DNS names.Explain Active Directory schema?The Active Directory schema is the set of definitions that defines the kinds of objects, and thetypes of information about those objects, that can be stored in Active Directory. Thedefinitions are themselves stored as objects so that Active Directory can manage the schemaobjects with the same object management operations used for managing the rest of theobjects in the directory.There are two types of definitions in the schema: attributes and classes. Attributes andclasses are also referred to as schema objects or metadata.Attributes are defined separately from classes. Each attribute is defined only once and can beused in multiple classes. For example, the Description attribute is used in many classes, but isdefined once in the schema, assuring consistency.
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comClasses, also referred to as object classes; describe the possible directory objects that can becreated. Each class is a collection of attributes. When you create an object, the attributesstore the information that describes the object. The User class, for example, is composed ofmany attributes, including Network Address, Home Directory, and so on. Every object inActive Directory is an instance of an object class.Active Directory does not support deletion of schema objects; however, objects can bemarked as deactivated, providing many of the benefits of deletion.The structure and content of the schema is controlled by the domain controller that holds theschema operations master role. A copy of the schema is replicated to all domain controllers inthe forest. The use of this common schema ensures data integrity and consistency throughoutthe forest.Explain Sites. What are the advantages of Sites?Site consists of one or more IP subnets connected by a high speed link. Wide area networksshould employ multiple sites for efficiently handling servicing requests and reducingreplication traffic. Sites map the physical structure of your network whereas domainsgenerally map the logical structure of your organization.Active Directory Sites and Services allow you to specify site information. Active Directory usesthis information to determine how best to use available network resources.This makes the following types of operations more efficient: • Service requests When a client requests a service from a domain controller, it directs the request to a domain controller in the same site. Selecting a domain controller that is well-connected to the client makes handling the request more efficient. • Replication Site streamlines replication of directory information and reduces replication trafficSite membership is determined differently for domain controllers and clients. A clientdetermines it is in when it is turned on, so its site location will often be dynamically updated.A domain controllers site location is established by which site its Server object belongs to inthe directory, so its site location will be consistent unless the domain controllers Serverobject is intentionally moved to a different site.Explain GC?By default, a GC is created automatically on the first DC in the forest. It stores a full replica ofall objects in the directory for its host domain and a partial replica of all objects of every otherdomain in the forest. The replica is partial because it stores only some attributes for eachobjects.The GC performs two key directory roles:
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.com • It enables network logon by providing universal group membership information to a DC when a logon process is initiated. • It enables finding directory information regardless of which domain in the forest actually contains the data.When a user logs on to the network, the GC provides universal group membershipinformation for the account sending the logon request to the DC. If a GC is not available theuser is only able to log on to the local computer unless he is in the Domain Admins group.The GC is designed to respond to queries about objects with maximum speed and minimumnetwork traffic. Because a single GC contains information about objects in all domains in theforest, a query about an object can be resolved by a GC in the domain in which the query isinitiated. Thus, finding information in the directory does not produce unnecessary query trafficacross domain boundaries.Active Directory defines a base set of attributes for each object in the directory. Each objectand some of its attributes (such as universal group memberships) are stored in the GC. UsingActive Directory Schema, you can specify additional attributes to be kept in the GC.Explain the role of Global Catalog Server in a Domain?By default, a global catalog is created automatically on the initial domain controller in theforest. It stores a full replica of all objects in the directory for its host domain and a partialreplica of all objects contained in the directory of every other domain in the forest. The replicais partial because it stores some, but not all, of the property values for every object in theforest.The global catalog performs two key directory roles: • It enables network logon by providing universal group membership information to a domain controller when a logon process is initiated. • It enables finding directory information in the entire forest regardless of which domain in the forest actually contains the data.When a user logs on to the network, the global catalog provides universal group membershipinformation for the account sending the logon request to the domain controller. If there isonly one domain controller in the domain, the domain controller and the global catalog arethe same server. If there are multiple domain controllers in the network, the global catalog ishosted on the domain controller configured as such. If a global catalog is not available when auser initiates a network logon process, the user is only able to log on to the local computer.If a user is a member of the Domain Admins group, they are able to log on to the networkeven when a global catalog is not available.The global catalog is designed to respond to queries about objects anywhere in the forest withmaximum speed and minimum network traffic. Because a single global catalog containsinformation about objects in all domains in the forest, a query about an object can beresolved by a global catalog in the domain in which the query is initiated. Thus, finding
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.cominformation in the directory does not produce unnecessary query traffic across domainboundaries.You can optionally configure any domain controller to host a global catalog, based on yourorganizations requirements for servicing logon requests and search queries.After additional domain controllers are installed in the domain, you can change the defaultlocation of the global catalog to another domain controller using Active Directory Sites andServices.GC and infrastructure master should not be on the same Server. Why?The infrastructure master is responsible for updating references from objects in its domain toobjects in other domains. The infrastructure master compares its data with that of a globalcatalog. Global catalogs receive regular updates for objects in all domains through replication,so the global catalogs data will always be up-to-date. If the infrastructure master finds datathat is out-of-date, it requests the updated data from a global catalog. The infrastructuremaster then replicates that updated data to the other domain controllers in the domain.Important 1. If the infrastructure master and global catalog are on the same domain controller, the infrastructure master will not function. The infrastructure master will never find data that is out of date, so will never replicate any changes to the other domain controllers in the domain. 2. If all of the domain controllers in a domain are also hosting the global catalog, all of the domain controllers will have the current data and it does not matter which domain controller holds the infrastructure master role.What are the Single master operations?Active Directory supports multimaster replication of the directory data between all DCs in thedomain. Some changes are impractical to perform in multimaster fashion, so only one DC,called the operations master, accepts requests for such changes.Because the operations master roles can be moved to other DCs within the domain or forest,these roles are sometimes referred to as Flexible Single Master Operations.In any Active Directory there are five operations master roles. Some roles must appear inevery forest. Other roles must appear in every domain in the forest.FOREST-WIDE OPERATIONS MASTER ROLESEvery Active Directory forest must have the following roles: • Schema master • Domain naming masterThere can be only one schema master and one domain naming master for the entire forest.
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comSchema masterThe schema master DC controls all updates and modifications to the schema.Domain naming masterDomain Naming Master DC controls the addition or removal of domains in the forest.DOMAIN-WIDE OPERATIONS MASTER ROLESEvery domain in the forest must have the following roles: • Relative ID master • Primary DC (PDC) emulator • Infrastructure masterE0ach domain in the forest can have only one RID master, PDC Emulator, and InfrastructureMaster.Relative ID masterThe RID master allocates pool of relative IDs to each DC in its domain. Whenever a DCcreates a user, group, or computer object, it assigns a unique security ID to that object. Thesecurity ID consists of a domain security ID (that is the same for all security IDs created inthe domain), and a relative ID that is unique for each security ID created in the domain.To move an object between domains (using Movetree.exe), you must initiate the move onthe DC acting as the relative ID master of the domain that currently contains the object.PDC emulatorFor pre-W2K clients, the PDC emulator acts as a Windows NT PDC. It processes passwordchanges from clients and replicates updates to the BDCs.In native-mode, the PDC emulator receives preferential replication of password changesperformed by other DCs in the domain. If a password was recently changed, that changetakes time to replicate to every DC in the domain. If a logon authentication fails at anotherDC due to a bad password, that DC will forward the authentication request to the PDCemulator before rejecting the log on attempt.Infrastructure masterThe infrastructure master is responsible for updating the group-to-user references wheneverthe members of groups are renamed or changed. At any time, there can be only one DCacting as the infrastructure master in each domain.When you rename or move a member of a group (and that member resides in a differentdomain from the group), the group may temporarily appear not to contain that member. Theinfrastructure master of the groups domain is responsible for updating the group so it knows
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comthe new name or location of the member. The infrastructure master distributes the update viamultimaster replication.There is no compromise to security during the time between the member rename and thegroup update. Only an administrator looking at that particular group membership wouldnotice the temporary inconsistency.What are the FSMO roles and explain their functions? • Schema master • Domain naming master • RID master • PDC emulator • Infrastructure daemonSchema MasterThe schema master is responsible for performing updates to the directory schema. This DC isthe only one that can process updates to the directory schema. Once the Schema update iscomplete, it is replicated from the schema master to all other DCs in the directory. There isonly one schema master per directory.Domain Naming MasterThe Domain Naming Master is responsible for making changes to the forest-wide domainname space of the directory. This DC is the only one that can add or remove a domain fromthe directory.RID MasterThe RID master is responsible for processing RID Pool requests from all DCs within a givendomain. It is also responsible for removing an object from its domain and putting it in anotherdomain during an object move.When a DC creates a security principal object such as a user or group, it attaches a uniqueSID to the object. This SID consists of a domain SID (the same for all SIDs created in adomain), and a relative ID (RID) that is unique for each security principal SID created in adomain.Each Windows 2000 DC in a domain is allocated a pool of RIDs that can be assigned to thesecurity principals it creates. When a DCs allocated RID pool falls below a threshold, that DCissues a request for additional RIDs to the domains RID master. The domain-RID masterresponds to the request by retrieving RIDs from the domains unallocated RID pool andassigns them to the pool of the requesting DC. There is one RID master per domain in adirectory.PDC Emulator FSMO RoleThe PDC emulator is necessary to synchronize time in an enterprise. Windows 2000 includesthe W32Time (Windows Time) time service that is required by the Kerberos authenticationprotocol. All Windows 2000-based computers within an enterprise use a common time. Thepurpose of the time service is to ensure that the Windows Time service uses a hierarchicalrelationship that controls authority and does not permit loops to ensure appropriate commontime usage.
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comThe PDC emulator of a domain is authoritative for the domain. The PDC emulator at the rootof the forest becomes authoritative for the enterprise, and should be configured to gather thetime from an external source. All PDC FSMO role holders follow the hierarchy of domains inthe selection of their in-bound time partner.In a Windows 2000 domain, the PDC emulator role holder retains the following functions: • Password changes performed by other DCs in the domain are replicated preferentially to the PDC emulator. • Authentication failures that occur at a given DC in a domain because of an incorrect password are forwarded to the PDC emulator before a bad password failure message is reported to the user. • Account lockout is processed on the PDC emulator.Note that the PDC emulator role becomes unnecessary as down-level workstations, memberservers, and domain controllers are all upgraded to Windows 2000, in which case thefollowing information applies: • Windows 2000 clients (workstations and member servers) and down-level clients that have installed the distributed services client package do not perform directory writes (such as password changes) preferentially at the DC that has advertised itself as the PDC; they use any DC for the domain. • Once backup domain controllers (BDCs) in down-level domains are upgraded to Windows 2000, the PDC emulator receives no down-level replica requests. • Windows 2000 clients (workstations and member servers) and down-level clients that have installed the distributed services client package use the Active Directory to locate network resources. They do not require the Windows NT Browser service.Infrastructure FSMO RoleWhen an object in one domain is referenced by another object in another domain, itrepresents the reference by the GUID, the SID (for references to security principals), and theDN of the object being referenced. The infrastructure FSMO role holder is the DC responsiblefor updating an objects SID and distinguished name in a cross-domain object reference.NOTE: The Infrastructure Master (IM) role should be held by a domain controller that is not aGlobal Catalog server(GC). If the Infrastructure Master runs on a Global Catalog server it willstop updating object information because it does not contain any references to objects that itdoes not hold. This is because a Global Catalog server holds a partial replica of every object inthe forest. As a result, cross-domain object references in that domain will not be updated anda warning to that effect will be logged on that DCs event log.How will you place the FSMO roles? • Place the RID and PDC emulator roles on the same domain controller. Good communication from the PDC to the RID master is desirable as downlevel clients and applications target the PDC, making it a large consumer of RIDs. • As a general rule, the infrastructure master should be located on a nonglobal catalog server that has a direct connection object to some global catalog in the forest, preferably in the same Active Directory site.
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.com Two exceptions to the "do not place the infrastructure master on a global catalog server" rule are: o Single domain forest: In a forest that contains a single Active Directory domain, there are no phantoms, and so the infrastructure master has no work to do. The infrastructure master may be placed on any domain controller in the domain. o Multidomain forest where every domain controller holds the global catalog: If every domain controller in the domain also hosts the global catalog, then there are no phantoms or work for the infrastructure master to do. The infrastructure master may be placed on any domain controller in the domain. • At the forest level, the schema master and domain naming master roles should be placed on the same domain controller as they are rarely used and should be tightly controlled. Additionally, the Domain Naming master FSMO should also be a global catalog server.Responding to operations master failuresSome of the operations master roles are crucial to the operation of your network. Others canbe unavailable for quite some time before their absence becomes a problemIf an operations master is not available due to computer failure or network problems, you canseize the operations master role.In general, seizing an operations master role is a drastic step that should be considered onlyif the current operations master will never be available again.SCHEMA MASTER FAILURETemporary loss of the schema operations master will be visible only if we are trying to modifythe schema or install an application that modifies the schema during installation.A DC whose schema master role has been seized must never be brought back online.To seize the schema master role 1. Click Start, click Run, and then type cmd. 2. At the command prompt, type ntdsutil. 3. At the ntdsutil prompt, type roles. 4. At the fsmo maintenance prompt, type connections. 5. At the server connections prompt, type connect to server, followed by the fully qualified domain name. 6. At the server connections prompt, type quit. 7. At the fsmo maintenance prompt, type seize schema master. 8. At the fsmo maintenance prompt, type quit. 9. At the ntdsutil prompt, type quit.
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comDOMAIN NAMING MASTER FAILURETemporary loss of the schema operations master will be visible only if we are trying to add adomain to the forest or remove a domain from the forest.A DC whose domain naming master role has been seized must never be brought back online.RELATIVE ID MASTER FAILURETemporary loss of the schema operations master will be visible if you are creating objects andthe domain in which you are creating the objects runs out of RIDs.A DC whose relative identifier master role has been seized must never be brought backonline.PDC EMULATOR FAILUREThe loss of the PDC emulator affects network users. Therefore, when the PDC emulator is notavailable, you may need to immediately seize the role.If the current PDC emulator master will be unavailable for an unacceptable length of time andits domain has clients without Windows 2000 client software, or if it contains Windows NTbackup DCs, seize the PDC emulator master role to the standby operations master. When theoriginal PDC emulator master is returned to service, you can return the role to the originalDC.INFRASTRUCTURE MASTER FAILURETemporary loss of the infrastructure master is not visible to network users or administratorseither, unless they have recently moved or renamed a large number of accounts.If the infrastructure master will be unavailable for an unacceptable length of time, you canseize the role to a DC that is not a GC but is well connected to a GC, ideally in the same siteas the current GC.How will you remove DC Server Object (In ADS Sites and Services) which isnot removed After Demotion?After demoting a DC, the object that represents the server in the Active Directory Sites andServices Manager snap-in remains.This issue occurs because the server object is a "container" in the Active Directory and mayhold child objects that represent configuration data for other services installed on yourcomputer. Because of this, the Dcpromo utility does not automatically remove the serverobject.If the server object contains any child objects named "NTDS Settings," these are objects that representthe server as a DC and should be automatically removed by the demotion process. If this does not work,these objects must be removed by using the Ntdsutil utility before you delete the server object.After verifying that all other services with a dependency on the server object have been
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comremoved an administrator can delete the server in Active Directory Sites and ServicesManager.NOTE: This process may not finish successfully for either of the following reasons:If you receive a message that states the server is a container that contains other objects,verify that the appropriate decommissioning of services has completed before continuing.If you receive a message that states the DSA object cannot be deleted, you may beattempting to delete an active DC.How will you remove Orphaned Domains from Active Directory?Typically, when the last DC for a domain is demoted, the administrator selects this server isthe last DC in the domain option in the DCPromo tool, which removes the domain meta-data from Active Directory.Note: The administrator must verify that replication has occurred since the demotion of thelast DC before manually removing the domain meta-data. Using the NTDSUTIL toolimproperly can result in partial or complete loss of Active Directory functionality.1. Determine the DC that holds the Domain Naming Master FSMO role.2. Verify that all servers for the specified domain have been demoted.3. At the command prompt: ntdsutil metadata cleanup connections connect to server servername(Servername is the name of the DC holding the Domain Naming Master FSMO Role)If an error occurs, verify that the DC being used in the connection is available and that thecredentials you supplied have administrative permissions on the server. QuitMetadata Cleanup menu is displayed Select operation target List domainsA list of domains in the forest is displayed, each with an associated number Select domain numberWhere number is the number associated with the domain to be removed QuitThe Metadata Cleanup menu is displayed.
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.com Remove selected domainYou should receive confirmation that the removal was successful. QuitYou should receive confirmation that the connection disconnected successfully.Audit Active Directory Objects in Windows 2000An audit entry in the Security log contains the following information: • The action that was performed. • The user who performed the action. • The success or failure of the event and the time that the event occurred.When you audit Active Directory events, Windows 2000 writes an event to the Security log onthe domain controller. If a user tries to log on to the domain using a domain user account andthe logon attempt is unsuccessful, the event is recorded on the DC and not on the computeron which the logon attempt was made. This is because it is the domain controller that tried toauthenticate the logon attempt.How to Configure an Audit Policy Setting for a Domain ControllerAuditing is turned off by default. To audit all DCs, Enable auditing on Domain ControllersOUTo configure an audit policy setting for a domain controller, follow these steps: 1. Start Directory Users and Computers. 2. Click Advanced Features on the View menu. 3. Right-click Domain Controllers, and then click Properties. 4. Click the Group Policy tab, click Default Domain Controller Policy, and then click Edit. 5. Click Computer Configuration, double-click Windows Settings, double-click Security Settings, double-click Local Policies, and then double-click Audit Policy. 6. In the right pane, right-click Audit Directory Services Access, and then click Security. 7. Click Define These Policy Settings, and then click to select one or both of the following check boxes: o Success: Click to select this check box to audit successful attempts for the event category. o Failure: Click to select this check box to audit failed attempts for the event category. 8. Right-click any other event category that you want to audit, and then click Security. Click OKHow to Configure Auditing for Specific Active Directory ObjectsYou can configure auditing for specific objects, such as users, computers, organizational units,or groups, by specifying both the types of access and the users whose access that you want
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comto audit.To configure auditing for specific Active Directory objects, follow these steps: 1. Open Active Directory Users and Computers. 2. Select Advanced Features on the View menu. 3. Right-click the Active Directory object that you want to audit, and then click Properties. 4. Click the Security tab, and then click Advanced. 5. Click the Auditing tab, and then click Add. Enter the name of either the user or the group whose access you want to audit 6. Click to select either the Successful check box or the Failed check box for the actions that you want to audit, and then click OK.How to set up a One-Way Non-Transitive Trust in Windows 2000Windows 2000 domains in the same forest share transitive trust relationships with oneanother. There is an implicit transitive trust between the root domains in each tree in theWindows 2000 forest. A two-way implicit transitive trust also exists between all contiguousdomains in a single tree.There may be times when you need to create explicit trust relationships between domains.Windows 2000 allows you to configure one-way transitive trusts between domains.Configure a One-way TrustPerform the following steps to configure the one-way trust: 1. On a domain controller in the trusted domain, start the Active Directory Domains and Trusts console. 2. In the Domains that trust this domain pane, click Add. 3. In the Add Trusting Domain dialog box, type the name of the trusting domain, type a password, and then type the password again in the Confirm password box. 4. Click OK. 5. In the Active Directory dialog box, click OK to verify the trust. 6. Enter a user name and password of a user that has permissions to modify trust relationships in the trusting domain. You receive a message that states that the trusting domain has been added and the trust verified. 7. Quit the Active Directory Domains and Trusts console. 8. On a domain controller in the trusting domain, start the Active Directory Domains and Trusts console. 9. Right-click the trusting domain and click Properties. 10. In the Domains trusted by this domain box, click Add. 11. In the Add Trusted Domain dialog box, type the name of the trusted domain and a password, and then type the password again in the Confirm Password dialog box. 12. Click OK.NOTE: The DNS infrastructure must be in place so that domain controllers from each domaincan find one another. You can configure Windows NT 4.0 domain trusts by using Windows NT
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.com4.0 User Manager for Domains.How to create a Container to List Printers in Active DirectoryBy default, printers are not displayed when you use My Network Places to browse ActiveDirectory. The ADSI Edit tool in Support Tools can be used to add a container in which to thelist printers that are published in Active Directory. By doing so, users can either find the folderthat contains the printers in My Network Places or add a network place to the folder thatcontains the printers.To create a Printers container in which to list your printers in Active Directory: 1. Click Start, point to Programs, point to Windows 2000 Support Tools, point to Tools, and then click ADSI Edit. 2. Expand Domain NC [DomainName], and then click DC=Domain, DC=com. 3. On the Action menu, point to New, and then click Object. 4. In the Select a class box, click container, and then click Next. 5. In the Value box, type Printers, and then click Next. 6. Click Finish. A CN=Printers container appears in the right pane of ADSI Edit. 7. Right-click CN=Printers, and then click Properties. 8. Click the Attributes tab. 9. In the Select a property to view box, click showInAdvancedViewOnly, and then click Clear. 10. In the Edit Attribute box, type false, click Set, and then click OK. 11. Quit ADSI Edit. 12. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers. The Printers container that you created appears in the list of directory objects. 13. On the View menu, click Advanced Features. 14. On the View menu, click Users, Groups, and Computers as containers. 15. Move the printers that you want to the Printers container. 16. Quit Active Directory Users and Computers.Note: The procedure in this article requires that printers are published in Active Directory.How to publish a printer in AD 1. Log on to the computer as an administrator. 2. Click Start, point to Settings, and then click Printers. 3. In the Printers folder, right-click the printer that you want to publish in Active Directory, and then click Properties. 4. Click the Sharing tab, click Share As, and then either type a share name or accept the default name. Use only letters and numbers; do not use spaces, punctuation, or special characters. 5. Click to select the List in the Directory check box, and then click OK. 6. Close the Printers folder.
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comNOTE: If you want to make this printer available to users who are running different versionsof Windows, you must install additional drivers. To do so, click Additional Drivers on theSharing tab of the Printer properties, and then select the appropriate items in the list.How to Configure an Authoritative Time Server in Windows 2000?Windows includes the W32Time Time service tool that is required by the Kerberosauthentication protocol. The purpose of the Time service is to ensure that all computers thatare running Windows 2000 in an organization use a common time.Windows-based computers use the following hierarchy by default: • All client PCs and member servers nominate the authenticating DC as their in-bound time Server. • DCs may nominate the PDC operations master as their in-bound time partner but may use a parent DC based on stratum numbering. • All PDC operations masters follow the hierarchy of domains in the selection of their in- bound time partner.PDC operations master at the root of the forest becomes authoritative for the organization.This PDC can be configured to recognize an external Simple Network Time Protocol (SNTP)time server as authoritative by using the following net time command:Net time /setsntp: server_listTo reset the local computers time against the authoritative time server for the domain:Net time /domain_name /setNet stop w32timeW32tm –onceNet start w32timeSNTP defaults to using UDP port 123. If this port is not open to the Internet, you cannotsynchronize your server to Internet SNTP servers.Administrators can also configure an internal time server as authoritative by using the nettime command. If the administrator directs the command to the operations master, it may benecessary to reboot the server for the changes to take effect.Loop back Processing of Group PolicyGroup Policy applies to the user or computer in a manner that depends on where both theuser and the computer objects are located in Active Directory. However, in some cases, usersmay need policy applied to them based on the location of the computer object alone. You canuse the Group Policy loopback feature to apply GPOs that depend only on which computer theuser logs on to.To set user configuration per computer:
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comIn the Group Policy Microsoft Management Console (MMC), click Computer Configuration.Locate Administrative Templates, click System, click Group Policy, and then enable theLoopback Policy option.This policy directs the system to apply the set of GPOs for the computer to any user who logson to a computer affected by this policy. Loopback is supported only in a purely Windows2000 based environment. Both the computer account and the user account must be in ActiveDirectory.Usually users in their OU have GPOs applied in order during logon, regardless of whichcomputer they log on to. In some cases, this processing order may not be appropriate (E.g.,when you do not want applications assigned to users to be installed while they are logged onto the computers in some specific OU).With the Group Policy loopback, you can specify some other ways to retrieve the list of GPOsfor any user who logs on to any of the computers in this specific OU:Merge ModeHere, first the GPO for users is applied. Then the GPO for the computer is then added to theend of the GPOs for the user. This causes the computers GPOs to have higher precedencethan the users GPOs.Replace ModeIn this mode, the users list of GPOs is not gathered. Only the list of GPOs based on thecomputer object is used.Group Policy May Not Be Applied to Users Belonging to Many GroupsIf a user is member of many groups either directly or because of group nesting, Kerberosauthentication may not work. The Group Policy object (GPO) may not be applied to the userand the user may not be validated to use network resources.Because: The Kerberos token has a fixed size. If a user is a member of a group either directlyor by membership in another group, the security ID (SID) for that group is added to theusers token. For a SID to be added to the users token, it must be communicated by usingthe Kerberos token. If the required SID information exceeds the size of the token,authentication does not succeed. The number of groups varies, but the limit is approximately70 to 80 groups.For many operations, Windows NTLM authentication succeeds; the Kerberos authenticationproblem may not be evident without analysis. However, operations that include GPOapplication do not work at all.To resolve this problem, obtain the latest service pack for Windows 2000.
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comExplain Kerberos V5 authentication process?Kerberos V5 is the primary security protocol for authentication within a domain. TheKerberos V5 protocol verifies both the identity of the user and network services. This dualverification is known as mutual authentication.HOW KERBEROS V5 WORKSThe Kerberos V5 authentication mechanism issues tickets (A set of identification data for asecurity principle, issued by a DC for purposes of user authentication. Two forms of tickets inWindows 2000 are ticket-granting tickets (TGTs) and service tickets) for accessing networkservices. These tickets contain encrypted data, including an encrypted password, whichconfirms the users identity to the requested service.An important service within Kerberos V5 is the Key Distribution Center (KDC) (AKerberos V5 service that runs on a DC. It issues ticket-granting tickets (TGTs) and servicetickets for obtaining network authentication in a domain). The KDC runs on each DC as part ofActive Directory, which stores all client passwords and other account information.The Kerberos V5 authentication process works as follows: 1. The user on a client system, using a password authenticates to the KDC. 2. The KDC issues a special ticket-granting ticket (A ticket issued by the Kerberos V5 Key Distribution Center (KDC) for purposes of obtaining a service ticket from the ticket-granting service (TGS) to the client. The client system uses this TGT to access the ticket-granting service (TGS), which is part of the Kerberos V5 authentication mechanism on the DC. 3. The TGS then issues a service ticket to the client. 4. The client presents this service ticket to the requested network service. The service ticket proves both the users identity to the service and the services identity to the user.KERBEROS V5 AND DCSThe Kerberos V5 services are installed on each DC, and a Kerberos client is installed on eachWindows 2000 workstation and server.Every DC acts as a KDC. A Windows 2000 system uses a DNS lookup to locate the nearestavailable DC. That DC then functions as the preferred KDC for that user during the userslogon session. If the preferred KDC becomes unavailable, the Windows 2000 system locatesan alternate KDC to provide authentication.How the Local User Accounts Are Handled When a Server Is Promoted to aDCWhen a server is promoted to a DC, the server no longer uses the local SAM database to storeusers and groups. When the promotion is complete, DC will store users, groups, and
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comcomputer accounts in Active Directory database. The SAM database is present, but it isinaccessible when the server is running in Normal mode. But SAM database is used when youboot into Directory Services Restore Mode or the Recovery Console.If this new DC is the first DC in a new domain, all of the local user accounts in the SAMdatabase are migrated to the Active Directory. All permissions that had been assigned to thelocal users, such as, NTFS permissions, are retained.Can we run DC promo on a server in which NAT is installed?When you attempt to promote or demote a DC with dcromo, you may receive the followingerror message: Active Directory Installation failed The operation failed because: Failed to modify the necessary properties for the machine account Servername$ The specified server cannot perform the requested operation.This can happen when the server is using Network Address Translation: and it can be causedby the H.323/LDAP Proxy Service. To resolve this behavior, install SP1 or disable theH.323/LDAP proxy service with the following command:Do not use NAT on a network with other DCs, DNS servers, Gateways, DHCP servers, orSystems configured for static IP because of possible conflict with other services. Do notconnect NAT directly to a corporate network because Kerberos authentication, IPSec, andInternet Key Encryption (IKE) will not work.Enable Debug Logging in the Microsoft Directory Synchronization ServicesToolWhen you troubleshoot synchronization issues in the MSDSS tool, you can enable debuglogging to capture detailed information about the synchronization process.Enabling Detailed MSDSS Logging, go toHKEY_LOCAL_MACHINESystemCurrentControlSetServicesMsdssCreate a new REG_DWORD key DebugLogLevel and set value as 1 and restart thecomputer1 activates logging, 0 turns logging off.The logging information is placed in the %Systemroot%System32DirectorySynchronizationSession Logs folder. The log files are labeled as "Session#-#.log"Auditing Does Not Report Security Event for Resetting Password on DCIf you choose to audit success and failure with the "Audit account management" policy, theauditing does not report the expected success event in the Security log when an administratorresets the user password on a DC.
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comThis problem occurs because Remote Procedure Call (RPC) impersonation does not succeedwhen the Security service tries to send a message to the Eventlog service. SP2 will solve thisproblem.How to Change the Recovery Console Administrator Password on a DCWhen you promote a Windows 2000 Server-based computer to a DC, you are prompted totype a Directory Service Restore Mode Administrator password. This password is also used byRecovery Console, and is separate from the Administrator password that is stored in ActiveDirectory after a completed promotion.The Administrator password that you use when you start Recovery Console or when you pressF8 to start Directory Service Restore Mode is stored in the SAM on the local computer. TheSAM-based account and password is computer specific and they are not replicated to otherDCs in the domain.To change the local Administrator password that you use when you start Recovery Console orwhen you start Directory Service Restore Mode, use one of the following methods.Method 1In a DC use the %systemroot%system32Setpwd.exe (SP2 or Later) utility to change theSAM-based Administrator password. To change the SAM Administrator password on a remoteDC, type the following commandSetpwd /s: servernameMethod 2Restart the DC in Directory Service Restore Mode. Use the command net useradministrator * or Local User and GroupsWho can "Log On locally" to a DCBy default Account Operators, Administrators, Backup Operators, Print Operators, ServerOperators, Internet Guest Account, and Terminal Services User Account are assigned the logon locally rightExplain User and Computer naming in AD?Active Directory domain names are usually the full DNS name of the domain. For backwardcompatibility, each domain also has a pre-Windows 2000 name.USER ACCOUNTSIn Active Directory, each user account has a user logon name, a pre-Windows 2000 userlogon name (SAM account name), and a user principal name suffix. Active Directory suggestsa pre-Windows 2000 user logon name using the first 20 bytes of the user logon name.
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comIn Active Directory, each user account has a user principal which is composed of the userlogon name and the user principal name suffix joined by the @ sign.Do not add the @ sign to the user logon name or to the user principal name suffix. ActiveDirectory automatically adds it when it creates the user principal name. A user principal namethat contains more than one @ sign is invalid.The second part of the user principal name, referred to as the user principal name suffix,identifies the domain in which the user account is located. This user principal name suffix canbe the DNS domain name, the DNS name of any domain in the forest, or it can be analternative name created by an administrator and used just for logon purposes. Thisalternative user principal name suffix does not need to be a valid DNS name.Using alternative domain names as the user principal name suffix can provide additional logonsecurity and simplify the names used to log on to another domain in the forest.E.g. Sanjo is user in sales.westcoast.microsoft.com. So the logon name would firstname.lastname@example.org. Creating a user principal name suffix of "microsoft"would allow that same user to log on using the much simpler logon name ofsanjo@microsoft.You can add or remove user principal name suffixes using Active Directory Domains andTrusts.COMPUTER ACCOUNTSEach computer account created in Active Directory has a relative distinguished name, a pre-Windows 2000 computer name (SAM account name), a primary DNS suffix, a DNS host nameand a service principal name. This computer name is used as the LDAP relative distinguishedname.Active Directory suggests the pre-Windows 2000 name using the first 15 bytes of the relativedistinguished name. This can be changed at any time.The primary DNS suffix defaults to the full DNS name of the domain to which the computer isjoined. The DNS host name is built from the first 15 characters of the relative distinguishedname + the primary DNS suffix.The service principal name is built from the DNS host name. The service principal name isused in the process of mutual authentication between the client and the server hosting aparticular service. The client finds a computer account based on the service principal name ofthe service to which it is trying to connect.It is possible for administrators to change the way the service principal name is created. Thissecurity modification allows a computer to use primary DNS suffixes that are different thanthe domain to which the computer is joined. The same modification also allows ActiveDirectory to use more than the first 15 bytes of the relative distinguished name whenconstructing the service principal name.Computers with these modified computer names will register their names in DNS correctly butan additional procedure is required to enable correct registration of the DNS host name
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.com(dNSHostName) and service principal Name (servicePrincipalName) attributes of the computerobject in Active Directory.To allow a computer to use a different DNS name 1. Right-click Active Directory Users and Computers, point to View, and then click Advanced Features. 2. Right-click the name of the domain, and then click Properties. 3. On the Security tab, click Add, click the Self group, click Add, and then click OK. 4. Click Advanced, click Self, and then click View/Edit. 5. On the Properties tab, in Apply onto, click Computer Objects. 6. Under Permissions, click Write dNSHostName, and then click the Allow check box.By modifying default security in this way, there is a possibility that a computer joined to theselected domain could be operated by a malicious user and may be able to advertise itselfunder a different name through the service principal name attribute.Resetting Computer Accounts in Windows 2000 and Windows XPFor each Windows 2000/XP PC that is a member of a domain, there is a discretecommunication channel, known as the secure channel, with a DC. The secure channelspassword is stored along with the computer account on all DCs. Default computer accountpassword change period is every 30 days. If the computer accounts password and the LSAsecret are not synchronized, the Netlogon service logs one or both of the following errorsmessages: The session setup from the computer DOMAINMEMBER failed to authenticate. The name of the account referenced in the security database is DOMAINMEMBER$. The following error occurred: Access is denied. NETLOGON Event ID 3210: Failed to authenticate with DOMAINDC, a Windows NT DC for domain DOMAIN.The Netlogon service on the DC logs the following error message when the password is notsynchronized: NETLOGON Event 5722: The session setup from the computer %1 failed to authenticate. The name of the account referenced in the security database is %2. The following error occurred: %n%3We can reset computer password using Active Directory Users and Computers MMC. Right-click the computer object and then click Reset Account. Resetting the password for DCsusing this method is not allowed. Resetting a computer account breaks that computersconnection to the domain and requires it to rejoin the domain. This will prevent an establishedcomputer from connecting to the domain and should only be used for a computer that hasjust been rebuilt.Distinguishing a DC from a Windows 2000 Member Server • The NTDS registry key exists in the HKLMSYSTEMCCSSERVICES portion of the registry. • The SYSVOL and NETLOGON shares exist. (The SYSVOL share and its contents exist after demotion of a DC.)
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.com • NBTSTAT shows that the 1C name (Domain) has been registered. Type nbtstat -n from a command prompt and note the presence of the 1C name. • The computer role from the NET ACCOUNTS utility lists the computer role as "PRIMARY" and standalone servers as "SERVERS." Type net accounts from the command prompt. • The NET START command indicates that the Kerberos Key Distribution Center (KDC) service is running. Type net start |more. • The computer responds to LDAP queries (specifically, to port 389 or 3268). • The "Connect to server %S" command in Ntdsutil.exe functions only against Windows 2000 DCs. • The Change button on the Network Identification tab in My Computer is disabled when Windows 2000 is configured as a DC. A note appears indicating this. • Run Netdiag (a Resource Kit utility) and observe the "Machine is a Primary DC" entry in the output. Type netdiag /v from the command prompt.How to create Third-Party Microsoft Installer Package (.MSI)If you want to install a third-party program by using this method, you must install a copy ofVeritas Software Console by Seagate Software at a location that is accessible by the referencecomputer. This program is available on the Windows 2000 CD-ROM inValueadd3rdpartyMgmtWinstleSwiadmle.msi. This includes a copy of WinINSTALLlimited edition, which allows for basic functionality.Clean PCA clean PC is defined as a computer with only the following items on it before you runDiscover: The operating system The service packs for the operating systemIf you install Veritas Software Console on the computer, it is by definition no longer a cleanPC. You must install Veritas Software Console somewhere, but not on the clean PC.Reference ComputerA clean PC ensures that the Discover program will pick up all files and registry entriesnecessary for the program to run. The reference computer should have access to the Discoverprogram (Discoz.exe) in the Winstall folder from Run command on the Start menu. Do notmap a drive to the Winstall share. Doing so may cause Discover to pick up the added drive,possibly causing problems in your Microsoft Installer packages.DiscoverThe Discover program is the program you use to create the instruction file (Microsoft Installerpackage) that contains information about what needs to be done to install a product.How to Create a Third-Party MSI PackageFor this process to work properly, you should start with a clean PC.
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.com 1. Start with a clean PC, or one that is representative of the computers in your network. 2. Start Discover to take a picture of the representative PCs software configuration. This is the Before snapshot. 3. Install a program on the PC on which you took the Before snapshot. 4. Reboot the PC. 5. Run the new program to verify that it works. 6. Quit the program. 7. Start Discover and take an After snapshot of the PCs new configuration. Discover compares the Before and the After snapshots and notes the changes. It creates a Microsoft Installer package with information about how to install that program on such a PC in the future. 8. (Optional) Use Veritas Software Console to customize the Microsoft Installer package. 9. Clean the reference computer to prepare to run Discover again. 10. (Optional) Perform a test installation of the program on non-production workstations.AD ReplicationCreate and Configure a Site Link in Active Directory in Windows 2000For the site link to become active, there must be at least two sites available in ActiveDirectory.A Site Link object represents a set of sites that can communicate at uniform cost through aninter-site transport. For IP transport, a typical site link connects just two sites andcorresponds to an actual WAN link. An IP site link that connects more than two sites mightcorrespond to an asynchronous transfer mode (ATM) backbone that connects more than twoclusters of buildings on a large campus, or several offices in a large metropolitan area thatare connected through leased lines and IP routers.How to Create a Site LinkTo create a new site link: 1. Click Active Directory Sites and Services. 2. Expand the Inter-Site Transports node, right-click IP (or click SMTP if you want to use SMTP as the inter-site transport protocol), and then click New Site Link.If you have only one site in Active Directory, you receive a message that states that two sitesare required for the site link to work. Click OK to continue.Domain Replication and the knowledge consistency checker
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comSince widows 2000 has multi master replication, maintaining consistency is a problem. KCCcreates connections dynamically between the DCs and triggers replication.As the number of DCs increases, replication consumes more and more network bandwidth.The KCC balances the need for consistency against bandwidth limitation using the timelycontact rule.This means that no DC is allowed to be more than 3 connections from any other DC. The KCCmaintains domain consistency automatically. You can manually force the KCC to runimmediately using the Repadmin.exe tool. To force the KCC on the server namedserver1.mydomain.com, you would issue the following command.Repadmin /kcc server1.mydomain.comIntersite replication relaxes the timely contact rule since replication between sites usuallyoccurs over slower links. The KCC can be optimized for your particular intersite replicationneeds.Bridgehead servers perform directory replication between two sites. Only two designated DCstalk to each other. These DCs are called bridgehead servers. If you have DCs from multipledomains, you will have a bridgehead server for each domain.Each Active Directory site also has one DC that takes the role of Inter-Site TopologyGenerator (ISTG), which reviews and generates the connection object for the bridgeheadservers in each site.There is only one DC with this role in each site, even if you have multiple domains. The firstDC in the site becomes the ISTG for the site by default. You cant controller which DC is theISTG, but you can know which one is the ISTG: • Open the Active Directory Sites and Services console. • Select the site object. • In the right pane right-click the NTDS Site Settings object and select Properties. The current role owner will appear in the Server box under Inter-Site Topology Generator on the Site Settings tab.If the DC holding the ISTG role is offline for more than 60 minutes, another DC in the site willautomatically take over this role.Replication Access Was Denied" Error Message When Attempting toSynchronize DCsWhen you use the Active Directory Sites and Services snap-in from a child domain to forcereplication from a parent domain or another child domain at the same level, you may receivethe following error message: The following error occurred during the attempt to synchronize the DCs: Replication Access was deniedDomains in Active Directory are natural security boundaries. Administrative permissions donot flow down; they need to be assigned. When a child domain is created, the Enterprise
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comAdmin global group is added to the built-in Administrators group of the child domain. Thisallows the administrator of the parent domain to administer and force replication from eitherthe parent domain or the child domain, but the administrator in the child domain is only ableto force replication from within his or her own domain.To resolve this issue, give the administrator in the child domain permissions to the parentdomain from which you want to force replication. Add his to Administrators group in parentdomainRepeat these steps from each domain that you want to assign administrative permissions to.Keep in mind that parent domains are able to manage all of their child domains but you needto perform the steps described in this article for any child domains that want to manage theparent domain or other child domains on the same level.RPC Error Messages Returned for Active Directory Replication When Time IsOut of SynchronizationWhen you are viewing the status of Active Directory replication between two DCs, thefollowing messages may be displayed for the result of the last replication attempt: The RPC server is unavailable. -or- The RPC server is too busy to complete this operation.These error messages may be reported in the Event log through Replication Monitor. Bydefault, W2K computers synchronize time with a time server. If the time server is notavailable and the time difference between DCs drifts beyond the skew allowed by Kerberos,authentication between the two DCs may not succeed and the RPC error messages can result.Synchronies time amongst DCs using net timeNet time mypdc /set /yThis synchronizes the local computer time with the server named Mypdc.The /set - Time not only be queried, but synchronized with the specified server.The /y switch skips the confirmation for changing the time on the local computerHow Conflicts Are Resolved in Active Directory ReplicationAll computers that provide multi-master updates must deal with potential conflicts that mayarise when concurrent updates originating on two separate master replicas are inconsistent.There are three types of conflicts: • Attribute value: An objects attribute is set concurrently to one value at one master, and another value at a second master.
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.com • Add/move under a deleted container object or the deletion of a non-leaf object: Essentially, this conflict is a situation in which one master records the deletion of a container object, while another master records the placement of another object subordinate to that deleted object. • Sibling name conflict: This conflict occurs when one replica attempts to move an object into a container in which another replica has concurrently moved another object with the same relative display name (RDN).Active Directory orders all update by assigning a globally unique stamp to the originatingupdate. If there is a conflict, the ordering of stamps allows a consistent resolution. Thisapproach is used in the following ways: • Attribute value: The value whose update operation has the larger stamp wins. • Add/move under a deleted container object or the deletion of a non-leaf object: After resolution at all replicas, the container object is deleted, and the leaf object is made a child of the folders special Lost&Found container. Stamps are not involved in this resolution. • Sibling name conflict: The object with the larger stamp keeps the RDN. The sibling object is assigned a unique RDN by the computer. This does not conflict with any client-assigned value [using a reserved character (the asterisk), the RDN, and the objects GUID].How to Modify the Default Intra-Site DC Replication IntervalWhen a DC writes a change to its local copy of the Active Directory, a timer is started thatdetermines when the DCs replication partners should be notified of the change. By default,this interval is 5 minutes. When this interval elapses, the DC initiates a notification to eachintra-site replication partner that it has changes that need to be propagated. Anotherconfigurable parameter determines the number of seconds to pause between notification. Thisparameter prevents simultaneous replies by the replication partners. By default, this intervalis 30 seconds. Both of these intervals can be modified by editing the registry.To modify the delay between the change to the Active Directory and first replication partnernotification, use Registry Editor to modify value data for the "Replicator notify pause aftermodify (secs)" DWORD value in the following registry key:HKEY_LOCAL_MACHINESystemCurrentControlSetServicesNTDSParametersThe default value data for the "Replicator notify pause after modify (secs)" DWORD value is0x12c, which in hexadecimal format is 300 decimal (5 minutes).To modify the notification delay between DCs, use Registry Editor to modify value data for the"Replicator notify pause between DSAs (secs)" DWORD value in the following registry key:HKEY_LOCAL_MACHINESystemCurrentControlSetServicesNTDSParameters
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comThe default value data for the "Replicator notify pause between DSAs (secs)" DWORD value is0x1e, which in hexadecimal format is 30 decimal (30 seconds).The Role of the Inter-Site Topology Generator in Active Directory ReplicationThe Knowledge Consistency Checker (KCC) is an Active Directory component that isresponsible for the generation of the replication topology between DCs. This article describesthe role of one server per site, known as the Inter-Site Topology Generator, which isresponsible for managing the inbound replication connection objects for all bridgehead serversin the site in which it is located.When the KCC on each DC generates the intra-site topology for the site in which it resides,the KCC create a connection object in the Active Directory only when a connection object isrequired for the local computer. These changes propagate to other DCs through the normalreplication process. Each DC uses the same algorithm to compute the replication topology,and in a state of equilibrium between DCs, each should arrive at the same result in respect towhat the replication topology should be. In the process, each DC creates its own connectionobjects.Connection objects for bridgehead servers for inter-site replication are created differently. TheKCC on one DC in each site is responsible for reviewing the inter-site topology and creatinginbound replication connection objects as necessary for bridgehead servers in the site inwhich it resides. This DC is known as the Inter-Site Topology Generator (ISTG). The DCholding this role may not necessarily be a bridgehead server.When the ISTG determines that a connection object needs to be modified on a givenbridgehead server in the site, the ISTG makes the change to its local Active Directory copy.As part of the normal intra-site replication process, these changes propagate to thebridgehead servers in the site. When the KCC on the bridgehead server reviews the topologyafter receiving these changes, it translates the connection objects into replication links thatActive Directory uses to replicate data from remote bridgehead servers.The current owner of the ISTG role is communicated through the normal Active Directoryreplication process. Initially, the first server in the site becomes the ISTG for the site. The roledoes not change as additional DCs are added to the site until the current ISTG becomesunavailable.The current ISTG notifies every other DC in the site that it is still present by writing the"interSiteTopologyGenerator" attribute on the NTDS Settings object under its DC object in theConfiguration naming context in Active Directory at a specified interval.As this attribute gets propagated to other DCs by Active Directory replication, the KCC oneach of these computers monitors this attribute to verify that it has been written within aspecified amount of time. If the amount of time elapses without a modification, a new ISTGtakes over.In the event that a new ISTG needs to be established, each DC orders the list of servers inascending order by their Globally Unique Identifier (GUID). The DC that is next highest in thelist of servers from the current owner takes over the role, starts to write the"interSiteTopologyGenerator" attribute, and performs the necessary KCC processes to
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.commanage inbound connection objects for bridgehead servers.As DCs evaluate which server should assume the ISTG role, the selection begins again withthe first DC listed in the site if the current server is the last server in the list.In the event that two DCs in the site believe that they own the ISTG role, there may betemporary state of inbound replication connection objects being created by two computers.However, once replication occurs and all DCs receive the change identifying the new ISTG,the KCC on the ISTG adjusts the topology as appropriate.Domain Naming SystemQuestions about Windows 2000 DNSWhat are the common mistakes that are made when administrators set up DNS onnetwork that contains a single Windows 2000 or Windows Server 2003 DC?The most common mistakes are:The DC is not pointing to itself for DNS resolution on all network interfaces.The "." zone exists under forward lookup zones in DNS.Other computers on the local area network (LAN) do not point to the Windows 2000 DNSserver for DNS.Why do I have to point my DC to itself for DNS?The Netlogon service on the DC registers a number of records in DNS that enable other DCsand computers to find Active Directory-related information. If the DC is pointing to theInternet service providers (ISP) DNS server, Netlogon does not register the correct recordsfor Active Directory, and errors are generated in Event Viewer. The preferred DNS setting forthe DC is itself; no other DNS servers should be listed. The only exception to this rule is withadditional DCs. Additional DCs in the domain must point to the first DC (which runs DNS)that was installed in the domain and then to themselves as secondary.What does a DC register in DNS?The Netlogon service registers all the SRV records for that DC. These records are displayedas the _msdcs, _sites, _tcp, and _udp folders in the forward lookup zone that matches yourdomain name. Other computers look for these records to find Active Directory-relatedinformation.Why cant I use WINS for name resolution like it is used in Microsoft Windows NT4.0?A Windows 2000 DC does not register Active Directory-related information with a WINSserver; it only registers this information with a DNS server that supports dynamic updatessuch as a Windows 2000 DNS server. Other Windows 2000-based computers do not query
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comWINS to find Active Directory-related information.If I remove the ISPs DNS server settings from the DC, how does it resolve namessuch as Microsoft.com on the Internet?As long as the "." zone does not exist under forward lookup zones in DNS, the DNS serviceuses the root hint servers. The root hint servers are well-known servers on the Internet thathelp all DNS servers resolve name queries.What is the "." zone in my forward lookup zone?This setting designates the Windows 2000 DNS server to be a root hint server and is usuallydeleted. If you do not delete this setting, you may not be able to perform external nameresolution to the root hint servers on the Internet.Do I need to configure forwarders in DNS?By default, Windows 2000 DNS use the root hint servers on the Internet; however, you canconfigure forwarders to send DNS queries directly to your ISPs DNS server or other DNSservers. In most cases, when you configure forwarders, DNS performance and efficiencyincreases, but this configuration can also introduce a point of failure if the forwarding DNSserver is experiencing problems. The root hint server can provide a level of redundancy inexchange for slightly increased DNS traffic on your Internet connection.Should I point the other Windows 2000-based and Windows Server 2003-basedcomputers on my LAN to my ISPs DNS servers?No. If a Windows 2000-based or Windows Server 2003-based server or workstation does notfind the DC in DNS, you may experience issues joining the domain or logging on to thedomain. A Windows 2000-based or Windows Server 2003-based computers preferred DNSsetting should point to the Windows 2000 or Windows Server 2003 DC running DNS. If youare using DHCP, make sure that you view scope option #15 for the correct DNS serversettings for your LAN.Do I need to point computers that are running Windows NT 4.0 or MicrosoftWindows 95, Microsoft Windows 98, or Microsoft Windows 98 Second Edition to theWindows 2000 or Windows Server 2003 DNS server?Legacy operating systems continue to use NetBIOS for name resolution to find a DC; howeverit is recommended that you point all computers to the Windows 2000 or Windows Server2003 DNS server for name resolution.What if my Windows 2000 or Windows Server 2003 DNS server is behind a proxyserver or firewall?If you are able to query the ISPs DNS servers from behind the proxy server or firewall,Windows 2000 and Windows Server 2003 DNS server is able to query the root hint servers.UDP and TCP Port 53 should be open on the proxy server or firewall.What should I do if the DC points to itself for DNS, but the SRV records still do notappear in the zone?
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comCheck for a disjointed namespace, and then run Netdiag.exe /fix. You must install SupportTools from the Windows 2000 Server CD-ROM to run Netdiag.exe.How do I set up DNS for other DCs in the domain that are running DNS?For each additional DC that is running DNS, the preferred DNS setting is the parent DNSserver (first DC in the domain), and the alternate DNS setting is the actual IP address ofnetwork interface.How do I set up DNS for a child domain?To set up DNS for a child domain, create a delegation record on the parent DNS server for thechild DNS server. Create a secondary zone on the child DNS server that transfers the parentzone from the parent DNS server. Set the child DNS server to point to itself only.Configure DNS Dynamic Update in Windows 2000The DNS service allows client computers to dynamically update their resource records in DNSand improves DNS administration. You can use DDNS in conjunction with DHCP to updateresource records when a computers IP address is changed.How Windows 2000-Based Computers Update Their DNS NamesWindows 2000 computers try to dynamically register host address (A) and pointer (PTR)resource records. All computers register records based on their full computer name.Dynamic updates can be sent for any of the following reasons or events: • An IP address is added, removed, or modified for any one of the installed network connections. • An IP address lease changes or renews. For example, if you use the ipconfig /renew command. • You use the ipconfig /registerdns command to manually force a refresh of the client name registration in DNS. • At startup time, when the computer is turned on.When one of these events triggers a dynamic update, the DHCP Client service (not the DNSClient service) sends updates. This process is designed so that if a change to the IP addressinformation occurs because of DHCP, corresponding updates in DNS are performed tosynchronize name-to-address mappings for the computer. The DHCP Client service performsthis function for all network connections used on the system, including connections thatare not configured to use DHCP.Dynamic updates are sent or refreshed periodically. By default, Windows 2000 sends arefresh once every 24 hours. If the update occurs and there are no changes to zone data, thezone remains at its current version and no changes are written.NOTE: Names are not removed from DNS zones if they become inactive or if they are notupdated within the refresh interval (24 hours). DNS does not use a mechanism to release ortombstone names, although DNS clients do attempt to delete or update old name recordswhen a new name or address change is applied.When the DHCP Client service registers A and PTR resource records for a Windows 2000computer, it uses a default caching Time-To-Live (TTL) value of 15 minutes for host records.This value determines how long other DNS servers and clients cache a computers records
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comwhen they are included in a query response.How to Allow Only Secure Dynamic Updates 1. Click Start, point to Programs, point to Administrative Tools, and then click DNS. 2. Under DNS, expand the applicable DNS server, expand Forward Lookup Zones (or Reverse Lookup Zones) , and then click the applicable zone. 3. On the Action menu, click Properties. 4. On the General tab, verify that the zone type is Active Directory-integrated. 5. In the Allow dynamic updates? box, click Only secure updates.The secure dynamic update functionality is supported only for Active Directory-integratedzones.How to Configure DNS Dynamic Update for DHCP ClientsBy default, Windows 2000-based DHCP clients are configured to request that the clientregister the A resource record and the server register the PTR resource record. By default, thename that is used in the DNS registration is a concatenation of the computer name and theprimary DNS suffix. To change this default name, open the TCP/IP properties of your networkconnection.To change the dynamic update defaults on the dynamic update client: 1. Right-click the connection that you want to configure, and then click Properties. 2. Click Internet Protocol (TCP/IP), click Properties, click Advanced, and then click the DNS tab. By default, Register this connections address in DNS is selected and Use this connections DNS suffix in DNS registration is not selected. This default configuration causes the client to request that the client register the A resource record and the server register the PTR resource record. In this case, the name to be used in DNS registration is a concatenation of the computer name and primary DNS suffix of the computer. 3. Click to select the Use this connections DNS suffix check box in DNS registration. If you select this check box, the client requests that the server update the PTR record by using the name that is a concatenation of the computer name and the connection- specific DNS suffix. PTR record, which uses the name that is a concatenation of the computer name and the primary DNS suffix. 4. To configure the client to make no requests for DNS registration, click to clear the Register this connections address in DNS check box. If you clear this check box, the client does not attempt to register any A or PTR DNS records that correspond to this connection.DNS Dynamic Update on Statically Configured and Remote Access ClientsStatically configured clients and remote access clients do not communicate with the DHCPserver. Statically configured Windows 2000-based clients dynamically update their A and PTRresource records every time they start in case the records become corrupted in the DNSdatabase. Remote access clients dynamically update A and PTR resource records when a dial-up connection is made. They also attempt to unregister the A and PTR resource records whenthe user closes down the connection.
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comHow to Configure DNS Dynamic Update on Multiple-Homed ClientsIf a dynamic update client is multiple-homed (if it has more than one adapter and anassociated IP address), it registers all of its IP addresses with DNS by default. If you do notwant the client to register all of its IP addresses, you can configure it to not register one ormore IP addresses in the network connection properties.To prevent the computer from registering all its IP addresses: 1. Right-click My Network Places, and then click Properties. 2. Click the connection that you want to configure, and then click Properties. 3. Click Internet Protocol (TCP/IP), click Properties, click Advanced, and then click the DNS tab. 4. Click to clear the Register this connections address in DNS check box.You can also configure the computer to register its domain name in DNS. For example, if youhave a client that is connected to two different networks, you can configure the client to havea different domain name on each network.How to Configure DNS Dynamic Update on a Windows 2000 DNS Client ComputerTo configure DNS dynamic update on a Windows 2000 DNS client computer: 1. Click Start, point to Settings, and then click Network and Dial-up Connections. 2. Right-click the network connection that you want to configure, and then click Properties. 3. Click either the General tab (for the local area connection) or the Networking tab (for all other connections), click Internet Protocol (TCP/IP), and then click Properties. 4. Click Advanced, and then click the DNS tab. 5. To use DNS dynamic update to register both the IP addresses for this connection and the full computer name of the computer, click to select the Register this connections addresses in DNS check box. This check box is selected by default. 6. To configure a connection-specific DNS suffix, type the DNS suffix in the DNS suffix for this connection box. 7. To use DNS dynamic update to register the IP addresses and the connection-specific domain name for this connection, click to select the Use this connections DNS suffix in DNS registration check box. This check box is selected by default.How to Configure DNS Dynamic Update on a Windows 2000 DNS ServerTo enable DNS dynamic update on a Windows 2000 DNS server: 1. Click Start, point to Programs, point to Administrative Tools, and then click DNS. 2. Click the appropriate zone under either Forward Lookup Zones or Reverse Lookup Zones. 3. On the Action menu, click Properties. 4. On the General tab, verify that the zone type is either Primary or Active Directory- integrated. 5. If the zone type is Primary, click Yes in the Allow dynamic updates? list. 6. If the zone types is Active Directory-integrated, click either Yes or Only secure updates in the Allow dynamic updates? list, depending on whether you want DNS dynamic updates to be secure.
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.comHow to Configure DNS Dynamic Update on a Windows 2000 DHCP ServerTo configure DNS dynamic update for a Windows 2000 DHCP server: 1. Click Start, point to Programs, point to Administrative Tools, and then click DHCP. 2. Click the appropriate DHCP server or a scope on the appropriate DHCP server. 3. On the Action menu, click Properties. 4. Click the DNS tab. 5. To enable DNS dynamic update for DHCP clients that support it, click to select the Automatically update DHCP client information in DNS check box. This check box is selected by default. 6. To enable DNS dynamic update for DHCP clients that do not support it, click to select the Enable updates for DNS clients that do not support dynamic updates check box. This check box is selected by default.How to Enable DNS Dynamic Updates on a DHCP ServerWindows 2000 DHCP and DNS servers now support dynamic updates to a DNS server.Windows 2000 clients can dynamically update their forward lookup records themselves withthe DNS server after the clients obtain a new IP address from a DHCP server.In Windows 2000 DHCP server, you can dynamically update the DNS records for pre-Windows2000 clients that cannot do it for themselves. This feature currently works only with theWindows 2000 DHCP and DNS servers.To enable a DHCP server to dynamically update the DNS records of its clients: 1. Select the scope or DHCP server on which you want to permit dynamic DNS updates. 2. On the Action menu, click Properties, and then click the DNS tab. 3. Click to select the Automatically Update DHCP Client Information In DNS check box. 4. To update a clients DNS records based on the type of DHCP request that the client makes and only when it is requested, click Update DNS Only If DHCP Client Requests. 5. To always update a clients forward and reverse lookup records, click Always Update DNS. 6. Click to select the Discard Forward Lookups When Leases Expire check box to have the DHCP server delete the Host resource record for a client when its DHCP lease expires and is not renewed. 7. Click to select the Enable Updates For DNS Clients That Do Not Support Dynamic Updates check box to enable the DHCP server to update the forward and reverse lookup records for clients that cannot update their own forward lookup records. If you do not select this check box, the DHCP server does not automatically update the DNS records of non-Windows 2000 clients.How to Create a DNS Entry for the Web ServerCreate an alias or CNAME record for the DNS server on which you configured IIS. This stepensures that external host computers can connect to your Web server by using the "www"host name. To do this: 1. Start the DNS snap-in. 2. Under DNS, expand Server1 (where Server1 is the host name of the DNS server).
Sanjo Thomas, CCNA, MCSE, MCDBA Sanjo900@yahoo.com 3. Expand Forward Lookup Zones. 4. Under Forward Lookup Zones, right-click the zone that you want (for example, Microsoft.com), and then click New Alias. 5. In the Alias name box, type www. 6. In the Fully qualified name for target host box, type the fully qualified host name of the DNS server on which IIS is installed. For example, type dns.microsoft.com, and then click OK.How to Configure a Secondary Name Server in Windows 2000Identify the Secondary Name ServerOn the primary DNS server, identify an additional name server: 1. Open DNS MMC. 2. In the console tree, click Host name (where Host name is the host name of the DNS server). 3. In the console tree, click Forward Lookup Zones. 4. Right-click the zone that you want (for example, example.com), and then click Properties. 5. Click the Name Servers tab, and then click Add. 6. In the Server name box, type the host name of the server that you want to add, for example, namesvr2.example.com. 7. In the IP address box, type the IP address of the name server that you want to add (for example, 192.168.0.22), and then click Add. 8. Click OK, and then click OK. 9. In the console tree, click Reverse Lookup Zones, right-click the zone that you want, and then click Properties. 10. Click the Name Servers tab, and then click Add. 11. In the Server name box, type the host name of the server that you want to add, for example, namesvr2.example.com. 12. In the IP address box, type the IP address of the name server that you want to add (for example, 192.168.0.22), and then click Add. 13. Click OK, and then click OK.Install DNS on the Secondary Name Server 1. To install the DNS service through Add/Remove Programs.Configure the Forward Lookup ZoneTo configure the forward lookup zone on the secondary name server: 1. Open the DNS MMC in the Secondary Name Server. 2. In the console tree, under DNS, click Host name (where Host name is the host name of the DNS server). 3. In the console tree, click Forward Lookup Zones. 4. Right-click Forward Lookup Zones, and then click New Zone. 5. When the New Zone Wizard starts, click Next to continue. 6. Click Standard secondary, and then click Next. 7. In the Name box, type the name of the zone (for example, example.com), and then click Next. 8. On the Master DNS Servers page, type the IP address of the primary name server for this zone, click Add, click Next, and then click Finish.