Table Of ContentNETWORKING
MCSA Guide to
ldenti� with
®
Windows Server 2016
MCSE/MCSA
Exam #70-74 2
.
--,
,, � CENGAGE�
r
L
.@. .w.fj
,.
Pil.•... .
. C!f' ... - ~
FQC00AABN10412
I
J
Microsoft Certification Exam Objectives
Exam #70-742: Identity with Windows Server 2016
Objective Chapter
Install and configure domain controllers 1, 6, 7
Create and manage Active Directory users and comp _2,4
Create and manage Active Directory groups and o
Manage and maintain AD DS (15-20%)
Configure service authentication and account pol
Maintain Active Directory
Configure Active Directory in a complex enterprl
Create and manage Group Policy (25-30%)
Create and manage Group Policy Objects (GPO
Configure Group Policy processing
Configure Group Policy settings
Configure Group Policy preferences
Implement Active Directory Certificate Se
Install and configure AD CS
Manage certificates
Implement identity federation and access
Install and configure Active Directory Federati
Implement Web Application Proxy (WAP)
Install and configure Active Directory Rights M
I•
N ETW O RI{ I NG
MCSA Guide to
Identify with · .
Windows Server® 2016
MCSE/MCSA
. ~'
·-
~~•~ CENGAGE
. Australia • Brazil • Mexico • Singapore • United Kingdom • United States
·-
~.,,'~ CENGAGE
MCSA Guide to Identity with Windows © 2018 Cengage Learning, Inc.
Server 2016, Exam 70-742 Unless otherwise noted, all content is© Cengage.
GregTomsho
ALL RIGHTS RESERVED. No part of this work covered by the copyright herein
may be reproduced or distributed in any form or by any means, except as
SVP, GM Skills: Jonathan Lau permitted by U.S. copyright law, without the prior written permission of the
copyright owner.
Product Director: Lauren Murphy
Some of the product names and company names used in this book have been
Product Team Manager: Kristin McNary used for identification purposes only and may be trademarks or registered trade
marks of their respective manufacturers and sellers.
Associate Product Manager: Amy Savino
Windows® is a registered trademark of Microsoft Corporation. Microsoft® is a regis
Executive Director of Development: Ma rah tered trademark of Microsoft Corporation in the United States and/or other countries.
Bellegarde Cengage is an independent entity from Microsoft Corporation and not affiliated
with Microsoft in any manner.
Senior Product Development Manager:
Leigh Hefferon
For product information and technology assistance, contact us at
Content Development Manager: Jill Gallagher Cengage Customer & Sales Support, 1-800-354-9706
Senior Content Developer: Michelle Ruelas
For permission to use material from this text or product, submit all
Cannistraci
requests on line at www.cengage.com/permissions.
Further permissions questions can be e-mailed to
Product Assistant: Jake Toth
[email protected]
Marketing Director: Michele McTighe
Production Director: Patty Stephan
Library of Congress Control Number: 2017953117
Senior Content Project Manager: Brooke
Student Edition ISBN: 978-1-337-40089-3
Greenhouse
Loose-leaf Edition ISBN: 978-1-337-68570-2
Senior Designer: Diana Graham Cengage
20 Channel Center Street
Cover image: iStockPhoto.com/loops7
Boston, MA 02210
Production Service/Composition: SPi Global USA
(engage is a leading provider of customized learning solutions with
employees residing in nearly 40 different countries and sales in more than
125 countries around the world. Find your local representative at
www.cengage.com.
Cengage products are represented in Canada by Nelson Education, Ltd.
To learn more about Cengage platforms and services, visit www.cengage.com
Purchase any of our products at your local college store or at our preferred
on line store www.cengagebrain.com
Notice to the Reader
Publisher does not warrant or guarantee any of the products described herein or perform any independent analysis in connection with
any of the product information contained herein. Publisher does not assume, and expressly disclaims, any obligation to obtain and include
information other than that provided to it by the manufacturer. The reader is expressly warned to consider and adopt all safety precautions
t~at might be indicated by the activities described herein and to avoid all potential hazards. By following the instructions contained herein,
the reader willingly assumes all risks in connection with such instructions. The publisher makes no representations or warranties of any kind,
including but not limited to, the warranties of fitness for particular purpose or merchantability, nor are any such representations implied with
respect to the material set forth herein, and the publisher takes no responsibility with respect to such material. The publisher shall.not be liable
for any special, consequential, or exerriplar1 damages resulting, in whole or part, from the readers' use of, or reliance upon, this material.
-
Printed in the United States of America
Print Number: 01 Print Year: 2017
Brief Contents
INTRODUCTION ................................................................................................... xi
ii=t4:idll
Introducing Active Directory .............................................................................. 1
ii=hi:id;fj
Managing OUs and Active Directory Accounts ............................................... 53
dlhi:iH;II
User and Service Account Configuration ...................................................... 109
ii:6i:id;I•
Configuring Group Policies ............................................................................. 135
G=t4:iHSi
Managing Group Policies ................................................................................ 189
G:t4i:iHOOi
Domain Controller and Active Directory Management .............................. 225
G=t4:id;iJ
Configuring Advanced Active Directory ........................................................ 267
Glt4:id;i:i
Implementing Active Directory Certificate Services ........... ~ ........................ 321
G=t4:iH;I•
Implementing Identity Solutions ................................................................... 359
fii4AHMf!f41
MCSA Exam 70-742 Objectives ....................................................................... 401
GLOSSARY ......................................................................................................... 407
INDEX ................................................................................................................ 417
-
Table of Contents
I NTROD UCTI ON .....................................................................................................................x i
G:t4U•H;ii
Introducing Active Directory .............................................................................1
The Role of a Directory Service .......................................................................................................... 2
Windows Active Directory .................................................................................................................... 2
Overview of the Active Directory Structure .................................................................................... 3
Installing Active Directory .................................................................................................................... 7
Installing Additional Domain Controllers in a Domain .............................................................. 9
Installing a New Domain in an Existing Forest.. .......................................................................... 11
Installing Active Directory in Server Core ...................................................................................... 12
Installing a DC with Install from Media .......................................................................................... 13
What's Inside Active Directory? ...................................................................................................... 16
The Active Directory Schema ............................. ,, . ..................... ,. .... ,. .... ,. ......................................... 18
Active Directory Container Objects ............. ,. .... ,. ............................ ,. .... ,. ...., . ................................... 19
Active Directory Leaf Objects ............................................................................................................ 20
Recovering Objects with the Active Directory Recycle Bin ....................................................... 22
Locating Active Directory Objects ..................................................................................................... 22
Working with Forests, Trees, and Domains ................................................................................ 30
Active Directory Terminology ................................... ,. ...................... ,. .......... ,. ................................... 31
The Role of Forests ............................................................................................................................... 34
Understanding Domains and Trees .............................................................................. ,. ................. 36
Introducing Group Policies ............................................................................................................... 40
The Computer Configuration Node ................................................................................................. 42
The User Configuration Node ............................................................... :. ........................................... 42
How Group Policies Are Applied ...................................................................................................... 43
Chapter Summary ................................................................................................................................ 48
Key Terms ................................................................................... :. ........................................................... SO
Review Questions ................................................................................................................................. 50
Managing OUs and Active Directory Accounts ....................................... 53
Working with Organizational Units ............................................................................................... 54
OU Delegation of Control .................................................................................................................... 57
Active Directory Object Permissions ............................................................................................... 57
Managing User Accounts .................................................................................................................. 62
Creating and Modifying User Accounts ......................................................................................... 64
Understanding Account Properties ................................................................................................. 68
Using Contacts and Distribution Groups ....................................................................................... 73 -
- Table of Contents
Managing Group Accounts ............................................................................................................... 79
Group Types ........................................................................................................................................... 79
Group Scope .......................................................................................................................................... 80
Nesting Groups ...................................................................................................................................... 84
Converting Group Scope .............................................................., . ................................, . ................... 85
Default Groups in a Windows Domain .......................................................................................... 85
Working with Computer Accounts ................................................................................................ 90
Creating Computer Accounts ............................................................, . .............................................. 90
Automating Account Management ............................................................................................... 96
Command-Line Tools for Managing Active Directory Objects ............................................... 96
Bulk Import and Export with csvde and ldifde ........................................................... 98
Creating Users with ldifde .............................................................................................. 100
Managing Accounts with PowerShell .......................................................................................... 100
Chapter Summary .............................................................................................................................. 104
Key Terms .............................................................................................................................................. 105
Review Questions ............................................................................................................................... 105
U#ttiAH#I
User and Service Account Configuration ................................................ 109
Overview of User Accounts and Group Policies ..................................................................... 11O
Creating and Configuring Group Policies ..................................................................................... 110
Configuring Account Policies ......................................................................................................... 111
Delegating Password Settings Management .................................................., . ........, , ...., . ............ 114
Local Account Policies ........................................................................................................................ 115
Kerberos Policy Settings ..................................................................................................................... 115
Configuring Password Settings Objects ..................................................................................... 122
Creating and Configuring a PSO ..................................................................................................... 122
Managing Service Accounts ........................................................................................................... 124
Working with Service Accounts ...................................................................................................... 125
Working with Managed Service Accounts ................................................................................... .127
Kerberos Delegation ................................................................................................., . ........................ 129
Chapter Summary .............................................................................................................................. 130
Key Terms .............................................................................................................................................. 131
Review Questions. .............................................................................................................................. 131
l•#tuAHil•
Configuring Group Policies ............................................................................ 135
Group Policy Objects. ........................................................................................................................ 136
Local and Domain Group Policy Objects .......................................................................................1 37
Group Policy Replication ............... ,. ..................................................................................................1 41
Creating and Linking GPOs ............................................................................................................... 141
Group Policy Settings ........................................................................................................................ 152
Software Installation Policies ....... ,. .... ,. .... ,. ..................... ,. .............................................................. .153
Deploying Scripts ............. ,. ...., . .................................................. ,. ..., . ......... ,. .... ,. ................................. 156
Folder Redirection ............................................................................................................................... .157
Security Settings .................................................................................................................... ·.·. .......... 160
Local Policies: Audit Policy ............................................................................................................... .161
TableofContents . .
Working with Administrative Templates ................................................................................... 167
Computer Configuration Settings ................................................................................................... 167
User Configuration Settings ............................................................................................................. 169
The ADMX Central Store ................................................................................................................... 169
Working with Filters .......................................................................................................................... 170
Using Custom Administrative Templates ..................................................................................... 171
Migrating Administrative Templates ............................................................................................ .172
Working with Security Templates ................................................................................................ 175
The Security Templates Snap-in .................................................................................................... .175
The Security Configuration and Analysis Snap-in ................................................................... 176
Configuring Group Policy Preferences ....................................................................................... 176
How Group Policy Preferences Are Applied ................................................................................. 177
Creating Group Policy Preferences ................................................................................................. 178
Chap~er Summary .............................................................................................................................. 183
Key Terms .............................................................................................................................................. 184
Review Questions ............................................................................................................................... 185
h#t4i:1Uh4i
Managing Group Policies ................................................................................ 189
Configuring Group Policy Processing .......................................................................................... 190
GPO Scope and Precedence ............................................................................................................. .190
Group Policy Inheritance .................................................................................................................. .191
Managing GPO Status and Link Status ..................................: . ..................................................... 193
GPO Filtering ........................................................................................................................................ 194
Loop back Policy Processing ........................... :···· ............................................................................. 198
Configuring Group Policy Client Processing ............................................................................. 203
Configuring Slow Link Processing ................................................................................................ 203
Changing Background Processing ......., . ... ,,,. ......., , .......... ,,.,,.,. ..... ,. ........, .,. ... ,.,, ..... ,,.,,., .. ,,, .. ,,., .. ,. . 205
Processing Unchanged Policies ...................................................................................................... .207
Synchronous and Asynchronous Processing .................................................. ,. ........................ 208
Group Policy Caching ........................................................................................................................ 208
Forcing Group Policy Updates ........................................................................................................ 209
Group Policy Results and Modeling ............................................................................................ 212
Managing GPOs ...................................................................................................................................2 15
GPO Backup and Restore ............................., . .......................................................................... ,. ........ 215
GPO Migration ...................................................................................................................................... 217
GPO Management Delegation ......................................................................................................... 218
PowerShell Cmdlets for Managing GPOs ..................................................................................... 219
Chapter Summary .............................................................................................................................. 221
Key Terms .............................................................................................................................................. 221
Review Questions ............................................................................................................................... 222
l•#t4i:IH;d
Domain Controller and Active Directory Management.. .................. 225
Active Directory Review ................................................................................................................... 226
Cloning a Virtual Domain Controller ........................................................................................... 227
Domain Controller Cloning Prerequisites .................................................................................... 227
Steps for Cloning a Domain Controller.. ....................................................................................... 227
- TableofContents
Configuring Read Only Domain Controllers ............................................................................. 229
RODC Installation ............................................................................................................................... 229
Staged RODC Installation. .................................................................................................................. 231
RODC Replication .................................. ,. ............................................................................................ 234
Read Only DNS .................................................................................................................................... 235
Understanding and Configuring Sites ........................................................................................ 238
Site Components ................................................................................................... ,, ......... ,. .................2 39
The Global Catalog and Universal Group Membership Caching ........................................... 242
Working with Operations Master Roles ..................................................................................... 244
Operations Master Best Practices ...................................................................................................2 45
Schema Master ..................................................... ,. ..................... ,. ...................................................... 245
Managing Operations Master Roles ...................................... ,. ........................................... ,. ........ .246
Maintaining Active Directory ......................................................................................................... 249
Active Directory Backup ................................................................................................................... 250
System State Backup ........................................................ ,. ............................................................... 250
Active Directory Restorations ........................................................................................................... 251
Recovering Deleted Objects from the Recycle Bin ..................................................................... 252
Active Directory Defragmentation ................................................................................................. 253
Active Directory Metadata Cleanup .............................................. ,. ............................................... 254
Working with Active Directory Snapshots .................................................................................. 254
Chapter Summary .............................................................................................................................. 260
Key Terms .............................................................................................................................................. 261
Review Questions ............................................................................................................................... 262
P=MiHM
Configuring Advanced Active Directory ................................................... 267
Configuring Multidomain Environments .................................................................................. 268
Reasons for a Single-Domain Environment ..... ,. .... ,. .......................... ,. ................................... ,. . 268
Reasons for a Multidomain Environment .................................................................................. 269
Adding a Subdomain ............................................................................ ,. ........................................... 270
Adding a Tree to an Existing Forest. ........................... ,. .......... ,. .................................................... .270
Configuring an Alternative UPN Suffix ........................................, . ................................................2 71
Configuring M ultiforest Environments ......................................................................... ,. ........... 276
Active Directory Trusts ..................................................................................................................... 278
One-Way and Two-Way Trusts ...................................................................................................... 279
Transitive Trusts ....................... ,. ............................................. ,. ......................................................... 279
Shortcut Trusts .................................................................... ,. .............................. ,. ......... ,. ........., . ....... 280
Forest Trusts ............................................ ,. .... ,. ... :,. ..................................... ,. ........................................ 281
External Trusts and Realm Trusts ............................, . .... ,. ..., . .... ,. ................... ,. ... ,. ... ,. .................... 282
Configuring Active Directory Trusts ............................................................................................ 282
Configuring Shortcut Trusts ............................................., . .........., . ... ,. ... ,. ......... ,. ................... ,. ........ 283
Configuring Forest Trusts ................................. ,. ................................ ,. ................... ,. ............... ,. ....... 284
Configuring External and Realm Trusts ........................ ,. .............. ,. ............................................. 286
Configuring Trust Properties .......... ,. ............... ,. ........., . ................ ,. ... ,. ., , ....., , ......... ,. ....................... 286
The Authentication Tab ............................... ,. .......................... ,. .... ,. ............................. ,. .................. 288
Upgrading Domains and Forests .................................................................................................. 291
Forest Functional Levels ................................................................................................................... 291
Domain Functional Levels ............................................................................................................... 293
