MCSE Windows Server 2003 active directory planning, implementation, and maintenance study guide

527 Pages·2006·14.19 MB·English

by  Robert Shimonski

4451fm.fm Page iii Tuesday, January 3, 2006 9:06 PM
MCSE:
Windows® Server 2003
Active Directory Planning,
Implementation, and
Maintenance
Study Guide
Second Edition
Robert Shimonski, James Chellis, Anil Desai
Wiley Publishing, Inc.
4451fm.fm Page iv Tuesday, December 20, 2005 2:27 PM
Acquisitions and Development Editor: Maureen Adams sional person should be sought. Neither the publisher nor
Technical Editor: Craig Vazquez the author shall be liable for damages arising herefrom.
Production Editors: Helen Song, Rachel Gunn The fact that an organization or Website is referred to in
Copy Editor: Rebecca Rider this work as a citation and/or a potential source of further
Production Manager: Tim Tate information does not mean that the author or the pub-
Vice President & Executive Group Publisher: lisher endorses the information the organization or Web-
Richard Swadley site may provide or recommendations it may make.
Vice President and Executive Publisher: Further, readers should be aware that Internet Websites
Joseph B. Wikert listed in this work may have changed or disappeared
Vice President and Publisher: Neil Edde between when this work was written and when it is read.
Media Project Supervisor: Shannon Walters
For general information on our other products and services
Media Development Specialist: Kit Malone
or to obtain technical support, please contact our Cus-
Media Quality Assurance: Kate Jenkins
tomer Care Department within the U.S. at [phone],
Illustrator: Jeffrey Wilson,
outside the U.S. at [phone] or fax [phone].
Happenstance Type-O-Rama
Compositor: Craig Woods, Wiley also publishes its books in a variety of electronic
Happenstance Type-O-Rama formats. Some content that appears in print may not be
Proofreader: Nancy Riddiough available in electronic books.
Indexer: Nancy Guenther
Cover Design: Archer Design TRADEMARKS: Wiley, the Wiley logo, Sybex, and
Cover Photograph: Photodisc and Victor Arre related trademarks and trade dress are trademarks or
Copyright © 2006 by Wiley Publishing, Inc., registered trademarks of John Wiley & Sons, Inc. and/or
Indianapolis, IN its affiliates in the United States and other countries, and
Published by Wiley Publishing, Inc., Indianapolis, IN may not be used without written permission. All other
Published simultaneously in Canada trademarks are the property of their respective owners.
First edition copyright © 2003 SYBEX Inc. Wiley Publishing, Inc. is not associated with any product
ISBN-13: 978-0-7821-4451-2 or vendor mentioned in this book.
ISBN-10: 0-7821-4451-9
Screen reproductions produced with FullShot 99. FullShot
No part of this publication may be reproduced, stored in 99 © 1991-1999 Inbit Incorporated. All rights reserved.
a retrieval system or transmitted in any form or by any
FullShot is a trademark of Inbit Incorporated.
means, electronic, mechanical, photocopying, recording,
scanning or otherwise, except as permitted under Sections The CD interface was created using Macromedia Direc-
107 or 108 of the 1976 United States Copyright Act, with- tor, COPYRIGHT 1994, 1997-1999 Macromedia Inc.
out either the prior written permission of the Publisher, For more information on Macromedia and Macromedia
or authorization through payment of the appropriate Director, visit http://www.macromedia.com.
per-copy fee to the Copyright Clearance Center, 222
Microsoft ® Internet Explorer © 1996 Microsoft Corpo-
Rosewood Drive, Danvers, MA 01923, [phone],
ration. All rights reserved. Microsoft, the Microsoft
fax [phone]. Requests to the Publisher for permis-
Internet Explorer logo, Windows, Windows NT, and the
sion should be addressed to the Legal Department, Wiley
Windows logo are either registered trademarks or trade-
Publishing, Inc., 10475 Crosspoint Blvd., Indianapolis, IN
marks of Microsoft Corporation in the United States
46256, [phone], fax [phone], or online at
and/or other countries.
http://www.wiley.com/go/permissions.
WILEY is an independent entity from Microsoft Corpo-
Limit of Liability/Disclaimer of Warranty: The publisher
ration, and not affiliated with Microsoft Corporation in
and the author make no representations or warranties
any manner. This publication may be used in assisting
with respect to the accuracy or completeness of the con-
students to prepare for a Microsoft Certified Professional
tents of this work and specifically disclaim all warranties,
Exam. Neither Microsoft Corporation, its designated
including without limitation warranties of fitness for a
review company, nor WILEY warrants that use of this
particular purpose. No warranty may be created or
publication will ensure passing the relevant exam.
extended by sales or promotional materials. The advice
Microsoft is either a registered trademark or trademark
and strategies contained herein may not be suitable for
of Microsoft Corporation in the United States and/or
every situation. This work is sold with the understanding
other countries.
that the publisher is not engaged in rendering legal,
accounting, or other professional services. If professional Manufactured in the United States of America
assistance is required, the services of a competent profes-
10 9 8 7 6 5 4 3 2 1
4451fm.fm Page v Thursday, December 15, 2005 9:33 PM
To Our Valued Readers:
Thank you for looking to Sybex for your Microsoft exam prep needs. The Sybex team is
proud of its reputation for providing certification candidates with the practical knowledge
and skills needed to succeed in the highly competitive IT marketplace. Just as the Microsoft
Training & Certification is committed to establishing measurable standards for certifying
individuals who will support Windows systems worldwide, Sybex is committed to providing
those individuals with the skills needed to meet those standards.
The authors and editors have worked hard to ensure that the updated edition you hold in
your hands is comprehensive, in-depth, and pedagogically sound. We’re confident that this
book will exceed the demanding standards of the certification marketplace and help you, the
Microsoft certification candidate, succeed in your endeavors.
As always, your feedback is important to us. If you believe you’ve identified an error in the
book, please visit the Customer Support section of the Wiley web site. And if you have general
comments or suggestions, feel free to drop me a line directly at [email protected]. At Sybex
we’re continually striving to meet the needs of individuals preparing for certification exams.
Good luck in pursuit of your Microsoft certification!
Neil Edde
Vice President & Publisher
Wiley Publishing, Inc.
4451fm.fm Page vi Tuesday, January 3, 2006 9:06 PM
Wiley Publishing, Inc. End-User License Agreement (60) days from the date of purchase of this Book. If WPI
READ THIS. You should carefully read these terms and receives notification within the warranty period of
conditions before opening the software packet(s) defects in materials or workmanship, WPI will replace
included with this book “Book”. This is a license agree- the defective Software Media. (b) WPI AND THE
ment “Agreement” between you and Wiley Publishing, AUTHOR OF THE BOOK DISCLAIM ALL OTHER
Inc.”WPI”. By opening the accompanying software WARRANTIES, EXPRESS OR IMPLIED, INCLUD-
packet(s), you acknowledge that you have read and ING WITHOUT LIMITATION IMPLIED WARRAN-
accept the following terms and conditions. If you do not TIES OF MERCHANTABILITY AND FITNESS FOR
agree and do not want to be bound by such terms and A PARTICULAR PURPOSE, WITH RESPECT TO
conditions, promptly return the Book and the unopened THE SOFTWARE, THE PROGRAMS, THE SOURCE
software packet(s) to the place you obtained them for a CODE CONTAINED THEREIN, AND/OR THE
full refund. TECHNIQUES DESCRIBED IN THIS BOOK. WPI
1. License Grant. WPI grants to you (either an individual DOES NOT WARRANT THAT THE FUNCTIONS
or entity) a nonexclusive license to use one copy of the CONTAINED IN THE SOFTWARE WILL MEET
enclosed software program( s) (collectively, the “Soft- YOUR REQUIREMENTS OR THAT THE OPERA-
ware” solely for your own personal or business purposes TION OF THE SOFTWARE WILL BE ERROR FREE.
on a single computer (whether a standard computer or a (c) This limited warranty gives you specific legal rights,
workstation component of a multi-user network). The and you may have other rights that vary from jurisdic-
Software is in use on a computer when it is loaded into tion to jurisdiction.
temporary memory (RAM) or installed into permanent 6. Remedies. (a) WPI’s entire liability and your exclusive
memory (hard disk, CDROM, or other storage device). remedy for defects in materials and workmanship shall
WPI reserves all rights not expressly granted herein. be limited to replacement of the Software Media, which
2. Ownership. WPI is the owner of all right, title, and may be returned to WPI with a copy of your receipt at
interest, including copyright, in and to the compilation the following address: Software Media Fulfillment
of the Software recorded on the disk(s) or CD-ROM Department, Attn.: MCSE: Windows Server 2003
“Software Media”. Copyright to the individual pro- Active Directory Planning, Implementation, and Main-
grams recorded on the Software Media is owned by the tenance Study Guide, Second Edition (70-294), Wiley
author or other authorized copyright owner of each pro- Publishing, Inc., 10475 Crosspoint Blvd., Indianapolis,
gram. Ownership of the Software and all proprietary IN 46256, or call 1-800-762-2974. Please allow four to
rights relating thereto remain with WPI and its licensers. six weeks for delivery. This Limited Warranty is void if
3. Restrictions On Use and Transfer. (a) You may only failure of the Software Media has resulted from accident,
(i) make one copy of the Software for backup or archival abuse, or misapplication. Any replacement Software
purposes, or (ii) transfer the Software to a single hard Media will be warranted for the remainder of the origi-
disk, provided that you keep the original for backup or nal warranty period or thirty (30) days, whichever is
archival purposes. You may not (i) rent or lease the Soft- longer. (b) In no event shall WPI or the author be liable
ware, (ii) copy or reproduce the Software through a for any damages whatsoever (including without limita-
LAN or other network system or through any computer tion damages for loss of business profits, business inter-
subscriber system or bulletin- board system, or (iii) mod- ruption, loss of business information, or any other
ify, adapt, or create derivative works based on the Soft- pecuniary loss) arising from the use of or inability to use
ware. (b) You may not reverse engineer, decompile, or the Book or the Software, even if WPI has been advised
disassemble the Software. You may transfer the Soft- of the possibility of such damages. (c) Because some
ware and user documentation on a permanent basis, jurisdictions do not allow the exclusion or limitation of
provided that the transferee agrees to accept the terms liability for consequential or incidental damages, the
and conditions of this Agreement and you retain no cop- above limitation or exclusion may not apply to you.
ies. If the Software is an update or has been updated, any 7. U.S. Government Restricted Rights. Use, duplication,
transfer must include the most recent update and all or disclosure of the Software for or on behalf of the
prior versions. United States of America, its agencies and/or instrumen-
4. Restrictions on Use of Individual Programs. You must talities "U.S. Government" is subject to restrictions as
follow the individual requirements and restrictions stated in paragraph (c)(1)(ii) of the Rights in Technical
detailed for each individual program in the About the Data and Computer Software clause of DFARS
CD-ROM appendix of this Book. These limitations are 252.227-7013, or subparagraphs (c) (1) and (2) of the
also contained in the individual license agreements Commercial Computer Software - Restricted Rights
recorded on the Software Media. These limitations may clause at FAR 52.227-19, and in similar clauses in the
include a requirement that after using the program for a NASA FAR supplement, as applicable.
specified period of time, the user must pay a registration 8. General. This Agreement constitutes the entire under-
fee or discontinue use. By opening the Software standing of the parties and revokes and supersedes all
packet(s), you will be agreeing to abide by the licenses prior agreements, oral or written, between them and may
and restrictions for these individual programs that are not be modified or amended except in a writing signed by
detailed in the About the CD-ROM appendix and on the both parties hereto that specifically refers to this Agree-
Software Media. None of the material on this Software ment. This Agreement shall take precedence over any
Media or listed in this Book may ever be redistributed, in other documents that may be in conflict herewith. If any
original or modified form, for commercial purposes. one or more provisions contained in this Agreement are
5. Limited Warranty. (a) WPI warrants that the Software held by any court or tribunal to be invalid, illegal, or oth-
and Software Media are free from defects in materials erwise unenforceable, each and every other provision
and workmanship under normal use for a period of sixty shall remain in full force and effect.
4451fm.fm Page vii Thursday, December 15, 2005 9:33 PM
Acknowledgments
This book is the work of a great team. First I’d like to thank my copy editor Rebecca Rider for
her excellent job on the editing process. The production editor, Helen Song, was always a pleasure
to work with and kept the book moving along and on schedule. Thanks also to technical editor
Craig Vazquez for his thorough edit and for keeping me honest.
I would also like to thank Neil Edde, Publisher, and James Chellis who both helped develop
and nurtured the MCSA and MCSE series of books since the beginning; and Maureen Adams,
Acquisitions and Developmental Editor, for all of her hard work on the initial development of
the book and its format and keeping the project on track. I’d also like to thank the proofreader
Nancy Riddiough and the indexer Nancy Guenther as this book’s success was truly a team effort.
4451fm.fm Page ix Thursday, December 15, 2005 9:33 PM
Contents at a Glance
Introduction xix
Assessment Test xxviii
Chapter 1 Overview of Active Directory 1
Chapter 2 Planning and Installing Active Directory 35
Chapter 3 Installing and Managing Trees and Forests 103
Chapter 4 Configuring Sites and Managing Replication 149
Chapter 5 Administering Active Directory 203
Chapter 6 Planning Security for Active Directory 257
Chapter 7 Active Directory Optimization and Reliability 313
Chapter 8 Planning, Implementing, and Managing Group Policy 377
Chapter 9 Software Deployment through Group Policy 429
Glossary 469
Index 481
4451fm.fm Page xi Thursday, December 15, 2005 9:33 PM
Contents
Introduction xix
Assessment Test xxviii
Chapter 1 Overview of Active Directory 1
The Industry before Active Directory 3
The Benefits of Windows NT 4 3
The Domain Model in Windows NT 4 5
The Limitations of Windows NT 4 6
The Benefits of Active Directory 9
Active Directory’s Logical Structure 11
Components and Mechanisms of Active Directory 12
An Overview of Active Directory Domains 14
Using Multiple Domains 16
Creating a Domain Structure with Organizational Units 18
Active Directory Object Names 19
User, Computer, and Group Objects 20
Active Directory’s Physical Structure 21
Server Roles within Active Directory 21
Accessing Active Directory through LDAP 24
Managing Replication with Sites 24
Active Directory Names and DNS 25
Summary 27
Exam Essentials 27
Review Questions 28
Answers to Review Questions 32
Chapter 2 Planning and Installing Active Directory 35
Preparing for Active Directory Installation 36
Planning and Installing DNS 37
Verifying the File System 66
Verifying Network Connectivity 69
Determining the Domain Functional Level 71
Planning the Domain Structure 74
Installing Active Directory 75
Verifying Active Directory Installation 81
Using Event Viewer 81
Using Active Directory Administrative Tools 83
Testing from Clients 85
Creating and Configuring Application Data Partitions 86
Creating Application Data Partitions 87
Managing Replicas 89
4451fm.fm Page xii Thursday, December 15, 2005 9:33 PM
xii Contents
Removing Replicas 89
Using ntdsutil to Manage Application Data Partitions 90
Configuring DNS Integration with Active Directory 92
Summary 94
Exam Essentials 94
Review Questions 96
Answers to Review Questions 101
Chapter 3 Installing and Managing Trees and Forests 103
Reasons for Creating Multiple Domains 104
Reasons for Using Multiple Domains 104
Drawbacks of Multiple Domains 107
Creating Domain Trees and Forests 107
Planning Trees and Forests 108
The Promotion Process 111
Creating a Domain Tree 112
Joining a New Domain Tree to a Forest 119
Adding Additional Domain Controllers 124
Demoting a Domain Controller 125
Managing Multiple Domains 127
Managing Single Master Operations 127
Managing Trusts 130
Managing UPN Suffixes 136
Managing Global Catalog Servers 137
Summary 138
Exam Essentials 139
Review Questions 141
Answers to Review Questions 146
Chapter 4 Configuring Sites and Managing Replication 149
Overview of Active Directory Physical Components 150
Active Directory Replication 152
Active Directory Site Concepts 153
Planning Your Sites 155
Implementing Sites and Subnets 156
Creating Sites 158
Creating Subnets 158
Configuring Sites 163
Configuring Replication 166
Intrasite Replication 167
Intersite Replication 167
Configuring Server Topology 178
4451fm.fm Page xiii Thursday, December 15, 2005 9:33 PM
Contents xiii
Monitoring and Troubleshooting Active Directory
Replication 181
Using System Monitor 181
Troubleshooting Replication 181
Summary 185
Exam Essentials 191
Review Questions 193
Answers to Review Questions 200
Chapter 5 Administering Active Directory 203
An Overview of OUs 204
The Purpose of OUs 205
Benefits of OUs 205
Planning the OU Structure 206
Logical Grouping of Resources 206
Understanding OU Inheritance 208
Delegation of Administrative Control 208
Applying Group Policy 210
Creating OUs 210
Managing OUs 214
Moving, Deleting, and Renaming OUs 215
Administering Properties of OUs 216
Delegating Control of OUs 218
Troubleshooting OUs 222
Creating and Managing Active Directory Objects 223
Overview of Active Directory Objects 223
Managing Object Properties 229
Filtering and Advanced Active Directory Features 232
Moving, Renaming, and Deleting Active
Directory Objects 233
Resetting an Existing Computer Account 235
Publishing Active Directory Objects 235
Making Active Directory Objects Available
to Users 235
Publishing Printers 236
Publishing Shared Folders 241
Querying Active Directory 242
Summary 245
Exam Essentials 245
Review Questions 246
Answers to Review Questions 254