Mike Meyers' MCSE/MCSA Windows Server 2003 Active Directory Certification Passport (Exam 70-294)

385 Pages·2003·6.518 MB·English

by  Culp, Brian

Y

L
F

M

A

E

T

Team-Fly®
Passport/ MCSE/MCSA Windows Server 2003 Active Directory Certification Passport / Culp / 222575-0 /
FM:i
Active Directory
BBRRIIAANNCCCUUULLLPPP
New York • Chicago (cid:127) San Francisco
Lisbon (cid:127) London (cid:127) Madrid (cid:127) Mexico City
Milan (cid:127) New Delhi (cid:127) San Juan
Seoul (cid:127) Singapore (cid:127) Sydney (cid:127) Toronto
Color proPfaislsep: oGretne/ rMicC SCMEY/KM pCrSinAt eWr inprdoofwilse Server 2003 Active Directory Certification Passport / Culp / 222575-0 /
Composite Default screen
Chapter1
McGraw-Hill/Osborne
2100 Powell Street,10thFloor
Emeryville,California 94608
U.S.A.
To arrange bulk purchase discounts for sales promotions, premiums, or fund-
raisers,pleasecontactMcGraw-Hill/Osborneattheaboveaddress.Forinformation
ontranslationsorbookdistributorsoutsidetheU.S.A.,pleaseseetheInternational
Contact Information page immediately following the index ofthis book.
Mike Meyers’ MCSE/MCSA Windows® Server 2003 Active Directory
Certification Passport (Exam 70-294)
Copyright©2003byTheMcGraw-HillCompanies.Allrightsreserved.Printedinthe
UnitedStatesofAmerica.ExceptaspermittedundertheCopyrightActof1976,nopart
ofthispublicationmaybereproducedordistributedinanyformorbyanymeans,or
stored in a database or retrieval system, without the prior written permission of
publisher,with the exception that the program listings may be entered,stored,and
executedinacomputersystem,buttheymaynotbereproducedforpublication.
1234567890 DOC DOC 019876543
Book p/n 0-07-222576-9 and CD p/n 0-07-222577-7
parts of
ISBN 0-07-222575-0
Publisher Proofreaders
Brandon A.Nordin Dan Esch,Claire Splan
Vice President & Associate Publisher Indexer
Scott Rogers Jack Lewis
Acquisitions Editor Composition
Nancy Maragioglio Carie Abrew,John Patrus
Project Editor Illustrators
Jody McKenzie Kathleen Edwards, Melinda Lytle,
Lyssa Wald
Acquisitions Coordinator
Jessica Wilson Series Design
Peter F.Hancik
Technical Editor
Kim Frank Cover Series Design
Ted Holladay
Copy Editor
Lunaea Weatherstone
This book was composed with Corel VENTURA™ Publisher.
InformationhasbeenobtainedbyMcGraw-Hill/Osbornefromsourcesbelievedtobereliable.
However,becauseofthepossibilityofhumanormechanicalerrorbyoursources,McGraw-Hill/
Osborne, or others, McGraw-Hill/Osborne does not guarantee the accuracy, adequacy, or
completenessofanyinformationandisnotresponsibleforanyerrorsoromissionsortheresults
obtained from the use ofsuch information.
P:\010Comp\Passport\575-0\fm.vp
Tuesday, August 05, 2003 12:48:26 PM
Color proPfaisles:p oGretne/ rMicC CSMEY/KM pCrSinAt eWr ipnrdoofwilse Server 2003 Active Directory Certification Passport / Culp / 222575-0 /
Composite Default screen
blind folioiii
About the Author
BrianCulp(MCT,MCSE,A+)cuthisteethintheITworldinasmallnetwork-
ingoutfitcalledIBMbeforegaininghisMCSEcertificationandsteppinginto
theclassroom.HeiscurrentlypresidentandCEOof LANscape,Inc.,andno,
theywon’ttrimyourshrubberyorbuildyouaberm.LANscapeprovidestrain-
ingservicestocompaniesbigandsmall,andalsoprovidesnetworkadministra-
tion. Brian is the author of Mike Meyers’ MCSE Windows 2000 Professional
CertificationPassportandMikeMeyers’MCSEWindowsXPProfessionalCertifi-
cation Passportand has contributed to several other computer titles.
About the Technical Editor
KimFrank(MCT,MCSEonW2K/NT4.0,MCSE+I,MCSA,MCP+I,A+)has
morethan10yearsexperienceintheglobalITarena.HeisoriginallyfromDen-
markwhereheworkedforaleadingmultinationalprofessionalservicesorgani-
zation.Kimisnowatechnicaltrainerandco-founderofCTESolutionsInc.,a
prominentMicrosoftCTECcenterinOttawa,Canada,andteachesatvarious
locationsacrossthecountry.AmonghisspecialtiesareWindowsServer2003,
WindowsXP,andWindows2000ActiveDirectorydesign,implementation,mi-
gration,and security.Kim can be reached at [email protected].
About LearnKey
LearnKeyprovidesself-pacedlearningcontentande-learningsolutionstoen-
hance personal skills and business productivity.LearnKey claims the largest li-
braryofrichstreaming-mediatrainingcontentthatengageslearnersindynamic
media-richinstructioncompletewithvideoclips,audio,fullmotiongraphics,and
animatedillustrations.LearnKeycanbefoundontheWebatwww.LearnKey.com.
iii
P:\010Comp\Passport\575-0\fm.vp
Tuesday, August 05, 2003 12:48:26 PM
Color prPoafislsep:o Grten/e MriCc SCEM/YMK CprSiAn tWeri npdroowfisl eServer 2003 Active Directory Certification Passport / Culp / 222575-0 /
Composite Default screen
blind folioiv
Dedication
For Griffin:
ChapterOne:Itwaswarmandsunnymorning,lateinthespring,andaboyand
hisdaddecidedtogoforarideontheirmountainbikes.Theypedaledovera
dirtpaththatcutthroughthetrees.Thecanopyoftreesprotectedthemfrom
thesun’smostdirectrays,andthebreezewascoolagainsttheirfaces.Themorn-
ing smelled like it had just washed its hair.
Afterpedalingawhile,theyparkedtheirbikesonthesideofthetrail,tookoff
their Styrofoam helmets, and twisted out of their backpacks. They left their
backpacks—full of bottled water, snacks, and, most importantly, a first aid
kit—againstthemountainbikesonthesideof theroad.Itwouldn’ttakevery
long to realize what a mistake that had been.
ChapterTwo:Theysetoffforawalktogathersticksforafire.Theyturned
fromthedirtpaththeyhadbeenridingon,andweavedtheirwayaboutafew
hundredyardsintheforest,keepingtheireyespeeledfordeadbranchesanddry
leaves they could use for kindling.
The boy called out.“Look,dad! Berries.Our favorite!”
Andbecausetheywerelookingsocarefullyalongtheground,theyfoundthe
berries,andeachsnackedonahandful.Theboyevenfilledhispockets.“We’ll
have them for dessert,”he said.
They should have been looking up in the trees, though. If they had, they
would have spotted the giant snakes.
ChapterThree:Daddynoticeditfirst:thebirdsstoppedchirping,andeven
the breeze seemed to be holding its breath now,waiting.
“Grab our swords!”the dad yelled.
“They’reinthebackpacks.Andwhydoweneedourswords?”askedtheboy,
balancingtwomoreberriesatopashirtpocketalreadyholdingmorethanitwas
designed for.
Theanswercameimmediatelyasthetwogiantsnakesthathadbeenwatch-
ingthemfromabovedroppedtothegroundwithathud.Asquicklyastheboy
andhisfathercouldturntorun,thesnakeshadcutofftheirescapeandcoiled
up,readytostrike.Eachofthesnakeswasabouttwelvefeetlong,asbigaround
as a barrel.One opened its jaws,revealing fangs that looked like tent spikes.
“Son,getbehindme!I’llgetthemtochasemeandyoucangetbacktothe
bikes.It’souronlywayoutofthis.”Hestartedtoturn,drawingtheattentionof
both deadly snakes.
iv
P:\010Comp\Passport\575-0\fm.vp
Tuesday, August 05, 2003 12:48:26 PM
Color proPfaisles:p oGretne/ rMicC CSMEY/KM pCrSinAt eWr ipnrdoofwilse Server 2003 Active Directory Certification Passport / Culp / 222575-0 /
Composite Default screen
blind foliov
“Wait.HowmuchNeosporindoyouhaveinyourbackpack?”theboyasked.
“Plenty.Why?”
“Give me your shoe.I just remembered something.”
ChapterFour:WhenDaddyflippedhisshoetotheboy,thesnakesbothdrew
back,hissing.Theboythentooktheshoeandthrewittowardthesnakes.Both
snakeshittheshoewithlightningstrikes,sinkingtheirfangsinthetoeof the
hiking shoe,emptying enough venom to kill offhalfthe population oftown.
Theboysawhischanceandjumpedononeofthesnakes,thesmallerofthe
two.Hehaditinachokeholdandwasbeginningtosubduethehugeserpent.
That’swhentheotheronestoppedbitingtheshoeandturned.Heopenedhis
jaws,andinablur,lungedforward.Whenthefangssankintoflesh,therewasa
great yelp ofpain.
Chapter Five: Daddy’s arm gushed blood almost immediately.The bigger
snakeheldon,butthroughthepainDaddywasabletogethisfreearmaround
the snake’s triangular head.
“Justholdon!”theboysaid.“Theyneedairjustlikeus.Actually,theyneedit
more,because oftheir size.”
Andhangonisexactlywhattheydid,andthoughthetwogiantsnakesputup
adesperatestrugglefortheirlives,theboyandhisdadwereabletomaintainthe
chokehold.Soonthesnakes’strugglingbegantosubside,butDaddywassad-
dened.
“I’m done for,son.”
“No,dad,itwasadrybite.Theonlythingyouhavetoworryaboutisinfec-
tion.That’s why I asked about the Neosporin.”
“So there’s no venom in my arm?”
“Theyusedalltheirvenomontheshoe.Youwouldn’thavelastedthislongif
there was venom in that bite.”
“How do you know?”
“Snakesdon’tplanonbitingthingsmorethanonce.Theyusuallydon’thaveto.”
“Buttheshoe?Whatmadeyouthinktheywouldspendtheirvenomonthe
shoe?”
“Thesnakesarevipers,andallvipershuntusingheatandsmell.It’sallinthat
bookonsnakesyougotme.Yourshoesseemedthewarmestthingtothrowat
them that would smell like you.”
Thegiantsnakesfinallygaveoutandwentlimp.Daddylookedpuzzledfora
moment,takinginwhathadjusthappened.Amomentago,hewascertainhe
wouldbetheonedoomedtothefateofthesnakeinhisarms.Fortunehadre-
verseditselfratherquickly,andallbecauseofabook.“Doesthatbooksayifyou
can eat viper snakes for dinner?”
v
P:\010Comp\Passport\575-0\fm.vp
Tuesday, August 05, 2003 12:48:26 PM
Color prPoafislsep:o Grten/e MriCc SCEM/YMK CprSiAn tWeri npdroowfisl eServer 2003 Active Directory Certification Passport / Culp / 222575-0 /
Composite Default screen
blind foliovi
ChapterSix:Onaspitofwood,thefleshofthesnakeshissed.Butthishiss
wasdifferentthantheonesthefatherandsonhadjustheard.Thisonemade
theirstomachsgrowl.Tenminuteslater,theywereputtinghoney-mustardand
pickles on snakemeat sandwiches. The sandwiches were about as thick as
Daddy’s forearm, which was now bandaged with plenty of Neosporin. Soon
theirbellieswerefullandtheireyeswereheavy.Daddylookedoverwithaweary
smile.“I hope you saved room for blackberries.”
“Ofcourse.”
Theyunrolledtheirsleepingbagsandtuckedthemselvesinside.Fullofsnake
sandwiches and blackberries,they were asleep within minutes.
Acknowledgments
Ican’toveremphasizetheimportanceof,norcanIover-thank,thepeoplere-
sponsible for putting this book together.
Asalways,thankstoNancyMaragioglioforherpatiencewithmyquestionsthat
Iprobablyshouldn’tbeaskinganymore,andthankstoJessicaWilsonforherinput
andstewardinginfluence.I’vebotheredthemthroughouttheentireprocess,andI
deeplyregretanypsychotherapythatmayresultfromworkingwithme.
Ineedtothanktheserieseditor,MikeMeyers,forhavingthejuicetogetthis
bookseriesoff theground,andforprovidingongoinginput,encouragement,
and support.
ThankstoKimFrankforanexcellenttechnicaledit.Anyerrorsincontent
that remain are solely my responsibility.
ThankstoLunaeaWeatherstoneandJodyMcKenziefortheireffortsinthe
copyedit,proofing,andproduction.Theyarebothresponsibleforhidingthe
bumpsandbruisesinmywriting.Theyaretobeheldblamelessforanyprob-
lemswiththewritingstyleorreadability;thereareonlysomanyhoursinaday
to correct my work.
ThankstoSteveLoethenintheKansasCityMicrosoftofficeforhelpingme
get the necessary software and for answering all my questions.
AndabigthankstoBillFerguson,whosteppedintohelpcreateagoodmany
ofthequestionsfortheCD-ROMandsupplementalWebmaterial.Andyoure-
allyshouldaccesstheWebmaterial.Withouthisvaluableassistancecranking
out excellent study material,I would probably still be writing.
vi
P:\010Comp\Passport\575-0\fm.vp
Tuesday, August 05, 2003 12:48:26 PM
Color proPfaisles:p oGretne/ rMicC CSMEY/KM pCrSinAt eWr ipnrdoofwilse Server 2003 Active Directory Certification Passport / Culp / 222575-0 /
Composite Default screen
blind foliovii
Contents
Check-In . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii
1
Planning and Preparing for Active Directory . . . . . . . . . . . 1
Objective1.01 Understanding a Directory Service . . . . . . . . . . . . 3
Directory Services in Ancient Times . . . . . . . . . . . . . . . . . . . . . . 4
Objective1.02 Understanding the Components of
Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
The Directory Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
The Schema . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
The Global Catalog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
The Active Directory Namespace . . . . . . . . . . . . . . . . . . . . . . . . . 9
The Objects Stored in Active Directory . . . . . . . . . . . . . . . . . . . . 10
Computers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Printers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Shared Folders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Objective1.03 Installing Active Directory on
Windows Server 2003 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Running the Active Directory Setup Wizard . . . . . . . . . . . . . . . . 14
Ideal Domain Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
CHECKPOINT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
REVIEW QUESTIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
REVIEW ANSWERS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
2
The Physical Active Directory Components . . . . . . . . . . . . . 25
Objective2.01 Manage an Active Directory Site . . . . . . . . . . . . . . 26
Creating a Site . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Renaming and Deleting a Site . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Site Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
vii
P:\010Comp\Passport\575-0\fm.vp
Tuesday, August 05, 2003 12:48:27 PM
Color prPoafislsep:o Grten/e MriCc SCEM/YMK CprSiAn tWeri npdroowfisl eServer 2003 Active Directory Certification Passport / Culp / 222575-0 /
Composite Default screen
blind folioviii
viii
MCSE/MCSAWINDOWSSERVER2003ACTIVEDIRECTORYCERTIFICATIONPASSPORT
Configure Site Boundaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Moving a Subnet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Objective2.02 Implement an Active Directory
Site Topology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Replication: How and Why . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
Replication Within Sites (Intra-Site) . . . . . . . . . . . . . . . . . 37
Replication Between Sites (Inter-Site) . . . . . . . . . . . . . . . 38
Configure Site Links . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
Configure Replication Schedules . . . . . . . . . . . . . . . . . . . 41
Configure Site Link Costs . . . . . . . . . . . . . . . . . . . . . . . . . 43
Site Link Bridges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
Configure Preferred Bridgehead Servers . . . . . . . . . . . . . . 45
The Inter-Site Topology Generator . . . . . . . . . . . . . . . . . . 46
Domain Controllers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Creating a Domain Controller . . . . . . . . . . . . . . . . . . . . . . 47
Planning Domain Controller Deployment . . . . . . . . . . . . . 48
Objective2.03 Monitor Active Directory Replication Failures Using
the Microsoft Monitoring and Management Tools . . . . . . . 48
Monitor Active Directory Replication . . . . . . . . . . . . . . . . . . . . . . 49
Monitor File Replication Service (FRS) Replication . . . . . . . . . . . 50
Delegating Control over Physical Active Directory Objects . . . . . 50
Using the ACL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Using the Delegation of Control Wizard . . . . . . . . . . . . . . 52
Objective2.04 Plan a Strategy for Placement of
Global Catalog Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Implementing a Global Catalog Server . . . . . . . . . . . . . . . . . . . . 55
Adding Attributes to the Global Catalog . . . . . . . . . . . . . . . . . . . 57
Evaluate Network Traffic Considerations When
Placing Global Catalog Servers . . . . . . . . . . . . . . . . . . . . . . . 58
Evaluate the Need to Enable Universal Group Caching . . . . . . . . 59
Objective2.05 Plan Flexible Operations Master
Role Placement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Forest-wide Operations Master Roles . . . . . . . . . . . . . . . . . . . . . 61
Domain-wide Operations Master Roles . . . . . . . . . . . . . . . . . . . . 62
RID Master . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
PDC Emulator Master . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
Infrastructure Master . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Plan for Business Continuity of Operations Master Roles . . . . . . 65
Transferring the Operations Master . . . . . . . . . . . . . . . . . 66
P:\010Comp\Passport\575-0\fm.vp
Tuesday, August 05, 2003 1:03:15 PM
Color proPfaisles:p oGretne/ rMicC CSMEY/KM pCrSinAt eWr ipnrdoofwilse Server 2003 Active Directory Certification Passport / Culp / 222575-0 /
Composite Default screen
blind folioix
ix
Contents
Seizing the Operations Master . . . . . . . . . . . . . . . . . . . . . 67
CHECKPOINT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
REVIEW QUESTIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
REVIEW ANSWERS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
3
The Logical Active Directory Components . . . . . . . . . . . . . 75
Logical Active Directory Components . . . . . . . . . . . . . . . . . . . . . 76
Domains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
Trees . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Forests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Organizational Units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
Objective3.01 Plan an Administrative Delegation Strategy . . . 83
Delegation of Control Wizard . . . . . . . . . . . . . . . . . . . . . . 85
Plan an Organizational Unit (OU) Structure Based
on Delegation Requirements . . . . . . . . . . . . . . . . . . . . . . . . . 86
Authorization Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . 88
Objective3.02 Implement an Active Directory Forest
and Domain Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Install and Configure an Active Directory Domain Controller . . . 91
Create the Forest Root Domain . . . . . . . . . . . . . . . . . . . . . . . . . . 92
Create a Child Domain . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93
Install an Additional Domain Controller for
an Existing Domain . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
CreateaNewTreeinanExistingActiveDirectoryForest . . . 97
Uninstall Active Directory and Remove a Domain . . . . . . 98
Create and Configure Application Data Partitions . . . . . . 99
Set an Active Directory Forest and Domain Functional Level
Based on Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
Domain Functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102
Forest Functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
Establish Trust Relationships . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
External Trusts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
Forest Trusts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Realm Trusts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
CHECKPOINT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
REVIEW QUESTIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
REVIEW ANSWERS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
P:\010Comp\Passport\575-0\fm.vp
Tuesday, August 05, 2003 12:48:27 PM