Before you install SMS you need to extent the active directory schema. to extend it you can follow the steps below

1. user should have the active directory schema rights if not add the user in “SCHEMA admin Group” in DSA.MSC

2. browse the SMS setup CD %cd drive %\smssetup \bin\i386\extadsc.exe from the command prompt and hit enter. your active directory schema will be extended.

*note :- to confirm you can browse through %system Root%\EXTadsch.log

 

What is Permissions:-

• Permissions define the type of access granted to a user, group, or computer to access resources.

• Permission can be applied to resources such as files, folders, and printers.

                 - Like: Privilege to read a file, delete a file, or to create a new file in folder.

Types of Permissions:-

1. Security Level Permissions
2. Share Level Permissions

1.Security Level Permissions:-

• Can be implemented Only in NTFS partitions.

• Security or NTFS Permissions can be set on drives, Folders, and Files.

• By default, security permissions will be inherited from its parent drive or folder.

• File permission override folder permissions.

• Creators of the file and folders are their owners.

• Different security Permissions are

                  - Full Control, Modify, Read & Execute, Write, Read, List Folder Contents.
2.Share Level Permission:-

• It can be implemented on NTFS and FAT partition.

• It can be set on Drives and shared Folders but not files.

• What are shared folders?

               - Share folders can be accessed from network.
               - When you copy or move shared folder, the folder will no longer be shared.
               - To hide a shared folder, include a $ after the name of the shared folder & users access                          hidden shared folder by typing the UNC path.

• Different Share Permission are

               -Reader, contributor, Co-Owner

 

What is Tree:-

• Tress is a set of one or more domains with contiguous names.

• If more than one domain exists, you can combine the multiple domains into hierarchical tree structures.

• The first domain created is the root domain of the first tree.

• Other domains in the same domain tree are child domains.

• A domain immediately above another domain in the same domain tree is its parent.

What is Forest:-

• Multiple domain trees within a single forest do not form a contiguous namespace.

• Although tree in a forest do not share root a namespace, a forest will have a single root domain, called the forest root domain.

• The forest root domain is the first domain created in the forest.

• These two forest-wide predefined groups reside in forest root domain.

                  - Enterprise Admins
                  - Schema Admins

Flexible Single Master Operation Roles(FSMO Roles):-

1. Names Master
2. Schema Msater
3. RID Master
4. PDC Emulator
5. Infrastructure Master

1.Naming Master:-

• Check the Maintains the Uniqueness off the Domain Names in the Whole Forest.

• It is Responsible for adding. Removing and renaming the domain names in the whole Forest.

2.Schema Master:-

• Schema is a set of rules which is used to define the structure if AD.

• Schema contains Definitions of all the objects which are stored in AD.

• Schema is further classified into:

             - Classes
                         Classed is a Template which is used to create an objest
             -Attributes
                         Attributes are Properties of an object

3.RID Master:-

• It assigns unique IDs (RIDs) to the objects which are created in the domain.

• Allocates pool of Relative IDs (RIDs) to all domain controllers within a Domain.

4.PDC Emulator:-

• Acts as a PDC for Windows NT 4.0 BDC’s in the domain

• Processed all passwords updates for clients

• Receives immediate updates from other domain controllers when a user’s password is changed

• It Synchronizes time between the Domain controllers.

5.Infrastructure Master:-

• Infrastructure Master Maintains and updates the Universal Group Membership information.

• It is used for Inter-Domain Operations.

Global Catalog:-

• A global catalog server is a domain controller. It is a master searchable database that contains information about every object in every domain in a forest.

• The global catalog contains a complete replica of all objects in Active Directory for its host domain, and contains a partial replica of all objects in Active Directory for every other domain in the forest.

What is Group Policy:-

• Group policy is a collection of settings which can be applied on computers and users.

• With group policy administrator can centrally manage the computers and users.

• Eases administration using group policy.

• Group policy is applied in three levels, There are

                     - Site GPO
                     - Domain GPO
                     - O.U GPO

Organizational Unit:-

• It a logical container which contains Active Directory objects (Users, Groups, OU & other objects)

• It is also called as SUBTREE

• It is used for Minimizing administrator tasks

• It is used for organizing and managing the directory objects.

• It is used for delegating the control to one or more users.

What is Delegation of Control:-

• The process of decentralizing management of organizational units.

• Assigning management of an organizational unit to another user or group

• Eases administrator by distributing routine administrator tasks to another user or group.

Soft Development:-

• It is to deploy software (Application) on all the computer in the domain from one central location by applying the Group Policies.

• Supports the development of “.MSI” but not “.EXE” applications.

Folder Redirection:-

• Redirection of folders on the local computer or on a shared folder.

• Folder on a server appears as if they are located on the local drive.

• Fastens the User logon process in case if Profile is large.

What is Trust:-

• Secure communication path the allow objects in one domain to be authenticated and accepted in other domains.

• Some trusts are automatically created.

               - Parent-child domain trust each other
               - Tree root domain trust forest root domain

• Other trusts are manually created

• Forest-to-Forest transitive trust relationships can be created in Windows Server 2003 and Windows Server 2008 forests only

Trust Relationships:-

Type of Trusts:-
Default:-
- Two-way-transitive Kerberos trust (Intraforest)

Shortcut:-
- One or two-way transitive Kerberos trust (Intraforest)

External:-
- One way non-transitive NTML trust. Used to connect to/from Windows NT or external 2000 domains Manually created

Forest:-
- One or two-way transitive Kerberos trust. Only between 2003 or 2008 Forest

Realm:-
- One or two-way-non-transitive Kerberos trust Connected to/from UNIX Kerberos realms

What is DHCP:-

• It gives Addresses automatically to the client who is requesting for an IP address

• Centralized IP Address management

• DHCP prevent IP address conflict and help conserve the use of client IP Address on the on the network

• DHCP reduces the complexity and amount of administrator work by assigning TCP/IP configuration automatically to the clients.

Types of IP Addresses:-

• Static IP address

                  - Address that are manually assigned and do not change over time

• Dynamic IP address

                 - Address that are automatically assigned for a specific period of time and might change
Authorization:-

• In domain model the DHCP server should be authorized to assign the IP addresses to client.

• It is a security precaution that ensures that only authorized DHCP server can run in the network. To avoid computer running illegal DHCP server in the network.

Scope:-

• A scope is a range of IP addresses that are available to be leases to clients.

DHCP Lease Generation Process(DORA):-

• This process of assigning the IP addresses by the DHCP server also known as DORA (Discover, Offer, Request, and Acknowledgement).

1. Step 1:

                    Your computer sends a "Discovery" request, asking for it's IP information from
                     any listening DHCP servers.
     2. Step 2:
                     Any listening DHCP servers will "Offer" their configuration information to your
                     workstation.
     3. Step 3:
                    You workstation chooses the best lease then "Requests" that lease from the
                     corresponding DHCP server.
    4. Step 4:
                    The DHCP server you requested the IP configuration information from then
                    "Acknowledges" your request and leases you the IP configuration information.

What is DHCP Reservation? :-

• A reservation is a specific IP address, within a scope that is permantly reserved to a specific DHCP client

What is DHCP options? :-

• DHCP Scope options are other server addresses given to client along with IP Configuration.

Posted by ashwaq javed at 7:42 AM No comments:

Email ThisBlogThis!Share to TwitterShare to Facebook

Labels: Windows Administration

Read-Only Domain Controllers (RODC)

Read-Only Domain Controllers (RODC):-

• RODC address some of the problems that are commonly found in branch offices.

• These locations might not have a DC, Or they might have a writable DC but no physical security to that DC, low network bandwidth, or inadequate expertise to support that DC.

Functionality of RODCs:-

• Read-Only DC database

• Uni-directional replication

• Credential caching

• Administrator role separation

Read-only AD DS Database:-

• Except for accounts password, an RODC holds all the Active Directory objects and attributes that a writable domain controller holds.

• However, changes cannot be made to the database that is stored on the RODC. Changes must be made on a writable domain controller and then replicated back to the RODC.

Uni-Directional Replication:-

• Because no changes are written directly to the RODC, no changes originate at the RODC. Accordingly, writable DCs do not have to pull changes from the RODC. This means that any changes or corruption that a malicious user might make at branch locations cannot replicate from the RODC to the rest of the forest.

Credential Caching:-

• By default, an RODC does not store any user credentials.

• You must explicitly allow any credential to be cached on a RODC.

Administrator Role Separation:-

• You can delegate local administrative permissions for an RODC to any domain user without granting that user right for the domain or other domain controllers.

• In this way, the branch user can be delegated the ability to effectively manage and perform maintenance work on the server, such as upgrading a driver in the branch office RODC only, without compromising security of the rest of the domain

What is DNS:-

• Domain Name Service/Domain Name System

• Provides resolution of name to IP addressing and resolution of IP addresses to names

• Define a hierarchical namespace where level of the namespace is separated by a “.”

Computer running DNS Service can be:-

DNS Namespace:-

How DNS Queries Work:-

Authoritative & Non-authoritative DNS Server:-

• Return the request IP address

• Return an authoritative “NO”

An Non-authoritative DNS Server will either:-

• Check its cache

• Use forwarders

• Use root hints

Fully Qualified Domain Name (FQDN):-

• Identifies a host’s name within the DNS namespace hierarchy

• Host name + DNS domain name = FQDN

• Example:

                      - Host name: sys1 & Domain name: WindowsAdmin.com
                      - Then FQDN = sys1.WindowsAdmin.com
Look up Types:-

ZONE:-

• Forward Lookup Zone

                 - Used for Resolving Host Name to IP-Address
                 - It maintains Host to IP Address Mapping Information

• Reverse Lookup Zone

                - Used for Resolving IP-Address to Host Name
                - It maintains IP Address to host Mapping Information
Types of Records:-
1. SOA Record
            - The first in any zone file
2. N S Record
            - Identifies the DNS server for each zone
3. Host Record
            - Resolves an alias name to a host name
4. Alias Record
            - Resolves an alias name to a host name
5. Pointer Record
            - Resolves an IP address to a host
6. MX Records
            - Used by the mail server
7.SRV Records (Service Records)
            - Resolves names of server providing services
Zone Types:-
1. Standard Primary
            - It is the Master Copy of all zone information. It is Read/Write copy
2. Standard Secondary
            - It is Backup to Primary zone. It
3. Stub Zone
            - It contains only NS, SOA & possibly Glue (A) Records with are used to locate name servers
4. Active Directory Integrated
            - It stores the information of Zone in ACTIVE DIRECTORY DATABASE
What are Service Records:-

• SRV records allow DNS client to locate TCP/IP-based Services.

• SRV record are used when:

            - A domain controller needs to replicate
            - A client searches Active Directory
            - A user attempts to change her password
            - An administrator modifies Active Directory

INTERNET INFORMATION SERVICES(IIS):-

• IIS is a service which is used to host the information over internet.

• It provides integrated, reliable, scalable and manageable web server capabilities over an intranet/internet

Versions of IIS:-

• IIS 2.0 in windows NT 4.0 Operating System

• IIS 5.0 in windows 2000 Operating System

• IIS 6.0 in windows 2003 Operating System

• IIS 7.0 in windows 2008 Operating System

Features Of IIS 7.0:-

• Supports IPv6

• Backup & Restoration of websites is automatic.

• Isolation of Users

• Supports for Application Developers & Programmers

• IIS 6.0 Compatibility

IIS 7.0 Services:-

• World wide web (WWW) publishing service (HTTP)

• File Transfer Protocol (FTP) service (IIS 6.0 Compatibility)

Hyper-Text Transfer Protocol:-

• Http service is used to publish data to World Wide Web quickly & easily

• This protocol is easily configurable and it supports security and encryption to product sensitive data.

• Default Port No is 80

Internet Web Server:-

Intranet Web Server:-

Required to Host WEB SERVER:-

• Static IP Address (Public IP if Published over Internet)

• Domain name (Registered Domain name if Public over internet)

• Name Resolution Service like DNS

• Home Directory

                     - Required for each Web site
                     - Central location of published pages
Virtual Directory:-

• Virtual Directory is sub directories of the root of the web site.

• By using Virtual directories we can create alias or pointer to a directory somewhere else in the same system or another system on the network.

File Transfer Protocol(FTP):-

• It is a protocol used to download and upload the files over the internet.

• Default Port No is 21

Internet FTP Server:-

Intranet FTP Server:-

Requirements to Host FTP SERVER:-

• Static IP Address (Public IP if public over internet)

• Home Directory

                    - Required for each FTP site
                    - Central location of published pages
Do not isolate user:-

• All users can access FTP Home directory of other Users.

• Anonymous access will be allowed.

Isolate User:-

• User can’t view or modify files or directories of other users.

• They are confined to access their own Home Directory.

• User Home Directory must be present within the root of the site.

Isolate user using Active Directory:-

• User can’t view or modify files or directory of other users.

• This option simplifies administrator of the FTP Site by permitting home directories to exit in any location.

• Only the users whose Active Directory properties are defined can logon to FTP server.

ROUTER

• It is device to communicate between two different networks.

ROUTING

• It is process of sending the data packets through the best path to reach the destination.

DEFAULT GATEWAY

• It gives exit point (or) entry point to reach the destination.

Types of Routing:-
1. Static Routing

• Routes should be added manually on the router by the administrator.

2. Dynamic Routing

• Routes will be added automatically by the router with the help of routing protocols

Types of Routers:-
1. Software Router

• It is a computer which performs routing task as one of its multiple tasks.

2. Hardware Router

• It is Dedicated HARDWARE DEVICE which works only as a router.

Router and Remote Access Service (RRAS):-

• Routing and Remote Access is a service that performs routing as one of its multiple processes.

NAT:-

• Provides access to internet from a protected private address range.

• Translates Private IP’s to public IP’s & vice-versa for outgoing and incoming traffic

• Hide private IP address range from the internet

• Can be used with DHCP or can be configured to assign IP to Client

How NAT works:-

DHCP Relay Agents:-

• A DHCP Relay agent is a computer or router that listens for DHCP Broadcasts from DHCP client and then relay(sends) those messages to DHCP Server on the another network.

How a DHCP Relay Agent Works? :-

 

How Dial-Up Network Access Work:-

• Dial-up client make a temporary connection to a remote access server by using.

Components of a Dial-Up Connection:-

How a VPN Connection Work:-

• A virtual private network (VPN) extends a private network across a public network, such as the internet.

Components of a VPN Connection:-

Modes of Terminal Services:-
1. Remote Administrator Mode

• Specially designed for remote management of server.

• Only two connections are Supported

• License is not required.

2. Application Server Mode

• Specially designed to use multiple application from terminal server.

• Unlimited connection supported.

• License should be purchased.

Terminal Services Sessions:-
Disconnect Session

• If the Session is disconnected all the programs will continue to run in the background & the user can reconnect to same session

Logoff Session

• If the Session is logged off then all programs will be closed and next time new session will be established

Features of Terminal Services:-

• Terminal Server

• TS Licensing

• TS Session Broker

• TS Gateway

• TS Web Access

                - Remote App
Terminal Server:-

• Users can connect to a terminal server to run programs, to save file, and to use network resources on that server.

• Users can access a terminal server from within a corporate network or from the by using Remote Desktop Connection.

TS Licensing:-

• Terminal Services Licensing (TS Licensing) manages the terminal Services client access licenses (TS CALs) that are required for each device or user to a terminal server.

• Remote Desktop support two concurrent connections to remotely administer a computer. You do not need a license server for these connections.

TS Session Broker:-

• Allows a user to reconnect to their existing in a load balanced terminal servers.

• Enables you to evenly distribute the session load between servers in a load-balanced terminal servers

TS Gateway:-

• Terminal Services Gateway (TS Gateway) enables authorized remote users to connect to resources on a private network.

• The network can be terminal server, or computer with Remote Desktop enabled.

TS Web Access:-

• TS Web Provides access to a Terminal Server through a web browser.

• Users can visit a Web site (either from the internet or from the intranet) to access a list of available Remote App programs.

WINDOWS DEPLOYMENT SERVICES (WDS):-

• Windows Deployment Services enables you to deploy Windows operating systems, particularly Windows Seven and Windows Server 2008.

• You can use it to set up new computers by using a network-based installation. This means that you do not have to be physically present at each computer and you do not have to install each operating system directly from a CD or DVD.

Required of WDS-Deployment Server:-

• DHCP Server

• DNS Server

• Active Directory – Domain Services

• An NTFS Partition to Store images

How WDS Work? :-

Types of Clients:-
1. Known Clients

• A Known Client is one whose computer account has been pre-created (Pre-staged) in Active directory.

2. Un-known Client

• A UN-Know Client Computer is one whose computer account has been per-staged in Active directory.

Types of Images:-
1. Boot Image

• It is a WIM file you can use to boot a computer to begin the deployment of an O.S to the computer.

2. Install Images

• It is a image of windows Vista or Windows server 2008 O.S itself that you want to deploy onto the client computer.

3. Capture Image

• It is a special boot image that you use to boot a master computer and upload an image to WDS server.

4. Discover Image

• It is a boot that you to deploy that you use to deploy an install image onto a computer that is not PXE enabled.

What is Server Core? :-

• Only the core components of Operating system and a subnet of the executable files will be installed

• GUI interface will not be installed

• Windows Explorer, Internet Explorer etc will not be installed

• Can be managed with remote tools

Server Core Features:-

• Reduced software maintenance

• Low attack surface

• Reduced Management

• Less disk space required

Basic Configuration Commands:-

• To view the computer name

                - Set C (or) Hostname

• To view the Username & UserDomain

                - Set U

• To view the current logged on User

                - Whoami

• To view the ip address

                - ipconfig (or) ipconfig/all

• To view available network adapters

                - netsh interface ipv4 show interfaces

• To set an automatic ip address

                - netsh interface ipv6 set address name=”Local Area Connection” source=dhcp

• To assign an static ip address

                - netsh interface ipv4 add address “Local Area Connection” 10.0.0.1 255.0.0.0

• To assign an DNS server address

                - netsh interface ipv4 add answer “Local Area Connection” 10.0.0.1

• To disable the Windows firewall

                - netsh firewall set opmode=disable

• To rename a computer name

                - Netdom renamcomputer WIN-S0254RTEF/NewName:sys2-core

• To join the server to the domain

                - Netdom join Sys2-core /Domain:Zoom.com /UserD:Administartor/PasswordD:*

• To restart the computer

                - Shutdown /r

• To view the installed roles and features

                - Oclist
Installing/Uninstalling Server Role on Server Core:-

• To install DNS server role

                - Start /w ocsetup DNS-Server-Core-Role

• To uninstall DNS server role

                - Start /w ocsetup DNS-Server-Core-Role/Uninstall

• To install DHCP server role

                - Start /w ocsetup DHCPServerCore

• To uninstall DHCP server role

                - Start /w ocsetup DHCPServerCore /Uninstall
Backup and Recovery:-

• Copy data alternate media

• Prevent data loss

• Only Administrator can backup the data

Distributed File System:-

• Distributed file system (DFS) allows Administrators to make it easier for users to access and manage file that are physically distributed across a network.

• With DFS, you can access make file distributed across multiple servers. It may appear for user that files actually reside in one place (computer) on the network.

New Names in Active Directory 2008:-

Lightweight Directory Services (AD-LDS):-

• AD LDS Provides an LDAP accessible directory services that supports identity managements scenarios

• Removes all other AD DS features

                  - No Kerberos authentication
                  - No forests, domain, DC, GC, sites, group polocies
                  - No dependency on DNS

• Each AD LDS server can host multiple directory stores (i.e. instances)

• Within each instance

                  - Schema partition
                  - Configuration Partition
                  - Zero or more application partition
Rights Managements Services (AD-RMS):-

• RMS enables customers to keep internal information internal

                  - Confidential files protection
                  - E-mail forwarding
                  - Web application

• Benefits

                  - Safeguards sensitive internal information
                  - Digitally enforce organization policies

Federation Services (AD-FS):-

• AD FS Provides an identity solution

• AD FS is a services that allows for the creation of federated relationships between organizations for web application authentication

• Deploy federation server in multiple organization to facilitate business-to-business (B2B) transactions

• AD FS provides a Web-based Single Sign-on (SSO) solution

• AD FS improves in windows Server 2008

Certificate Services (AD-CS):-

• AD CS Provides PKI certification issuance and managements services

• Not significantly different than CS in 2003

• Provides certificate issuance and certification Authority (CA) service

• Issues Digital certificates to web server for Secure data transfer (HTTPS)

Upgrading Windows 2003 to 2008:-

• Windows Server 2003 can be upgrades to same flavor of windows server 2008

                 - EX: Win 2003 Enterprise to Win 2008 Enterprise

• Requirements

                 - Windows 2003 Service pack 1 or higher
                 - “C” Drive should have at least 10GB of Free space to upgrade
                 - Upgrade installation should start from the Console only
System-specific data that must be backed up:-

• System-specific data that must be backed up

                 - Registry
                 - Boot files – including system files
                 - Active Directory Database
                 - SYSVOL Directory
Installing/Uninstalling Backup Tool on Server Core:-

• To install windows server Backup tool

                - Start/w ocsetup WindowsServerBackup

• To Uninstall Windows Server Backup /uninstall

                - Start/w ocsetup WindowsServerBackup /uninstall
System State Data Backup and Recovery:-

• To start SSD Backup

                - Go to Cmd
                - WEADMIN START SYSTEMSTATEBACKUP –BACKUPTARGET:F:

• To start SSD Recovery

                - Restarting the D.C in DSRM (Directory Service Restore Mode) safe Mode by pressing
                   “F8” during the system startup and login as Administrator
                - Go to Cmd
                - WBADMIN START SYSTEMSTATERECOVERY –VERSION:01/01/2009-90:00