Matt Carlson
IT255.XM1.10WTR
Instructor Vincent Tran
January 9, 2010
Learner Outcome Project

Virtual Lab 1 1. Open the Server Manager console on your Windows Server 2008 computer. What selections are available to you in the left pane?
The selections available to me include: Roles, Features, Diagnostics, Configuration, and Storage. 2. Using the Windows Help option, describe any roles and features that are currently installed on this server.
There are currently no Roles or Features installed on the server. 3. Explain in your own words why it is a best practice to configure a server, such as a DNS server, with a static IP address rather than allowing it to obtain an IP address using DHCP.
To put it simply, if the IP address of the server is consistently being changed by DHCP, then the ports that were opened up to allow the server to work through the firewall are going to be remain opened on the server’s old address, and not necessarily on the new one. This could cause applications to not run properly or at all, but worse, could create security vulnerabilities for the network. A static IP address allows other workstations on the network to easily keep track of the server. 4. Explore the netsh command menus. Record three commands that you can issue from the command line using netsh, and describe what each command does. 1. Exec- runs a script file 2. Add- adds a configuration entry to a list of entries 3. Online- sets the current mode to online

Matt Carlson
IT255.XM1.10WTR
Instructor Vincent Tran
January 9, 2010

Virtual Lab 2 1. When a child domain is installed and the parent domain is hosting an Active Directory–integrated DNS server that allows dynamic updates, are the SRV resource records of the child domain added automatically during Active Directory installation?
Yes, they are added automatically during Active Directory installation. 2. How is a child domain represented in the Domain Name System (DNS) console?
It is represented as being a forward lookup zone. 3. Which domain controller establishes the name of the forest?
The forest root domain controller establishes the name of the forest. 4. Whether you are installing a child domain or the first domain in a forest, what are some common parameters you define for the Active Directory installation process?
Some common Active Directory installation parameters include: name of domain in the forest to install the domain controller, the user credentials to do so, and the domain for the domain controller, DNS server, and a password for Directory Services Restore Mode (in the event of a disaster or similar).

Matt Carlson
IT255.XM1.10WTR
Instructor Vincent Tran
January 15, 2010
Virtual Lab 3 1. Which default administrative group has the necessary privileges to create and monitor sites?
The Domain Controllers default administrative group has the necessary privileges to create and monitor sites. 2. In a multidomain environment, what is the main difference between the partitions on a domain controller that is also a global catalog server, versus other domain controllers that are not configured as global catalog servers?
A domain controller that is also a global catalog server not only stores all of the objects from the local domain, but also stores a partial copy of all objects from other domains within the same forest. A domain controller that is not configured as a global catalog server only stores objects pertaining to its local domain; this is the main difference between the two. Global catalog servers are queried by domain controllers when an object within that domain controller’s forest, but not in its local domain, needs to be resolved, such as a logon request. 3. What major tasks are required to create an Active Directory site?
The first steps that need to be completed are to create the site by giving it a name and selecting a site link object for the new site. Next, links can be established with other sites via the Inter-site Transports icon in the left pane. Subnets also should be created, if necessary, and added to the Subnets container. Lastly, the site needs to be assigned at least one domain controller either by installing a new one or moving one to the new site.

Matt Carlson
IT255.XM1.10WTR
Instructor Vincent Tran
January 24, 2010
Virtual Lab 4 1. You are the network administrator for an Active Directory domain that has five domain controllers. The domain functional level is set to Windows Server 2003. Only one domain controller is configured as a global catalog server. If that global catalog server fails, will it prevent users from logging onto the network?
No this will not prevent users from being able to log onto the network. However, users will not be able to log onto the network from somewhere on the network away from their local domain controller since the global catalog server is not available to resolve these logon requests. If such an occurrence would create a major problem for this organization, which is highly likely, I would recommend adding at least one other global catalog server for redundancy or enabling universal group membership caching. This feature would enable users to logon to the network even if the global catalog server failed, as long as they had done so in the past when the global catalog server was functioning and universal group membership caching was enabled. 2. How many FSMO roles would you find in an Active Directory forest that has one parent domain and two child domains?
I would expect to find all five FSMO roles installed in such an Active Directory forest. On the domain controller of the forest root domain (parent domain), I would expect it to have all five roles along with global catalog. On the domain controllers for each of the two child domains, I would expect each to contain all three of the domain-wide FSMOs, as well as global catalog. The two forest-wide FSMO roles can only be installed on one domain controller in the entire forest, of course, so these should be on a domain controller in the forest root domain.

Matt Carlson
IT255.XM1.10WTR
Instructor Vincent Tran
February 12, 2010
Virtual Lab 5 1. Name a task that a member of Schema Admins cannot perform that a member of Enterprise Admins or Domain Admins can perform.
Domain Admins and Enterprise Admins can enable user accounts and computers to be trusted for delegation, but Schema Admins cannot perform this task. 2. What command must you run before you can add the Active Directory Schema console as a snap-in to the Microsoft Management Console?
The command that must be issued in order to add the Active Directory Schema snap-in to the MMC is: Regsvr32 schmmgmt.dll. This will register schmmgmt.dll on the computer. 3. What type of administrative membership allows you to add attributes and object classes to the Active Directory database?
Schema admins can add attributes and object classes to the Active Directory database.

Matt Carlson
IT255.XM1.10WTR
Instructor Vincent Tran
February 14, 2010
Virtual Lab 6 1. In your own words, describe what you learned by completing this lab.
There was a lot to be learned in this lab despite it only containing three exercises. First of all, I learned about how naming standards can be used for creating accounts in a domain, why they are useful, and how to implement such a standard. Secondly, I learned how to manage user accounts via the command prompt, including adding users and moving them to different OUs. Thirdly, I learned how to use the “runas” command to perform administrative tasks from a non-administrative account. This lessens the opportunity for possible network intrusion because it does not give a hacker easy access to an administrative account as performing administrative tasks from an administrative account potentially can; one can also create shortcuts for such runas commands to simplify the process. I also learned how Organization Units can be used to delegate commonly used administrative tasks on both parent and child domains. 2. If you delegate administrative control over an OU to allow password changes, should that user be able to delete user accounts within the OU?
No that user should not be able to delete user accounts within the OU. Just because a user is given permissions to allow password changes, this does not allow this user to modify entire user accounts such as adding or deleting them. 3. True or False? You should not be able to open more than two administrative consoles with the runas command. Explain.
This is true. Up to two administrative applications can be started at the same time. Using either run as administrator or the runas command, two administrative applications can be started as separate instances including those directed at other domains or even other forests, making interdomain and interforest administrative tasks simpler.

Matt Carlson
IT255.XM1.10WTR
Instructor Vincent Tran
February 21, 2010
Virtual Lab 7 1. If there is a conflict between a setting configured in the Local Computer Policy and a setting configured in a domain-linked GPO, which policy setting will be applied?
The domain-linked GPO absolutely overrides the Local Computer Policy. We proved this by enabling the “Remove Properties from the Computer icon context menu” setting in the Local Computer Policy and then disabling it in the domain GPO. Upon logging in as an administrator of that domain, Properties was once again displayed in the Computer icon context menu. 2. If multiple policies are configured at the domain level and you only want one of those policies to flow down to a given OU, what should you do to that OU? What should you do to the policy that you want to flow down?
To prevent the policies configured at the domain level from flowing down to a given OU, the Block Inheritance setting can be used on the OU. In order to allow the one desired policy to flow down to the OU from the domain level, the Link an Existing GPO setting can be used to select this policy. 3. You have two conflicting policies: PolicyA and PolicyB. Each is linked to the same OU named Marketing. PolicyA settings are implemented over PolicyB settings, but you need to implement PolicyB settings instead of PolicyA settings. You do not want to use No Override, because that will affect all child OUs. What should you do?
The best solution would be to move PolicyB settings up the link order so that they are higher up than PolicyA settings instead of using No Override. 4. The Enforce setting on a GPO overrides which GPO control measure?
The Enforce setting on a GPO overrides the Block Inheritance setting. It also protects the GPO and its settings from being overridden by a later GPO.

Matt Carlson
IT255.XM1.10WTR
Instructor Vincent Tran
February 22, 2010
Virtual Lab 8 1. When you create a GPO to implement a new password policy, where must you link the GPO to have the policy affect Active Directory domain accounts?
By creating and linking a GPO to implement a new password policy at the domain-level, all Active Directory domain accounts will be affected. All OUs that do not have the Block Inheritance setting enabled will inherit the new password policy as well. 2. If you want to configure auditing on domain controllers, where must you create and link a GPO or modify an existing GPO?
In order to configure auditing on domain controllers, a GPO must be created or modified and linked to the Domain Controllers OU. 3. Which items can you redirect under Folder Redirection in Group Policy?
Using Folder Redirection in Group Policy, the contents of folders on a local computer located in the Documents and Settings folder, including the Documents, Application Data, Desktop, and Start Menu folders, all can be redirected. 4. If you configure the Reset Account Lockout Counter After setting to 0, what does this mean?
0 is not a possible value for the Reset Account Lockout Counter After setting. The value must be between 1 and 99,999. If the value for the Reset Account Lockout Counter were able to be set to 0, the counter would instantly reset, allowing the user to continue trying to logon, and rendering the account lockout itself useless; it would basically cancel out the lockout because a lockout couldn’t take place when the counter instantly is reset to 0 as soon as the Account lockout threshold value is reached.

Matt Carlson
IT255.XM1.10WTR
Instructor Vincent Tran
February 27, 2010
Virtual Lab 9 1. Is the option to publish a software package to a computer available when you create a software package?
No, the option to publish a software package to a computer is not available when I create a software package. I could, however, publish a Windows Installer package to a user, but publishing cannot occur in a computer-based policy. 2. How can you enable the option Install This Application At Logon in a software package's Deployment tab?
The Install This Application At Logon option can be made available in a software package’s Deployment tab by setting the package to Assigned. 3. What are the advantages and disadvantages of using path rules?
Some advantages of using path rules include: allowing desired applications to run when the Default Security Level is set to Disallowed, preventing undesired applications from running when the Default Security Level is set to Unrestricted, one can specify either file directory paths or registry path settings to restrict certain applications from being able to execute, and registry path restrictions mitigate the possibility of users moving software to a different file path to get it to execute.
A few disadvantages of using path rules are: path rules can be invalidated when the specified directory paths are changed due to network restructuring or user tampering, setting the security level to Disallowed on Windows folders can adversely affect the function of one’s operating system, and software restriction policies do not take effect until the user logs off and logs back on.

Matt Carlson
IT255.XM1.10WTR
Instructor Vincent Tran
March 5, 2010
Virtual Lab 10 1. When you want to filter a GPO based on file system attributes, installed services, or running services, what type of filtering do you use?
Windows Management Instrumentation (WMI) filtering can be used to filter a GPO based on file system attributes, installed services, or running services, and also based on hardware and software. 2. When you want to filter a GPO based on group membership, what type of filter do you use?
To filter a GPO based on group membership, Security Group Filtering can be used to determine user and group account access to the policy. 3. What tools can you use to investigate the application of GPOs for a particular computer or user account?
The Resultant Set of Policy (RSoP) wizard is one tool which can assist administrators in determining the effects of policies on users as well as computers. An even simpler tool that administrators can use to gather and report the same information is the Group Policy Results feature within the Group Policy Management utility. Using the Group Policy Management utility, one can easily determine how individual settings will affect a given user, and also, multiple queries can be stored within a single interface; this is a common drawback of the RSoP MMC snap-in, but works quite well with the Group Policy Management utility. GPRESULT is a command-line tool that allows summary data for a given user account to be displayed, which is similar to Group Policy Results in the GPMC. 4. When running GPRESULT or GPMC using a nonadministrative account, what information is unavailable?
When running GPRESULT or GPMC using a non-administrative account, the Computer Configuration settings are unavailable.

Matt Carlson
IT255.XM1.10WTR
Instructor Vincent Tran
March 14, 2010
Virtual Lab 11 1. If you wanted to restore the entire Active Directory database authoritatively, what command in ntdsutil do you use instead of restore subtree?
The command “Restore database” in Ntdsutil will restore the entire Active Directory database authoritatively. 2. To perform an authoritative restore, what startup option do you select?
In order to perform an authoritative restore, the startup option to select is Directory Services Restore Mode. 3. When performing an authoritative restore, in what mode do you restore your System State data? What tool do you immediately run after the restore?
You restore your System State data in Directory Services Restore mode, and then run Ntdsutil immediately after to complete the authoritative restore.

4. How do you configure a domain controller to start in Directory Services Restore Mode on the next bootup?
A DC can be configured to start in Directory Services Restore Mode on the next bootup by using the bcdedit utility from the command line. The command to issue that would cause the computer to boot in Directory Services Restore Mode upon restart is
“bcdedit /set safeboot dsrepair”. To change the DC back to restarting normally, the command to issue is “bcdedit /deletevalue safeboot”. 5. What command do you key at the File Maintenance prompt if you want to compact your Active Directory database to a directory named database in the root of the C drive?
The command to key at the File Maintenance prompt is “compact to c:\database”.

Matt Carlson
IT255.XM1.10WTR
Instructor Vincent Tran
March 19, 2010
Virtual Lab 12 1. Are Active Directory zone transfers configured for an entire DNS server or individual DNS zones?
Active Directory zone transfers are configured for individual DNS zones. 2. When configuring zone transfers for a DNS zone, which options are available for you?
One has 3 options for configuring zone transfers for a DNS zone, which are to allow zone transfers: to any server, only to servers listed on the Name Servers tab, and only to the following servers (this option includes a list to manually add desired server(s)). 3. What is the difference between configuring a secondary zone for your partner's Active Directory domain versus configuring a forwarder for that domain? (Hint: Where are the DNS records stored?)
A DNS server configured with a secondary zone physically stores a read-only copy of the zone database received from the primary master server, whereas configuring a forwarder for that domain would cause it to forward queries received for that domain to another DNS server that can resolve the request because it contains the appropriate zone database for that particular domain. 4. What command-line utility can you use to administer DNS zones and records on a Windows Server 2008 computer? (Hint: Use the Help and Support option to find a list of command-line utilities.)
The command-line utility DnsCmd can be used to administer DNS zones and records on a Windows Server 2008 computer.

Matt Carlson
IT255.XM1.10WTR
Instructor Vincent Tran
March 22, 2010
Virtual Lab 13 1. Will the configuration that you established in this lab allow you to take your root CA offline for added security? Why or why not?
No, the configuration that I have established in this lab will not allow me to take my root CA offline for added security. This is the case because only a root CA configured as a standalone CA can use this offline root functionality, and my configuration used an enterprise CA (which integrates with the Active Directory domain) instead of a standalone CA. 2. Why did you need to create copies of the User and Computer templates during this lab?
I needed to create duplicates of the User and Computer templates during this lab because that was the only way to make all of the necessary changes to the templates that were required for this scenario. Using the templates as-is does not allow for the customizability that a duplicated template does. Templates in this case are quite similar to templates in other applications such as those in Microsoft Office. They provide a starting point, but then need to be customized to suit the user’s needs, which is what I accomplished by creating copies of these templates. 3. Does a key recovery agent require any special permissions within Active Directory, such as Domain Admin or Server Operator group membership?
A key recovery agent does not require any special permissions within Active Directory. It only requires membership in the Domain Users group. 4. What command-line utility can you use to administer PKI certificates on a Windows Server 2008 computer? (Hint: Use the Help and Support option to find a list of command-line utilities.)
The command-line utility that can be used to administer PKI certificates on a Windows Server 2008 computer is Certutil.