Windows Server Infrastructure - Basics

Question: What is an Organizational Unit (OU) and why would you create additional OUs?
Show Answer
An OU is an object in a domain that you can use to store user objects, computer objects, group objects, and other AD DS objects. You typically create additional OUs when you want to delegate control to a specific group or link a Group Policy Object to the OU.


Question: What are the five flexible single master operations (FSMO) roles and where do they exist?
Show Answer
FSMO roles are special roles within a forest and domain. There are two FSMO roles at the forest level: Schema Master and Domain Naming Master. There are three FSMO roles at the domain level: RID Master, Infrastructure Master, and PDC Emulator.

Question: What is a trust relationship and which type of trust relationship is used to improve user logon times between two domains in a forest?
Show Answer
Trust relationships are authentication pipelines between different domains. Shortcut trusts can be used to improve user logon times between two domains in an Active Directory forest.


Question: Which optional AD DS feature enables you to quickly restore objects that have been deleted?
Show Answer
The Active Directory Recycle Bin, an optional feature of AD DS, provides a simplified process for restoring deleted objects.

Question: What is Server Core and what are some advantages of using it?
Show Answer
Server Core is the default Windows Server installation option. Server Core does not have a graphical user interface. Server Core installs fewer components so fewer updates are required. Server Core removes unneeded files so disk space and memory requirements are less. Lastly, fewer files and components means less opportunity for security threats.

Question: Which feature can you use to define different password policies and account lockout settings in a domain?
Show Answer
Fine-grained password policies let you specify different password policies and account lockout policies for different groups of users. For example, executives, administrators, service accounts, or regular users.

Question: Aziz has reported he is unable to sign in to the domain. The error message is, “The trust relationship between this workstation and the primary domain failed.” What is likely the problem and how should you fix it?
Show Answer
Most likely the problem is a broken secure channel. You can use Active Directory Users and Computers or PowerShell to reset the computer account and rejoin the computer to the domain.

Question: What is the global catalog and when is it used?
Show Answer
The global catalog is a central directory of every object in the forest. The global catalog is commonly used to provide Exchange email account information and a user’s Universal group memberships.

Question: What is the global catalog and when is it used?
Show Answer
The global catalog is a central directory of every object in the forest. The global catalog is commonly used to provide Exchange email account information and a user’s Universal group memberships.

Question: What is an AD DS site and when should you consider creating a site?
Show Answer
An AD DS site represents the physical structure, or topology, of your network. There are several reasons to consider creating additional sites such as: number of users at a location, slow links between locations, service localization, and AD DS database replication.


Question: When should you use an authoritative restore?
Show Answer
An authoritative restore is necessary when a known good copy of AD DS has been restored that contains objects that must override the existing state of other objects in the AD DS database.

Question: How are Group Policy settings and a Group Policy preferences different?
Show Answer
Group policy settings and group policy preferences are different. Preferences are not enforced, can reapply automatically, and can use item-level targeting.

Windows Server Infrastructure - Basics

Question: What is an Organizational Unit (OU) and why would you create additional OUs?
Show Answer
An OU is an object in a domain that you can use to store user objects, computer objects, group objects, and other AD DS objects. You typically create additional OUs when you want to delegate control to a specific group or link a Group Policy Object to the OU.


Question: What are the five flexible single master operations (FSMO) roles and where do they exist?
Show Answer
FSMO roles are special roles within a forest and domain. There are two FSMO roles at the forest level: Schema Master and Domain Naming Master. There are three FSMO roles at the domain level: RID Master, Infrastructure Master, and PDC Emulator.

Question: What is a trust relationship and which type of trust relationship is used to improve user logon times between two domains in a forest?
Show Answer
Trust relationships are authentication pipelines between different domains. Shortcut trusts can be used to improve user logon times between two domains in an Active Directory forest.


Question: Which optional AD DS feature enables you to quickly restore objects that have been deleted?
Show Answer
The Active Directory Recycle Bin, an optional feature of AD DS, provides a simplified process for restoring deleted objects.

Question: What is Server Core and what are some advantages of using it?
Show Answer
Server Core is the default Windows Server installation option. Server Core does not have a graphical user interface. Server Core installs fewer components so fewer updates are required. Server Core removes unneeded files so disk space and memory requirements are less. Lastly, fewer files and components means less opportunity for security threats.

Question: Which feature can you use to define different password policies and account lockout settings in a domain?
Show Answer
Fine-grained password policies let you specify different password policies and account lockout policies for different groups of users. For example, executives, administrators, service accounts, or regular users.

Question: Aziz has reported he is unable to sign in to the domain. The error message is, “The trust relationship between this workstation and the primary domain failed.” What is likely the problem and how should you fix it?
Show Answer
Most likely the problem is a broken secure channel. You can use Active Directory Users and Computers or PowerShell to reset the computer account and rejoin the computer to the domain.

Question: What is the global catalog and when is it used?
Show Answer
The global catalog is a central directory of every object in the forest. The global catalog is commonly used to provide Exchange email account information and a user’s Universal group memberships.

Question: What is the global catalog and when is it used?
Show Answer
The global catalog is a central directory of every object in the forest. The global catalog is commonly used to provide Exchange email account information and a user’s Universal group memberships.

Question: What is an AD DS site and when should you consider creating a site?
Show Answer
An AD DS site represents the physical structure, or topology, of your network. There are several reasons to consider creating additional sites such as: number of users at a location, slow links between locations, service localization, and AD DS database replication.

 
Question: When should you use an authoritative restore?
Show Answer
An authoritative restore is necessary when a known good copy of AD DS has been restored that contains objects that must override the existing state of other objects in the AD DS database.

Question: How are Group Policy settings and a Group Policy preferences different?
Show Answer
Group policy settings and group policy preferences are different. Preferences are not enforced, can reapply automatically, and can use item-level targeting.

Powershell - Create an organizational unit and delegate control

Create an organizational unit and delegate control

1. Sign in to LON‑DC1 as Adatum\Administrator with the password Pa$$w0rd.
2. In Server Manager, click Tools, and then click Active Directory Users and Computers.
3. Right-click Adatum.com, click New, and then click Organizational Unit.
4. Name the new OU A Datum Merger Team.
5. Verify that you have a new OU named A Datum Merger Team.
6. Right-click the A Datum Merger Team OU, and then Delegate Control…
7. On the Users or Groups page, click Add, and add the Managers group.
8. On the Tasks to Delegate page, read through the different common tasks that can be delegated.
9. Take a moment to select Create a custom task to delegate, click Next, and review the many objects and permissions settings that can be used to customize a task.
10. Return to the common tasks, click the Delegate the following common tasks radio button, and then select the Reset user passwords and force password change at next logon checkbox.
11. Complete the delegation of control wizard.

Microsoft INF200.1x, Windows Server 2012 Fundamentals: Infrastructure - Organizational Unit

 

What are OUs and Containers?

OUs group AD DS objects

An organizational unit (OU) is an object in a domain that you can use to store user objects, computer objects, group objects, and other objects. With OUs you can link GPOs directly and delegate an OU manager.

Containers have limited functionality

Containers are used for system objects and as the default locations for new objects. Containers have limited management capabilities. You cannot link a GPO to a container. You cannot create an OU in a container.

When to create more OUs?

Although you can manage a small organization without creating additional OUs, even small organizations typically create an OU hierarchy. An OU hierarchy lets you subdivide the administration of your domain for management purposes. There are basically two reasons to create OUs.

• Application of GPOs. To group objects together to make it easier to manage them by applying Group Policy Objects (GPOs) to the whole group. You can link GPOs to the OU, and the settings apply to all objects within the OU. For example, you create an OU for contractors who have different security requirements than full-time employees.
• Delegation of control. To delegate administrative control of objects within the OU. You can assign management permissions on an OU, thereby delegating control of that OU to an AD DS user or group. For example, you create an OU to manage a satellite office in a different geographical location. Then, you delegate control of the OU to a group.

 How to Design the OU Hierarchy

Create OUs based on your organization

When you design an OU hierarchy, you can follow many strategies. You can create a flat, wide structure that has only one or two levels of OUs. You can create a deep, narrow structure that has five or more levels of nesting OUs; or you can create anything in between. The key factor in designing your OU hierarchy is that it should help you manage your organization.

• Geographic location. There might be local IT staff for delegating management, local regulations that require specific policies, or many other factors.
• Departmental characteristics. Typically, different departments are managed differently and have unique requirements.
• Resource type. Some organizations create separate OUs for different resources. File servers are typically managed differently than computers that are running SQL Server and require different policies applied to them.
• Management structure. Some organizations want their OU hierarchy to mirror their management structure.

Are there default OUs and containers?

Every AD DS domain has a standard set of containers and OUs that are created when you install AD DS.

• Builtin container. Stores several default groups.
• Computers container. The default location for new computer accounts that you create in the domain.
• Domain Controllers OU. The default location for domain controllers' computer accounts. This is the only OU that's present in a new installation of AD DS.
• Foreign Security Principals container. The default location for trusted objects from domains outside the AD DS forest. Typically, these are created when an object from an external domain is added to a group in the AD DS domain.
• Managed Service Accounts. The default location for managed service accounts. AD DS provides automatic password management in managed service accounts.
• Users container. The default location for new user accounts and groups that you create in the domain. The Users container also holds the administrator and guest accounts for the domain, and some default groups.

Are there any hidden containers?

Some containers are hidden in Active Directory Users and Computers.

There are several containers that you can see only when you select Advanced Features on the View menu.

By default, the following objects are hidden.

• LostAndFound. This container holds orphaned objects.
• Program Data. This container holds Active Directory data for Microsoft applications, such as Active Directory Federation Services (AD FS).
• System. This container holds the built-in system settings.
• NTDS Quotas. This container holds directory service quota data.
• TPM Devices. This container is new with Windows Server 2012. It stores the recovery information for Trusted Platform Module (TPM) devices.