Windows Server: Active Directory Certificate Service

True or False: Certificate Templates define which security principals have permissions to read, enroll, and configure the certificate template.

   
A.    False
   
B.    True



True or False: Every computer is deployed with a preset list of trusted root certificate authorities.

   
A.    False
   
B.    True

Which off the following options is available with Active Directory Certificate Services in Stand-alone mode? (Choose all that apply)

   
A.    Can be used to generate smart card Windows domain authentication certificates
   
B.    Can use certificate auto-enrollment
   
C.    Can use certificate templates
   
D.    Can be used without AD DS
   
E.    Can enforce credential checks during enrollment



True or False:  Active Directory Certificate Services will always include both a root CA and a subordinate CA.

   
A.    True
   
B.    False

 

Which of the following would be a reason for deploying more than a single server CA hierarchy?
   
A.    High availability
   
B.    Load balancing
   
C.    Organizational divisions
   
D.    All of the above
   
E.    Geographic divisions
 

1. True
2. True
3. Can be used without AD DS
4. False
5. All of Above

Windows Server: Active Directory Domain Service (AD DS) - Quiz

1. When accessing resources using authorization from Active Directory Domain Services, what is included in the security token? (Choose two)
   
A.    User’s SID
B.    ACL
C.    Group SIDs
D.    DACL
E.    SACL

2. True or False:  Active Directory Domain Services has a maximum size of 128 000 objects.

3. True or False: The SRV records for AD DS need to be created manually before installing a second domain controller.

4. True or False: Active Directory Domain Services can exist only in a single geographic location.
   
5. What standard is Active Directory based on?
   
A.    X.500
B.    X.300
C.    X.600
D.    X.400
E.    X.200

6. True or False: AD DS requires IPv6 to be installed and configured.

7. True or False: AD DS requires a DNS Infrastructure.

Answers:
1. (Please help me out)
2. False
3 False
4. False
5. X.500
6. False
7. True

Microsoft INF200.1x, Windows Server 2012 Fundamentals: Infrastructure - Organizational Unit

 

What are OUs and Containers?

OUs group AD DS objects

An organizational unit (OU) is an object in a domain that you can use to store user objects, computer objects, group objects, and other objects. With OUs you can link GPOs directly and delegate an OU manager.

Containers have limited functionality

Containers are used for system objects and as the default locations for new objects. Containers have limited management capabilities. You cannot link a GPO to a container. You cannot create an OU in a container.

When to create more OUs?

Although you can manage a small organization without creating additional OUs, even small organizations typically create an OU hierarchy. An OU hierarchy lets you subdivide the administration of your domain for management purposes. There are basically two reasons to create OUs.

• Application of GPOs. To group objects together to make it easier to manage them by applying Group Policy Objects (GPOs) to the whole group. You can link GPOs to the OU, and the settings apply to all objects within the OU. For example, you create an OU for contractors who have different security requirements than full-time employees.
• Delegation of control. To delegate administrative control of objects within the OU. You can assign management permissions on an OU, thereby delegating control of that OU to an AD DS user or group. For example, you create an OU to manage a satellite office in a different geographical location. Then, you delegate control of the OU to a group.

 How to Design the OU Hierarchy

Create OUs based on your organization

When you design an OU hierarchy, you can follow many strategies. You can create a flat, wide structure that has only one or two levels of OUs. You can create a deep, narrow structure that has five or more levels of nesting OUs; or you can create anything in between. The key factor in designing your OU hierarchy is that it should help you manage your organization.

• Geographic location. There might be local IT staff for delegating management, local regulations that require specific policies, or many other factors.
• Departmental characteristics. Typically, different departments are managed differently and have unique requirements.
• Resource type. Some organizations create separate OUs for different resources. File servers are typically managed differently than computers that are running SQL Server and require different policies applied to them.
• Management structure. Some organizations want their OU hierarchy to mirror their management structure.

Are there default OUs and containers?

Every AD DS domain has a standard set of containers and OUs that are created when you install AD DS.

• Builtin container. Stores several default groups.
• Computers container. The default location for new computer accounts that you create in the domain.
• Domain Controllers OU. The default location for domain controllers' computer accounts. This is the only OU that's present in a new installation of AD DS.
• Foreign Security Principals container. The default location for trusted objects from domains outside the AD DS forest. Typically, these are created when an object from an external domain is added to a group in the AD DS domain.
• Managed Service Accounts. The default location for managed service accounts. AD DS provides automatic password management in managed service accounts.
• Users container. The default location for new user accounts and groups that you create in the domain. The Users container also holds the administrator and guest accounts for the domain, and some default groups.

Are there any hidden containers?

Some containers are hidden in Active Directory Users and Computers.

There are several containers that you can see only when you select Advanced Features on the View menu.

By default, the following objects are hidden.

• LostAndFound. This container holds orphaned objects.
• Program Data. This container holds Active Directory data for Microsoft applications, such as Active Directory Federation Services (AD FS).
• System. This container holds the built-in system settings.
• NTDS Quotas. This container holds directory service quota data.
• TPM Devices. This container is new with Windows Server 2012. It stores the recovery information for Trusted Platform Module (TPM) devices.

 

Microsoft INF200.1x, Windows Server 2012 Fundamentals: Infrastructure - Site Links

 

What are Site Links?

Site links describe connections

Site links describe the connections between sites. For two sites to exchange replication data, a site-link must connect them. A site-link is a logical path that is used to establish replication between sites.

Initially there is only one site link

When you create a forest, one site-link object is created: DEFAULTIPSITELINK. By default, each new site that you add is associated with this site link. The DEFAULTIPSITELINK and any other site-links created have a default cost of 100 and a default replication period of 180 minutes.

When to create more site links?

By default, all sites use the default site link

To understand site links it is best to think through an example. Consider an organization with a data center at the headquarters and three branch offices connected to a data center with dedicated high speed networks. You create sites for each branch office: Seattle, Amsterdam, and Beijing. By default, each of the sites, including headquarters, is associated with the DEFAULTIPSITELINK site-link object.

A single site link may not be efficient

Because all four sites use the same site link, you are instructing AD DS that all four sites can replicate with each other. That means that Seattle may replicate changes from Amsterdam; Amsterdam may replicate changes from Beijing; and so on. So, some replication traffic on the network can flow from one branch through the headquarters on its way to another branch. A single site-link does not control the network routes that are used. Having a single site link may not be efficient when you have multiple sites and different network topologies.

Control replication by creating site links that mirror your network topology

To align your network topology with Active Directory replication, you must create specific site-links. That is, you can create site-links that reflect your intended replication topology.

Define the site links you want to use for replication

Continuing the preceding example, you would create three site-links as follows:

• HQ-SEA includes the Headquarters and Seattle sites.
• HQ-AMS includes the Headquarters and Amsterdam sites.
• HQ-BEI includes the Headquarters and Beijing sites.

After you create site-links, the topology will be used to build a replication topology that connects each site.