Section 2 - Chapter 12

Question 1

2003 Domain Functional Level Features

Hint: DDS

Answer 1

Domain Controller Rename - netdom
Default User And Computer Redirection
Selective authentication

lastLogonTimestamp Attribute
userPassword Attribute
Authorization Manager Policies
Constrained Delegation

Question 2

2008 Domain Functional Level Features

Hint: FAD LA

Answer 2

Fine Grained Password Policies
Advanced Encrtpyion Services (Kerberos)
DFS-R Replication of Sysvol

Last Interactive Logon Info
Access Based Enumeration (ABE) of Domain DFS Namespaces

Question 3

Raising The Domain Functional Level

Answer 3

AD D&T - rc Domain, Raise Domain Functional Level
AD U&C - rc Domain, Raise the Domain Functional Level

Must be a member of Domain Admins

PDC Emulator Operations Master must be accessible

Question 4

2003 Forest Functional Level Features

Hint: FDR L

Answer 4

Forest Trusts
Domain Rename
RODCs
Linked Value Replication

Improved KCC algorithms and scalability
Conversion of inetOrgPerson objects to user objects
Support for dynamicObject auxiliary class
Support for application basic groups and LDAP query groups
Deactivation and redefinition of attributes and object classes

Question 5

2008 R2 Forest Functional Level Features

Answer 5

AD Recycle Bin

Question 6

Raising the Forest Functional Level

Answer 6

AD D&T - rc Root Node, Raise Forest Functional Level

Question 7

Domain Characteristics

Answer 7

Single Domain Partition - rep’d to all DCs
Single Kerberos policy
Single DNS namespace

Question 8

Moving Objects Between Domains and Forests

Answer 8

Inter-Forest - preserves the source domain, and clones accounts into the target domain

Non destructive, provides for rollback

Intra-forest - moves objects from the source domain to the target domain

Decommission after migration

Question 9

Active Directory Migration Tool (ADMT)

Answer 9

Console or command line admt.exe

Can script

Can simulate to evaluate before move

sIDHistory - attribute loaded with SID in source domain

Question 10

ADMT - Security translation

Answer 10

Security translation - replace source SID with target SID, re-mapping ACLs

Can translate:
File and Folder Permissions
Printer Permissions
Share Permissions
Registry Permissions
User Rights
Local Profiles
Group Memberships

Question 11

ADMT - Global Groups

Answer 11

Inter-forest - migrate global groups first, then users

Intra-forest - create global group as a universal group in the target, move users, then change group scope back to global

Question 12

ADMT - Migration Concerns

Answer 12

Password Migration - can migrate but cannot verify policy, when they expire a new compliant password must be created

Service Accounts - must be updated with new service account identity - automatic

Objects that cannot be migrated - some builtin groups such as Domain Admins or Domain Local Admins

Question 13

Domain Trusts Parties

Answer 13

The trusting domain has resources, it extends the trust to the authentication services, it is the outgoing trust

The trusted domain authenticates the users, it is the incoming trust

Question 14

Manual Trusts

Answer 14

Shortcut trusts - creates trusts between child domains in the forest trust path, one way or two way, transitive

External Trusts - a trust between a domain in your forest and one not in your forest, creates a foreign security principal object for each security principal in the trusted domain, one way, non transitive

Realm Trusts - establishes a trust with UNIX, one way, non transitive, account mapping system creates proxy accounts managed thru AD U&C

Forest Trust - trust between the forest root domains of two forests

Question 15

Trust Domain Quarantine

Answer 15

Trusts use SID filtering to quarantine users without original SID

If users have been migrated and have sIDHistory attribute must disable

netdom trust trustingDN/domain:trustedDN /quarantine:no or yes

Question 16

Trust Authentication

Answer 16

Domain Wide

Selective Authentication - users must be given allow to authenticate permission on DC in trusting domain

Question 17

Verify Trusts

Answer 17

AD D&T or netdom trust

Question 18

Remove Trusts

Answer 18

AD D&T or netdom trust

Use /force to remove realm trusts