12.2. Exam 70-294 Suggested Exercises Exam 70-294 expects you to know how to plan, implement, manage, and maintain Active Directory infrastructure for Windows Server 2003. You'll need plenty of hands-on previous experience to pass the exam. You'll need to review the study guide closely and review closely any areas with which you are unfamiliar. This section provides a numbered list of exercises that you can follow to gain experience in the exam's subject areas. Performing the exercises will be useful for help to ensure that you have hands-on experience with all areas of the exam. For this exam, I recommend setting up a three-computer test network with two servers running Windows Server 2003 and one workstation running Windows XP Professional. One of your servers should be configured as a domain controller with DNS. The other should be configured as your DHCP server and as your Routing and Remote Access Server (RRAS). The workstation will need to be used in several roles. You'll need to configure it to be a member of the domain when you test TCP/IP, DHCP, and DNS client configurations. When you test RRAS, you'll want to configure the workstation as a RRAS client. To help prepare for this exam, I recommend setting up a test environment that creates a forest root domain and a child domain with four servers running Windows Server 2003. In the forest root domain, install two domain controllers to handle the forest and parent domain roles. In a child domain, install two domain controllers to handle child domain roles. This configuration should help ensure that you can practice all the management and maintenance tasks measured by the exam. In addition to performing the exercises below, you should also have experience using each of the Windows Server 2003 administrative tools described in the Study Guide.
Tip: Perform the exercises in this section in an isolated test environment. Do not perform these exercises on your organization's network.
12.2.1. Creating a Forest and Domain Plan Create a plan for deploying a new forest using a dedicated root. Create a plan for deploying a new forest using a nondedicated root. Plan the placement of DNS servers. Plan the placement of operations masters. Plan the placement of global catalogs. Plan the placement of bridgehead servers.
12.2.2. Installing an Active Directory Domain Controller Prepare a test environment. Install an Active Director domain controller in a new forest. Add an additional domain controller to the forest. Use DCPROMO /ADV promote a DC from backup. Install a child domain in a new forest. Install an additional domain controller to the child domain. Demote one of the domain controllers in the child domain by uninstalling Active Directory. Install an application data partition on one of the domain controllers. Configure an application partition replica on another domain controller. Remove the application partition replica. Remove the application partition.
12.2.3. Setting Forest and Domain Functional Levels View the current forest functional level. Based on the server operating systems being used, determine whether you can raise the forest functional level. View the current domain functional level. Based on the server operating systems being used, determine whether you can raise the domain functional level.
12.2.4. Optimizing the Active Directory Infrastructure Prepare a test environment. Configure the UPN suffix for all users. Update replication settings so the wWWHomePage attribute is replicated. Update replication settings so the wWWHomePage attribute is indexed for searches. Enable universal group membership caching. Designate a global catalog server.
12.2.5. Transferring Operations Master Roles Prepare a test environment. Locate the current operations masters for all roles. Transfer the schema master role to a new owner. Transfer the PDC emulator master role to a new owner.
12.2.6. Creating Organizational Units Prepare a test environment. Create a new domain. Create organizational units for each business unit in the company. Modify the OU hierarchy so the top-level OU is for enterprise administration. Create user and computer accounts and move these accounts to an OU. Delegate control over an OU so a user can create, delete, and manage accounts in the OU.
12.2.7. Creating and Configuring Sites Prepare a test environment. Create two sites. Create one or more subnets and associate them with each site. Link one site to other site using site links. Associate a domain controller with each site. Specify a site license server for each site.
12.2.8. Configuring Intersite Replication Prepare a test environment. Create the site links for connecting two or more sites. Configure site link properties for replication cost, interval, and schedule as appropriate. Disable site link transitivity for IP and SMTP. Create a site link bridges between sites. Enable site link transitivity for IP and SMTP. Determine a site's Inter-Site Topology Generator. Determine a site's bridgehead servers. Specify preferred bridgehead servers.
12.2.9. Configuring Trust Relationships Prepare a test environment. Examine the current trust relationships for all domains in a forest. List the types of trusts, the trusting domains, and the trusted domains. Establish a shortcut trust between two child domains in separate domain trees.
12.2.10. Monitoring Active Directory Prepare a test environment. Ensure that the dependent services are running. Examine firewalls to ensure that TCP and UDP ports are open as appropriate for Active Directory. Use Repadmin to examine all aspects of replication. Use Replmon to synchronize a domain controller's domain partition with all other domain controllers in a domain. Use Replmon to search for replication errors. Use the Performance console to monitor the Directory Replication Agent in Active Directory. Use the Performance console to monitor FRS. Check the event logs for Active Directory errors. Check the event logs for FRS errors.
12.2.11. Backing up and Restoring Active Directory Prepare a test environment. Back up a domain controller. Perform a nonauthoritative restore of a domain controller. Perform an authoritative restore of a domain controller. Perform a primary restore of the Sysvol.
12.2.12. Planning Security Groups Create a security group plan for a new network with 5,000 users. Create a security group hierarchy that encompasses all resources and includes universal groups. Create a distribution group hierarchy for users and includes universal groups.
12.2.13. Planning an Authentication Strategy That Uses Smart Cards and Group Policy Prepare a test environment. Configure an enterprise CA hierarchy. Enable autoenrollment in Group Policy. Configure user accounts to require smart cards for log on and authentication. Configure remote access to require Extensible Authentication Protocol (EAP). Configure domain-wide account password and account lockout policies in Group Policy. Configure domain-wide policy for renaming the Administrator and Guest accounts.
12.2.14. Working with Local Group Policy Prepare a test environment. Access local group policy on a local computer. Enable Automatic Updates policy on the local computer. Access local group policy on a remote computer. Enable Automatic Updates policy on the remote computer.
12.2.15. Managing Active Directory Group Policy Prepare a test environment. Create a GPO and link it to a site. Configure the site GPO so that its setting cannot be overridden. Edit the site GPO and configure policy settings. Create a GPO and link it to a domain. Configure the domain GPO to block inheritance. Edit the domain GPO and configure policy settings. Create a GPO and link it to an OU. Configure the OU's GPO so user settings are disabled.
12.2.16. Configuring User and Computer Environments Using Group Policy Prepare a test environment. Create a GPO and link it to an OU. Configure a startup script for computers in the OU. Configure a logon script for users in the OU. Configure folder redirection for AppData and My Documents.
12.2.17. Distributing Software by Using Group Policy Prepare a test environment. Deploy software using user publishing. Adminpak.msi is in the %SystemRoot%\System32 folder on the servers. Deploy a new version of the deployed software. If you've deployed the Adminpak.msi for Windows Server 2003, you can try deploying the Adminpak.msi for Windows Server 2003 Service Pack 1 as an update.
12.2.18. Troubleshooting the Application of Group Policy Security Settings Prepare a test environment. Use the Resultant Set Of Policy in planning mode to determine settings for a user and computer in a new OU. Move the user and computer to the new OU. Refresh Group Policy using gpupdate. Use the Resultant Set Of Policy in logging mode to determine the applied policy settings. Use Gpresult to determine the complete list of GPOs applied to a user and computer. Use Gpresult to determine the security groups of which a user and computer are members. Use Gpresult in verbose mode and store the results in a text file.
12.2.19. Restoring the Default Domain Policy and Default Domain Controller Policy GPOs Prepare a test environment. Examine the Default Domain Policy and the Default Domain Controller Policy for a domain. Configure Account Lockout Policy and Password Policy in the Default Domain Policy in a nonstandard way. Configure Audit Policy in the Default Domain Controller Policy in a nonstandard way. Use Dcgpofix to restore the Default Domain Policy and the Default Domain Controller Policy for a domain. Examine the Default Domain Policy and the Default Domain Controller Policy for the domain.
|