Microsoft 70-640 Online Practice Questions and Exam Preparation

Microsoft 70-640 Online Questions & Answers

• Question 201:

  Your network consists of a single Active Directory domain. All domain controllers run Windows Server 2008 R2. The Audit account management policy setting and Audit directory services access setting are enabled for the entire domain.

  You need to ensure that changes made to Active Directory objects can be logged. The logged changes must include the old and new values of any attributes.

  What should you do?

  A. Run auditpol.exe and then configure the Security settings of the Domain Controllers OU.
  B. From the Default Domain Controllers policy, enable the Audit directory service access setting and enable directory service changes.
  C. Enable the Audit account management policy in the Default Domain Controller Policy.
  D. Run auditpol.exe and then enable the Audit directory service access setting in the Default Domain policy.
  A. Run auditpol.exe and then configure the Security settings of the Domain Controllers OU.

  ---

  http://technet.microsoft.com/en-us/library/cc731607%28v=ws.10%29.aspx AD DS Auditing Step-by-Step Guide

  In Windows Server 2008 you can now set up AD DS auditing with a new audit subcategory to log old and new values when changes are made to objects and their attributes.

  ..

  The ability to audit changes to objects in AD DS is enabled with the new audit policy subcategory Directory Service Changes. This guide provides instructions for implementing this audit policy subcategory.

  The types of changes that you can audit include a user (or any security principal) creating, modifying, moving, or undeleting an object. The new audit policy subcategory adds the following capabilities to auditing in AD DS:

  When a successful modify operation is performed on an attribute, AD DS logs the previous and current values of the attribute. If the attribute has more than one value, only the values that change as a result of the modify operation are logged.

  If a new object is created, values of the attributes that are populated at the time of creation are logged. If the user adds attributes during the create operation, those new attribute values are logged. In most cases, AD DS assigns default values

  to attributes (such as samAccountName). The values of such system attributes are not logged.

  If an object is moved, the previous and new location (distinguished name) is logged for moves within the domain. When an object is moved to a different domain, a create event is generated on the domain controller in the target domain.

  If an object is undeleted, the location where the object is moved to is logged. In addition, if the user adds, modifies, or deletes attributes while performing an undelete operation, the values of those attributes are logged.

  ..

  In Windows Server 2008, you implement the new auditing feature by using the following controls:

  Global audit policy

  System access control list (SACL)

  Schema

  Global audit policy

  Enabling the global audit policy, Audit directory service access, enables all directory service policy subcategories. You can set this global audit policy in the Default Domain Controllers Group Policy (under Security Settings\Local Policies\Audit

  Policy). In Windows Server 2008, this global audit policy is not enabled by default.

  Although the subcategory Directory Service Access is enabled for success events by default, the other subcategories are not enabled by default. You can use the command-line tool Auditpol.exe to view or set audit policy subcategories.

  There is no Windows interface tool available in Windows Server 2008 to view or set audit policy subcategories.

  Further information:

  http://technet.microsoft.com/en-us/library/cc731451%28v=ws.10%29.aspx Auditpol

  Displays information about and performs functions to manipulate audit policies. http://servergeeks.wordpress.com/2012/12/31/auditing-directory-services/ AD Scenario Auditing Directory Services

  Auditing of Directory Services depends on several controls, these are:

  1.

  Global Audit Policy (at category level using gpmc.msc tool)

  2.

  Individual Audit Policy (at subcategory level using auditpol.exe tool)

  3.

  System ACLs to specify which operations are to be audited for a security principal.

  4.

  Schema (optional) this is an additional control in the schema that you can use to create exceptions to what is audited.

  In Windows Server 2008, you can now set up AD DS (Active Directory Domain Services) auditing with a new audit policy subcategory (Directory Service Changes) to log old and new values when changes are made to AD DS objects and their attributes. This can be done using auditpol.exe tool. Command to check which audit policies are active on your machine: auditpol /get /category:*

  

  Command to view the audit policy categories and Subcategories:

  

  How to enable the global audit policy using the Windows interface i.e. gpmc tool Click Start, point to Administrative Tools, and then Group Policy Management or run gpmc.msc command.

  In the console tree, double-click the name of the forest, double-click Domains, double-click the name of your domain, double-click Domain Controllers, right-click Default Domain Controllers Policy, and then click Edit.

  

  Under Computer Configuration, double-click Policies, double-click Windows Settings, double-click Security Settings, double-click Local Policies, and then click Audit Policy.

  

  In the details pane, right-click Audit directory service access, and then click Properties.

  Select the Define these policy settings check box.

  Under Audit these attempts, select the Success, check box, and then click OK.

  

  How to enable the change auditing policy using a command line Click Start, right-click Command Prompt, and then click Run as administrator.

  Type the following command, and then press ENTER:

  auditpol /set /subcategory:"directory service changes" /success:enable To verify if the auditing is enabled or not for "Directory Service Changes", you can run below command:

  auditpol /get /category:"DS Access"

  

  How to set up auditing in object SACLs

  Click Start, point to Administrative Tools, and then click Active Directory Users and Computers. Right-click the organizational unit (OU) (or any object) for which you want to enable auditing, and then click Properties.

  Click the Security tab, click Advanced, and then click the Auditing tab.

  

  Click Add, and under Enter the object name to select, type Authenticated Users (or any other security principal) and then click OK.

  

  In Apply onto, click Descendant User objects (or any other objects). Under Access, select the Successful check box for Write all properties. Click OK

  

  Click OK until you exit the property sheet for the OU or other object. To Test whether auditing is working or not, try creating or modifying objects in Finance OU and check the Security event logs. I just created a new user account in Finance OU named f4.

  

  If you check the security event logs you will find eventid 5137 (Create) Note:

  Once the auditing is enabled these eventids will appear in security event logs: 5136 (Modify), 5137 (Create), 5138 (Undelete), 5139 (Move).

  

• Question 202:

  Your network contains an Active Directory forest. The forest contains one domain and three sites. Each site contains two domain controllers. All domain controllers are DNS servers.

  You create a new Active Directory-integrated zone.

  You need to ensure that the new zone is replicated to the domain controllers in only one of the sites.

  What should you do first?

  A. Modify the NTDS Site Settings object for the site.
  B. Modify the replication settings of the default site link.
  C. Create an Active Directory connection object.
  D. Create an Active Directory application directory partition.
  D. Create an Active Directory application directory partition.

  ---

  Practically the same question as A/Q50 and K/Q17, different set of answers. To control which servers get a copy of the zone we have to store the zone in an application directory partition.

  That application directory partition must be created before we create the zone, otherwise it won't work. So that's what we have to do first. Directory partitions are also called naming contexts and we can create one using ntdsutil.

  Here I tried to create a zone with dnscmd /zoneadd. It failed because the directory partition I wanted to use did not exist yet. To fix that I used ntdsutil to create the directory partition dc=venomous,dc=contoso,dc=com.

  Note that after creating it a new naming context had been added. Then, after a minute or two, I tried to create the new zone again, and this time it worked.

  

  Reference 1:

  http://technet.microsoft.com/en-us/library/cc725739.aspx Store Data in an AD DS Application Partition

  You can store Domain Name System (DNS) zones in the domain or application directory partitions of Active

  Directory Domain Services (AD DS). An application directory partition is a data structure in AD DS that distinguishes data for different replication purposes. When you store a DNS zone in an application directory partition, you can control the

  zone replication scope by controlling the replication scope of the application directory partition.

  Reference 2:

  http://technet.microsoft.com/en-us/library/cc730970.aspx Partition management

  Manages directory partitions for Active Directory Domain Services (AD DS) or Active Directory Lightweight

  Directory Services (AD LDS).

  This is a subcommand of Ntdsutil and Dsmgmt.

  Examples

  To create an application directory partition named AppPartition in the contoso.com domain, complete the following steps:

  1.

  To open an elevated Command Prompt window, click Start, point to All Programs, click Accessories, rightclick Command Prompt, and then click Run as administrator.

  2.

  Type: ntdsutil

  3.

  Type: Ac in ntds

  4.

  Type: partition management

  5.

  Type: connections

  6.

  Type: Connect to server DC_Name

  7.

  Type: quit

  8.

  Type: list The following partitions will be listed: 0 CN=Configuration, DC=Contoso, DC=com 1 DC=Contoso, DC=com 2 CN=Schema, CN=Configuration, DC=Contoso, DC=com 3 DC=DomainDnsZones, DC=Contoso, DC=com 4 DC=ForestDnsZones, DC=Contoso, DC=com

  9.

  At the partition management prompt, type: create nc dc=AppPartition, DC=contoso,dc=com ConDc1.contoso.com

  10.

  Run the list command again to refresh the list of partitions.

• Question 203:

  Your network contains a domain controller that has two network connections named Internal and Private.

  Internal has an IP address of 192.168.0.20. Private has an IP address of 10.10.10.5. You need to prevent the domain controller from registering Host (A) records for the 10.10.10.5 IP address.

  What should you do?

  A. Modify the netlogon.dns file on the domain controller.
  B. Modify the Name Server settings of the DNS zone for the domain.
  C. Modify the properties of the Private network connection on the domain controller.
  D. Disable netmask ordering on the DNS server that hosts the DNS zone for the domain.
  C. Modify the properties of the Private network connection on the domain controller.

  ---

  http://support.microsoft.com/kb/2023004 Steps to avoid registering unwanted NIC(s) in DNS on a Mulithomed Domain Controller Symptoms On Domain Controllers with more than one NIC where each NIC is connected to separate Network, there is a possibility that the Host A DNS registration can occur for unwanted NIC(s). If the client queries for DC's DNS records and gets an unwanted record or the record of a different network which is not reachable to client, the client will fail to contact the DC causing authentication and many other issues.

  Cause The DNS server will respond to the query in a round robin fashion. If the DC has multiple NICs registered in DNS. The DNS will serve the client with all the records available for that DC. To prevent this, we need to make sure the unwanted NIC address is not registered in DNS. Below are the services that are responsible for Host A record registration on a DC

  1.

  Netlogon service

  2.

  DNS server service (if the DC is running DNS server service)

  3.

  DHCP client /DNS client (2003/2008) If the NIC card is configured to register the connection address in DNS, then the DHCP /DNS client service will Register the record in DNS. Unwanted NIC should be configured not to register the connection address in DNS If the DC is running DNS server service, then the DNS service will register the interface Host A record that it has set to listen on. The Zone properties, "Name server" tab list out the IP addresses of interfaces present on the DC. If it has listed both the IPs, then DNS server will register Host A record for both the IP addresses. We need to make sure only the required interface listens for DNS and the zone properties, name server tab has required IP address information Resolution To avoid this problem perform the following 3 steps (It is important that you follow all the steps to avoid the issue).

  1.

  Under Network Connections Properties: On the Unwanted NIC TCP/IP Properties -> Advanced -> DNS > Uncheck "Register this connections Address in DNS"

  2.

  Open the DNS server console: highlight the server on the left pane Action-> Properties and on the "Interfaces" tab select "listen on only the following IP addresses". Remove unwanted IP address from the list

  3.

  On the Zone properties, select Name server tab. Along with FQDN of the DC, you will see the IP address associated with the DC. Remove unwanted IP address if it is listed. After performing this delete the existing unwanted Host A record of the DC.

• Question 204:

  Your network contains an Active Directory forest.

  You set the Windows PowerShell execution policy to allow unsigned scripts on a domain controller in the network.

  You create a Windows PowerShell script named new-users.ps1 that contains the following lines:

  

  new-aduser

  user1

  

  new-aduser

  user2

  

  new-aduser

  user3

  

  new-aduser

  user4

  

  new-aduser

  user5

  On the domain controller, you double-click the script and the script runs. You discover that the script fails to create the user accounts.

  You need to ensure that the script creates the user accounts. Which cmdlet should you add to the script?

  A. Import-Module
  B. Register-ObjectEvent
  C. Set-ADDomain
  D. Set-ADUser
  A. Import-Module

  ---

  http://blog.coretech.dk/jgs/powershell-creating-new-users-from-csv-with-password-and-enabled- accounts-orhow-to-pipe-into-multiple-cmdlets/

  PowerShell: Creating new users from CSV with password and enabled accounts or How to Pipe into multiple cmdlets ..

  1.

  Import-Module ActiveDirectory

  2.

  import-csv e:\users\newusers.csv |

  3.

  New-ADUser -path "ou=test1,dc=contoso,dc=com" -passthru |

  4.

  ForEach-Object {

  5.

  $_ | Set-ADAccountPassword -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "Pa$ $w0rd" - Force)

  6.

  $_ | Enable-ADAccount }

• Question 205:

  Your company has a domain controller server that runs the Windows Server 2008 R2 operating system. The server is a backup server. The server has a single 500-GB hard disk that has three partitions for the operating system, applications, and data. You perform daily backups of the server.

  The hard disk fails. You replace the hard disk with a new hard disk of the same capacity. You restart the computer on the installation media. You select the Repair your computer option.

  You need to restore the operating system and all files.

  What should you do?

  A. Select the System Image Recovery option.
  B. Run the Imagex utility at the command prompt.
  C. Run the Wbadmin utility at the command prompt.
  D. Run the Rollback utility at the command prompt.
  C. Run the Wbadmin utility at the command prompt.

  ---

  Old answer: Run the Wbadmin utility at the command prompt.

  Answer: Select the System Image Recovery option.

  http://technet.microsoft.com/en-us/library/cc755163.aspx Recover the Operating System or Full Server Applies To: Windows Server 2008 R2 You can recover your server operating system or full server by using Windows Recovery Environment and a backup that you created earlier with Windows Server Backup. You can access the recovery and troubleshooting tools in Windows Recovery Environment through the System Recovery Options dialog box in the Install Windows Wizard. In Windows Server 2008 R2, to launch this wizard, use the Windows Setup disc or start/restart the computer, press F8, and then select Repair Your Computer from the list of startup options. .. To recover your operating system or full server using a backup created earlier and Windows Setup disc

  1.

  Insert the Windows Setup disc that has the same architecture of the system that you are trying to recover into the CD or DVD drive and start or restart the computer. If needed, press the required key to boot from the disc. The Install

  Windows Wizard should appear.

  2.

  In Install Windows, specify language settings, and then click Next.

  3.

  Click Repair your computer.

  4.

  Setup searches the hard disk drives for an existing Windows installation and then displays the results in System Recovery Options. If you are recovering the operating system onto separate hardware, the list should be empty (there should

  be no operating system on the computer). Click Next.

  5.

  On the System Recovery Options page, click System Image Recovery. This opens the Re-image your computer page.

  ...

  http://technet.microsoft.com/en-us/magazine/dd767786.aspx Use the Wbadmin Backup Command Line Utility in Windows Server 2008 Wbadmin is the command-line counterpart to Windows Server Backup. You use Wbadmin to manage all

  aspects of backup configuration that you would otherwise manage in Windows Server Backup. This means that you can typically use either tool to manage backup and recovery. After you've installed the Backup Command-Line Tools feature,

  you can use Wbadmin to manage backup and recovery. Wbadmin is located in the %SystemRoot%\System32\ directory. As this directory is in your command path by default, you do not need to add this directory to your command path.

  Further information:

  http://technet.microsoft.com/en-us/library/cc754015%28v=ws.10%29.aspx Wbadmin Enables you to back up and restore your operating system, volumes, files, folders, and applications from a command prompt.

  

  Remarks

  The wbadmin command replaces the ntbackup command that was released with previous versions of Windows. You cannot recover backups that you created with ntbackup by using wbadmin. However, a version of ntbackup is available as a

  download for Windows Server 2008, Windows Vista, Windows Server 2008 R2, or Windows 7 users who want to recover backups that they created using ntbackup. This downloadable version of ntbackup enables you to perform recoveries

  only of legacy backups, and it cannot be used on computers running Windows Server 2008, Windows Vista, Windows Server 2008 R2, or Windows 7 to create new backups.

  http://technet.microsoft.com/en-us/library/dd979562%28v=ws.10%29.aspx Backup and Recovery Overview for Windows Server 2008 R2 Windows Server 2008 R2 contains features to help you create backups and, if needed, perform a

  recovery of your operating system, applications, and data. By using these features appropriately and implementing good operational practices, you can improve your organization's ability to recover from damaged or lost data, hardware

  failures, and disasters. For Windows Server 2008 R2, there are new features that expand what you can back up, where you can store backups, and how you can perform recoveries.

  ..

  This table summarizes the tools you can use to perform the following backup or recovery tasks for your computers running Windows Server 2008 R2:

  

  What is Windows Recovery Environment?

  You can access the recovery and troubleshooting tools in Windows Recovery Environment through the System Recovery Options dialog box in the Install Windows Wizard. In Windows Server 2008 R2, to launch this wizard, use the Windows

  Setup disc or start/restart the computer, press F8, and then select Repair Your Computer from the list of startup options.

  Features in Windows Recovery Environment

  The tools in Windows Recovery Environment include:

  System Image Recovery. You can use this tool and a backup that you created earlier with Windows Server Backup to restore your operating system or full server. Windows Memory Diagnostic. You can use this tool (which is a memory

  diagnostic schedule) to check your computer's RAM. Doing this requires a restart. In addition, this tool requires a valid Windows Server 2008, Windows Vista, Windows Server 2008 R2, or Windows 7 installation to function. Command Prompt.

  This opens a command prompt window with Administrator privileges that provides full access to your file system and volumes. In addition, certain Wbadmin commands are only available from this command window.

• Question 206:

  Your company has a main office and a branch office. The company has a single-domain Active Directory forest. The main office has two domain controllers named DC1 and DC2 that run Windows Server 2008 R2. The branch office has a Windows Server 2008 R2 read-only domain controller (RODC) named DC3.

  All domain controllers hold the DNS Server role and are configured as Active Directory-integrated zones. The DNS zones only allow secure updates.

  You need to enable dynamic DNS updates on DC3.

  What should you do?

  A. Run the Dnscmd.exe /ZoneResetType command on DC3.
  B. Reinstall Active Directory Domain Services on DC3 as a writable domain controller.
  C. Create a custom application directory partition on DC1. Configure the partition to store Active Directoryintegrated zones.
  D. Run the Ntdsutil.exe > DS Behavior commands on DC3.
  B. Reinstall Active Directory Domain Services on DC3 as a writable domain controller.

  ---

  Answer: Reinstall Active Directory Domain Services on DC3 as a writable domain controller.

  http://technet.microsoft.com/en-us/library/cc754218%28WS.10%29.aspx#BKMK_DDNS Appendix A: RODC Technical Reference Topics DNS updates for clients that are located in an RODC site When a client attempts a dynamic update, it sends a start of authority (SOA) query to its preferred Domain Name System (DNS) server. Typically, clients are configured to use the DNS server in their branch site as their preferred DNS server. The RODC does not hold a writeable copy of the DNS zone. Therefore, when it is queried for the SOA record, it returns the name of a writable domain controller that runs Windows Server 2008 or later and hosts the Active Directoryintegrated zone, just as a secondary DNS server handles updates for zones that are not Active Directory-integrated zones. After it receives the name of a writable domain controller that runs Windows Server 2008 or later, the client is then responsible for performing the DNS record registration against the writeable server. The RODC waits a certain amount of time, as explained below, and then it attempts to replicate the updated DNS object in Active Directory Domain Services (AD DS) from the DNS server that it referred the client to through an RSO operation.

  Note: For the DNS server on the RODC to perform an RSO operation of the DNS record update, a DNS server that runs Windows Server 2008 or later must host writeable copies of the zone that contains the record. That DNS server must register a name server (NS) resource record for the zone. The Windows Server 2003 Branch Office Guide recommended restricting name server (NS) resource record registration to a subset of the available DNS servers. If you followed those guidelines and you do not register at least one writable DNS server that runs Windows Server 2008 or later as a name server for the zone, the DNS server on the RODC attempts to perform the RSO operation with a DNS server that runs Windows Server 2003. That operation fails and generates a 4015 Error in the DNS event log of the RODC, and replication of the DNS record update will be delayed until the next scheduled replication cycle.

  Further information: http://technet.microsoft.com/en-us/library/dd737255%28v=ws.10%29.aspx Plan DNS Servers for Branch Office Environments This topic describes best practices for installing Domain Name System (DNS) servers to support Active Directory Domain Services (AD DS) in branch office environments. As a best practice, use Active Directoryintegrated DNS zones, which are hosted in the application directory partitions named ForestDNSZones and DomainDNSZones. The following guidelines are based on the assumption that you are following this best practice. In branch offices that have a read-only domain controller (RODC), install a DNS server on each RODC so that client computers in the branch office can still perform DNS lookups when the wide area network (WAN) link to a DNS server in a hub site is not available. The best practice is to install the DNS server when you install AD DS, using Dcpromo.exe. Otherwise,you must use Dnscmd.exe to enlist the RODC in the DNS application directory partitions that host Active Directoryintegrated DNS zones. Note: You also have to configure the DNS client's setting for the RODC so that it points to itself as its preferred DNS server. To facilitate dynamic updates for DNS clients in branch offices that have an RODC, you should have at least one writeable Windows Server 2008 DNS server that hosts the corresponding DNS zone for which client computers in the branch office are attempting to make DNS updates. The writeable Windows Server 2008 DNS server must register name server (NS) resource records for that zone. By having the writeable Windows Server 2008 DNS server host the corresponding zone, client computers that are in branch offices that are serviced by RODCs can make dynamic updates more efficiently. This is because the updates replicate back to the RODCs in their respective branch offices by means of a replicatesingleobject (RSO) operation, rather than waiting for the next scheduled replication cycle.

  For example, suppose that you add a new member server in a branch office, Branch1, which includes an RODC. The member server hosts an application that you want client computers in Branch1 to locate by using a DNS query. When the member server attempts to register its host (A or AAAA) resource records for its IP address to a DNS zone, it performs a dynamic update on a writeable Windows Server 2008 or Windows Server 2008 R2 DNS server that the RODC tracks in Branch1. If a writeable Windows Server 2008 DNS server hosts the DNS zone, the RODC in Branch1 replicates the updated zone information as soon as possible from the writeable Windows Server 2008 DNS server. Then, client computers in Branch1 can successfully locate the new member server by querying the RODC in Branch1 for its IP address.

  If you do not have a writeable Windows Server 2008 DNS server that hosts the DNS zone, the update can still succeed against Windows Server 2003 DNS server if one is available but the updated record in the DNS zone will not replicate to the RODC in Branch1 until the next scheduled replication cycle, which can delay client computers that use the RODC DNS server for name resolution from locating the new member server.

• Question 207:

  A domain controller named DC12 runs critical services. Restructuring of the organizational unit hierarchy for the domain has been completed and unnecessary objects have been deleted. You need to perform an offline defragmentation of the Active Directory database on DC12. You also need to ensure that the critical services remain online.

  What should you do?

  A. Start the domain controller in the Directory Services restore mode. Run the Defrag utility.
  B. Start the domain controller in the Directory Services restore mode. Run the Ntdsutil utility.
  C. Stop the Domain Controller service in the Services (local) Microsoft Management Console (MMC). Run the Defrag utility.
  D. Stop the Domain Controller service in the Services (local) Microsoft Management Console (MMC). Run the Ntdsutil utility.
  D. Stop the Domain Controller service in the Services (local) Microsoft Management Console (MMC). Run the Ntdsutil utility.

  ---

  http://support.microsoft.com/kb/232122

  Performing offline defragmentation of the Active Directory database Active Directory automatically performs online defragmentation of the database at certain intervals (by default, every 12 hours) as part of the Garbage Collection process.

  Online defragmentation does not reduce the size of the database file (Ntds.dit), but instead optimizes data storage in the database and reclaims space in the directory for new objects.

  Performing an offline defragmentation creates a new, compacted version of the database file. Depending on how fragmented the original database file was, the new file may be considerably smaller. http://rickardnobel.se/when-to-offlinedefrag-ntds-dit/ When to offline defrag the Active Directory database.

  This article will show a simple way to determine if there is any gain to do an offline defrag of your Active Directory database.

  During normal operations the Active Directory service will do an online defragmentation of the Active Directory database (always called ntds.dit) each 12 hours.

  This online defrag will arrange all pages in an optimal way internal in the ntds.dit, however the file size will never shrink, sometimes even grow. During the years of operations of the ntds.dit the file size will increase as user accounts,

  organizational units, groups, computers, dns records and more are added and later removed.

  When deleted objects are finally removed (after the so called tombstone lifetime, typically 180 days) the space they have occupied will unfortunately not decrease.

  

  The actual size of the ntds.dit could be easily studied through Explorer, as above. The size of the database is in this example around 575 MB. Note that Active Directory does not use a file level replication, so the file could be of various size on each Domain Controller in your domain. If wanted there is the possibility to take the AD services offline on one DC and then do an offline defragmentation of ntds.dit. This would both arrange all pages the best possible way, and also to reclaim any empty space inside the database, which could make backup and restore faster and also possible increase AD performance. The offline defrag means "offline" from an Active Directory perspective. This means that on Windows 2000 and 2003 you will have to reboot into Directory Services Restore Mode, and on Windows 2008 and R2 you will have to stop the AD services by typing "net stop ntds" in the command prompt. So in Windows 2008 and later it is far easier, but still something that you do not want to do if not necessary. There are numerous article on the web how to do the actual offline defrag, so we will not cover that part here. However, we will see the perhaps most important information and that is to be able to see in advance the amount of space that we could reclaim. With this information we could make our decision based on fact and not guesses. This has been possible since at least Windows 2003, but is not well documented.

  

  To enable this you will have to alter a registry value on the Domain Controller you will investigate the reclaimable MBs. Use regedit and find the following key:

  HKEY_LOCAL_MACHINE \ System \ CurrentControlSet \ Services \ NTDS \ Diagnostics Change the value "6 Garbage Collection" from 0 to 1. This will increase the logging from the Garbage Collection process which runs together with the

  online defrag. So now wait for the next online defragmentation which runs twice a day and then study the Directory Service log in Event Viewer.

  

  Search for event id 1646, usually together with event ids 700 and 701.

  

  Here we can note the amount of space that would be reclaimed from an offline defrag. The top value is the number of MB that the offline defrag would recover, here almost half the database size. If the amount is negligible then do not worry about this any more, and if there is a considerable amount of MBs reported then you could plan to do the offline defrag.

  

  Note that both the change of registry key and the actual offline defrag has to be done on each domain controller, since neither does replicate. As noted above we will not look at the commands for the offline defragmentation here, since they are well documented already.

• Question 208:

  Your network contains a server named Server1 that runs Windows Server 2008 R2.

  On Server1, you create an Active Directory Lightweight Directory Services (AD LDS) instance named Instance1.

  You connect to Instance1 by using ADSI Edit.

  You run the Create Object wizard and you discover that there is no User object class. You need to ensure that you can create user objects in Instance1.

  What should you do?

  A. Run the AD LDS Setup Wizard.
  B. Modify the schema of Instance1.
  C. Modify the properties of the Instance1 service.
  D. Install the Remote Server Administration Tools (RSAT).
  B. Modify the schema of Instance1.

  ---

  http://technet.microsoft.com/en-us/library/cc772194.aspx To create users in AD LDS, you must first import the optional user classes that are provided with AD LDS into the AD LDS schema. These user classes are provided in importable .ldf files, which you can find in the directory %windir%adam on the computer where AD LDS is installed. The user, inetOrgPerson, and OrganizationalPerson object classes are not available until you import the AD LDS user class definitions into the schema.

• Question 209:

  You create a new Active Directory domain. The functional level of the domain is Windows Server 2003. The domain contains five domain controllers that run Windows Server 2008 R2.

  You need to monitor the replication of the group policy template files.

  Which tool should you use?

  A. Dfsrdiag
  B. Fsutil
  C. Ntdsutil
  D. Ntfrsutl
  D. Ntfrsutl

  ---

  With domain functional level 2008 you have available dfs-r sysvol replication. So with DFL2008 you can use the DFSRDIAG tool. It is not available with domain functional level 2003. With domain functional level 2003 you can only use Ntfrsutl.

• Question 210:

  Your network contains an Active Directory domain named contoso.com. The Zone Transfers settings of contoso.com are configured as shown in the Zone Transfers exhibit. (Click the Exhibit button.)

  

  The Name Servers settings ofcontoso.com are configured as shown in the Name Servers exhibit. (Click the Exhibit button.)

  

  To answer, complete each statement according to the information presented in the exhibits. Each correct selection is worth one point.

  Hot Area: