1. Essential Services
Module 5

2. Objectives Skills/Concepts Objective Domain Description
Objective Domain Number
Looking at Objects
Introducing Groups
Understand accounts and groups.
3.1
Introducing Domains, Trees and Forests
Introducing Organizational Units
Understand organizational units (OUs) and containers.
3.2
Introducing Directory Services with Active Directory
Understand Active Directory Infrastructure.
3.3
Introducing Group Policies
Understand group policy.
3.4
This should also be a review for the

3. Name Resolution
In today’s networks, you assign logical addresses, such as with IP addressing.
Unfortunately, these addresses tend to be hard to remember, especially in the case of newer, more complicated IPv6 addresses.
Therefore, you need to use some form of naming service that will allow you to translate logical names, which are easier to remember, into logical addresses.
The most common naming service is Domain Name System, or DNS.
Another one is WINS

4. DEMO: HOST File
Early TCP/IP networks used hosts (used with domain/hostnames associated with DNS) and lmhost (used with NetBIOS/computer names associated with WINS) files, which were text files that would list a name and its associated IP address. H
owever, with this system, every time you needed to add or modify a name and address, you would have to go to every computer and modify the text file each required to know the address.
For larger organizations, this was incredibly inefficient, because it might involve hundreds if not thousands of computers and extremely large text files.
Although the hosts and lmhosts files are considered legacy methods for naming resolution, they still come in handy when troubleshooting or testing because name resolution will check these two files before contacting naming servers.

5. Domain Name System DNS is short for Domain Name System.
DNS is a hierarchical client/server-based distributed database management system that translates domain/hosts names to IP addresses.
The top of the tree is known as the root domain.
Below the root domain, you will find top-level domains, such as .com, .edu, .org, and .net, as well as two-letter country codes, such as .uk, .ca, and .us.

6. DNS Zones Types
When you define DNS zones, you create the zone as either a forward lookup zone or a reverse lookup zone.
The forward lookup zone (such as technet.microsoft.com or microsoft.com) has the majority of the resource records, including A and CNAME records, whereas the reverse lookup zone has PTR records.
The reverse lookup zone is defined by reverse lookup format.

7. DEMO: DNS

8. DNS Round Robin
DNS servers can use a mechanism called round-robin to distribute loads for network services.
Round-robin rotates the order of resource records with the same name that point to different IP addresses.

9. DNQ Queries and Transfers
DNS queries and DNS transfers between primary and secondary zones occur over TCP/UDP port 53.
So, if you have any firewall between servers (including firewalls running on the servers), you will need to open port 53.

10. Windows Internet Service (WINS)
Windows Internet Name Service (WINS) is a legacy naming service that translates from NetBIOS (computer name) to specify a network resource.
A WINS sever contains a database of IP addresses and NetBIOS names that update dynamically. Unfortunately, WINS is not a hierarchy system like DNS, so it is only good for your organization; also, it functions only for Windows operating systems.
Typically, other network devices and services cannot register with a WINS server.
Therefore, you have to add static entries for these devices if you want name resolution using WINS.

11. DHCP
Dynamic Host Configuration Protocol (DHCP) services automatically assign IP addresses and related parameters (including subnet mask and default gateway and length of the lease) so that a host can immediately communicate on an IP network when it starts.
A DHCP server maintains a list of IP addresses called a pool.
When a DHCP client starts and needs an IP address assigned to it, it broadcasts to a DHCP server asking for a leased address.
The client sends messages to UDP port 67, and the server sends messages to UDP port 68.

12. DEMO: DHCP

13. Directory Services
A directory service stores, organizes, and provides access to information in a directory.
Directory services are used for locating, managing, administering, and organizing common items and network resources, such as volumes, folders, files, printers, users, groups, devices, telephone numbers, and other objects.
One popular directory service used by many organizations is Microsoft’s Active Directory.

14. Active Directory
Active Directory is a technology created by Microsoft that provides a variety of network services, including the following:
LDAP
Kerberos-based and single sign-on authentication
DNS-based naming and other network information
A central location for network administration and delegation of authority
Active Directory requires DNS.

15. Active Directory Logical Structure
Active Directory forests, trees and domains are logical representations of your network organization, which allow you to organize them in the best way to manage them.
Forest
Tree
Domain
To allow users in one domain to access resources in another domain, Active Directory uses trust relationships.

16. Physical Structure
Although domains, trees, and forests are logical representations of your organization, sites and domain controllers represent the physical structure of your network.
Sites: A site is one or more IP subnets that are connected by a high-speed link, typically defined by a geographical location.
Domain Controllers: A Windows server that stores a replica of the account and security information for the domain and defines the domain boundaries.

17. Member Server
A server that is not running as a domain controller is known as a member server.
To demote a domain controller to a member server, you would rerun the dcpromo program.

18. Global Catalogs
Because the domain controller only has information for the domain and does not store a copy of the objects for other domains, you still need a way to find and access objects in other domains within your tree and forest.
A global catalog replicates the information of every object in a tree and forest.
By default, a global catalog is created automatically on the first domain controller in the forest, but any domain controller can be made into a global catalog.

19. FSMO Roles
Active Directory uses multimaster replication, which means that there is no master domain controller, commonly referred to as a primary domain controller within Windows NT domains.
However, because there are certain functions that can be handled by only one domain controller at a time, Active Directory uses Flexible Single Master Operations (FSMO) roles, also known as operations master roles.

20. FSMO Roles Role Scope Description PDC Emulator Domain
Provides Backward compatibility as well as password changes and master time server
Infrastructure Master
Syncs cross-domain group memberships changes
RID Master
Allocates pools of unique identifies to domain controllers for use when creating objects
Domain Naming Master
Forest
Controls the addition and removal of domains from the forest
Schema Master
Controls and handles updates and modifications to the AD Schema

21. Functional Levels
In Active Directory, you can have domain controllers running different versions of Windows servers, such as Windows 2000, Windows Server 2003, or Windows Server 2008.
The functional level of a domain or forest depends on which Windows Server operating system versions are running on the domain controllers in that domain or forest.
The functional level also controls which advanced features are available in the domain or forest.

22. Delegation of Control
By delegating administration, you can assign a range of administrative tasks to the appropriate users and groups.
Containers are objects that can store or hold other objects.
They include the forest, tree, domain, and organizational unit.
To help manage your objects, you can delegate authority to a container, particularly the domain or organizational unit.

23. Active Directory Objects
An object is a distinct, named set of attributes or characteristics that represent a network resource.
Common objects used within Active Directory are computers, users, groups, and printers.
Attributes have values that define the specific object.
Active Directory objects are assigned a 128-bit unique number called a globally unique identifier (GUID), sometimes referred to as a security identifier (SID), to uniquely identify an object.

24. User Accounts
A user account enables a user to log on to a computer and domain.
As a result, it can be used to prove the identity of a user, and this identity information can then be used to determine what the user can access and what kind of authorization he or she has.
It can also be used for auditing.
On today’s Windows networks, there are two types of user accounts: Local user accounts and Domain user accounts

25. Permissions
A permission defines the type of access that is granted to an object (an object can be identified with a security identifier) or object attribute.
The most common objects assigned permissions are NTFS files and folders, printers, and Active Directory objects.
Which users can access an object and what actions those users are authorized to perform are recorded in the access control list (ACL), which lists all users and groups that have access to the object.

26. Computer Accounts
Like user accounts, Windows computer accounts provide a means for authenticating and auditing a computer’s access to a Windows network and access to domain resources.
Each Windows computer to which you want to grant access must have a unique computer account.
A computer account can also be used for auditing purposes, specifying what system was used when something was accessed.

27. Groups
A group is a collection or list of user accounts or computer accounts.
Different from a container, a group does not store user or computer information; rather, it just lists it.
The advantage of using groups is that they simplify administration, especially when assigning rights and permissions.
In Windows Active Directory, there are there are two types of groups: Security and Distribution group

28. Using Groups
To effectively manage the use of groups when assigning access to a network resource using global groups and domain local groups, remember the mnemonic AGDLP
Accounts
Global
Domain Local
Permissions
If you are using universal groups, the mnemonic is expanded to AGUDLP:

29. Built-In Groups
Similar to the administrator and guest accounts, Windows has default groups called built-in groups.
These default groups are granted specific rights and permissions to get you started. Various built-in groups are as follows:
Domain Admins
Domain Users
Account Operators
Backup Operators
Authenticated Users
Everyone

30. Active Directory Management Tools
After you have promoted a computer to a domain controller, you can use several MMC snap-in consoles to manage Active Directory.
These consoles are as follows:
Active Directory Users and Computers
Active Directory Domains and Trusts
Active Directory Sites and Services
Active Directory Administrative Center
Group Policy Management Console (GPMC)

31. DEMO: Active Directory Management Tools
Active Directory Users and Computers
Active Directory Domains and Trusts
Active Directory Sites and Services
Active Directory Administrative Center
Group Policy Management Console (GPMC)

32. DEMO: AD Objects Users Groups (Types and Scopes) Computers
Organizational Units

33. Group Policies
Group Policy is one of the most powerful features of Active Directory that controls the working environment for user accounts and computer accounts.
Group Policy provides centralized management and configuration of operating systems, applications, and user settings in an Active Directory environment.

34. Apply Group Policies
Group Policy can be set locally on a workstation or set at different levels (site, domain, or organizational unit) within Active Directory.
Generally speaking, you will not find as many settings locally as you will at the site, domain, or OU level. When group policies are applied, they are applied in the following order:
Local
Site
Domain OU

35. DEMO: Group Policies

36. Additional Resources & Next Steps
Instructor-Led Courses
40033A: Windows Operating System and Windows Server Fundamentals: Training 2-Pack for MTA Exams and (5 Days)
40349A: Windows Operating System Fundamentals: MTA Exam (3 Days)
40032A: Networking and Security Fundamentals: Training 2-Pack for MTA Exams and (5 Days)
40366A: Networking Fundamentals: MTA Exam
Books
Exam : MTA Networking Fundamentals (Microsoft Official Academic Course)
Exams & Certifications
Exam : Networking Fundamentals

37. 5/12/2018 4:35 PM
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.