20411B-ENU-TrainerHandbook

Administering Windows Server® 2012 2-33

Exercise 4: Troubleshooting DNS

MCT

Scenario

After implementing the new server, you need to test and verify the configuration by using standard DNS

troubleshooting tools.

USE

1.

On the host computer, start Hyper-V Manager.

PROHIBITED

2.

In the Virtual Machines list, right-click 20411B-LON-DC1, and then click Revert.

3.

In the Revert Virtual Machine dialog box, click Revert.

4.

Repeat steps 2 and 3 for 20411B-LON-SVR1 and 20411B-LON-CL1.

3-1

Module 3

MCT

USE

Maintaining Active Directory Domain Services

Contents:

.ONLY

Module Overview

3-1

Lesson 1: Overview of AD DS

3-2

Lesson 2: Implementing Virtualized Domain Controllers

3-7

Lesson 3: Implementing Read-Only Domain Controllers

3-11

Lesson 4: Administering AD DS

3-15

Lesson 5: Managing the AD DS Database

3-23

Lab: Maintaining AD DS

3-32

Module Review and Takeaways

3-38

features, how important components integrate with each other, and how you can ensure that your

STUDENT

domain-based network functions properly.

You will learn about new features, such as virtualized domain controller cloning, recent features like read-

only domain controllers (RODCs), and a host of other features and tools that you can use in the AD DS

USE

environment.

Objectives

After completing this module, you will be able to:

PROHIBITED

• Explain the general structure of AD DS.

• Implement virtualized domain controllers.

•

Implement RODCs.

•

Administer AD DS.

•

Manage the AD DS database.

Administering Windows Server® 2012

MCT

3-3

Logical component

Description

Partition

A section of the AD DS database. Although the database actually is just one

USE

file named NTDS.DIT, users view, manage, and replicate it as if it consists of

distinct sections or instances. These are partitions, or naming contexts.

Schema

Defines the list of object types and attributes that all AD DS objects can have.

Domain

A logical, administrative boundary for users and computers.

Domain tree

A collection of domains that share a common root domain and a Domain

ONLY.

Name System (DNS) namespace.

Forest

A collection of domains that share a common AD DS.

Site

A collection of users, groups, and computers, which are defined by their

physical locations. Sites are useful in planning administrative tasks such as

replication of changes to the AD DS database.

OU

Organizational units (OUs) are containers in AD DS that provide a framework

for delegating administrative rights and for linking Group Policy Objects

(GPOs).

Understanding AD DS Forest and Schema Structure

STUDENT

In AD DS forest and schema structure are

USE

important for the defining the functionality and

scope of your environment.

AD DS Forest Structure

A forest is a collection of one or more domain

trees. A tree is a collection of one or more

domains. The first domain that is created in the

forest is called the forest root domain. The forest

root domain contains a few objects that do not

exist in other domains in the forest. For example,

the forest root domain contains two special roles,

PROHIBITED

the schema master and the domain naming

master. In addition, the Enterprise Admins group and the Schema Admins group exist only in the forest

root domain. The Enterprise Admins group has full control over every domain within the forest.

The AD DS forest is also the replication boundary for the configuration and schema partitions in the

MCT

AD DS database. This means that all domain controllers in the forest must share the same schema. A

second reason why organizations deploy multiple forests is because they must deploy incompatible

schemas in two parts of the organization.

recipients are listed in the global catalog, making it easy to send mail to any of the users in the forest,

USE

even those users in different domains.

By default, all the domains in a forest automatically trust the other domains in the forest. This makes it

easy to enable access to resources such as file shares and websites for all users in a forest, regardless of

the domain in which the user account is located.

store data. It is sometimes referred to as the blueprint for AD DS.

ONLY.

AD DS stores and retrieves information from a wide variety of applications and services. AD DS

standardizes how data is stored so that it can store and replicate data from these various sources. By

standardizing how data is stored, AD DS can retrieve, update, and replicate data, while ensuring that the

integrity of the data is maintained.

AD DS uses objects as units of storage. All object types are defined in the schema. Each time that the

directory handles data, the directory queries the schema for an appropriate object definition. Based on

the object definition in the schema, the directory creates the object and stores the data.

Object definitions control both the types of data that the objects can store, and the syntax of the data.

Using this information, the schema ensures that all objects conform to their standard definitions. As a

result, AD DS can store, retrieve, and validate the data that it manages, regardless of the application that

is the original source of the data. Only data that has an existing object definition in the schema can be

stored in the directory. If a new type of data needs to be stored, a new object definition for the data must

first be created in the schema.

STUDENT

In AD DS, the schema defines the following:

USE

• Objects that are used to store data in the directory

• Rules that define what types of objects you can create, what attributes must be defined (mandatory)

when you create the object, and what attributes are optional

• Structure and content of the directory itself

PROHIBITED

You can use an account that is a member of the Schema Administrators to modify the schema

Administering Windows Server® 2012

MCT

3-5

Before making any changes, you should review the changes through a tightly-controlled process, and

then implement them only after you have performed testing to ensure that the changes will not adversely

affect the rest of the forest and any applications that use AD DS.

USE

that change is replicated automatically to all other domain controllers in the domain.

USE

An AD DS domain is an administrative center. It contains an Administrator account and a Domain

Admins group, which both have full control over every object in the domain. Unless they are in the forest

root domain, however, their range of control is limited to the domain. Password and account rules are

managed at the domain level by default. The AD DS domain also provides an authentication center. All

user accounts and computer accounts in the domain are stored in the domain database, and users and

PROHIBITED

computers must connect to a domain controller to authenticate.

Administering Windows Server® 2012

MCT

3-7

Lesson 2

Implementing Virtualized Domain Controllers

USE

Virtualization is a common practice in IT departments. The consolidation and performance benefits that

virtualization provides are great assets to any organization. Windows Server 2012 AD DS and domain

controllers are now more aware of virtualization. In this lesson, you will learn the considerations for

implementing virtualized domain controllers in Windows Server 2012, and how you can deploy and

manage these domain controllers in the AD DS environment.

.ONLY

Lesson Objectives

After completing this lesson, you will be able to:

• Identify considerations for implementing cloned virtualized domain controllers.

• Explain how to deploy a cloned virtualized domain controller.

• Describe how to manage virtualized domain controller snapshots.

STUDENT

Understanding Cloned Virtualized Domain Controllers

Windows Server 2012 introduces virtualized

domain-controller cloning. In previous Windows

Server versions, domain controllers that were

running within a virtual machine were unaware of

their virtual state. This made performing processes

like cloning and restoring virtual machine

snapshots potentially dangerous, because changes

could occur to the operating-system environment

that the domain controller did not expect. For

example, two domain controllers cannot coexist in

USE

the same forest with the same name, invocation

3-8 Maintaining Active Directory Domain Services

MCT

Virtual domain controller cloning provides the following benefits in Windows Server 2012:

USE

• Rapid domain-controller deployment in a new forest or domain.

• Scalable provisioning of domain controllers to handle increased load.

• Quick replacement or recovery of domain controllers for business continuity.

• Fast provisioning of test environments.

.ONLY

Safe Cloning

Domain controllers have unique characteristics that make unmanaged cloning detrimental to the AD DS

database-replication process. Domain controllers that are simply cloned end up with the same name,

which is unsupported within the same domain or forest. In previous Windows Server versions, you had

to prepare a domain controller for cloning by using sysprep. After the cloning process, you then had to

promote the new server to a domain controller manually.

USESTUDENT

With Safe Cloning in Windows Server 2012, a cloned domain controller automatically runs a subset of the

sysprep process, and promotes with the existing local AD DS data as installation media.

Safe Backup and Restore

Rolling back to a previous snapshot of a VDC is problematic because AD DS uses multimaster replication

that relies on transactions being assigned numeric values called Update Sequence Numbers (USNs). The

VDC tries to assign USNs to prior transactions that have already been assigned to valid transactions. This

causes inconsistencies in the AD DS database. Windows Server 2003 and newer implements a process that

is known as USN rollback protection. With this in place, the VDC does not replicate, and you must demote

it forcibly or manually restore it.

Windows Server 2012 now detects the snapshot state of a domain controller, and synchronizes or

replicates the delta of changes, between a domain controller and its partners for AD DS and the SYSVOL.

You now can use snapshots without risk of permanently disabling domain controllers and requiring

manually forced demotion, metadata cleanup, and repromotion.

Deploying a Cloned Virtualized Domain Controller

When deploying a VDC, consider the following

regarding installation:

PROHIBITED

• All Windows Server 2012 computers support

VDC cloning automatically.

• The following requirements must be met to

support VDC cloning:

o The primary domain controller (PDC)

Emulator FSMO role must be located on

a Windows Server 2012 domain

controller.