Sandesh Vidhate - MCITP

System Administrator – Active Directory Interview Questions and Answers

2012-08-02T13:40:00.000-07:00

1) What is Active Directory?
ACTIVE DIRECTORY IS A CENTRALIZED DATABASE …WHICH IS USED IN DOMAIN FOR ADMINISTRATIVE PURPOSES…
An active directory is a directory structure used on Microsoft Windows based computers and servers to store information and data about networks and domains. It is primarily used for online information and was originally created in 1996 and first used with Windows 2000.
An active directory (sometimes referred to as an AD) does a variety of functions including the ability to provide information on objects, helps organize these objects for easy retrieval and access, allows access by end users and administrators and allows the administrator to set security up for the directory.
An active directory can be defined as a hierarchical structure and this structure is usually broken up into three main categories, the resources which might include hardware such as printers, services for end users such as web email servers and objects which are the main functions of the domain and network.
It is interesting to note the framework for the objects. Remember that an object can be a piece of hardware such as a printer, end user or security settings set by the administrator. These objects can hold other objects within their file structure. All objects have an ID, usually an object name (folder name). In addition to these objects being able to hold other objects, every object has its own attributes which allows it to be characterized by the information which it contains. Most IT professionals call these setting or characterizations schemas.
Depending on the type of schema created for a folder, will ultimately determine how these objects are used. For instance, some objects with certain schemas can not be deleted, they can only be deactivated. Others types of schemas with certain attributes can be deleted entirely. For instance, a user object can be deleted, but the administrator object can not be deleted.
When understanding active directories, it is important to know the framework that objects can be viewed at. In fact, an active directory can be viewed at either one of three levels; these levels are called forests, trees or domains. The highest structure is called the forest because you can see all objects included within the active directory.
Within theForeststructure are trees, these structures usually hold one or more domains, going further down the structure of an active directory are single domains. To put the forest, trees and domains into perspective, consider the following example.
A large organization has many dozens of users and processes. The forest might be the entire network of end users and specific computers at a set location. Within this forest directory are now trees that hold information on specific objects such as domain controllers, program data, system, etc. Within these objects are even more objects which can then be controlled and categorized
Another Answer
Active Directory in Windows Server 2003
The Active Directory is the one of the important part of Windows Server 2003 networking .First need to know and understand Active directory. How does it work? It makes information easy for the administrator and the users. You can use the Active Directory to design an organization’s structure according to the requirement. If you are using the Active Directory then you can scale active directory from a single computer to a single network or too many networks. In active directory you can include every object server and domain in a network.
Logical Component
In the organization you set up in Windows Server 2003 and the organization you set up in Exchange Server 2003 are the same and the same is the case with Windows 2000 and Exchange 2000 as well. Now I am going to tell you its advantage one user administrator manage all aspects of user configuration. These logical constructs which are described in the following subsections allow you to define and group resources so that they can be located and administered by the name rather than by physical location.
Objects
Object is the basic unit in the Active Directory. It is an apocarpous named set of features that represents something adjective such as a user, printer and the application. A user is also an object. In Exchange a user’s features include its name and location, surrounded by other things.
Organization Unit
Organization Unit is a persona in which you can keep objects such as user accounts, groups, computer, and printer. Applications and other (OU). In organization unit you can assign specific permission to the users. Organization unit can also be used to create departmental limitation.
Domains
Domains is a group of computers and other resources that are part of a network and share a common directory database .Once a server has been installed, you can use the Active Directory Wizard to install Active Directory in order to install Active directory on the first server on the network, that server must have the access to a server running DNS (Domain Name Service). If you don’t have installed this service on your server then you will have to install this service during the Active Directory installation…
Active Directory in Windows Server 2003
The Active Directory is the one of the important part of Windows Server 2003 networking .First need to know and understand Active directory. How does it work? It makes information easy for the administrator and the users. You can use the Active Directory to design an organization’s structure according to the requirement. If you are using the Active Directory then you can scale active directory from a single computer to a single network or too many networks. In active directory you can include every object server and domain in a network.
Logical Component
In the organization you set up in Windows Server 2003 and the organization you set up in Exchange Server 2003 are the same and the same is the case with Windows 2000 and Exchange 2000 as well. Now I am going to tell you its advantage one user administrator manage all aspects of user configuration. These logical constructs which are described in the following subsections allow you to define and group resources so that they can be located and administered by the name rather than by physical location.
Objects
Object is the basic unit in the Active Directory. It is an apocarpous named set of features that represents something adjective such as a user, printer and the application. A user is also an object. In Exchange a user’s features include its name and location, surrounded by other things.
Organization Unit
Organization Unit is a persona in which you can keep objects such as user accounts, groups, computer, and printer. Applications and other (OU). In organization unit you can assign specific permission to the user’s. Organization unit can also be used to create departmental limitation.
Domains
Domains is a group of computers and other resources that are part of a network and share a common directory database .Once a server has been installed, you can use the Active Directory Wizard to install Active Directory in order to install Active directory on the first server on the network, that server must have the access to a server running DNS (Domain Name Service). If you don’t have installed this service on your server then you will have to install this service during the Active Directory installation…
Another Answer
An active directory is a directory structure used on Microsoft Windows based computers and servers to store information and data about networks and domains. It is primarily used for online information and was originally created in 1996 and first used with Windows 2000.
An active directory (sometimes referred to as an AD) does a variety of functions including the ability to provide information on objects, helps organize these objects for easy retrieval and access, allows access by end users and administrators and allows the administrator to set security up for the directory.
An active directory can be defined as a hierarchical structure and this structure is usually broken up into three main categories, the resources which might include hardware such as printers, services for end users such as web email servers and objects which are the main functions of the domain and network.
It is interesting to note the framework for the objects. Remember that an object can be a piece of hardware such as a printer, end user or security settings set by the administrator. These objects can hold other objects within their file structure. All objects have an ID, usually an object name (folder name). In addition to these objects being able to hold other objects, every object has its own attributes which allows it to be characterized by the information which it contains. Most IT professionals call these setting or characterizations schemas.
Depending on the type of schema created for a folder, will ultimately determine how these objects are used. For instance, some objects with certain schemas can not be deleted, they can only be deactivated. Others types of schemas with certain attributes can be deleted entirely. For instance, a user object can be deleted, but the administrator object can not be deleted.
When understanding active directories, it is important to know the framework that objects can be viewed at. In fact, an active directory can be viewed at either one of three levels; these levels are called forests, trees or domains. The highest structure is called the forest because you can see all objects included within the active directory.
Within theForeststructure are trees, these structures usually hold one or more domains, going further down the structure of an active directory are single domains. To put the forest, trees and domains into perspective, consider the following example.
A large organization has many dozens of users and processes. The forest might be the entire network of end users and specific computers at a set location. Within this forest directory are now trees that hold information on specific objects such as domain controllers, program data, system, etc. Within these objects are even more objects which can then be controlled and categorized.
2) What is LDAP?
LDAP means Light-Weight Directory Access Protocol. It determines how an object in an Active directory should be named. LDAP (Lightweight Directory Access Protocol) is a proposed open standard for accessing global or local directory services over a network and/or the Internet. A directory, in this sense, is very much like a phone book. LDAP can handle other information, but at present it is typically used to associate names with phone numbers and email addresses. LDAP directories are designed to support a high volume of queries, but the data stored in the directory does not change very often. It works on port no. 389. LDAP is sometimes known as X.500 Lite. X.500 is an international standard for directories and full-featured, but it is also complex, requiring a lot of computing resources and the full OSI stack. LDAP, in contrast, can run easily on a PC and over TCP/IP. LDAP can access X.500 directories but does not support every capability of X.500
ANSWER B:
The Lightweight Directory Access Protocol or LDAP is an application protocol for querying and modifying directory services running over TCP/IP. [1]A directory is a set of objects with attributes organized in a logical and hierarchical manner. The most common example is the telephone directory, which consists of a series of names (either of persons or organizations) organized alphabetically, with each name having an address and phone number attached.
An LDAP directory tree often reflects various political, geographic, and/or organizational boundaries, depending on the model chosen. LDAP deployments today tend to use Domain name system (DNS) names for structuring the topmost levels of the hierarchy. Deeper inside the directory might appear entries representing people, organizational units, printers, documents, groups of people or anything else that represents a given tree entry (or multiple entries).
Its current version is LDAPv3, which is specified in a series of Internet Engineering Task Force (IETF) Standard Track Requests for comments (RFCs) as detailed in RFC 4510.
3) Can you connect Active Directory to other 3rd-party Directory Services? Name a few options.
Yes, you can use dirXML or LDAP to connect to other directories (ie. E-directory from Novell). Novell eDirectory, formerly called Novell Directory Services (NDS)
4) Where is the AD database held? What other folders are related to AD?
AD Database is saved in/ntds. You can see other files also in this folder. These are the main files controlling the AD structure •ntds.dit
•edb.log
•res1.log
•res2.log
•edb.chk
•SysVOl folder is also created which is used for replication
When a change is made to the Win2K database, triggering a write operation, Win2K records the transaction in the log file (edb.log). Once written to the log file, the change is then written to the AD database. System performance determines how fast the system writes the data to the AD database from the log file. Any time the system is shut down; all transactions are saved to the database.
During the installation of AD, Windows creates two files: res1.log and res2.log. The initial size of each is 10MB. These files are used to ensure that changes can be written to disk should the system run out of free disk space. The checkpoint file (edb.chk) records transactions committed to the AD database (ntds.dit). During shutdown, a “shutdown” statement is written to the edb.chk file. Then, during a reboot, AD determines that all transactions in the edb.log file have been committed to the AD database. If, for some reason, the edb.chk file doesn’t exist on reboot or the shutdown statement isn’t present, AD will use the edb.log file to update the AD database.
The last file in our list of files to know is the AD database itself, ntds.dit. By default, the file is located in\NTDS, along with the other files we’ve discussed
5) What is the SYSVOL folder?
All active directory data base security related information store in SYSVOL folder and it’s only created on NTFS partition.
B:
The Sysvol folder on a Windows domain controller is used to replicate file-based data among domain controllers. Because junctions are used within the Sysvol folder structure, Windows NT file system (NTFS) version 5.0 is required on domain controllers throughout a Windows distributed file system (DFS) forest.
This is a quote from Microsoft themselves; basically the domain controller info stored in files like your group policy stuff is replicated through this folder structure
6) Name the AD NCs and replication issues for each NC
*Schema NC, *Configuration NC, * DomainNC
Schema NC This NC is replicated to every other domain controller in the forest. It contains information about the Active Directory schema, which in turn defines the different object classes and attributes within Active Directory.
Configuration NC Also replicated to every other DC in the forest, this NC contains forest-wide configuration information pertaining to the physical layout of Active Directory, as well as information about display specifies and forest-wide Active Directory quotas.
Domain NC This NC is replicated to every other DC within a single Active Directory domain. This is the NC that contains the most commonly-accessed Active Directory data: the actual users, groups, computers, and other objects that reside within a particular Active Directory domain.
7) What are application partitions? When do I use them?
Application directory partitions: These are specific to Windows Server 2003 domains.
An application directory partition is a directory partition that is replicated only to specific domain controllers. A domain controller that participates in the replication of a particular application directory partition hosts a replica of that partition. Only Domain controllers running Windows Server 2003 can host a replica of an application directory partition.
8) How do you create a new application partition?
When you create an application directory partition, you are creating the first instance of this partition. You can create an application directory partition by using the create nc option in the domain management menu of Ntdsutil. When creating an application directory partition using LDP or ADSI, provide a description in the description attribute of the domain DNS object that indicates the specific application that will use the partition. For example, if the application directory partition will be used to store data for a Microsoft accounting program, the description could be Microsoft accounting application. Ntdsutil does not facilitate the creation of a description.
To create or delete an application directory partition
1. Open Command Prompt.
2. Type:
Ntdsutil
3. At the Ntdsutil command prompt, type:
Domain management
4. At the domain management command prompt, do one of the following:
· To create an application directory partition, type:
Create ncApplicationDirectoryPartitionDomainController
Answer:
Start >> RUN>> CMD >> type there “NTDSUTIL” Press Enter
Ntdsutil: domain management Press Enter
Domain Management: Create NC dc=, dc=, dc=com <>
ANSWER B
Create an application directory partition by using the DnsCmd command
Use the DnsCmd command to create an application directory partition. To do this, use the following syntax:
DnsCmd ServerName /CreateDirectoryPartition FQDN of partition
To create an application directory partition that is named CustomDNSPartition on a domain controller that is named DC-1, follow these steps:
1. Click Start, click Run, type cmd, and then click OK.
2. Type the following command, and then press ENTER:dnscmd DC-1 /createdirectorypartition CustomDNSPartition.contoso.com
When the application directory partition has been successfully created, the following information appears:
DNS Server DC-1 created directory partition: CustomDNSPartition.contoso.com Command completed successfully.
Configure an additional domain controller DNS server to host the application directory partition
Configure an additional domain controller that is acting as a DNS server to host the new application directory partition that you created. To do this, use the following syntax with the DnsCmd command:
DnsCmd ServerName /EnlistDirectoryPartition FQDN of partition
To configure the example domain controller that is named DC-2 to host this custom application directory partition, follow these steps:
1. Click Start, click Run, type cmd, and then click OK.
2. Type the following command, and then press ENTER:dnscmd DC-2 /enlistdirectorypartition CustomDNSPartition.contoso.com
The following information appears:
DNS Server DC-2 enlisted directory partition: CustomDNSPartition.contoso.com Command completed successfully.
9) How do you view replication properties for AD partitions and DCs?
By using replication monitor
go to start > run > type repadmin
go to start > run > type replmon
10) What is the Global Catalog?
The global catalog contains a complete replica of all objects in Active Directory for its Host domain, and contains a partial replica of all objects in Active Directory for every other domain in the forest.

ANSWER B:

The global catalog is a distributed data repository that contains a searchable, partial representation of every object in every domain in a multidomain Active Directory forest. The global catalog is stored on domain controllers that have been designated as global catalog servers and is distributed through multimaster replication. Searches that are directed to the global catalog are faster because they do not involve referrals to different domain controllers.
In addition to configuration and schema directory partition replicas, every domain controller in a Windows 2000 Server or Windows Server 2003 forest stores a full, writable replica of a single domain directory partition. Therefore, a domain controller can locate only the objects in its domain. Locating an object in a different domain would require the user or application to provide the domain of the requested object.
The global catalog provides the ability to locate objects from any domain without having to know the domain name. A global catalog server is a domain controller that, in addition to its full, writable domain directory partition replica, also stores a partial, read-only replica of all other domain directory partitions in the forest. The additional domain directory partitions are partial because only a limited set of attributes is included for each object. By including only the attributes that are most used for searching, every object in every domain in even the largest forest can be represented in the database of a single global catalog server.
11) How do you view all the GCs in the forest?
C:\>repadmin /showreps
domain_controller
OR
You can use Replmon.exe for the same purpose.
OR
AD Sites and Services and nslookup gc._msdcs.
To find the in GC from the command line you can try using DSQUERY command.
dsquery server -isgc to find all the GC’s in the forest
you can try dsquery server -forest -isgc.
12) Why not make all DCs in a large forest as GCs?
The reason that all DCs are not GCs to start is that in large (or even Giant) forests the DCs would all have to hold a reference to every object in the entire forest which could be quite large and quite a replication burden.
For a few hundred, or a few thousand users even, this not likely to matter unless you have really poor WAN lines.
13) Trying to look at the Active Directory Schema, how can I do that?
Option to view the schema
Register schmmgmt.dll using this command
c:\windows\system32>regsvr32 schmmgmt.dll
Open mmc –> add snapin –> add Active directory schema
name it as schema.msc
Open administrative tool –> schema.msc
14) What are the Support Tools? Why do I need them?
Support Tools are the tools that are used for performing the complicated tasks easily. These can also be the third party tools. Some of the Support tools include DebugViewer, DependencyViewer, RegistryMonitor, etc.
-edit by Casquehead
I believe this question is referring to the Windows Server 2003 Support Tools, which are included with Microsoft Windows Server 2003 Service Pack 2. They are also available for download here:
http://www.Microsoft.com/downloads/details.aspx?familyid=96A35011-FD83-419D-939B-9A772EA2DF90&displaylang=en
you need them because you cannot properly manage an Active Directory network without them.
Here they are, it would do you well to familiarize yourself with all of them.
Acldiag.exe
Adsiedit.msc
Bitsadmin.exe
Dcdiag.exe
Dfsutil.exe
Dnslint.exe
Dsacls.exe
Iadstools.dll
Ktpass.exe
Ldp.exe
Netdiag.exe
Netdom.exe
Ntfrsutl.exe
Portqry.exe
Repadmin.exe
Replmon.exe
Setspn.exe
15) What is LDP? What is REPLMON? What is ADSIEDIT? What is NETDOM? What is REPADMIN?

What is LDP?

A:
The Lightweight Directory Access Protocol, or LDAP is an application protocol for querying and modifying directory services running over TCP/IP.[1]
A directory is a set of objects with attributes organized in a logical and hierarchical manner. The most common example is the telephone directory, which consists of a series of names (either of persons or organizations) organized alphabetically, with each name having an address and phone number attached.
An LDAP directory tree often reflects various political, geographic, and/or organizational boundaries, depending on the model chosen. LDAP deployments today tend to use Domain name system (DNS) names for structuring the topmost levels of the hierarchy. Deeper inside the directory might appear entries representing people, organizational units, printers, documents, groups of people or anything else that represents a given tree entry (or multiple entries).
Its current version is LDAPv3, which is specified in a series of Internet Engineering Task Force (IETF) Standard Track Requests for comments (RFCs) as detailed in RFC 4510.
LDAP means Light-Weight Directory Access Protocol. It determines how an object in an Active directory should be named. LDAP (Lightweight Directory Access Protocol) is a proposed open standard for accessing global or local directory services over a network and/or the Internet. A directory, in this sense, is very much like a phone book. LDAP can handle other information, but at present it is typically used to associate names with phone numbers and email addresses. LDAP directories are designed to support a high volume of queries, but the data stored in the directory does not change very often. It works on port no. 389. LDAP is sometimes known as X.500 Lite. X.500 is an international standard for directories and full-featured, but it is also complex, requiring a lot of computing resources and the full OSI stack. LDAP, in contrast, can run easily on a PC and over TCP/IP. LDAP can access X.500 directories but does not support every capability of X.500

What is REPLMON?

A: Replmon is the first tool you should use when troubleshooting Active Directory replication issues. As it is a graphical tool, replication issues are easy to see and somewhat easier to diagnose than using its command line counterparts. The purpose of this document is to guide you in how to use it, list some common replication errors and show some examples of when replication issues can stop other network installation actions.
For more go to http://www.techtutorials.net/articles/replmon_howto_a.html

What is ADSIEDIT?
A: Adsiedit.msc is a Microsoft Management Console (MMC) snap-in that acts as a low-level editor for Active Directory. It is a Graphical User Interface (GUI) tool. Network administrators can use it for common administrative tasks such as adding, deleting, and moving objects with a directory service. The attributes for each object can be edited or deleted by using this tool. Adsiedit.msc uses the ADSI application programming interfaces (APIs) to access Active Directory. The following are the required files for using this tool:
· ADSIEDIT.DLL
· ADSIEDIT.MSC
Regarding system requirements, a connection to an Active Directory environment and Microsoft Management Console (MMC) is necessary

What is NETDOM?

A: NETDOM is a command-line tool that allows management of Windows domains and trust relationships. It is used for batch management of trusts, joining computers to domains, verifying trusts, and secure channels
A:
Enables administrators to manage Active Directory domains and trust relationships from the command prompt.
Netdom is a command-line tool that is built into Windows Server 2008. It is available if you have the Active Directory Domain Services (AD DS) server role installed. To use Netdom, you must run the Netdom command from an elevated command prompt. To open an elevated command prompt, click Start, right-click Command Prompt, and then click Run as administrator.
You can use Netdom to:
Join a computer that runs Windows XP Professional or Windows Vista to a Windows Server 2008 or Windows Server 2003 or Windows 2000 or Windows NT 4.0 domain.
Provide an option to specify the organizational unit (OU) for the computer account.
Generate a random computer password for an initial Join operation.
Manage computer accounts for domain member workstations and member servers. Management operations include:
Add, Remove, Query.
An option to specify the OU for the computer account.
An option to move an existing computer account for a member workstation from one domain to another while maintaining the security descriptor on the computer account.
Establish one-way or two-way trust relationships between domains, including the following kinds of trust relationships:
From a Windows 2000 or Windows Server 2003 or Windows Server 2008 domain to a Windows NT 4.0 domain.
From a Windows 2000 or Windows Server 2003 or Windows Server 2008 domain to a Windows 2000 or Windows Server 2003 or Windows Server 2008 domain in another enterprise.
Between two Windows 2000 or Windows Server 2003 or Windows Server 2008 domains in an enterprise (a shortcut trust).
The Windows Server 2008 or Windows Server 2003 or Windows 2000 Server half of an interoperable Kerberos protocol realm.
Verify or reset the secure channel for the following configurations:
Member workstations and servers.
Backup domain controllers (BDCs) in a Windows NT 4.0 domain.
Specific Windows Server 2008 or Windows Server 2003 or Windows 2000 replicas.
Manage trust relationships between domains, including the following operations:
Enumerate trust relationships (direct and indirect).
View and change some attributes on a trust.
16) What are sites? What are they used for?
One or more well-connected (highly reliable and fast) TCP/IP subnets. A site allows administrators to configure Active Directory access and replication topology to take advantage of the physical network.
B: A Site object in Active Directory represents a physical geographic location that hosts networks. Sites contain objects called Subnets. [3] Sites can be used to Assign Group Policy Objects, facilitate the discovery of resources, manage active directory replication, and manage network link traffic. Sites can be linked to other Sites. Site-linked objects may be assigned a cost value that represents the speed, reliability, availability, or other real property of a physical resource. Site Links may also be assigned a schedule
17) What’s the difference between a site link’s schedule and interval?
Schedule enables you to list weekdays or hours when the site link is available for replication to happen in the give interval. Interval is the re occurrence of the inter site replication in given minutes. It ranges from 15 – 10,080 mins. The default interval is 180 mins.
18) What is the KCC?
Knowledge consistency checker- it generates the replication topology by specifying what domain controllers will replicate to which other domain controllers in the site. The KCC maintains a list of connections, called a replication topology, to other domain controllers in the site. The KCC ensures that changes to any object are replicated to all site domain controllers and updates go through no more than three connections. Also an administrator can configure connection objects.
19) What is the ISTG? Who has that role by default?
Intersite Topology Generator (ISTG), which is responsible for the connections among the sites. By default Windows 2003 Forestlevel functionality has this role.
By Default the first Server has this role. If that server can no longer perform this role then the next server with the highest GUID then takes over the role of ISTG.
20) What are the requirements for installing AD on a new server?
· An NTFS partition with enough free space (250MB minimum)
· An Administrator’s username and password
· The correct operating system version
· A NIC
· Properly configured TCP/IP (IP address, subnet mask and – optional – default gateway)
· A network connection (to a hub or to another computer via a crossover cable)
· An operational DNS server (which can be installed on the DC itself)
· A Domain name that you want to use
· The Windows 2000 or Windows Server 2003 CD media (or at least the i386 folder)
20) What can you do to promote a server to DC if you’re in a remote location with slow WAN link?
First available in Windows 2003, you will create a copy of the system state from an existing DC and copy it to the new remote server. Run “Dcpromo /adv”. You will be prompted for the location of the system state files
===================================
Answer B:
Backup system state as;

Click Start, click Run, type ntbackup, and then click OK. (If the Backup utility starts in wizard mode, click the Advanced Mode hyperlink.)
From the Backup tab, click to select the System State check box in the left pane. Do not back up the file system part of the SYSVOL tree separately from the system state backup.
In the Backup media or file name box, specify the drive, path, and file name of the system state backup.

Name the file .bak (recommended and general)
Restore system stat as below on the target computer;

Log on to the Windows Server 2003-based computer that you want to promote. You must be a member of the local administrators group on this computer.
Click Start, click Run, type ntbackup, and then click OK. (If the Backup utility starts in wizard mode, click the Advanced Mode hyperlink.)
In the Backup utility, click the Restore and Manage Media tab. In the Tools menu, click Catalog a backup file…, and then locate the .bkf file that you created earlier. Click OK.
Expand the contents of the .bkf file, and then click to select the System State check box.
In Restore files to: click Alternate Location. To restore the system state, type the logical drive and the path. We suggest that you type X:\Ntdsrestore. In this command, X is the logical drive that will ultimately host the Active Directory database when the member computer is promoted. The final location for the Active Directory database is selected when you run the Active Directory Installation Wizard. This folder must be different from the folder that contains the restored system state.

Now Last stage is Promoting an additional domain controller

Verify that the domain controller that is to be promoted has DNS name resolution and network connectivity to existing domain controllers in the domain controller’s target domain.
Click Start, click Run, type dcpromo /adv, and then click OK.
Click Next to bypass the Welcome to the Active Directory Installation Wizard and Operating System Compatibility dialog boxes.
On the Domain Controller Type page, click Additional domain controller for an existing domain, and then click next.
On the Copying Domain Information page, click from these restored backup files: and then type the logical drive and the path of the alternative location where the system state backup was restored. Click Next.
In Network Credentials, type the user name, the password, and the domain name of an account that is a member of the domain administrators group for the domain that you are promoting in.
Continue with the remainder of the Active Directory Installation Wizard pages as you would with the standard promotion of an additional domain controller.
After the SYSVOL tree has replicated in, and the SYSVOL share exists, delete any remaining restored system files and folders.

21) How can you forcibly remove AD from a server, and what do you do later? • Can I get user passwords from the AD database?
Demote the server using dcpromo /forceremoval, and then remove the metadata from Active directory using Ntdsutil. There is no way to get user passwords from AD that I am aware of, but you should still be able to change them.
Another way out too
Restart the DC is DSRM mode
a. Locate the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ProductOptions
b. In the right-pane, double-click ProductType.
c. Type ServerNT in the Value data box, and then click OK.
Restart the server in normal mode
it’s a member server now but AD entries are still there. Promote the server to a fake domain say ABC.com and then remove gracefully using Dcpromo. Else after restart you can also use Ntdsutil to do metadata as told in the earlier post
22) Name some OU design considerations
OU design requires balancing requirements for delegating administrative rights – independent of Group Policy needs – and the need to scope the application of Group Policy. The following OU design recommendations address delegation and scope issues:
Applying Group Policy An OU is the lowest-level Active Directory container to which you can assign Group Policy settings.
Delegating administrative authority
Usually don’t go more than 3 OU levels
23) What is tombstone lifetime attribute?
The number of days before a deleted object is removed from the directory services. This assists in removing objects from replicated servers and preventing restores from reintroducing a deleted object. This value is in the Directory Service object in the configuration NIC
By default 2000 (60 days)
2003 (180 days)
24) How would you find all users that have not logged on since last month?
Using only native commands, JSILLD.bat produces a sorted/formated report of Users who have not logged on since YYYYMMDD.
The report is sorted by UserName and list the user’s full name and last logon date.
The syntax for using JSILLD.bat is:
JSILLD \Folder\OutputFile.Ext YYYYMMDD [/N]
where:
YYYYMMDD will report all users who have not logged on since this date.
/N is an optional parameter that will bypass users who have never logged on.
JSILLD.bat contains:
@echo off
setlocal
if {%2}=={} goto syntax
if “%3″==”" goto begin
if /i “%3″==”/n” goto begin
:syntax
@echo Syntax: JSILLD File yyyymmdd [/N]
endlocal
goto :EOF
:begin
if /i “%2″==”/n” goto syntax
set dte=%2
set XX=%dte:~0,4%
if “%XX%” LSS “1993″ goto syntax
set XX=%dte:~4,2%
if “%XX%” LSS “01″ goto syntax
if “%XX%” GTR “12″ goto syntax
set XX=%dte:~6,2%
if “%XX%” LSS “01″ goto syntax
if “%XX%” GTR “31″ goto syntax
set never=X
if /i “%3″==”/n” set never=/n
set file=%1
if exist %file% del /q %file%
for /f “Skip=4 Tokens=*” %%i in (‘net user /domain^|findstr /v /c:”—-”^|findstr /v /i /c:”The command completed”‘) do (
do call :parse “%%i”
)
endlocal
goto :EOF
:parse
set str=#%1#
set str=%str:#”=%
set str=%str:”#=%
set substr=%str:~0,25%#
set substr=%substr: =%
set substr=%substr: #=%
set substr=%substr:#=%
if “%substr%”==”" goto :EOF
for /f “Skip=1 Tokens=*” %%i in (‘net user “%substr%” /domain’) do call :parse1 “%%i”
set substr=%str:~25,25%#
set substr=%substr: =%
set substr=%substr: #=%
set substr=%substr:#=%
if “%substr%”==”" goto :EOF
for /f “Skip=1 Tokens=*” %%i in (‘net user “%substr%” /domain’) do call :parse1 “%%i”
set substr=%str:~50,25%#
set substr=%substr: =%
set substr=%substr: #=%
set substr=%substr:#=%
if “%substr%”==”" goto :EOF
for /f “Skip=1 Tokens=*” %%i in (‘net user “%substr%” /domain’) do call :parse1 “%%i”
goto :EOF
:parse1
set ustr=%1
if %ustr%==”The command completed successfully.” goto :EOF
set ustr=%ustr:”=%
if /i “%ustr:~0,9%”==”Full Name” set fullname=%ustr:~29,99%
if /i not “%ustr:~0,10%”==”Last logon” goto :EOF
set txt=%ustr:~29,99%
for /f “Tokens=1,2,3 Delims=/ ” %%i in (‘@echo %txt%’) do set MM=%%i&set DD=%%j&set YY=%%k
if /i “%MM%”==”Never” goto tstnvr
goto year
:tstnvr
if /i “%never%”==”/n” goto :EOF
goto report
:year
if “%YY%” GTR “1000″ goto mmm
if “%YY%” GTR “92″ goto Y19
set /a YY=100%YY%%%100
set YY=%YY% + 2000
goto mmm
:Y19
set YY=19%YY%
:mmm
set /a XX=100%MM%%%100
if %XX% LSS 10 set MM=0%XX%
set /a XX=100%DD%%%100
if %XX% LSS 10 set DD=0%XX%
set YMD=%YY%%MM%%DD%
if “%YMD%” GEQ “%dte%” goto :EOF
:report
set fullname=%fullname% #
set fullname=%fullname:~0,35%
set substr=%substr% #
set substr=%substr:~0,30%
@echo %substr% %fullname% %txt% >> %file%
25) What are the DS commands?
New DS (Directory Service) Family of built-in command line utilities for Windows Server 2003 Active Directory
A:
New DS built-in tools for Windows Server 2003
The DS (Directory Service) group of commands are split into two families. In one branch are DSadd, DSmod, DSrm and DSMove and in the other branch are DSQuery and DSGet.
When it comes to choosing a scripting tool for Active Directory objects, you really are spoilt for choice. The DS family of built-in command line executables offers alternative strategies to CSVDE, LDIFDE and VBScript.
Let me introduce you to the members of the DS family:
DSadd – add Active Directory users and groups
DSmod – modify Active Directory objects
DSrm – to delete Active Directory objects
DSmove – to relocate objects
DSQuery – to find objects that match your query attributes
DSget – list the properties of an object
DS Syntax
These DS tools have their own command structure which you can split into five parts:
1 2 3 4 5
Tool object “DN” (as in LDAP distinguished name) -switch value For example:
DSadd user “cn=billy, ou=managers, dc=cp, dc=com” -pwd cX49pQba
This will add a user called Billy to the Managers OU and set the password to cx49Qba
Here are some of the common DS switches which work with DSadd and DSmod
-pwd (password) -upn (userPrincipalName) -fn (FirstName) -samid (Sam account name).
The best way to learn about this DS family is to logon at a domain controller and experiment from the command line. I have prepared examples of the two most common programs. Try some sample commands for DSadd.˚
Two most useful Tools: DSQuery and DSGet
The DSQuery and DSGet remind me of UNIX commands in that they operate at the command line, use powerful verbs, and produce plenty of action. One pre-requisite for getting the most from this DS family is a working knowledge of LDAP.
If you need to query users or computers from a range of OU’s and then return information, for example, office, department manager. Then DSQuery and DSGet would be your tools of choice. Moreover, you can export the information into a text file
26) What is the difference between ldifde and csvde usage considerations?

Ldifde

Ldifde creates, modifies, and deletes directory objects on computers running Windows Server 2003 operating systems or Windows XP Professional. You can also use Ldifde to extend the schema, export Active Directory user and group information to other applications or services, and populate Active Directory with data from other directory services.
The LDAP Data Interchange Format (LDIF) is a draft Internet standard for a file format that may be used for performing batch operations against directories that conform to the LDAP standards. LDIF can be used to export and import data, allowing batch operations such as add, create, and modify to be performed against the Active Directory. A utility program called LDIFDE is included in Windows 2000 to support batch operations based on the LDIF file format standard. This article is designed to help you better understand how the LDIFDE utility can be used to migrate directories.
http://support.microsoft.com/kb/237677

Csvde

Imports and exports data from Active Directory Domain Services (AD DS) using files that store data in the comma-separated value (CSV) format. You can also support batch operations based on the CSV file format standard.
Csvde is a command-line tool that is built into Windows Server 2008 in the/system32 folder. It is available if you have the AD DS or Active Directory Lightweight Directory Services (AD LDS) server role installed. To use csvde, you must run the csvde command from an elevated command prompt. To open an elevated command prompt, click Start, right-click Command Prompt, and then click Run as administrator.
http://technet.microsoft.com/en-us/library/cc732101.aspx

DIFFERENCE USAGE WISE

Csvde.exe is a Microsoft Windows 2000 command-line utility that is located in the SystemRoot\System32 folder after you install Windows 2000. Csvde.exe is similar to Ldifde.exe, but it extracts information in a comma-separated value (CSV) format. You can use Csvde to import and export Active Directory data that uses the comma-separated value format. Use a spreadsheet program such as Microsoft Excel to open this .csv file and view the header and value information. See Microsoft Excel Help for information about functions such as Concatenate that can simplify the process of building a .csv file.
Note Although Csvde is similar to Ldifde, Csvde has a significant limitation: it can only import and export Active Directory data by using a comma-separated format (.csv). Microsoft recommends that you use the Ldifde utility for Modify or Delete operations. Additionally, the distinguished name (also known as DN) of the item that you are trying to import must be in the first column of the .csv file or the import will not work.
The source .csv file can come from an Exchange Server directory export. However, because of the difference in attribute mappings between the Exchange Server directory and Active Directory, you must make some modifications to the .csv file. For example, a directory export from Exchange Server has a column that is named “obj-class” that you must rename to “objectClass.” You must also rename “Display Name” to “displayName.”
http://support.microsoft.com/kb/327620
27) What are the FSMO roles that have them by default what happens when each one fails?
FSMO stands for the Flexible single Master Operation
It has 5 Roles: -

Schema Master:

The schema master domain controller controls all updates and modifications to the schema. Once the Schema update is complete, it is replicated from the schema master to all other DCs in the directory. To update the schema of a forest, you must have access to the schema master. There can be only one schema master in the whole forest.

Domain naming master:

The domain naming master domain controller controls the addition or removal of domains in the forest. This DC is the only one that can add or remove a domain from the directory. It can also add or remove cross references to domains in external directories. There can be only one domain naming master in the whole forest.

Infrastructure Master:

When an object in one domain is referenced by another object in another domain, it represents the reference by the GUID, the SID (for references to security principals), and the DN of the object being referenced. The infrastructure FSMO role holder is the DC responsible for updating an object’s SID and distinguished name in a cross-domain object reference. At any one time, there can be only one domain controller acting as the infrastructure master in each domain.
Note: The Infrastructure Master (IM) role should be held by a domain controller that is not a Global Catalog server (GC). If the Infrastructure Master runs on a Global Catalog server it will stop updating object information because it does not contain any references to objects that it does not hold. This is because a Global Catalog server holds a partial replica of every object in the forest. As a result, cross-domain object references in that domain will not be updated and a warning to that effect will be logged on that DC’s event log. If all the domain controllers in a domain also host the global catalog, all the domain controllers have the current data, and it is not important which domain controller holds the infrastructure master role.

Relative ID (RID) Master:

The RID master is responsible for processing RID pool requests from all domain controllers in a particular domain. When a DC creates a security principal object such as a user or group, it attaches a unique Security ID (SID) to the object. This SID consists of a domain SID (the same for all SIDs created in a domain), and a relative ID (RID) that is unique for each security principal SID created in a domain. Each DC in a domain is allocated a pool of RIDs that it is allowed to assign to the security principals it creates. When a DC’s allocated RID pool falls below a threshold, that DC issues a request for additional RIDs to the domain’s RID master. The domain RID master responds to the request by retrieving RIDs from the domain’s unallocated RID pool and assigns them to the pool of the requesting DC. At any one time, there can be only one domain controller acting as the RID master in the domain.

PDC Emulator:

The PDC emulator is necessary to synchronize time in an enterprise. Windows 2000/2003 includes the W32Time (Windows Time) time service that is required by the Kerberos authentication protocol. All Windows 2000/2003-based computers within an enterprise use a common time. The purpose of the time service is to ensure that the Windows Time service uses a hierarchical relationship that controls authority and does not permit loops to ensure appropriate common time usage.
The PDC emulator of a domain is authoritative for the domain. The PDC emulator at the root of the forest becomes authoritative for the enterprise, and should be configured to gather the time from an external source. All PDC FSMO role holders follow the hierarchy of domains in the selection of their in-bound time partner.
:: In a Windows 2000/2003 domain, the PDC emulator role holder retains the following functions:
:: Password changes performed by other DCs in the domain are replicated preferentially to the PDC emulator.
Authentication failures that occur at a given DC in a domain because of an incorrect password are forwarded to the PDC emulator before a bad password failure message is reported to the user.
Account lockout is processed on the PDC emulator.
Editing or creation of Group Policy Objects (GPO) is always done from the GPO copy found in the PDC Emulator’s SYSVOL share, unless configured not to do so by the administrator.
The PDC emulator performs all of the functionality that a Microsoft Windows NT 4.0 Server-based PDC or earlier PDC performs for Windows NT 4.0-based or earlier clients.
This part of the PDC emulator role becomes unnecessary when all workstations, member servers, and domain controllers that are running Windows NT 4.0 or earlier are all upgraded to Windows 2000/2003. The PDC emulator still performs the other functions as described in a Windows 2000/2003 environment.

28) What FSMO placement considerations do you know of?

Windows 2000/2003 Active Directory domains utilize a Single Operation Master method called FSMO (Flexible Single Master Operation), as described in Understanding FSMO Roles in Active Directory.
In most cases an administrator can keep the FSMO role holders (all 5 of them) in the same spot (or actually, on the same DC) as has been configured by the Active Directory installation process. However, there are scenarios where an administrator would want to move one or more of the FSMO roles from the default holder DC to a different DC.
Windows Server 2003 Active Directory is a bit different than the Windows 2000 version when dealing with FSMO placement. In this article I will only deal with Windows Server 2003 Active Directory, but you should bear in mind that most considerations are also true when planning Windows 2000 AD FSMO roles
29) I want to look at the RID allocation table for a DC. What do I do?
1.install support tools from OS disk(OS Inst: Disk=>support=>tools=>suptools.msi)
2.In Command prompt type dcdiag /test:ridmanager /s:system1 /v (system1 is the name of our DC)
30) What’s the difference between transferring a FSMO role and seizing one? Which one should you NOT seize? Why?
Seizing an FSMO can be a destructive process and should only be attempted if the existing server with the FSMO is no longer available.
If the domain controller that is the Schema Master FSMO role holder is temporarily unavailable, DO NOT seize the Schema Master role.
If you are going to seize the Schema Master, you must permanently disconnect the current Schema Master from the network.
If you seize the Schema Master role, the boot drive on the original Schema Master must be completely reformatted and the operating system must be cleanly installed, if you intend to return this computer to the network.
NOTE: The Boot Partition contains the system files (\System32). The System Partition is the partition that contains the startup files, NTDetect.com, NTLDR, Boot.ini, and possibly Ntbootdd.sys.
The Active Directory Installation Wizard (Dcpromo.exe) assigns all 5 FSMO roles to the first domain controller in the forest root domain. The first domain controller in each new child or tree domain is assigned the three domain-wide roles.
31) How do you configure a “stand-by operation master” for any of the roles?

Open Active Directory Sites and Services.
Expand the site name in which the standby operations master is located to display the Servers folder.
Expand the Servers folder to see a list of the servers in that site.
Expand the name of the server that you want to be the standby operations master to display its NTDS Settings.
Right-click NTDS Settings, click New, and then click Connection.
In the Find Domain Controllers dialog box, select the name of the current role holder, and then click OK.
In the New Object-Connection dialog box, enter an appropriate name for the Connection object or accept the default name, and click OK.

32) How do you backup & restore AD.
Backing up Active Directory is essential to maintain an Active Directory database. You can back up Active Directory by using the Graphical User Interface (GUI) and command-line tools that the Windows Server 2003 family provides.
You frequently backup the system state data on domain controllers so that you can restore the most current data. By establishing a regular backup schedule, you have a better chance of recovering data when necessary.
To ensure a good backup includes at least the system state data and contents of the system disk, you must be aware of the tombstone lifetime. By default, the tombstone is 60 days. Any backup older than 60 days is not a good backup. Plan to backup at least two domain controllers in each domain, one of at least one backup to enable an authoritative restore of the data when necessary.
SystemStateData
Several features in the windows server 2003 family make it easy to backup Active Directory. You can backup Active Directory while the server is online and other network function can continue to function.
System state data on a domain controller includes the following components:
Active Directory system state data does not contain Active Directory unless the server, on which you are backing up the system state data, is a domain controller. Active Directory is present only on domain controllers.
The SYSVOL shared folder: This shared folder contains Group policy templates and logon scripts. The SYSVOL shared folder is present only on domain controllers.
The Registry: This database repository contains information about the computer’s configuration.
System startup files: Windows Server 2003 requires these files during its initial startup phase. They include the boot and system files that are under windows file protection and used by windows to load, configure, and run the operating system.
The COM+ Class Registration database: The Class registration is a database of information about Component Services applications.
The Certificate Services database: This database contains certificates that a server running Windows server 2003 uses to authenticate users. The Certificate Services database is present only if the server is operating as a certificate server.
System state data contains most elements of a system’s configuration, but it may not include all of the information that you require recovering data from a system failure. Therefore, be sure to backup all boot and system volumes, including theSystemState, when you back up your server.
Restoring Active Directory
In Windows Server 2003 family, you can restore the Active Directory database if it becomes corrupted or is destroyed because of hardware or software failures. You must restore the Active Directory database when objects in Active Directory are changed or deleted.
Active Directory restore can be performed in several ways. Replication synchronizes the latest changes from every other replication partner. Once the replication is finished each partner has an updated version of Active Directory. There is another way to get these latest updates by Backup utility to restore replicated data from a backup copy. For this restore you don’t need to configure again your domain controller or no need to install the operating system from scratch.
Active Directory Restore Methods
You can use one of the three methods to restore Active Directory from backup media: primary restore, normal (non authoritative) restore, and authoritative restore.
Primary restore: This method rebuilds the first domain controller in a domain when there is no other way to rebuild the domain. Perform a primary restore only when all the domain controllers in the domain are lost, and you want to rebuild the domain from the backup.
Members of Administrators group can perform the primary restore on local computer, or user should have been delegated with this responsibility to perform restore. On a domain controller only Domain Admins can perform this restore.
Normal restore: This method reinstates the Active Directory data to the state before the backup, and then updates the data through the normal replication process. Perform a normal restore for a single domain controller to a previously known good state.
Authoritative restore: You perform this method in tandem with a normal restore. An authoritative restore marks specific data as current and prevents the replication from overwriting that data. The authoritative data is then replicated through the domain.
Perform an authoritative restore individual object in a domain that has multiple domain controllers. When you perform an authoritative restore, you lose all changes to the restore object that occurred after the backup. Ntdsutil is a command line utility to perform an authoritative restore along with windows server 2003 system utilities. The Ntdsutil command-line tool is an executable file that you use to mark Active Directory objects as authoritative so that they receive a higher version recently changed data on other domain controllers does not overwrite system state data during replication.
33) Why can’t you restore a DC that was backed up 4 months ago?
Because of the tombstone life which is set to only 60 days
34) What are GPOs?
Group Policy Objects
35) What is the order in which GPOs are applied?
Local, Site, Domain, OU
Group Policy settings are processed in the following order:
1:- Local Group Policy object-each computer has exactly one Group Policy object that is stored locally. This processes for both computer and user Group Policy processing.
2:- Site-Any GPOs that have been linked to the site that the computer belongs to are processed next. Processing is in the order that is specified by the administrator, on the Linked Group Policy Objects tab for the site in Group Policy Management Console (GPMC). The GPO with the lowest link order is processed last, and therefore has the highest precedence.
3:- Domain-processing of multiple domain-linked GPOs is in the order specified by the administrator, on the Linked Group Policy Objects tab for the domain in GPMC. The GPO with the lowest link order is processed last, and therefore has the highest precedence.
4:- Organizational units-GPOs that are linked to the organizational unit that is highest in the Active Directory hierarchy are processed first, then GPOs that are linked to its child organizational unit, and so on. Finally, the GPOs that are linked to the organizational unit that contains the user or computer are processed.
At the level of each organizational unit in the Active Directory hierarchy, one, many, or no GPOs can be linked. If several GPOs are linked to an organizational unit, their processing is in the order that is specified by the administrator, on the Linked Group Policy Objects tab for the organizational unit in GPMC. The GPO with the lowest link order is processed last, and therefore has the highest precedence.
This order means that the local GPO is processed first, and GPOs that are linked to the organizational unit of which the computer or user is a direct member are processed last, which overwrites settings in the earlier GPOs if there are conflicts. (If there are no conflicts, then the earlier and later settings are merely aggregated.)
36) Name a few benefits of using GPMC.

Easy administration of all GPOs across the entireActiveDirectoryForest
View of all GPOs in one single list
Reporting of GPO settings, security, filters, delegation, etc.
Control of GPO inheritance with Block Inheritance, Enforce, and Security Filtering
Delegation model
Backup and restore of GPOs
Migration of GPOs across different domains and forests

With all of these benefits, there are still negatives in using the GPMC alone. Granted, the GPMC is needed and should be used by everyone for what it is ideal for. However, it does fall a bit short when you want to protect the GPOs from the following:

Role based delegation of GPO management
Being edited in production, potentially causing damage to desktops and servers
Forgetting to back up a GPO after it has been modified
Change management of each modification to every GPO

37) What are the GPC and the GPT? Where can I find them?
A GPO is a collection of Group Policy settings, stored at the domain level as a virtual object consisting of a Group Policy container (GPC) and a Group Policy template (GPT).
The GPC, which contains information on the properties of a GPO, is stored in Active Directory on each domain controller in the domain. The GPT contains the data in a GPO and is stored in the Sysvol in the /Policies sub-directory.
38) What are GPO links? What special things can I do to them?
Linking GPOs
To apply the settings of a GPO to the users and computers of a domain, site, or OU, you need to add a link to that GPO. You can add one or more GPO links to each domain, site, or OU by using GPMC. Keep in mind that creating and linking GPOs is a sensitive privilege that should be delegated only to administrators who are trusted and understand Group Policy.

Linking GPOs to the Site

If you have a number of policy settings to apply to computers in a particular physical location only – certain network or proxy configuration settings, for example – these settings might be appropriate for inclusion in a site-based policy. Because domains and sites are independent, it is possible that computers in the site might need to cross domains to link the GPO to the site. In this case, make sure there is good connectivity.
If, however, the settings do not clearly correspond to computers in a single site, it is better to assign the GPO to the domain or OU structure rather than to the site.

Linking GPOs to the Domain

Link GPOs to the domain if you want them to apply to all users and computers in the domain. For example, security administrators often implement domain-based GPOs to enforce corporate standards. They might want to create these GPOs with the GPMC Enforce option enabled to guarantee that no other administrator can override these settings.
Important

If you need to modify some of the settings contained in the Default Domain Policy GPO, it is recommended that you create a new GPO for this purpose, link it to the domain, and set the Enforce option. In general, do not modify this or the Default Domain Controller Policy GPO. If you do, be sure to back up these and any other GPOs in your network by using GPMC to ensure you can restore them.

As the name suggests, the Default Domain Policy GPO is also linked to the domain. The Default Domain Policy GPO is created when the first domain controller in the domain is installed and the administrator logs on for the first time. This GPO contains the domain-wide account policy settings, Password Policy, Account Lockout Policy, and Kerberos Policy, which is enforced by the domain controller computers in the domain. All domain controllers retrieve the values of these account policy settings from the Default Domain Policy GPO. In order to apply account policies to domain accounts, these policy settings must be deployed in a GPO linked to the domain, and it is recommended that you set these settings in the Default Domain Policy. If you set account policies at a lower level, such as an OU, the settings only affect local accounts (non-domain accounts) on computers in that OU and its children.
Before making any changes to the default GPOs, be sure to back up the GPO using GPMC. If for some reason there is a problem with the changes to the default GPOs and you cannot revert back to the previous or initial states, you can use the Dcgpofix.exe tool to recreate the default policies in their initial state.
Dcgpofix.exe is a command-line tool that completely restores the Default Domain Policy GPO and Default Domain Controller GPO to their original states in the event of a disaster where you cannot use GPMC. Dcgpofix.exe restores only the policy settings that are contained in the default GPOs at the time they are generated. The only Group Policy extensions that include policy settings in the default GPOs are RIS, Security, and EFS. Dcgpofix.exe does not restore other GPOs that administrators create; it is only intended for disaster recovery of the default GPOs.
Note that Dcgpofix.exe does not save any information created through applications, such as SMS or Exchange. The Dcgpofix.exe tool is included with Windows Server 2003 and only works in a Windows Server 2003 domain.
Dcgpofix.exe is located in the C:\Windows\Repair folder. The syntax for Dcgpofix.exe is as follows:
Copy Code
DCGPOFix [/Target: Domain | DC | BOTH]
Table 2.1 describes the options you can use with the command line parameter /Target: when using the Dcgpofix.exe tool.
Table 2.1 Dcgpofix.exe Options for Using the /Target Parameter

/Target option:

Description of option

DOMAINSpecifies that the Default Domain Policy should be recreated.DCSpecifies that the Default Domain Controllers Policy should be recreated.BOTH
Specifies that both the Default Domain Policy and the Default Domain Controllers Policy should be recreated.
For more information about Dcgpofix.exe, in Help and Support Centerfor Windows Server 2003 click Tools, and then click Command-line reference A-Z

Linking GPOs to the OU Structure

Most GPOs are normally linked to the OU structure because this provides the most flexibility and manageability:

You can move users and computers into and out of OUs.
OUs can be rearranged if necessary.
You can work with smaller groups of users who have common administrative requirements.
You can organize users and computers based on which administrators manage them.

Organizing GPOs into user- and computer-oriented GPOs can help make your Group Policy environment easier to understand and can simplify troubleshooting. However, separating the user and computer components into separate GPOs might require more GPOs. You can compensate for this by adjusting the GPO Status to disable the user or computer configuration portions of the GPO that do not apply and to reduce the time required to apply a given GPO.

Changing the GPO Link Order

Within each domain, site, and OU, the link order controls the order in which GPOs are applied. To change the precedence of a link, you can change the link order, moving each link up or down in the list to the appropriate location. Links with the lowest number have higher precedence for a given site, domain, or OU. For example, if you add six GPO links and later decide that you want the last one that you added to have the highest precedence, you can adjust the link order of the GPO link so it has link order of 1. To change the link order for GPO links for a domain, OU, or site, use GPMC
http://technet.microsoft.com/en-us/library/cc736813.aspx
http://technet.microsoft.com/en-us/library/cc757050.aspx
39) What can I do to prevent inheritance from above?
You can block policy inheritance for a domain or organizational unit. Using block inheritance prevents GPOs linked to higher sites, domains, or organizational units from being automatically inherited by the child-level. By default, children inherit all GPOs from the parent, but it is sometimes useful to block inheritance. For example, if you want to apply a single set of policies to an entire domain except for one organizational unit, you can link the required GPOs at the domain level (from which all organizational units inherit policies by default), and then block inheritance only on the organizational unit to which the policies should not be applied.
40) How can I override blocking of inheritance?
A. Group Policies can be applied at multiple levels (Sites, domains, organizational Units) and multiple GP’s for each level. Obviously it may be that some policy settings conflict hence the application order of Site – Domain – Organization Unit and within each layer you set order for all defined policies but you may want to force some polices to never be overridden (No Override) and you may want some containers to not inherit settings from a parent container (Block Inheritance).
A good definition of each is as follows:
No Override – This prevents child containers from overriding policies set at higher levels
Block Inheritance – Stops containers inheriting policies from parent containers
No Override takes precedence over Block Inheritance so if a child container has Block Inheritance set but on the parent a group policy has No Override set then it will get applied.
Also the highest No Override takes precedence over lower No Override’s set.
To block inheritance perform the following:

Start the Active Directory Users and Computer snap-in (Start – Programs – Administrative Tools – Active Directory Users and Computers)
Right click on the container you wish to stop inheriting settings from its parent and select Properties
Select the ‘Group Policy’ tab
Check the ‘Block Policy inheritance’ option
Click here to view image
Click Apply then OK

To set a policy to never be overridden performs the following:

Start the Active Directory Users and Computer snap-in (Start – Programs – Administrative Tools – Active Directory Users and Computers)
Right click on the container you wish to set a Group Policy to not be overridden and select Properties
Select the ‘Group Policy’ tab
Click Options
Check the ‘No Override’ option
Click OK
Click Apply then OK

41) How can you determine what GPO was and was not applied for a user? Name a few ways to do that.

Group Policy Management Console (GPMC) can provide assistance when you need to troubleshoot GPO behavior. It allows you to examine the settings of a specific GPO, and is can also be used to determine how your GPOs are linked to sites, domains, and OUs. The Group Policy Results report collects information on a computer and user, to list the policy settings which are enabled. To create a Group Policy Results report, right-click Group Policy Results, and select Group Policy Results Wizard on the shortcut menu. This launches the Group Policy Results Wizard, which guides you through various pages to set parameters for the information that should be displayed in the Group Policy Results report.
Gpresult.exe Click Start > RUN > CMD > gpresult, this will also give you information of applied group policies.

3. RSOP.MSC

42) A user claims he did not receive a GPO, yet his user and computer accounts are in the right OU, and everyone else there gets the GPO. What will you look for?
Here interviewer want to know the troubleshooting steps
what GPOs is applying?
If it applying in all user and computer?
What GPOs are implemented on ou?
Make sure user not is member of loopback policy as in loopback policy it doesn’t affect user settings only computer policy will applicable.
If he is member of GPOs filter grp or not?
You may also want to check the computers event logs. If you find event ID 1085 then you may want to download the patch to fix this and reboot the computer.
===============================================
Answer 2: Start troubleshooting by running RSOP.MSC (Resultant Set of Policy) or gpresult /z to verify whether relevant GPO actually applies to that user?
This also can be a reason of slow network; you can change the default setting by using the Group Policy MMC snap-in. This feature is enabled by default, but you can disable it by using the following policy: Administrative Templates\System\Logon\Always wait for the network at computer startup and logon.
Identify which GPOs they correspond to; verify that they are applicable to the computer/user (based on the output of RSOP.MSC/gpresult)
43) What are administrative templates?
The GPO settings are divided between the Computer settings and the User settings. In both parts of the GPO you can clearly see a large section called Administrative Templates.
Administrative Templates are a large repository of registry-based changes (in fact, over 1300 individual settings) that can be found in any GPO on Windows 2000, Windows XP, and Windows Server 2003.
By using the Administrative Template sections of the GPO you can deploy modifications to machine (called HKEY_LOCAL_MACHINE in the registry) and user (called HKEY_CURRENT_USER in the registry) portions of the Registry of computers that are influenced by the GPO.
The Administrative Templates are Unicode-formatted text files with the extension .ADM and are used to create the Administrative Templates portion of the user interface for the GPO Editor.
44) What’s the difference between software publishing and assigning?
An administrator can either assign or publish software applications.
Assign Users
the software application is advertised when the user logs on. It is installed when the user clicks on the software application icon via the start menu, or accesses a file that has been associated with the software application.
Assign Computers
The software application is advertised and installed when it is safe to do so, such as when the computer is next restarted.
Publish to users
the software application does not appear on the start menu or desktop. This means the user may not know that the software is available. The software application is made available via the Add/Remove Programs option in control panel, or by clicking on a file that has been associated with the application. Published applications do not reinstall themselves in the event of accidental deletion, and it is not possible to publish to computers.
45) You want to standardize the desktop environments (wallpaper, My Documents, Start menu, printers etc.) on the computers in one department. How would you do that?
Yes… Through Group Policy

How to Add Domain User to Local Administrator Group

2012-08-02T13:38:00.001-07:00

As an IT professional we all know the benefit of adding domain user to local admin group of laptop/desktop. In a big organization we can not go desk to desk to perform this activity. We can achieve this by using Restricted Groups.
Finding Restricted Groups is easy but it only works in a domain with Active Directory.
Here how we can achieve this.
GPO -> Computer Configuration -> Windows Settings -> Security Settings -> Restricted Groups
Add desired group (I used “localadmin”) which users are responsible. Now you have two different choices of what you want to do with the group you selected. Either you use “Members of this group” or “This group is a member of”.
Note: Here I have not explained what is “Members of this group” or “This group is a member of” instead I will tell you what to put in these boxes.
In Members of this group – Administrator
In This group is a member of – Administrators

After completing this activity update the group policy on server, it will get updated at client end in some time.
Hopefully you found this quicker than it took me to write it, and your problems are now solved.

Active Directory Migration from 2003 to 2008 using ADMT V3.2

2012-08-02T13:37:00.002-07:00

ADMT Guide: Migrating and Restructuring Active Directory Domains

Published: 4-March-2012
Author: Sandesh Vidhate
Abstract
This guide explains how we use the Active Directory Migration Tool version 3.1 (ADMT v3.1) or ADMT v 3.2 to migrate users, groups, managed service accounts, and computers between Active Directory domains in different forests (interforest migration) or between Active Directory domains in the same forest (intraforest migration). It also shows how to use ADMT to perform security translation between different Active Directory forests. Also for this activity we required a two way trust between source forest & target forest. After establishing trust we need add Administrator from both domain to each other Domain Admin group.

Terms and definitions

The following terms apply to the Active Directory domain restructure process.
Migration   The process of moving or copying an object from a source domain to a target domain, while preserving or modifying characteristics of the object to make it accessible in the new domain.
Domain restructure   A migration process that involves changing the domain structure of a forest. A domain restructure can involve either consolidating or adding domains, and it can take place between forests or in a forest.
Migration objects   Domain objects that are moved from the source domain to the target domain during the migration process. Migration objects can be user accounts, service accounts, groups, or computers.
Source domain   The domain from which objects are moved during a migration. When you restructure Active Directory domains between forests, the source domain is an Active Directory domain in a different forest from the target domain.
Target domain   The domain to which objects are moved during a migration.
Built-in accounts   Default security groups that have common sets of rights and permissions. You can use built-in accounts to grant permissions to any accounts or groups that you designate as members of these groups. Built-in accounts SIDs are identical in every domain. Therefore, built-in accounts cannot be migration objects.

Checklist: Performing an Interforest Migration

Applies to: Active Directory Migration Tool 3.1 (ADMT 3.1) and ADMT 3.2
Migrating Active Directory domains between forests (interforest migration) involves relocating objects from source domains in one forest to target domains in another forest. You might have to restructure Active Directory domains between forests for the following reasons:
 To migrate a pilot domain into your production environment
 To merge your Active Directory forest with the forest of another organization and consolidate the two information technology (IT) infrastructures

Task	Reference
Review the Active Directory Migration Tool (ADMT) preinstallation instructions.	Installing ADMT in the Target Domain
To migrate computers running Windows Server 2008, Windows Server 2003, Windows Vista (without Service Pack 1), Windows XP, and Microsoft Windows 2000 (using ADMT 3.1) to a target domain with domain controllers running Windows Server 2008 R2 or Windows Server 2008, first set the following registry key on the target domain controllers:NoteThis registry key does not need to be set to migrate computers that run Windows Server 2008 R2, Windows 7, or Windows Vista SP1.Registry path: HKLM\System\CurrentControlSet\Services\Netlogon\Parameters Registry value: AllowNT4Crypto Type: REG_DWORD Data: 1 Note This registry setting corresponds to the Allow cryptography algorithms compatible with Windows NT 4.0 setting in Group Policy.	For more information about making this change using Group Policy, see Known Issues for Installing and Removing AD DS (http://go.microsoft.com/fwlink/?LinkId=119321).
For any migration tasks that use agent deployment and where Windows Firewall is in use, enable the File and Printer Sharing exception. This can include migration for the following situations: Migrating workstation computers and member servers that are running Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, Windows 7, Windows Vista, or Windows XP. Migrating security settings or performing security translation	For more information about making this change in Windows Firewall, see Enable or Disable the File and Printer Sharing Exception (http://go.microsoft.com/fwlink/?LinkID=119315).
Prepare to restructure Active Directory domains within a forest. This task has the following subtasks: Determine your account migration process. Assign object roles and locations. Develop a test plan for your migration.  Create a rollback plan.  Manage users, groups, and user profiles.  Create a user communication plan.	Installing ADMT in the Target Domain Planning to Restructure Active Directory Domains Between Forests
Prepare the source and target domains. This task has the following subtasks: Install 128-bit encryption software. Establish trusts that are required for migration. Establish migration accounts for your migration.  Configure the source and target domains for security identifier (SID) history migration.  Configure the target domain organizational unit (OU) structure.  Install ADMT in the target domain.  Specify service accounts for your migration.	Installing ADMT in the Target Domain Planning to Restructure Active Directory Domains Between Forests
Specify and transition service accounts using either the Service Account Migration Wizard or ADMT command-line tools. You can use the admt service command-line tool to specify service accounts in the source domain. You can use the admt user command-line tool to transition service accounts that you specify.	Transitioning Service Accounts in Your Migration
Migrate global groups using either the Group Account Migration Wizard or the admt group command-line tool.	Migrating Global Groups
Migrate managed service accounts, user accounts, and workstation accounts with their SID histories in batches. You can use either the User Account Migration Wizard or the admt user command-line tool to migrate user accounts. You can use the Managed Service Account Migration Wizard or admt managedserviceaccount command-line tool to migrate managed service accounts.	Migrating Accounts While Using SID History Migrating Managed Service Accounts Migrating All User Accounts
Migrate resources, such as member servers and domain local groups. You can use either the Computer Account Migration Wizard or the admt computer command-line tool to migrate computer accounts. You can use the Group Account Migration Wizard or the admt group command-line tool to migrate groups.	Remigrating User Accounts and Migrating Workstations in Batches
Translate security on servers to add the SIDs of the user and group accounts in the target domain to the access control lists (ACLs) of the resources. You can use either the Security Translation Wizard or the admt security command-line tool.	Translating Security in Add Mode
Repeat a migration of user accounts, workstation computers, and member servers, including translating local user profiles to user and computer objects that you migrated earlier.	Remigrating User Accounts and Migrating Workstations in Batches
Migrate domain local groups using either the Group Account Migration Wizard or the admt group command-line tool.	Migrating Domain and Shared Local Groups
Migrate domain controllers.	Migrating Domain Controllers
Complete postmigration tasks. This task has the following subtasks: Translate security on member servers. Decommission the source domains.	Translating Security on Your Member Servers Decommissioning the Source Domain

Interforest Active Directory Domain Restructure

Applies to: Active Directory Migration Tool 3.1 (ADMT 3.1) and ADMT 3.2
Restructuring Active Directory domains between forests involves relocating objects from source domains in one forest to target domains in another forest. You might have to restructure Active Directory domains between forests to:
    Migrate a pilot domain into your production environment.
    Merge users and resources with another organization because of a corporate merger and the need to consolidate the two information technology (IT) infrastructures.
    Relocate users and resources on a regular basis because of a planned multiforest deployment.
    Remove objects from your forest because of a divestiture to another organization or to merge later into a new or existing forest for that organization.

Process for Restructuring Active Directory Domains Between Forests

Applies to: Active Directory Migration Tool 3.1 (ADMT 3.1) and ADMT 3.2
Restructuring Active Directory domains between forests involves planning and preparing for the domain restructure for your organization. It also entails successfully migrating accounts and resources to an Active Directory domain in another forest. The following figure shows the process for restructuring Active Directory domains between forests.

Installing ADMT v3.2

ADMT v3.2 requires a preconfigured instance of SQL Server for its underlying data store. You should use SQL Server Express. When you use one of the following versions of SQL Server Express, ADMT installation enforces the following service pack requirements:
SQL Server 2005 Express must be installed with Service Pack 3 (SP3) or later.
SQL Server 2008 Express must be installed with Service Pack 1 (SP1) or later.

Note

If you use SQL Server Express, the ADMT console must be installed and run locally on the server that hosts the SQL Server Express database instance.
As an option, you can use full versions of SQL Server 2005 or SQL Server 2008. In this case, you can install and run the ADMT console on a remote computer, and you can run multiple ADMT consoles on different remote computers. If you use a full version of SQL Server, ADMT installation does not enforce any service pack requirements.
The rest of this section covers the following installation issues:

Prerequisites for installing ADMT v3.2

Before you install ADMT v3.2, complete the following prerequisite tasks:
    In Control Panel, use Add or Remove Programs to remove all versions of ADMT earlier than ADMT v3.2.
Although ADMT v3.2 does not support an upgrade from a previous version of ADMT, you can reuse an existing database from a previous ADMT installation, unless it is a database from ADMT v2 or ADMT v1. For more information, see Reuse an existing ADMT database from a previous installation.
    Install or upgrade a server computer (preferably a member server) in either your source or target domain environment as necessary to run Windows Server 2008 R2.
Although you can use ADMT v3.2 to migrate accounts and resources from Active Directory environments that have a domain functional level of Windows Server 2003 or later, you can install ADMT v3.2 only on a server running Windows Server 2008 R2.
In addition to running Windows Server 2008 R2, the server computer that you use to install ADMT v3.2 must not be installed under the Server Core installation option or be running as a read-only domain controller (RODC).
    Configure a SQL Server database installation with an ADMT instance. You can either download and install SQL Server Express locally or create a database instance for ADMT from an existing SQL Server database.
To install ADMT v3.2
1.   In the ADMT download package, double-click admtsetup32.exe.
2.   On the Welcome page, ensure that the recommendations are completed, and then click Next.
3.   On the License Agreement page, click I Agree, and then click Next.
4.   On the Database Selection page, type the server\instance.
The requirement to type the server name also applies to a local database instance. You can type a dot (“.”) to indicate the local server. By default, the SQL Server Express instance is named SQLEXPRESS.
For example, to use a default SQL Server Express instance on the local server, type .\SQLEXPRESS.
5.   If you chose a SQL Express installation and a database file ADMT.mdf is not in the default data location %windir%\ADMT\Data, the Database Import page appears. Otherwise, ADMT Setup automatically attaches to that database file, and the Summary page appears.
On the Database Import page, if you do not need to import data, click No, do not import data from an existing database (Default). If you need to import data from a previous ADMT installation, click Yes, import data from an existing ADMT v3.0 or ADMT v3.1 database, and then, to navigate to the existing database file location, click Browse.
Before you can import the data from an existing database, you have to detach the database file from SQL Server by using SQL Server commands. For more information, see Detach an existing database file from a previous version of ADMT and SQL Server.
When you are finished, click Next.
6.         On the Summary page, review the results of the installation, and then click Finish.

Enabling Migration of Passwords

***
Applies to: Active Directory Migration Tool 3.1 (ADMT 3.1) and ADMT 3.2
The Active Directory Migration Tool (ADMT) uses the Password Export Server service version 3.1 (PES v3.1) to help you migrate passwords when you perform an interforest migration. Both ADMT v3.1 and ADMT v3.2 use Password Export Server (PES) version 3.1. Download PES v3.1 from the Microsoft Download Center. For x86-based computers, see Password Export Server version 3.1 (x86) (http://go.microsoft.com/fwlink/?LinkId=147652). For 64-bit computers, see Password Export Server version 3.1 (x64) (http://go.microsoft.com/fwlink/?LinkId=147653). The PES service can be installed on any writable domain controller in the source domain that supports 128-bit encryption.

Note

The PES service cannot be installed on read-only domain controllers (RODCs).
Because ADMT does not check all settings of the target domain password policy, users need to explicitly set their password after migration unless the Password never expires or Smartcard is required for interactive logon flags are set.
The PES service installation in the source domain requires an encryption key. However, you must create the encryption key on the computer running the ADMT in the target domain. When you create the key, save it to a shared folder on your network or onto removable media so that you can copy it to the local drive of the source domain controller where the PES service is installed. Store it in a secure location that you can reformat after the migration is complete.
You can install the PES service after you install ADMT. The following procedures explain how to install and use the PES service on computers running Windows Server 2008 R2 or Windows Server 2008.
Membership in Administrators, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at Local and Domain Default Groups (http://go.microsoft.com/fwlink/?LinkId=83477).

To create an encryption key

 At a command line, type the following command, and then press ENTER:admt key /option:create /sourcedomain:<SourceDomain> /keyfile:<KeyFilePath> /keypassword:{<password>|*}ADMTKEY Example:admt key /option:create /sourcedomain:sourcedomain.local /keyfile:c: /keypassword:yourpassword

Value	Description
<SourceDomain>	Specifies the name of the source domain in which the PES service is being installed. Can be specified as either the Domain Name System (DNS) or NetBIOS name.
<KeyFilePath>	Specifies the path to the location where the encrypted key is stored.
{<password>\|*}	A password, which provides key encryption, is optional. To protect the shared key, type either the password or an asterisk (*) on the command line. The asterisk causes you to be prompted for a password that is not displayed on the screen.

After you create the encryption key, configure the PES service on a domain controller in the source domain.
ADMT provides the option to run the PES service under the Local System account or by using the credentials of an authenticated user in the target domain. We recommend that you run the PES service as an authenticated user in the target domain. This way, you do not have to add the Everyone group and the Anonymous Logon group to the Pre–Windows 2000 Compatible Access group.

Note

If you run the PES service under the Local System account, ensure that the Pre–Windows 2000 Compatible Access group in the target domain contains the Everyone group and the Anonymous Logon group.

To configure the PES service in the source domain

1. On the domain controller that runs the PES service in the source domain, insert the encryption key disk.2. Run Pwdmig.msi. If you set a password during the key generation process on the domain controller in the target domain, provide the password that was given when the key was created, and then click Next.

Wizard page	Action
Welcome to the ADMT Password Migration DLL Installation Wizard	Click Next.
Encryption File	To install the ADMT Password Migration dynamic-link library (DLL), you must specify a file that contains a valid password encryption key for this source domain. The key file must be located on a local drive.You use the admt key command to generate the key files. For more information, see the previous procedure “To create an encryption key.”
Run the service as	Specify the account that you want the PES service to run under. You can specify either of the following accounts: The local System account A specified user accountNote If you plan to run the PES service as an authenticated user account, specify the account in the format domain\user_name.
Summary	Click Finish to complete the PES service installation.NoteTo use the password migration of ADMT, you must restart the server where you installed the PES service.

3.   After installation completes, restart the domain controller.
4.   After the domain controller restarts, to start the PES service, point to Start, point to All Programs, point to Administrative Tools, and then click Services.
5.   In the details pane, right-click Password Export Server Service, and then click Start.
Note
Run the PES service only when you migrate passwords. Stop the PES service after you complete the password migration.

Migrating All User Accounts

Applies to: Active Directory Migration Tool 3.1 (ADMT 3.1) and ADMT 3.2
Begin the user account migration process by migrating all users. This helps you translate local profiles and ensure that users continue to have the appropriate resource access after the migration.

Note

Built-in accounts (such as Administrators, Users, and Power Users) cannot be Active Directory Migration Tool (ADMT) migration objects. Because built-in account security identifiers (SIDs) are identical in every domain, migrating these accounts to a target domain results in duplicate SIDs in a single domain. Every SID in a domain must be unique. Well-known accounts (such as Domain Admins and Domain Users) also cannot be ADMT migration objects.
The ADMT user account migration process includes the following steps:
1.   ADMT reads the attributes of the source user objects.
2.   ADMT creates a new user object in the target domain and a new primary SID for the new user account.
3.   ADMT adds the original SID of the user account to the SID history attribute of the new user account.
4.   ADMT migrates the password for the user account.
5.   If ADMT identifies global groups in the target domain that the migrated users belonged to in the source domain, the tool adds the users to the appropriate global groups in the target domain.
During the migration, audit events are logged in both the source and the target domains.
You can migrate user accounts by using the ADMT snap-in, by using the ADMT command-line option, or by using a script. If you are migrating user accounts that have authentication mechanism assurance enabled, use an include file. In the include file, specify the original user principal names (UPNs) from the source domain as the target UPNs so that you can keep the authentication mechanism assurance working. For more information about using an include file, see Use an Include File.

Important

When you start a user migration with SID history from the command line or from a script, you must perform the migration on a domain controller in the target domain.

To migrate the current batch of users by using the ADMT snap-in

1. On the computer in the target domain on which ADMT is installed, log on by using the ADMT account migration account.2. Use the User Account Migration Wizard by performing the steps in the following table.

Wizard page	Action
Domain Selection	Under Source, in the Domain drop-down list, type or select the NetBIOS or Domain Name System (DNS) name of the source domain. In the Domain controller drop-down list, type or select the name of the domain controller, or select Any domain controller.Under Target, in the Domain drop-down list, type or select the NetBIOS or DNS name of the target domain. In the Domain controller drop-down list, type or select the name of the domain controller, or select Any domain controller, and then click Next.
User Selection	Click Select users from domain, and then click Next. On the User Selection page, click Add to select the users in the source domain that you want to migrate in the current batch, click OK, and then click Next.OrClick Read objects from an include file, and then click Next. Type the location of the include file, and then click Next.
Organizational Unit Selection	Ensure that ADMT lists the correct target OU. If it is not correct, type the correct OU, or click Browse.In the Browse for Container dialog box, locate the target domain and OU, and then click OK.
Password Options	Click Do not update passwords for existing users.Click Generate complex passwords.
Account Transition Options	In Target Account State:, click Disable target accounts.In Source Account Disabling Options:, click Days until source accounts expire:, and then type the numbers of days you want to keep the source account. A value of seven is commonly used.Select the Migrate user SIDs to target domains check box.
User Account	Type the user name, password, and domain of a user account that has administrative credentials in the source domain.
User Options	Select the Translate roaming profiles check box.Clear the Update user rights check box.Clear the Migrate associated user groups check box.Select the Fix users’ group memberships check box.
Object Property Exclusion	Clear the Exclude specific object properties from migration check box.
Conflict Management	Click Do not migrate source object if a conflict is detected in the target domain.Ensure that the Before merging remove user rights for existing target accounts and Move merged objects to specified target Organizational Unit check boxes are not selected.

3. When the wizard has finished running, click View Log, and then review the migration log for any errors.
4. Start Active Directory Users and Computers, and then verify that the user accounts exist in the appropriate OU in the target domain.

Migrating workstations in batches

After you migrate a batch of local user profiles, migrate the corresponding batch of user workstations. When you migrate a workstation between domains, the Security Accounts Manager (SAM) database is migrated along with the computer. Accounts in the local SAM database (such as local groups) that are used to enable access to resources always move with the computer. Therefore, these accounts do not have to be migrated.
If a workstation has managed service accounts installed and those accounts have been previously migrated, ADMT provides an option to reinstall the migrated managed service account on the migrated computer and update Service Control Manager. So that ADMT can perform this operation, the account performing the computer migration needs permissions to modify the security descriptor of the migrated managed service account.

Note

Use a low value for the RestartDelay parameter to restart workstations immediately after joining them to the target domain, or as soon as possible thereafter. Resources that are not restarted after migration are in an indeterminate state.
You can migrate workstations and member servers by using the AMDT snap-in, ADMT command-line option, or a script.

To migrate workstations by using the ADMT snap-in

1. On the computer in the target domain on which you installed ADMT, log on by using the ADMT resource migration account.2. Use the Computer Migration Wizard by performing the steps in the following table.

Wizard page	Action
Domain Selection	Under Source, in the Domain drop-down list, type or select the NetBIOS or Domain Name System (DNS) name of the source domain. In the Domain controller drop-down list, type or select the name of the domain controller, or select Any domain controller.Under Target, in the Domain drop-down list, type or select the NetBIOS or DNS name of the target domain. In the Domain controller drop-down list, type or select the name of the domain controller, or select Any domain controller, and then click Next.
Computer Selection	Click Select computers from domain, and then click Next. On the Computer Selection page, click Add to select the computers in the source domain that you want to migrate, click OK, and then click Next.OrClick Read objects from an include file, and then click Next. Type the location of the include file, and then click Next.
Managed Service Account Information (appears if the computer has a managed service account installed)	Select any managed service accounts that do not have to be installed on the migrated computer in the target domain, and then click Skip/Include to mark the accounts as Skip.
Organizational Unit Selection	Click Browse.In the Browse for Container dialog box, locate the target domain Computers container or the appropriate OU, and then click OK.
Translate Objects	Select the Local groups check box.Select the User rights check box.
Security Translation Options	Click Add.
Computer Options	In the Minutes before computer restart after wizard completion box, accept the default value of 5 minutes or type a different value.
Object Property Exclusion	To exclude certain object properties from the migration, select the Exclude specific object properties from migration check box, select the object properties that you want to exclude and move them to Excluded Properties, and then click Next.
Conflict Management	Click Do not migrate source object if a conflict is detected in the target domain.
ADMT Agent Dialog	Select Run pre-check and agent operation, and then click Start.

3. Review the results that are displayed on the screen for any errors. After the wizard completes, click View Migration Log to see the list of computers, completion status, and the path to the log file for each computer. If an error is reported for a computer, you will have to refer to the log file on that computer to review any problems with local groups. The log file for each computer is named MigrationTaskID.log and is stored in the Windows\ADMT\Logs\Agents folder.
4. Open Active Directory Users and Computers, and verify that the workstations exist in the appropriate OU in the target domain.

How To Setup ADMT Password Export Server

2012-08-02T13:36:00.001-07:00

I had to migrate some users from my forest into a brand new forest and I was told to just create all the users on the new forest.
So I prepared the target forest for migration by setting up the trust relationship between my forest and the target forest, delegated the rights on the remote forest for my administrative user and installed ADTM 3.2 on both forests as I was going to experiment migration from both forests.
Now, before you install ADMT 3,2 remember you will have to install SQL Express server. In my case I had the ADMT installed on Domain Controller instead of a member server. If this is your case also then do NOT install SQL Express 2008, just install SQL Express 2005 SP1 because the ADMT 3.2 will not work with SQL Express 2008 installed on the DC.
So first install SQL Express 2005 SP1 then install the ADMT.
Now, if you also plan on migrating the passwords and SID history from one forest to the other you will also need to further prepare the target and source domain for the migration. Please see this Technet article regarding preparation of the domain, and here is the Technet article regarding password migration domain preparation.
You will probably find many more guides on the internet on how to prepare the domain and groups and other small things.
After you install ADMT and you want to migrate also the Passwords then you will have to install also “Password Export Server“.
After you install PES you will have to create a KEY for password encryption. The key needs to be created on the TARGET domain and imported on the SOURCE domain.
So you will need to run this command on the TARGET domain:
admt key /option:create /sourcedomain:/keyfile: /keypassword:{|*}
ADMTKEY Example:
admt key /option:create /sourcedomain:sourcedomain.local /keyfile:c: /keypassword:yourpassword
After you copy the key from the target domain to the source domain you will also have to IMPORT IT ! No article will tell you this. The PES key must be imported on the source domain by this command:
admt key /option:import /sourcedomain:sourcedomain.local /keyfile:key.pes
Only now START the “Password Export Server Service”.
After performing this activity you will able to migrate users with passwords.

Steps required for Active Directory Migration using ADMT

2012-08-02T13:35:00.002-07:00

Inter-Forest Migration Preparation using ADMT
1. Purpose – The purpose of this document is to prepare Source & Target Domains for Inter-Forest Migration
2. Prerequisites –
1. Understanding in Active Directory and DNS.
2. Administrative access is needed on the source domain that is about to be migrated into the Target Domain by creating a user on the source domain that is a member of “Domain Admins” & “Enterprise Admins” that would be used during migration.
3. Communication between the source domain DC & PDC Emulator and Target DC on site & Target PDC Emulator has to be fully open between them all (full IP).
Inter-Forest Migration Preparation
1. Make sure the Target DC on site that is going to be used for Migration has a DNS Server Service Installed.
2. Create an AD integrated conditional forwarder on “target.com” DNS to forward any DNS queries of the source domain to the source domain’s DNS server.
3. Create an AD integrated conditional forwarder on “SourceDomain.com” DNS to forward any DNS queries of “target.com” domain to the Target domain’s DNS server.
4.Verify that there is DNS resolving between the Domains using NSLOOKUP, This test could only take place from the DC’s that are open to each other (refer to “PREREQUISITES”, Section 3).
5. Create a Two Way External Trust between both Domains using a Target Domain Admin User and the Domain Admin user you created on the Source Domain.
6. Create a dedicated Global Group in the OU on the Target domain, which would contain the members of those who would be involved in the migration process of Users/Groups/Workstations/Servers (e.g. Site_Admins).
10. Assign the Migrators Members to the Site_Admins Group.
11. Install the ADMT Software on a member server that is Part of Target Domain (not on the Source Domain member server).
12. Add Target “Domain Admins” group & Site_Admins in to the “Administrators” Group on the server that is running the ADMT.
13. Add Target “Domain Admins” group & Site_Admins in to the “Administrators” Group in the SourceDomain Active Directory.
15. Make sure that on both Domains “Default Domain Controller Policy” -> Computer Configuration -> Windows Setting -> Security Settings -> Local Policies -> Audit Policy -> “Audit Account Management” is set to Audit both Success & Failure.
Steps required for Active Directory Migration using ADMT.

Both domains should ping / trace route each other successfully.
Necessary network port should be allowed from both domain to create trust
Need to create two way domain / forest trust.
Need to install ADMT on target domain.
After installing ADMT, client needs to provide users list to be migrated.
User Migration
In the ADMT snap-in, click Action, and then click User Account Migration Wizard.
Select the appropriate options in the User Account Migration Wizard
Domain Selection – > Select Source and Target Domain
User Selection -> Select User accounts (use an input file if you want to migrate a group of people)
Organizational Unit Selection -> Select target OU
Password Options -> Migrate Password
Account Transition Options -> Select appropriate options
User Account -> Enter Type the user name, password, and domain of a user account that has administrative credentials in the source domain.
User Options-> Select appropriate options
Object Property Exclusion-> Select appropriate options
Conflict Management -> Select appropriate options
Complete the User Account Migration Wizard.
When the wizard has finished running, click View Log, and review the migration log for any errors.

Active Directory Forest Functional Level and Domain Functional Level

2012-08-02T13:33:00.002-07:00

Setting the Domain or Forest Functional Level
Functional levels determine the features of Active Directory Domain Services (AD DS) that are enabled in a domain or forest. They also restrict which Windows Server operating systems can run on domain controllers in the domain or forest. However, functional levels do not affect which operating systems can run on workstations and member servers that are joined to the domain or forest.
When you create a new domain or a new forest, set the domain and forest functional levels to the highest values that you know your environment can support. This way, you can take advantage of as many AD DS features as possible. For example, if you are sure that no domain controllers that run Windows Server 2008 (or any earlier operating system) will ever be added to the domain or forest, select the Windows Server 2008 R2 functional level. On the other hand, if it is possible that you will retain or add domain controllers that run Windows Server 2008 or earlier, select the Windows Server 2008 functional level during installation. You can raise the functional level after the installation, when you are sure that no such domain controllers will be added or are still in use.
When you install a new forest, you are prompted to set the forest functional level and then the domain functional level. You cannot set the domain functional level to a value that is lower than the forest functional level. For example, if you set the forest functional level to Windows Server 2008 R2, you can set the domain functional level only to Windows Server 2008 R2. The Windows 2000, Windows Server 2003, and Windows Server 2008 domain functional level values will not be available on the Set domain functional level wizard page. In addition, all domains that you subsequently add to that forest will have the Windows Server 2008 R2 domain functional level by default.
After you set the domain functional level to a certain value, you cannot roll back or lower the domain functional level, with one exception: when you raise the domain functional level to Windows Server 2008 R2 and if the forest functional level is Windows Server 2008 or lower, you have the option of rolling the domain functional level back to Windows Server 2008. You can lower the domain functional level only from Windows Server 2008 R2 to Windows Server 2008. If the domain functional level is set to Windows Server 2008 R2, it cannot be rolled back, for example, to Windows Server 2003.
After you set the forest functional level to a certain value, you cannot roll back or lower the forest functional level, with one exception: when you raise the forest functional level to Windows Server 2008 R2 and if Active Directory Recycle Bin is not enabled, you have the option of rolling the forest functional level back to Windows Server 2008. You can lower the forest functional level only from Windows Server 2008 R2 to Windows Server 2008. If the forest functional level is set to Windows Server 2008 R2, it cannot be rolled back, for example, to Windows Server 2003.
The following sections explain the sets of features that are enabled at the different domain and forest functional levels.

Domain functional Level	Enabled features	Supported domain controller operating systems

Windows 2000 native	All default Active Directory features, plus the following	Windows 2000
	features:	Windows Server 2003
	Universal groups for both distribution groups	Windows Server 2008
	and security groups	Windows Server 2008 R2
	Group nesting	Server 2008 R2
	Group conversion, which makes conversion
	possible between security groups and
	distribution groups
	Security identifier (SID) history

Windows Server 2003	All default Active Directory features, all features from	Windows Server 2003
	the Windows 2000 native domain functional level, plus	Windows Server 2008
	the following features:	Windows Server 2008 R2
	The domain management tool, Netdom.exe, is
	available to prepare for domain controller
	rename.
	Logon time stamp update. The
	lastLogonTimestamp attribute will be updated
	with the last logon time of the user or
	computer. This attribute is replicated within the
	domain. Note that this attribute might not be
	updated if a read-only domain controller (RODC)
	authenticates the account.
	The userPassword attribute can be set as the
	effective password on inetOrgPerson objects
	and user objects.
	Users and Computers containers can be
	redirected. By default, two well-known
	containers are provided for housing computer
	and user/group accounts:
	cn=Computers,<domain root> and
	cn=Users,<domain root>. With this feature, you
	can define a new well-known location for these
	accounts.
	Authorization Manager can store its
	authorization policies in AD DS.
	Constrained delegation, which makes it possible
	for applications to take advantage of the secure
	delegation of user credentials by means of the
	Kerberos authentication protocol. You can
	configure delegation to be allowed only to
	specific destination services.
	Support for selective authentication, which
	makes it possible to specify the users and
	groups from a trusted forest who are allowed to
	authenticate to resource servers in a trusting
	forest.

Windows Server 2008	All default Active Directory features, all features from	Windows Server 2008
	the Windows 2000 native and the	Windows Server 2008 R2
	Windows Server 2003 domain functional levels, plus
	the following features:
	Distributed File System (DFS) Replication
	support for SYSVOL, which provides more
	robust and detailed replication of SYSVOL
	contents. You may need to perform additional
	steps to use DFS Replication for SYSVOL. For
	more information, see File Services
	(http://go.microsoft.com/fwlink/?
	LinkId=93167).
	Advanced Encryption Services (AES 128 and
	256) support for the Kerberos protocol.
	Last Interactive Logon Information, which
	displays the time of the last successful
	interactive logon for a user, from what
	workstation, and the number of failed logon
	attempts since the last logon.
	Fine-grained password policies, which make it
	possible for password and account lockout
	policies to be specified for users and global
	security groups in a domain.

Windows Server 2008 R2	All default Active Directory features, all features from	Windows Server 2008 R2
	the Windows 2000 native, Windows Server 2003, and
	Windows Server 2008 functional levels, plus the
	following feature:
	Authentication Mechanism Assurance, which
	packages information about the type of logon
	method (smartcard or user name/password)
	that is used to authenticate domain users inside
	each user’s Kerberos token. When this feature is
	enabled in a network environment that has
	deployed a federated identity management
	infrastructure, such as Active Directory
	Federation Services (AD FS), the information in
	the token can then be extracted whenever a
	user attempts to access any claims-aware
	application that has been developed to
	determine authorization based on a user’s logon
	method.

Features that are enabled at forest functional levels
The following table lists the enabled features and supported domain controller operating systems for each forest functional level.

Domain functional Level	Enabled features	Supported domain controller operating systems

Windows 2000	All default Active Directory features	Windows 2000
		Windows Server 2003
		Windows Server 2008
		Windows Server 2008 R2

Windows Server 2003	All default Active Directory features, plus the following	Windows Server 2003
	features:	Windows Server 2008
	Forest trust	Windows Server 2008 R2
	Domain rename
	Linked-value replication (changes in group
	membership to store and replicate values for
	individual members instead of replicating the entire
	membership as a single unit). This change results in
	lower network bandwidth and processor usage
	during replication, and it eliminates the possibility of
	lost updates when different members are added or
	removed concurrently at different domain
	controllers.
	The ability to deploy an RODC
	Improved Knowledge Consistency Checker (KCC)
	algorithms and scalability. The intersite topology
	generator (ISTG) uses improved algorithms that
	scale to support forests with a greater number of
	sites than can be supported at the Windows 2000
	forest functional level.
	The ability to create instances of the dynamic
	auxiliary class called dynamicObject in a domain
	directory partition
	The ability to convert an inetOrgPerson object
	instance into a User object instance, and the
	reverse
	The ability to create instances of the new group
	types, called application basic groups and
	Lightweight Directory Access Protocol (LDAP) query
	groups, to support role-based authorization
	Deactivation and redefinition of attributes and
	classes in the schema

Windows Server 2008	All the features that are available at the	Windows Server 2008
	Windows Server 2003 forest functional level, but no	Windows Server 2008 R2
	additional features. All domains that are subsequently
	added to the forest, however, will operate at the Windows
	Server 2008 domain functional level by default.
	If you plan to include only domain controllers that run
	Windows Server 2008 or Windows Server 2008 R2 in the
	entire forest, you might choose this forest functional level
	for administrative convenience.

Windows Server 2008 R2	All of the features that are available at the	Windows Server 2008 R2
	Windows Server 2003 forest functional level, plus the
	following feature:
	Recycle Bin, which provides the ability to restore
	deleted objects in their entirety while AD DS is
	running.
	All domains that are subsequently added to the forest will
	operate at the Windows Server 2008 R2 domain
	functional level by default.
	If you plan to include only domain controllers that run
	Windows Server 2008 R2 in the entire forest, you might
	choose this forest functional level for administrative
	convenience. If you do, you will never have to raise the
	domain functional level for each domain that you create in
	the forest.

Windows Deployment Services – Deploy Windows 7

2012-08-02T13:31:00.002-07:00

Windows Deployment Services – Deploy Windows 7 Video tutorial.

I found these WDS video tutorials very useful ,sharing for your reference.

http://www.youtube.com/watch?v=s6KppyXtiDk
http://www.youtube.com/watch?feature=fvwp&NR=1&v=Lxv6A7i_CHE
http://www.youtube.com/watch?NR=1&feature=fvwp&v=n1lcnbbAtDk
http://www.youtube.com/watch?v=nEHPwyxahS0&NR=1&feature=endscreen