Sie sind auf Seite 1von 6

Lab 1: Transfer Operations Master Roles

Task 1: Identify operations masters by using the Active Directory administrative snap-ins.
1. On 2008DC, run Active Directory Users and Computers with administrative credentials. 2. In the console tree, right-click the domain, and then click Operations Masters. The Operations Masters dialog box appears. The tabs identify the domain controllers currently performing the single master operations roles for the domain: PDC emulator, RID master, and Infrastructure master. 3. Click the tab for each operations master. Question: Which DC holds those roles? 4. Click Close. 5. Close Active Directory Users and Computers. 6. Run Active Directory Domains and Trusts with administrative credentials. 7. In the console tree, right-click the root node of the snap-in, Active Directory Domains and Trusts, and then click Operations Master. The Operations Master dialog box appears. Question: Which DC holds the domain naming operations master role? 8. Click Close. 9. Close Active Directory Domains and Trusts. The Active Directory Schema snap-in does not have a console of its own and cannot be added to a custom console until you have registered the snap-in. 10. Run Command Prompt with administrative credentials. 11. Type regsvr32 schmmgmt.dll, and then press Enter. 12. Click OK to close the message box that appears. 13. Click Start and, in the Start Search box, type mmc.exe, and then press Enter. The User Account Controldialog box appears. 14. Click Use another account. 15. In the User name box, type credentials 16. In the Password box, type your password, and then press Enter. An empty MMC console appears. 17. Click the File menu, and then click Add/Remove Snap-In. 18. From the Available snap-ins list, select Active Directory Schema, click Add, and then click OK. 19. Click the root node of the snap-in, Active Directory Schema. 20. Right-click Active Directory Schema, and then click Operations Master. The Change Schema Master dialog box appears. Question: Which DC holds the schema master role? 21. Click Close. 22. Close the console. You do not need to save any changes.

Task 2: Identify operations masters by using NetDom


1. Run Command Prompt with administrative credentials. 2. Type the command netdom query fsmo,and then press Enter. All operations master role holders are listed.
Results:In this exercise, you used both administrative snap-ins and NetDom to identify operations masters.

Exercise 2: Transfer Operations Master Roles


Task 1: Transfer the PDC role byusing the Active Directory Users And Computers snap-in
1. Run Active Directory Users and Computers with administrative credentials. 2. Right-click the domain name and click Change Domain Controller. 3. In the list of directory servers, select DC2.Emerson.local, and then click OK. Before transferring an operations master, you must connect tothe domain controller to which the role will be transferred. The root node of the snap-in indicates the domain controller to which you are connected: Active Directory Users and Computers [DC2.Emerson.local]. 4. Right-click thecontoso.com domain and click Operations Masters. 5. Click the PDC tab. The tab indicates that DC1. Emerson.local currently holds the role token. DC2.Emerson.local is listed in the second text box. 6. Click the Change button. An Active Directory Domain Services dialog box prompts you to confirm the transfer of the operations master role. 7. Click Yes. An Active Directory Domain Services dialog box confirms that the role was successfully transferred. 8. Click OK, and then click Close. At this point in a production environment, you would also transfer other FSMO roles held by DC1 to DC2 or other domain controllers. You would ensure that other roles performed by DC1DNS and global catalog, for examplewere covered by other servers. Then, you could takeDC1 offline. Remember that you cannot bring a domain controller back online if the RID, schema, or domain-naming roles have been seized. But you can bring it back online if a role was transferred.

Task 2: Consider other roles before taking a domain controller offline.


You are preparing to take DC1 offline. You have just transferred the PDC operations role to DC2. Question: List other operations master roles that must be transferred prior to taking DC1 offline. Answer: All other operations master roles held by DC1 should be transferred to DC2 or to other domain controllers prior to taking DC1 offline. Specifically, RID, Infrastructure, Domain Naming, and Schema master roles. Question: List other server roles that must be transferred prior to taking DC1 offline. Answer: You should consider other roles performed by DC1, such as DNS Server and global catalog. Ensure that these roles are covered by other servers or domain controllers prior to taking DC1 offline.

Lab 2: Configure Read-Only Domain Controllers


Exercise 1: Install an RODC
Task 1: Stage a delegated installation of an RODC.
1. Run Active Directory Users and Computers with administrative credentials. 2. In the console tree, expand the domain name, and then click the Domain Controllers OU. 3. Right-click Domain Controllers and click Pre-create Read-only Domain Controller Account. The Active Directory Domain Services Installation Wizard appears. 4. Click Next. 5. On the Operating System Compatibility page, click Next. 6. On the Network Credentials page, click Next.

7. On the Specify the Computer Name page, type BRANCHDC01 (2008Memberserver), and then click Next. 8. On the Select a Site page, click Next. 9. On the Additional Domain Controller Options page, click Next. Note that the Read-only domain controller option is selected and cannot be unselected. That is because you launched the wizard by choosing to precreate a read-only domain controller account. 10. On the Delegation of RODC Installation and Administration page, click the Set button. The Select User & Computerdialog box appears. 11. Type any user name, and then press Enter. 12. Click Next. 13. Review your selections on the Summary page, and then click Next. 14. On the Completing the Active Directory Domain Services Installation Wizard page, click Finish. Note that in the DC Type column, the new server is listed as an Unoccupied DC Account (Read-only, GC).

Task 2: Run the Active Directory Domain Services Installation Wizard on a workgroup server.
1. Start BRANCHDC01. 2. Log on to BRANCHDC01 as Administrator 3. Click Start, and then click Run. 4. Type dcpromo, and then press Enter. A window appears and informs you that the Active Directory Domain Services binaries are being installed. When installation is completed, the Active Directory Domain Services Installation Wizard appears. 5. Click Next. 6. On the Operating System Compatibility page, click Next. 7. On the Choose A Deployment Configuration page, click the Existing forest option, then click Add a domain controller to an existing domain, and then click Next. 8. On the Network Credentials page, type emerson.local. 9. Click Set. A Windows Security dialog box appears. 10. In the User Name box, type user name which was delegated. 11. In the Password box, enter password, and then press Enter. 12. Click Next. 13. On the Select a Domain page, select emerson.local, and then click Next. A message appears to inform you that your credentials do not belong to the Domain Admins or Enterprise Admins groups. Because you have prestaged and delegated administration of the RODC, you can proceed with the delegated credentials. 14. Click Yes. A message appears to inform you that the account for BRANCHDC01 has been prestaged in Active Directory as an RODC. 15. Click OK. 16. On the Location For Database, Log Files, and SYSVOL page, click Next. 17. On the Directory Services Restore Mode Administrator Password page, type Pa$$w0rd12345 in the Password and Confirm Password boxes, and then click Next. In a production environment, you should assign a complex and secure password to the Directory Services Restore Mode Administrator account. 18. On the Summary page, click Next. 19. In the progress window, select the Reboot On completion check box. After Active Directory Domain Services is installed on BRANCHDC01, the server reboots.
Results:In this exercise, you created a new RODC named BRANCHDC01 in the Emerson.local domain.

Lab 3: Advanced Configuration of DNS


Task 1: Enable scavenging of a DNS zone
1. Switch to DC1. 2. Run DNS Management with administrative credentials. 3. In the console tree, expand DC1 and Forward Lookup Zones, and then Click emerson.local. 4. Right-click emerson.local, and then click Properties. 5. On the General tab, click the Aging button. The Zone Aging/Scavenging Properties dialog box appears. 6. Select the Scavenge stale resource records check box. 7. Click OK. 8. Click OK to close the emerson.local Properties dialog box.

Exercise 2: Create Reverse Lookup Zones


Task 1: Create a reverse lookup zone
1. In the console tree, click Reverse Lookup Zones. 2. Right-click Reverse Lookup Zones, and then click New Zone. The New Zone Wizard appears. 3. Click Next. 4. On the Zone Type page, click Next. 5. On the Active Directory Zone Replication Scope page, clickTo all domain controllers in this domain(for Windows 2000 compatibility: emerson.local, and thenclick Next. 6. On the Reverse Lookup Zone Name page, click IPv4 Reverse Lookup Zone, and thenclick Next. 7. On the Reverse Lookup Zone Name page, in Network ID, type 10. Leave the other two octets empty. Click Next. 8. On the Dynamic Update page, click Allow only secure dynamic updates, and then click Next. 9. On the Completing the New Zone Wizard page, click Finish.

Task 2: Explore and verify the functionality of a reverse lookup zone


1. Run Command Prompt with administrative credentials 2. At the command prompt, type nslookup www.development.emerson.local,and then press Enter. 3. Note that the first section of the command output, which identifies the DNS server that was queried, indicates the IP address of the server but, next to Server, reports that the server is Unknown. That is because the nslookup.exe command cannot resolve the IP address to a name. 4. Switch to DNS Manager. 5. In the console tree, click the 10.in-addr.arpa zone under Reverse Lookup Zones. 6. Examine the records in the zone. 7. Switch to the command prompt. 8. Type ipconfig /registerdns, and then press Enter. 9. Switch to DNS Manager. 10. Right-click the 10.in-addr.arpa zone, and then clickRefresh. 11. Examine the resource records that have appeared. 12. Switch to the command prompt. 13. Type nslookup www.development.emerson.local,and then press Enter.Note that the first section of the command is now able to identify the server by both address and name.Note that the DNS server that was queried at 10.0.0.11 is now resolved to its name.
Results:In this exercise, you created and experienced the functionality of a reverse lookup zone.

Exercise 3: Explore Domain Controller Location


Task 1: Explore _tcp
1. Switch to DNS Manager. 2. In the console tree, expand DC1, Forward Lookup Zones, and Emerson.local, and then click the _tcp node. Question: What do the resource records in the details pane represent? Answer: The services offered by every domain controller in the contoso.com Domain

Lab 4: Configure Replication


Exercise 1: Create a Connection Object
Task :Create a connection object.
1. Run Active Directory Sites and Services with administrative credentials. 2. In the console tree, expand HQ-Building-2, Servers and DC2, and then click the NTDS Settings node below DC2. 3. Right-click NTDS Settings and click New Active Directory Domain Services Connection. 4. In the Find Active Directory Domain Controllers dialog box, select DC1, and then click OK. A warning appears asking if you want to create another connection. Because the Knowledge Consistency Checker (KCC) has already created a connection from DC1 to DC2, you are asked if you want to create a duplicate connection. The direct connection that you create will be persistent, whereas connections that are automatically generated by the KCC may be changed. You want to ensure the connection is always maintained. 5. Click Yes. 6. In the New Object Connection dialog box, type the name DC1 OPERATIONS MASTER, and click OK. . Right-click the -DC1 - OPERATIONS MASTER connection object under the NTDS settings object in the details pane, and then click Properties. Question: Examine the properties of the connection object. Do not make any changes. What partitions are replicated from DC1? Is DC2 a GC server? How can you tell? Answer: DC2 replicates the domain (emerson.local), Schema, and Configuration from DC1. It is also a global catalog server. The Partially Replicated Naming Context(s) property shows All other domains. This is another way of describing the forest's partial attribute set. 8. Click OK to close the Properties dialog box.
Results:In this exercise, you created a connection object to replicate changes from DC1 to DC2.

Lab 5: Back Up and Restore Active Directory


Make a full system backup

Exercise 1: Restore Active Directory and a Deleted OU


In this exercise, you will perform an authoritative restore of the AD DS database. You will then verify that the data is restored successfully. The main tasks are as follows: 1. Delete the Contractors OU. 2. Restart in the Directory Services Restore Mode (DSRM). 3. Restore System State data. 4. Mark the restored information as authoritative and restart the server. 5. Verify that the deleted data has been restored.

Task 1: Delete the Contractors OU.


1. On DC1, run Active Directory Users and Computers as an administrator, 2. Delete the Contractors OU within the User Accounts OU. 3. On DC2, run Active Directory Users and Computers as an administrator, 4. Verify that the domain controller has replicated the deletion of the Contractors OU.

Task 2: Restart in the Directory Services Restore Mode (DSRM).


1. On DC1, run the command prompt as an administrator, 2. Type bcdedit /set safeboot dsrepair to configure the server to start in Directory Services Restore Mode (DSRM). 3. Restart DC1.

Task 3: Restore System State data.


1. Log on as Administrator 2. Run the command prompt as an administrator. 3. Type wbadmin get versions -backuptarget:D: -machine: DC1 to get the version identifier for the backup. 4. Restore the System State information by typing wbadmin start systemstaterecovery -version:version-backuptarget:D: -machine: DC1. i.e. wbadmin start systemstaterecovery -version:01/22/2011-10:37 backuptarget:D: -machine: DC1 The restore will take about 30-35 minutes. 5. When prompted to restart, type Y, and then press Enter. 6. Log on to DC1 as Administrator. 7. Click Start, right-click Command Prompt, and then click Run as administrator.

Task 4: Mark the restored information as authoritative, and then restart the server.
1. At the command prompt, use NTDS to perform an authoritative restore of OU=Contractors,OU=User Accounts,DC=emerson,DC=local. 2. To restart the server normally after you perform the restore operation, type bcdedit /deletevalue safeboot, and then press Enter. 3. Restart the server.

Task 5: Verify that the deleted data has been restored.


1. After the server restarts, log on. 2. Run Active Directory Users and Computers as an administrator, 3. On DC2, refresh the view of Active Directory Users and Computers. Verify that the Contractors OU has also been restored on this domain controller.
Results: In this exercise, you performed an authoritative restore of Active Directory data to recover from the accidental deletion of an OU.