KCC

The KCC is a built-in process that runs on all domain controllers and generates replication
topology for the Active Directory forest. The KCC creates separate replication topologies
depending on whether replication is occurring within a site (intrasite) or between sites
(intersite). The KCC also dynamically adusts the topology to accommodate new domain
controllers! domain controllers moved to and from sites! changing costs and schedules! and
domain controllers that are temporarily unavailable.
How do you view replication properties for AD?
"y using Active Directory #eplication $onitor.
%tart&' #un&' #eplmon
What are sites What are they used for?
(ne or more well-connected (highly reliable and fast) TC)*+) subnets. A site allows
administrators to configure Active Directory access and replication topology to ta,e
advantage of the physical networ,.
Name some OU design considerations?
(- design re.uires balancing re.uirements for delegating administrative rights & independent
of /roup )olicy needs & and the need to scope the application of /roup )olicy. The
following (- design recommendations address delegation and scope issues0
Applying /roup )olicy An (- is the lowest-level Active Directory container to which you
can assign /roup )olicy settings. Delegating administrative authority usually don1t go more
than 2 (- levels
http0**technet.microsoft.com*en-us*library*cc342567.asp8
What are !"O #oles? $ist them%
9smo roles are server roles in a 9orest
There are five types of 9%$( roles
5-%chema master
:-Domain naming master
2-#id master
6-)DC ;mullator
<-+nfrastructure master
$ogical Diagram of Active Directory ?& What is the difference 'etween child domain (
additional domain "erver?
=ell! if you ,now what a domain is then you have half the answer. %ay you have the domain
$icrosoft.com. >ow microsoft has a server named server5 in that domain! which happens to
the be parent domain. %o it1s 9?D> is server5.microsoft.com. +f you add an additional
domain server and name it server:! then it1s 9?D> is server:.microsoft.com.
>ow $icrosoft is big so it has offices in ;urope and Asia. %o they ma,e child domains for
them and their 9?D> would loo, li,e this0 europe.microsoft.com @ asia.microsoft.com. >ow
lets say each of them have a server in those child domains named server5. Their 9?D>
would then loo, li,e this0 server5.europe.microsoft.com @ server5.asia.microsoft.com..
What are Active Directory )roups?
/roups are containers that contain user and computer obects within them as members. =hen
security permissions are set for a group in the Access Control Aist on a resource! all members
of that group receive those permissions. Domain /roups enable centraliBed administration in
a domain. All domain groups are created on a domain controller.
+n a domain! Active Directory provides support for different types of groups and group
scopes. The group type determines the type of tas, that you manage with the group. The
group scope determines whether the group can have members from multiple domains or a
single domain.
)roup *ypes
C "ecurity groups0 -se %ecurity groups for granting permissions to gain access to resources.
%ending an e-mail message to a group sends the message to all members of the group.
Therefore security groups share the capabilities of distribution groups.
C Distri'ution groups0 Distribution groups are used for sending e-main messages to groups
of users. Dou cannot grant permissions to security groups. ;ven though security groups have
all the capabilities of distribution groups! distribution groups still re.uires! because some
applications can only read distribution groups.
)roup "copes
/roup scope normally describe which type of users should be clubbed together in a way
which is easy for there administration. Therefore! in domain! groups play an important part.
(ne group can be a member of other group(s) which is normally ,nown as /roup nesting.
(ne or more groups can be member of any group in the entire domain(s) within a forest.
C Domain $ocal )roup0 -se this scope to grant permissions to domain resources that are
located in the same domain in which you created the domain local group. Domain local
groups can e8ist in all mi8ed! native and interim functional level of domains and forests.
Domain local group memberships are not limited as you can add members as user accounts!
universal and global groups from any domain. Eust to remember! nesting cannot be done in
domain local group. A domain local group will not be a member of another Domain Aocal or
any other groups in the same domain.
C )lo'al )roup0 -sers with similar function can be grouped under global scope and can be
given permission to access a resource (li,e a printer or shared folder and files) available in
local or another domain in same forest. To say in simple words! /lobal groups can be use to
grant permissions to gain access to resources which are located in any domain but in a single
forest as their memberships are limited. -ser accounts and global groups can be added only
from the domain in which global group is created. >esting is possible in /lobal groups within
other groups as you can add a global group into another global group from any domain.
9inally to provide permission to domain specific resources (li,e printers and published
folder)! they can be members of a Domain Aocal group. /lobal groups e8ist in all mi8ed!
native and interim functional level of domains and forests.
C Universal )roup "cope0 these groups are precisely used for email distribution and can be
granted access to resources in all trusted domain as these groups can only be used as a
security principal (security group type) in a windows :777 native or windows server :772
domain functional level domain. -niversal group memberships are not limited li,e global
groups. All domain user accounts and groups can be a member of universal group. -niversal
groups can be nested under a global or Domain Aocal group in any domain.
What are the types of 'ac+up? ,-plain each?
+ncremental
A FnormalG incremental bac,up will only bac, up files that have been changed since the last
bac,up of any type. This provides the .uic,est means of bac,up! since it only ma,es copies
of files that have not yet been bac,ed up. 9or instance! following our full bac,up on 9riday!
$onday1s tape will contain only those files changed since 9riday. Tuesday1s tape contains
only those files changed since $onday! and so on. The downside to this is obviously that in
order to perform a full restore! you need to restore the last full bac,up first! followed by each
of the subse.uent incremental bac,ups to the present day in the correct order. %hould any one
of these bac,up copies be damaged (particularly the full bac,up)! the restore will be
incomplete.
Differential
A cumulative bac,up of all changes made after the last full bac,up. The advantage to this is
the .uic,er recovery time! re.uiring only a full bac,up and the latest differential bac,up to
restore the system. The disadvantage is that for each day elapsed since the last full bac,up!
more data needs to be bac,ed up! especially if a maority of the data has been changed.
What is the "."/O$ folder?
The =indows %erver :772 %ystem Holume (%D%H(A) is a collection of folders and reparse
points in the file systems that e8ist on each domain controller in a domain. %D%H(A provides
a standard location to store important elements of /roup )olicy obects (/)(s) and scripts so
that the 9ile #eplication service (9#%) can distribute them to other domain controllers within
that domain.
Dou can go to %D%H(A folder by typing 0 IsystemrootI*sysvol
What is the 0"*) Who has that role 'y default?
The first server in the site becomes the +%T/ for the site! The domain controller holding this
role may not necessarily also be a bridgehead server.
What is the order in which )1Os are applied?
Aocal! %ite! Domain! (-
2% Can a wor+station computer 'e configured to 'rowse the 0nternet and yet NO* have
a default gateway?
+f we are using public ip address! we can browse the internet. +f it is having an intranet
address a gateway is needed as a router or firewall to communicate with internet.
3% What is C0D#?
C+D# (Classless +nter-Domain #outing! sometimes ,nown as supernetting) is a way to
allocate and specify the +nternet addresses used in inter-domain routing more fle8ibly than
with the original system of +nternet )rotocol (+)) address classes. As a result! the number of
available +nternet addresses has been greatly increased. C+D# is now the routing system used
by virtually all gateway hosts on the +nternet1s bac,bone networ,. The +nternet1s regulating
authorities now e8pect every +nternet service provider (+%)) to use it for routing.
4% What is DHC1? What are the 'enefits and draw'ac+s of using it?
DJC) is Dynamic Jost Configuration )rotocol. +n a networ,ed environment it is a method
to assign an Kaddress1 to a computer when it boots up.
Advantages
All the +) configuration information gets automatically configured for your client machine by
the DJC) server.
+f you move your client machine to a different subnet! the client will send out its discover
message at boot time and wor, as usual. Jowever! when you first boot up there you will not
be able to get bac, the +) address you had at your previous location regardless of how little
time has passed.
Disadvantage
Dour machine name does not change when you get a new +) address. The D>% (Domain
>ame %ystem) name is associated with your +) address and therefore does change. This only
presents a problem if other clients try to access your machine by its D>% name.
5% How do you manually create "#/ records in DN"?
To create %#H records in D>% do below steps0 -
(pen D>%
Clic, on Lone M& %elect domain abc.local MM-
#ight Clic, to domain and go to (ther >ew #ecordsMM
And choose service location (%#H)
6% Name 4 'enefits of using AD7integrated 8ones%
"enefits as follows
a. you can give easy name resolution to ur clients.
b. "y creating AD- integrated Bone you can also trace hac,er and spammer by creating
reverse Bone.
c. AD integrated Boned all for incremental Bone transfers which on transfer changes and not
the entire Bone. This reduces Bone transfer traffic.
d. AD +ntegrated Bones suport both secure and dmanic updates.
e. AD integrated Bones are stored as part of the active directory and support domain-wide or
forest-wide replication through application pertitions in AD.
N. Jow do + clear the D>% cache on the D>% serverO
/o to cmd prompt and type Fipconfig*flushdnsG without .uotes
9% What is NA*?
>AT (>etwor, Address Translation) is a techni.ue for preserving scarce +nternet +)
addresses. 9or more details go to $icrosoft lin,
:% How do you configure NA* on Windows 3;;4?
9or above answer go to below lin,
Configure >AT
<% How to configure special ports to allow in'ound connections?
a. Clic, %tart! Administrative Tools! and then clic, #outing and #emote Access to open the
#outing and #emote Access management console.
b. Aocate the interface that you want to configure.
c. #ight-clic, the interface and then select )roperties from the shortcut menu.
d. Clic, the %pecial )orts tab.
e. -nder )rotocol! select TC) or -D) and then clic, the Add button.
f. ;nter the port number of the incoming traffic in +ncoming )ort.
g. %elect (n This Address )ool ;ntry! and provide the public +) address of the incoming
traffic.
h. ;nter the port number of the private networ, resource in (utgoing )ort.
i. ;nter the private networ, resource1s private +) address in )rivate Address.
. Clic, (K.
DN" 0nterview =uestions and Answer
5. %ecure services in your networ, re.uire reverse name resolution to ma,e it more
difficult to launch successful attac,s against the services. To set this up! you configure
a reverse loo,up Bone and proceed to add records. =hich record types do you need to
createO
:. =hat is the main purpose of a D>% serverO
2. %(A records must be included in every Bone. =hat are they used forO
6. "y default! if the name is not found in the cache or local hosts file! what is the first
step the client ta,es to resolve the 9?D> name into an +) addressO
<. =hat is the main purpose of %#H recordsO
N. "efore installing your first domain controller in the networ,! you installed a D>%
server and created a Bone! naming it as you would name your AD domain. Jowever!
after the installation of the domain controller! you are unable to locate infrastructure
%#H records anywhere in the Bone. =hat is the most li,ely cause of this failureO
3. =hich of the following conditions must be satisfied to configure dynamic D>%
updates for legacy clientsO
4. At some point during the name resolution process! the re.uesting party received
authoritative reply. =hich further actions are li,ely to be ta,en after this replyO
P. Dour company uses ten domain controllers! three of which are also used as D>%
servers. Dou have one companywide AD-integrated Bone! which contains several
thousand resource records. This Bone also allows dynamic updates! and it is critical to
,eep this Bone up-to-date.
#eplication between domain controllers ta,es up a significant amount of bandwidth.
Dou are loo,ing to cut bandwidth usage for the purpose of replication. =hat should
you doO
57. Dou are administering a networ, connected to the +nternet. Dour users complain that
everything is slow. )reliminary research of the problem indicates that it ta,es a
considerable amount of time to resolve names of resources on the +nternet. =hat is
the most li,ely reason for thisO
AnswersQQQQQQQ.
5. )T# #ecords
:. D>% servers are used to resolve 9?D> hostnames into +) addresses and vice versa
2. %(A records contain a TTA value! used by default in all resource records in the Bone.
%(A records contain the e-mail address of the person who is responsible for
maintaining the Bone. %(A records contain the current serial number of the Bone!
which is used in Bone transfers.
6. )erforms a recursive search through the primary D>% server based on the networ,
interface configuration
<. %#H records are used in locating hosts that provide certain networ, services.
N. The Bone you created was not configured to allow dynamic updates. The local
interface on the D>% server was not configured to allow dynamic updates.
3. The Bone to be used for dynamic updates must be configured to allow dynamic
updates. The DJC) server must support! and be configured to allow! dynamic
updates for legacy clients.
4. After receiving the authoritative reply! the resolution process is effectively over.
P. Change the replication scope to all D>% servers in the domain.
57. D>% servers are not caching replies.. Aocal client computers are not caching repliesQ
The cache.dns file may have been corrupted on the server.
2%What are some of the new tools and features provided 'y Windows "erver
3;;:?
=indows %erver :774 now provides a des,top environment similar to $icrosoft
=indows Hista and includes tools also found in Hista! such as the new bac,up snap-
in and the "itAoc,er drive encryption feature. =indows %erver :774 also provides the
new ++%3 web server and the =indows Deployment %ervice.
3%What are the different editions of Windows "erver 3;;:?
The entry-level version of =indows %erver :774 is the %tandard ;dition. The
;nterprise ;dition provides a platform for large enterprisewide networ,s. The
Datacenter ;dition provides support for unlimited Jyper-H virtualiBation and
advanced clustering services. The =eb ;dition is a scaled-down version of =indows
%erver :774 intended for use as a dedicated web server. The %tandard! ;nterprise! and
Datacenter ;ditions can be purchased with or without the Jyper-H virtualiBation
technology.
What two hardware considerations should 'e an important part of the planning
process for a Windows "erver 3;;: deployment?
Any server on which you will install =indows %erver :774 should have at least the
minimum hardware re.uirement for running the networ, operating system. %erver
hardware should also be on the =indows %erver :774 Jardware Compatibility Aist to
avoid the possibility of hardware and networ, operating system incompatibility.
What are the options for installing Windows "erver 3;;:?
Dou can install =indows %erver :774 on a server not currently configured with >(%!
or you can upgrade e8isting servers running =indows :777 %erver and =indows
%erver :772.
How do you configure and manage a Windows "erver 3;;: core installation?
This stripped-down version of =indows %erver :774 is managed from the command
line.
Which Control 1anel tool ena'les you to automate the running of server utilities
and other applications?
The Tas, %cheduler enables you to schedule the launching of tools such as =indows
"ac,up and Dis, Defragmenter.
What are some of the items that can 'e accessed via the "ystem 1roperties dialog
'o-?
Dou can access virtual memory settings and the Device $anager via the %ystem
)roperties dialog bo8.
When a child domain is created in the domain tree& what type of trust
relationship e-ists 'etween the new child domain and the trees root domain?
Child domains and the root domain of a tree are assigned transitive trusts. This means
that the root domain and child domain trust each other and allow resources in any
domain in the tree to be accessed by users in any domain in the tree.
What is the primary function of domain controllers?
The primary function of domain controllers is to validate users to the networ,.
Jowever! domain controllers also provide the catalog of Active Directory obects to
users on the networ,.
What are some of the other roles that a server running Windows "erver 3;;:
could fill on the networ+?
A server running =indows %erver :774 can be configured as a domain controller! a
file server! a print server! a web server! or an application server. =indows servers can
also have roles and features that provide services such as D>%! DJC)! and #outing
and #emote Access.
Which Windows "erver 3;;: tools ma+e it easy to manage and configure a
servers roles and features?
The %erver $anager window enables you to view the roles and features installed on a
server and also to .uic,ly access the tools used to manage these various roles and
features. The %erver $anager can be used to add and remove roles and features as
needed.
What Windows "erver 3;;: service is used to install client operating systems
over the networ+?
=indows Deployment %ervices (=D%) enables you to install client and server
operating systems over the networ, to any computer with a )R;-enabled networ,
interface.
What domain services are necessary for you to deploy the Windows Deployment
"ervices on your networ+?
=indows Deployment %ervices re.uires that a DJC) server and a D>% server be
installed in the domain
How is WD" configured and managed on a server running Windows "erver
3;;:?
The =indows Deployment %ervices snap-in enables you to configure the =D% server
and add boot and install images to the server.
What is the difference 'etween a 'asic and dynamic drive in the Windows "erver
3;;: environment?
A basic dis, embraces the $%-D(% dis, structureS a basic dis, can be divided into
partitions (simple volumes).
Dynamic dis,s consist of a single partition that can be divided into any number of
volumes. Dynamic dis,s also support =indows %erver :774 #A+D implementations.
What is #A0D in Windows "erver 3;;:?
#A+D! or #edundant Array of +ndependent Dis,s! is a strategy for building fault
tolerance into your file servers. #A+D enables you to combine one or more volumes
on separate drives so that they are accessed by a single drive letter. =indows %erver
:774 enables you to configure #A+D 7 (a striped set)! #A+D 5 (a mirror set)! and
#A+D < (dis, striping with parity).
What conceptual model helps provide an understanding of how networ+
protocol stac+s such as *C1>01 wor+?
The (%+ model! consisting of the application! presentation! session! transport!
networ,! data lin,! and physical layers! helps describe how data is sent and received
on the networ, by protocol stac,s.
What protocol stac+ is installed 'y default when you install Windows "erver
3;;: on a networ+ server?
TC)*+) (v6 and vN) is the default protocol for =indows %erver :774. +t is re.uired for
Active Directory implementations and provides for connectivity on heterogeneous
networ,s.
How is a server running Windows "erver 3;;: configured as a domain
controller& such as the domain controller for the root domain or a child domain?
+nstalling the Active Directory on a server running =indows %erver :774 provides
you with the option of creating a root domain for a domain tree or of creating child
domains in an e8isting tree. +nstalling Active Directory on the server ma,es the server
a domain controller.
What are some of the tools used to manage Active Directory o'?ects in a
Windows "erver 3;;: domain?
=hen the Active Directory is installed on a server (ma,ing it a domain controller)! a
set of Active Directory snap-ins is provided. The Active Directory -sers and
Computers snap-in is used to manage Active Directory obects such as user accounts!
computers! and groups. The Active Directory Domains and Trusts snap-in enables
you to manage the trusts that are defined between domains. The Active Directory
%ites and %ervices snap-in provides for the management of domain sites and subnets.
How are domain user accounts created and managed?
The Active Directory -sers and Computers snap-in provides the tools necessary for
creating user accounts and managing account properties. )roperties for user accounts
include settings related to logon hours! the computers to which a user can log on! and
the settings related to the user1s password.
What type of Active Directory o'?ects can 'e contained in a group?
A group can contain users! computers! contacts! and other nested groups.
What type of group is not availa'le in a domain that is running at the mi-ed7
mode functional level?
-niversal groups are not available in a mi8ed-mode domain. The functional level
must be raised to =indows :772 or =indows :774 to ma,e these groups available.
What types of Active Directory o'?ects can 'e contained in an Organi8ational
Unit?
(rganiBational -nits can hold users! groups! computers! contacts! and other (-s. The
(rganiBational -nit provides you with a container directly below the domain level
that enables you to refine the logical hierarchy of how your users and other resources
are arranged in the Active Directory.
What are Active Directory sites in Windows "erver 3;;:?
Active Directory sites are physical locations on the networ,1s physical topology. ;ach
regional domain that you create is assigned to a site. %ites typically represent one or
more +) subnets that are connected by +) routers. "ecause sites are separated from
each other by a router! the domain controllers on each site periodically replicate the
Active Directory to update the /lobal Catalog on each site segment.
Can servers running Windows "erver 3;;: provide services to clients when they
are not part of a domain?
%ervers running =indows %erver :774 can be configured to participate in a
wor,group. The server can provide some services to the wor,group peers but does not
provide the security and management tools provided to domain controllers.
What does the use of )roup 1olicy provide you as a networ+ administrator?
/roup )olicy provides a method of controlling user and computer configuration
settings for Active Directory containers such as sites! domains! and (-s. /)(s are
lin,ed to a particular container! and then individual policies and administrative
templates are enabled to control the environment for the users or computers within
that particular container.
What tools are involved in managing and deploying )roup 1olicy?
/)(s and their settings! lin,s! and other information such as permissions can be
viewed in the /roup )olicy $anagement snap-in.
How do you deal with )roup 1olicy inheritance issues?
/)(s are inherited down through the Active Directory tree by default. Dou can bloc,
the inheritance of settings from upline /)(s (for a particular container such as an (-
or a local computer) by selecting "loc, +nheritance for that particular obect. +f you
want to enforce a higher-level /)( so that it overrides directly lin,ed /)(s! you can
use the ;nforce command on the inherited (or upline) /)(.
How can you ma+e sure that networ+ clients have the most recent Windows
updates installed and have other important security features such as the
Windows irewall ena'led 'efore they can gain full networ+ access?
Dou can configure a >etwor, )olicy %erver (a service available in the >etwor, )olicy
and Access %ervices role). The >etwor, )olicy %erver can be configured to compare
des,top client settings with health validators to determine the level of networ, access
afforded to the client.
What is the purpose of deploying local DN" servers?
A domain D>% server provides for the local mapping of fully .ualified domain names
to +) addresses. "ecause the D>% is a distributed database! the local D>% servers can
provide record information to remote D>% servers to help resolve remote re.uests
related to fully .ualified domain names on your networ,.
0n terms of DN"& what is a caching7only server?
A caching-only D>% server supplies information related to .ueries based on the data
it contains in its D>% cache. Caching-only servers are often used as D>% forwarders.
"ecause they are not configured with any Bones! they do not generate networ, traffic
related to Bone transfers.
How the range of 01 addresses is defined for a Windows "erver 3;;: DHC1
server?
The +) addresses supplied by the DJC) server are held in a scope. A scope that
contains more than one subnet of +) addresses is called a superscope. +) addresses in a
scope that you do not want to lease can be included in an e8clusion range.
,-change "erver 3;;9 0nterview =uestion and Answer
What is ,-change "erver 3;;9?
$icrosoft ;8change %erver :773 is the ne8t version of $icrosoft ;8change.
$icrosoft ;8change is the industry1s leading e-mail! calendaring! and unified
messaging server. The release of ;8change %erver :773 is closely aligned with the
:773 $icrosoft (ffice release. Together! these products deliver a best-in-class
enterprise messaging and collaboration solution.
What is new in ,-change "erver 3;;9?
;8change :773 provides built-in protection to ,eep the e-mail system up and running
and protected from outside threats and lets employees wor, more productively from
wherever they are by using a variety of clients. These clients include $icrosoft (ffice
(utloo, :773! $icrosoft (ffice (utloo, =eb Access! and mobile devices. ;8change
%erver :773 ma,es it easier for +T departments to deliver these new capabilities to
their organiBations by ma,ing the messaging environment easier to manage and more
cost-efficient. 9or more information about ;8change %erver :773
How does ,-change "erver 3;;9 integrate with !icrosoft Office Outloo+ 3;;9?
(utloo, :773 provides the most complete e-mail! calendaring! contacts! and tas,s
functionality available in an e-mail client that is compatible with ;8change. =hen
(utloo, :773 is used with ;8change %erver :773! users benefit from the new
%cheduling Assistant that automates time-consuming meeting and resource
scheduling! the ability to plan and customiBe out-of-office communications! and
managed e-mail folders that facilitate compliance with internal and regulatory
policies. (utloo, :773 and ;8change %erver :773 also combine to enhance security
by offering features that are easy to use and let users confidently send and receive
sensitive business communications through e-mail. "y enabling the Autodiscover
service! you can reduce the comple8ity of client configuration and reduce
administrative costs that are associated with troubleshooting connectivity issues for
users.
What are the different editions of ,-change "erver 3;;9?
;8change %erver :773 is offered in two server editions0 %tandard ;dition and
;nterprise ;dition. ;8change %erver :773 %tandard ;dition is designed to meet the
messaging and collaboration needs of small and medium organiBations. +t may also be
appropriate for specific server roles or branch offices. ;8change %erver :773
;nterprise ;dition! designed for large enterprise organiBations! enables the creation of
multiple storage groups and databases. 9or more information about ;8change %erver
:773 editions and Client Access Aicenses
How can 0 upgrade my current ,-change 3;;; "erver or ,-change "erver 3;;4
environment?
=hen you upgrade to ;8change %erver :773! you cannot perform an in-place server
upgrade on an e8isting ;8change server. +nstead! you must install a new ;8change
:773 server into the e8isting organiBation! and then move the re.uired data to the new
;8change server. ;8change %erver :773 supports mi8ed environments that include
;8change :777 %erver! ;8change %erver :772! or both. This allows for an easier and
more gradual transition. 9or more information about how to plan and deploy
;8change %erver :773
"hould 0 map my current routing groups to my current Active Directory sites?
;8change :773 is based on Active Directory sites. +f your current $icrosoft
;8change environment maps as closely as possible to Active Directory sites! your
interoperability and migration story will be easier. Additionally! the recommended
upgrade path is to upgrade all the ;8change :777 %erver or ;8change %erver :772
servers in a single routing group before you upgrade the ne8t routing group. This lets
you fully decommission a routing group as you upgrade and reduces the comple8ity
of your current routing topology. $apping the ;8change :777 %erver or ;8change
%erver :772 routing groups to the ;8change :773 physical topology also ma,es it
easier to plan for an upgrade to ;8change :773 because the two environments are
similarly organiBed and generally correlate to Active Directory sites.