Active Directory

Active Directory

Q. What is Directory Service?

A. Directory service is a software application that stores and organizes information of networked computers, users, and network resources, and that allows network administrators to manage users’ access the resources.

Q. What is Active Directory?

A. Active Directory is an implementation of LDAP directory services. Active Directory allows administrators to assign enterprise-wide policies, deploy programs to many computers, and apply critical updates to an entire organization. Active Directory stores information and settings related to an organization in a central, organized, accessible database. Active Directory networks can vary from a small installation with a few hundred objects, to a large installation with millions of objects.

Q. What is Active Directory Services?

A.  Active Directory is a directory service used to store information about the network resources across a domain.

Q. What are components of Active Directory (Hierarchy)?

A. Components of Active Directory are Domain, Forest, Tree, Organizational Unit, Schema, Group Policy Objects and Global Catalog.

Q. What is Tree (Logical Component)?

A. Domain trees is a hierarchical grouping of one or more domains that share a single DNS namespace & have one or more child domain and are connected by transitive trust relationship. Example: ttsl.com is root and mah.ttsl.com is child.

Q. What is Forest (Logical Component)?

A. A forest is a group of one or more domain trees which share a common schema and global catalog. There is always at least one forest on a network, and it is created when the first Active Directory (domain controller) installed on a network.

This first domain in a forest, called the forest root domain, is special because it holds the schema and controls domain naming for the entire forest. It cannot be removed from the forest without removing the entire forest itself. Also, no other domain can ever be created above the forest root domain in the forest domain hierarchy.

Q. What is Domain (Logical Component)?

A. A Domain is a logical grouping of networked computers in which more than one computer has shared resources. (Domains are the fundamental units that make up Active Directory).

Q. What is OU (Logical Component)?

A. OU is administrative-level container object in ADS that organize users, computers, groups and other organizational units together so that any changes, security privileges or any other administrative tasks could be accomplished more efficiently.

Q. What is Domain Controller (Physical Component)?

A.  Domain Controllers are the physical storage location for the Active Directory Services Database.

Q. What is Sites (Physical Component)?

A.  A Site is a physical component of Active Directory that is used to define and represent the physical topology of a network.

Q. What is Object?

A. Active Directory objects are the entities that make up a network. An object is a distinct, named set of attributes that represents something concrete, such as a user, a printer, or an application. For example, when we create a user object, Active Directory assigns the globally unique identifier (GUID), and we provide values for such attributes as the user's given name, surname, the logon identifier, and so on.

Q. What is Schema?

A. The schema defines the type of objects and the attributes that each object has. The schema is what defines a user account for example. A user account must have a name, a password, and a unique SID. A user account can also have many additional attributes, such as location, address, phone number, e-mail addresses, terminal services profiles, and so on.

Q. What is Schema Class & Attributes?

A.  Every directory object you create is an instance of an object class contained in the schema. Each object class contains a list of associated attributes that determine the information the object can contain. Classes and attributes are defined independently, so that a single attribute can be associated with multiple classes. All schema classes and attributes are defined by the classSchema and attributeSchema objects, respectively.

Q. What is Global Catalog?

A  Global catalog is a domain controller that stores a copy of all Active Directory objects in a forest. The global catalog stores a full copy of all objects in the directory for its host domain and a partial copy of all objects for all other domains in the forest.

Q. What is Universal Group Membership Cache?

A.     In a forest that has more than one domain, in sites that have domain users but no global catalog server, Universal Group Membership Caching can be used to enable caching of logon credentials so that the global catalog does not have to be contacted for subsequent user logons.

Q. What is LDAP?

A. LDAP stands for Lightweight Directory Access Protocol is a networking protocol for querying and modifying directory services running over TCP/IP.  And the TCP port for LDAP is 389. LDAP Version 5.

Q. What are IIS services?

A.  IIS services are used to publish web based applications.

What is TCP/IP port no for Global Catalog? 3268
What is TCP/IP port no for LDAP? 389
What is TCP/IP port no for RDP? 3389
What is the TCP/IP port no for SNMP? 161,162
What is the TCP/IP port no for SMTP? 25
What is the TCP/IP port no for POP3? 110
What is the TCP/IP port no for IMAP? 143
What is the TCP/IP port no for HTTP? 80
What is the TCP/IP port no for HTTPS? 443

Q. What are important operations roles in Active Directory?

A. In a forest, there are at least five FSMO roles that are assigned to one or more domain controllers. The five FSMO roles are:

•	Schema Master: The schema master domain controller controls all updates and modifications to the schema. To update the schema of a forest, you must have access to the schema master. There can be only one schema master in the whole forest.
•	Domain Naming Master: The domain naming master domain controller controls the addition or removal of domains in the forest. There can be only one domain naming master in the whole forest.
•	Infrastructure Master: Responsible for maintaining all inter-domain object references. In other words, the infrastructure master informs certain objects (such as groups) that other objects (such as users in another domain) have been moved, changed, or otherwise modified. This update is needed only in a multiple-domain environment.
•	Relative ID (RID) Master: The RID master is responsible for processing RID pool requests from all domain controllers in a particular domain. At any one time, there can be only one domain controller acting as the RID master in the domain.
•	PDC Emulator: Used whenever a domain contains non–Active Directory computers. It acts as a Windows NT primary domain controller (PDC) for legacy client operating systems, as well as for Windows NT backup domain controllers (BDCs). The PDC emulator also processes password changes and receives preferential treatment within the domain for password updates. If another domain controller is unable to authenticate a user because of a bad password, the request is forwarded to the PDC emulator. The PDC emulator performs this additional (and important) operations master role whether or not there are any BDCs in the domain.

You can transfer FSMO roles by using the Ntdsutil.exe command-line utility or by using an MMC snap-in tool. Depending on the FSMO role that you want to transfer, you can use one of the following three MMC snap-in tools:

Q. How can we view All FSMO roles using command prompt?
A. Ntdsutil.exe

Q. How can we transfer Schema Master Role?

A. Transfer the Schema Master Role

Use the Active Directory Schema Master snap-in to transfer the schema master role. Before you can use this snap-in, you must register the Schmmgmt.dll file.
Register Schmmgmt.dll

1.	Click Start, and then click Run.
2.	Type regsvr32 schmmgmt.dll in the Open box, and then click OK.
3.	Click OK when you receive the message that the operation succeeded.

Transfer the Schema Master Role

1.	Click Start, click Run, type mmc in the Open box, and then click OK.
2.	On the File, menu click Add/Remove Snap-in.
3.	Click Add.
4.	Click Active Directory Schema, click Add, click Close, and then click OK.
5.	In the console tree, right-click Active Directory Schema, and then click Change Domain Controller.
6.	Click Specify Name, type the name of the domain controller that will be the new role holder, and then click OK.
7.	In the console tree, right-click Active Directory Schema, and then click Operations Master.
8.	Click Change.
9.	Click OK to confirm that you want to transfer the role, and then click Close.

Q. How can we transfer Domain naming Master?

A. Transfer the Domain Naming Master Role

1.	Click Start, point to Administrative Tools, and then click Active Directory Domains and Trusts.
2.	Right-click Active Directory Domains and Trusts, and then click Connect to Domain Controller. NOTE: You must perform this step if you are not on the domain controller to which you want to transfer the role. You do not have to perform this step if you are already connected to the domain controller whose role you want to transfer.
3.	Do one of the following: • In the Enter the name of another domain controller box, type the name of the domain controller that will be the new role holder, and then click OK. -or- • In the Or, select an available domain controller list, click the domain controller that will be the new role holder, and then click OK.
4.	In the console tree, right-click Active Directory Domains and Trusts, and then click Operations Master.
5.	Click Change.
6.	Click OK to confirm that you want to transfer the role, and then click Close.

Q. How can we transfer PDC Emulator, RID Master, Infrastructure Master?

A. Transfer the RID Master, PDC Emulator, and Infrastructure Master Roles

1.	Click Start, point to Administrative Tools, and then click Active Directory Users and Computers.
2.	Right-click Active Directory Users and Computers, and then click Connect to Domain Controller. NOTE: You must perform this step if you are not on the domain controller to which you want to transfer the role. You do not have to perform this step if you are already connected to the domain controller whose role you want to transfer.
3.	Do one of the following: • In the Enter the name of another domain controller box, type the name of the domain controller that will be the new role holder, and then click OK. -or- • In the Or, select an available domain controller list, click the domain controller that will be the new role holder, and then click OK.
4.	In the console tree, right-click Active Directory Users and Computers, point to All Tasks, and then click Operations Master.
5.	Click the appropriate tab for the role that you want to transfer (RID, PDC, or Infrastructure), and then click Change.
6.	Click OK to confirm that you want to transfer the role, and then click Close.

Q. What will happen if Schema Master fails?

A. No updates to the Active Directory schema will be possible. Since schema updates are rare (usually done by certain applications and possibly an Administrator adding an attribute to an object), then the malfunction of the server holding the Schema Master role will not pose a critical problem.

Q. What will happen if Domain Naming Master fails?

A. Domain Naming Master must be available when adding or removing a domain from the forest (i.e. running DCPROMO). If it is not, then the domain cannot be added or removed.  It is also needed when promoting or demoting a server to/from a Domain Controller.  Like the Schema Master, this functionality is only used on occasion and is not critical unless you are modifying your domain or forest structure.

         
Q. What will happen if RID Master fails?

A. RID Master provides RIDs for security principles (users, groups, computer accounts). The failure of this FSMO server would have little impact unless you are adding a very large number of users or groups.      

Each DC in the domain has a pool of RIDs already, and a problem would occur only if the DC you adding the users/groups on ran out of RIDs.

Q. What will happen if PDC Emulator fails?

A. The server holding the PDC emulator role will cause the most problems if it is unavailable.  This would be most noticeable in a mixed mode domain where you are still running NT 4 BDCs and if you are using down-level clients (NT and Win9x). Since the PDC emulator acts as a NT 4 PDC, then any actions that depend on the PDC would be affected (User Manager for Domains, Server Manager, changing passwords, browsing and BDC replication).  

In a native mode domain the failure of the PDC emulator isn't as critical because other domain controllers can assume most of the responsibilities of the PDC emulator.

Q. What will happen if Infrastructure Master fails?

A. This FSMO server is only relevant in a multi-domain environment. If you only have one domain, then the Infrastructure Master is irrelevant.  Failure of this server in a multi-domain environment would be a problem if you are trying to add objects from one domain to another.    

Q. What are the basic requirements (Hardware/Software) to implement the Windows ADS server?

A. Minimum requirements:

Processor: Single 550 MHz PIII or comparable

Memory: 512 MB of RAM

Hard Disks: Two 9 GB - Mirrored

Network: 100 Megabit Ethernet

Systems: 2 Windows 2000 SP4 Servers- Redundancy

Recommended requirement Processor: Dual Intel Xeon or comparable

Memory: 1 GB of RAM

Hard Disks: Three 9 GB - RAID5

Network: 100 Megabit Ethernet

Systems: 2 Windows 2000 SP4 Servers- Redundancy

Desktop/Member Server Requirements:

Windows desktop OS should be at least Windows 2000 and have hardware to support such to receive benefit from the GTAD service.

Windows member servers should be at the Windows 2000 level and have hardware to support such.

Q. What is GROUPS?

A. Groups are Active Directory (or local computer) objects that can contain users, contacts, computers, and other groups. In Windows 2003, groups are created in domains, using the Active Directory Users and Computers tool. You can create groups in the root domain, in any other domain in the forest, in any organizational unit, or in any container class object (such as the default Users container). Like user and computer accounts, groups are Windows 2000 security principals; they are directory objects to which SID’s are assigned at creation.

Q. What is Distribution Group?

A. These are used for non-security purposes by applications other than Windows. One of the primary uses is within an e-mail.

As with user accounts, there are both local and domain-level groups. Local groups are stored in a local computer’s security database and are intended to control resource access on that computer. Domain groups are stored in Active Directory and let you gather users and control resource access in a domain and on domain controllers.

Q. What is Security Groups?

A. Security groups are used to group domain users into a single administrative unit. Security groups can be assigned permissions and can also be used as e-mail distribution lists. Users placed into a group inherit the permissions assigned to the group for as long as they remain members of that group. Windows itself uses only security groups.

Q. What is Global Group?

A. Global groups are used to gather users that have similar permissions requirements. Global groups have the following characteristics:

1. Global groups can contain user and computer accounts only from the domain in which the global group is created.

2. When the domain functional level is set to Windows 2000 native or Windows Server 2003 (i.e., the domain contains only Windows 2000 or 2003 servers), global groups can also contain other global groups from the local domain.

3. Global groups can be assigned permissions or be added to local groups in any domain in a forest.

Q. What is Domain Local Group?

A. Exist on domain controllers and are used to control access to resources located on domain controllers in the local domain (for member servers and workstations, you use local groups on those systems instead). Domain local groups share the following characteristics:

1. Domain local groups can contain users and global groups from any domain in a forest no matter what functional level is enabled.

2. When the domain functional level is set to Windows 2000 native or Windows Server 2003, domain local groups can also contain other domain local groups and universal groups.

Q. What is Universal Group?

A. Are normally used to assign permissions to related resources in multiple domains. Universal groups share the following characteristics:

1. Universal groups are available only when the forest functional level is set to Windows 2000 native or Windows Server 2003.

2. Universal groups exist outside the boundaries of any particular domain and are managed by Global Catalog servers.

3. Universal groups are used to assign permissions to related resources in multiple domains.

4. Universal groups can contain users, global groups, and other universal groups from any domain in a forest.

5. You can grant permissions for a universal group to any resource in any domain.

Q. What is GROUP Policy?

A. Group Policies are configuration settings applied to computers or users as they are initialized. All Group Policy settings are contained in Group Policy Objects (GPO’s) applied to Active Directory sites, domains, or organizational units.

A. Group policy is part of Microsoft's IntelliMirror technology which aims to reduce the overall cost of supporting users of Windows. Group policy provides centralized management of computers and users in an Active Directory environment.

Q. What is Group Policy Object?

A. Group Policy Object (GPO) is a collection of settings that define what a system will look like and how it will behave for a defined group of users.

Q. What is LSDO?

A. LSDO - Local policies first, then Site based policies, then Domain level policies, then OU polices, then nested OU polices (OUs within OUs). Group polices cannot be linked to a specific user or group, only container objects.
 

Q. What is the difference between FAT, FAT32 & NTFS & what is it?

A.  Following are Microsoft's Windows Glossary definitions for each of the 3 file systems:

• File Allocation Table (FAT): A file system used by MS-DOS and other Windows-based operating systems to organize and manage files. The file allocation table (FAT) is a data structure that Windows creates when you format a volume by using the FAT or FAT32 file systems. Windows stores information about each file in the FAT so that it can retrieve the file later.
• FAT32: A derivative of the File Allocation Table (FAT) files system. FAT32 supports smaller cluster sizes and larger volumes than FAT, which results in more efficient space allocation on FAT32 volumes.
• NTFS: An advanced file system that provides performance, security, reliability, and advanced features that are not found in any version of FAT. For example, NTFS guarantees volume consistency by using standard transaction logging and recovery techniques. If a system fails, NTFS uses its log file and checkpoint information to restore the consistency of the file system. In Windows 2000 and Windows XP, NTFS also provides advanced features such as file and folder permissions, encryption, disk quotas, and compression.

NTFS File System:

• NTFS is the best file system for large drives. Unlike FAT and FAT32, performance with NTFS isn't corrupted as drive size increases.
• One of the major security features in NTFS is encryption or, in other words, the process of disguising a message or data in such a way as to hide its substance.
• Another feature in NTFS is disk quotas. It gives you the ability to monitor and control the amount of disk space used by each user.
• Using NTFS, you can keep access control on files and folders and support limited accounts. In FAT and FAT32, all files and folders are accessible by all users no matter what their account type is.
• Domains can be used to tweak security options while keeping administration simple.
• Compression available in NTFS enables you to compress files, folders, or whole drives when you're running out of disk space.
• Removable media (such as tapes) are made more accessible through the Remote Storage feature.
• Recovery logging helps you restore information quickly if power failures or other system problems occur.
• In NTFS we can convert the file system through:

1.  Back up all your data before formatting:

So you want to start with a 'clean' drive but can't afford losing your precious files? Very simple. All you need to do is back up your files to an external hard-drive or a partition other than the one you want to convert, or burn the data onto CDs. After you're done you can format a drive with NTFS.

2. Use the convert command from command prompt:

This way, you don't need to back up. All files are preserved as they are. However, I recommend a backup. You don't know what might go wrong and besides what would you lose if you do back-up? When I converted to NTFS using convert.exe, everything went smooth. Chances are your conversion will be equally smooth.

IMPORTANT NOTE: This is a one-way conversion. Once you've converted to NTFS, you can't go back to FAT or FAT32 unless you format the drive.

1.      Open Command Prompt
Start | All Programs | Accessories | Command Prompt
OR
Start | Run | type "cmd" without quotes | OK

2.      Type "convert drive letter: /fs:ntfs" and press Enter. For example, type "convert C: /fs:ntfs" (without quotes) if you want to convert drive C.

3.      If you're asked whether you want to dismount the drive, agree.

Q. What are Permissions?

A. Permissions are a key component of the Windows Server 2003 security architecture that you can use to manage the process of authorizing users, groups, and computers to access objects on a network.

Q. What is Backup?

A.  To copy files to a second medium (a disk or tape) as a precaution in case the first medium fails.

Q. What are the types of Backup?

A.  There are 5 types of backup in windows 2003 and are as follows: Copy, Normal, Incremental, Daily and Differential.

Q. Difference between Incremental & Differential Backup?

A. Differential backup backs up only the files that changed since the last full back. For example, suppose you do a full backup on Sunday. On Monday you back up only the files that changed since Sunday, on Tuesday you back up only the files that changed since Sunday, and so on until the next full backup. Differential backups are quicker than full backups because so much less data is being backed up. But the amount of data being backed up grows with each differential backup until the next full back up. Differential backups are more flexible than full backups, but still unwieldy to do more than about once a day, especially as the next full backup approaches.

    Incremental backups also back up only the changed data, but they only back up the data that has changed since the last backup — be it a full or incremental backup. They are sometimes called "differential incremental backups," while differential backups are sometimes called "cumulative incremental backups." Confused yet? Don't be.

Q. How can we take the backup for ADS?

A  We can take the ADS backup through ntbackup and select the system state backup.

Q. How to restore an ADS Backup?
A. Restoring Windows Server 2003 system state and system services

Tivoli Storage Manager supports the Microsoft Volume Shadow copy Service (VSS) on Windows Server 2003. Tivoli Storage Manager uses VSS to restore all system state components as a single object, to provide a consistent point-in-time snapshot of the system state. You can restore all system service components (the default) or individual components.

System state components include the following:

• Active Directory (domain controller only)
• Windows Server 2003 system volume
• Certificate Server Database
• COM+ database
• Windows Registry
• System and boot files

Attention: Restoring system state in a situation other than system recovery is not recommended.

You must have administrative authority to restore System State information. To restore the Windows Server 2003 system state using the GUI:

• Click Restore from the GUI main window. The Restore window appears.
• Expand the directory tree by clicking the plus sign +. To display files in a folder, click the folder icon.
• Locate the System State node in the directory tree. You can expand the System State node to display the components.
• Click the selection box next to the System State node to restore the entire system state. You can restore the System State node only as a single entity because of dependencies among the system state components. By default, all components are selected; you cannot back up individual system state components.
• Click Restore. The Task List window displays the restore processing status.

On the command line, use the restore system state command to restore a backup of a system state. See Restore System state for more information.

Considerations:

• You can restore System State data to an alternate machine.
• If you are upgrading from a Windows 2000 machine to a Windows Server 2003 machine, you cannot restore the Windows 2000 system objects that were backed up to the server.
• Your Windows Server 2003 client must be connected to a Tivoli Storage Manager Version 5.2.0 or higher server.
• If Active Directory is installed, you must be in Active Directory restore mode.
• See Performing a Windows XP or Windows Server 2003 system recovery for procedures on how to perform the following tasks:
• Your operating system is still functioning, but a complete system restore is required.
• A complete recovery is required, including an operating system re-installation.

System services components include the following:

• Background Intelligent Transfer Service (BITS)
• Event logs
• Removable Storage Management Database (RSM)
• Cluster Database (cluster node only)
• Remote Storage Service
• Terminal Server Licensing
• Windows Management Instrumentation (WMI)
• Internet Information Services (IIS) metabase
• DHCP database
• Wins database

To restore the system services using the GUI:

• Click Restore from the GUI main window. The Restore window appears.
• Expand the directory tree by clicking the plus sign +. To display files in a folder, click the folder icon.
• Locate the System Services node in the directory tree. You can expand the System Services node to display the components.
• Click the selection box next to the system services component(s) that you want to restore.
• Click Restore. The Task List window displays the backup processing status.

On the command line, use the restore system services command to restore a backup of the system services. See Restore System services for more information.

Q. What is a Cluster?

A. A cluster is a group of independent computers that work together to run a common set of applications and provide the image of a single system to the client and application. The computers are physically connected by cables and programmatically connected by cluster software. These connections allow computers to use problem-solving features such as failover in Server clusters and load balancing in Network Load Balancing (NLB) clusters.

Q. What is the definition for Additional Domain Controller?

A  As name suggest its additional domain controller ...can play any of the FSMO roles at any given instance and provide SRV services to clients

Q. What is Domain Controller?

A. A domain controller is a server in which Active Directory Service is installed. Domain controllers are used to administer domain objects, such as user accounts and groups.

Q. What is Proxy Server?

A. In an enterprise that uses the Internet, a proxy server is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service. A proxy server is associated with or part of a gateway server that separates the enterprise network from the outside network and a firewall server that protects the enterprise network from outside intrusion.

DNS & WINS

DNS

Q. What is DNS?

A. DNS provides name registration and name to IP Address resolution capabilities. And DNS drastically lowers the need to remember numeric IP addresses when accessing hosts on the Internet or any other TCP/IP-based network.

Before DNS, the practice of mapping friendly host or computer names to IP addresses was handled via host files. Host files are easy to understand. These are static ASCII text files that simply map a host name to an IP address in a table-like format. Windows ships with a HOSTS file in the \winnt\system32\drivers\etc subdirectory

The fundamental problem with the host files was that these files were labor intensive. A host file is manually modified, and it is typically centrally administrated.

The DNS system consists of three components: DNS data (called resource records), servers (called name servers), and Internet protocols for fetching data from the servers.

A. DNS is the name resolution system of the Internet. Using DNS allows clients to resolve names of hosts to IP addresses so that communication can take place. DNS is the foundation upon which Active Directory is built.

Q. How DNS Works?

A. DNS uses a client/server model in which the DNS server maintains a static database of domain names mapped to IP addresses. The DNS client, known as the resolver, performs queries against the DNS servers. The bottom line? DNS resolves domain names to IP address using these steps

Step 1: A client (or “resolver”) passes its request to its local name server. For example, the URL term www.idgbooks.com typed into Internet Explorer is passed to the DNS server identified in the client TCP/IP configuration. This DNS server is known as the local name server.

Step 2: If, as often happens, the local name server is unable to resolve the request, other name servers are queried so that the resolver may be satisfied.

Step 3: If all else fails, the request is passed to more and more, higher-level name servers until the query resolution process starts with far-right term (for instance, com) or at the top of the DNS tree with root name servers

Below is the Steps explained with the help of a chart.

Figure 8-5: How DNS works

Q. What is the TCP/IP port no. used for DNS services?

A. 53/TCP, UDP is used for DNS services.

Q. What are the basic requirements (Hardware/Software) to implement the Windows DNS server?

A. Server Hardware Requirements:

Microsoft's suggested minimum hardware requirements (and some Microsoft recommendations) for Windows Server 2003 (Standard) is listed here:

·         CPU speed: 133MHz (550MHz recommended)

·         RAM: 128MB (256MB recommended; 4GB maximum on Standard Server)

·         Disk space for setup: 1.5GB

·         CD-ROM drive: 12X

·         Monitor: Super VGA capable of providing 800 x 600 resolution

Q. Explain DNS Zones?

A. A zone is simply a contiguous section of the DNS namespace.  Records for a zone are stored and managed together.  Often, sub-domains are split into several zones to make manageability easier.  For example, support.microsoft.com and msdn.microsoft.com are separate zones, where support and msdn are sub-domains within the Microsoft.com domain.

Q. Explain zone file?

A. The database in a DNS server that contains the translations (mappings) between domain names and IP addresses. A zone file is made up of "resource records," which are lines of text that define the forward lookup of domains to IP, the reverse lookup of IP to domains as well as the names of DNS and mail servers. Records for aliases and other related information.

Q. What is Primary DNS Zone?

A. A primary DNS server holds the "master copy" of the data for a zone, and secondary servers have copies of this data which they synchronize with the primary through zone transfers at intervals or when prompted by the primary.

Q. What is Standard Primary DNS Server?

A. Standard primary zone holds a master copy of a zone and can replicate it to all configured secondary zones in standard text format. Any changes that must be made to the zone are made on the copy stored on the primary.

Q. What is Active Directory Integrated DNS server?

A. Active Directory–integrated zones are available only on Windows 2000 and 2003 DNS servers in an Active Directory domain. The zone information is contained within the Active Directory database and is replicated using Active Directory replication. Active Directory–integrated zones provide an increased level of replication flexibility as well as security. Active Directory–integrated zones also operate in a multi-master arrangement because they are hosted within Active Directory itself; this way, any DNS server (domain controller) hosting the Active Directory–integrated zone can update the zone data.

Q. What is Secondary DNS Zone?

A. A standard secondary zone holds a read-only copy of the zone information in standard text format. Secondary zones are created to increase performance and resilience of the DNS configuration. Information is transferred from the primary zone to the secondary zones.

Q. What is STUB Zone?

A. Microsoft has introduced support for stub zones for the first time in Windows Server 2003. A stub zone contains only those resource records that are necessary to identify the authoritative DNS servers for that zone. Those resource records include Name Server (NS), Start of Authority (SOA), and possibly glue host (A) records. (Glue host records provide A record pointers to ensure that the master zone has the correct name server information for the stub zone.)

Q. What is Forward Lookup?

A. Forward Lookup – resolves hostname to IP address.  Forward Lookup zones supply the main DNS mechanism for finding Hosts (A), Name Servers (NS) or Service (_gc).

Q. What is Reverse Lookup?

A. Reverse Lookup – resolves IP address to hostname.  I think of Reverse Lookup as a hacker’s tool, they can PING a server's IP address and then they use a Reverse Lookup query to discover the hostname.  In truth, Reverse Lookup is required by NSLookup, DNSLint and other utilities.

Q. What's the difference between a zone and a domain?

A. Although the two terms can seem as if they are used interchangeably, there is a difference. A DNS domain is a segment of the DNS namespace. A zone, on the other hand, can contain multiple contiguous domains.

For example, quepublishing.com is a DNS domain. It contains all the information for that specific portion of the DNS namespace. sales.quepublishing.com is another example of a domain, which is contiguous with the quepublishing.com domain; in other words, the two domains "touch." So, if you were to create a DNS forward lookup zone on your DNS server, it could contain records for both domains. Zones allow for the logical grouping and management of domains and resource records on your DNS servers.

WINS

Q. What is WINS?

A.  WINS (Windows Internet Naming Service) resolves’ Windows network computer names (also known as NetBIOS names) to Internet IP addresses, allowing Windows computers on a network to easily find and communicate with each other.

Q. How WINS Works?

A. By default, when a computer running Microsoft® Windows® 2000, Windows XP, or a Windows Server 2003 operating system is configured with WINS server addresses (either manually or through DHCP) for its name resolution, it uses hybrid node (h-node) as its node type for NetBIOS name registration unless another NetBIOS node type is configured. For NetBIOS name query and resolution, it also uses h-node behavior, but with a few differences.

For NetBIOS name resolution, a WINS client typically performs the following general sequence of steps to resolve a name:

1. Client checks to see if the name queried is its local NetBIOS computer name, which it owns.

2. Client checks its local NetBIOS name cache of remote names. Any name resolved for a remote client is placed in this cache where it remains for 10 minutes.

3. Client forwards the NetBIOS query to its configured primary WINS server. If the primary WINS server fails to answer the query--either because it is not available or because it does not have an entry for the name--the client will try to contact other configured WINS servers in the order they are listed and configured for its use.

4. Client broadcasts the NetBIOS query to the local subnet.

5. Client checks the Lmhosts file for a match to the query, if it is configured to use the Lmhosts file.

6. Client tries the Hosts file and then a DNS server, if it is configured for one

Q. What is the TCP/IP port no. used for WINS services?

A. 137

Q. What are the basic requirements (Hardware/Software) to implement the Windows WINS server?

A. Hardware Requirement:

• Pentium 4 - 2.8 GHz with 2 GB RAM
• 80 GB Hard drive/7200RPM
• Recommended hard drive division: 20 GB System Partition and 60 GB Data partition
• 100 Mbps Network adaptor or better
• Screen Resolution: - 1024 X 768 pixels, 256 colours (65,536 colours recommended)

Software Requirement:

•   Windows® Server 2003 Standard Edition SP1 or higher installed.
•    Application Server Role installed:
•    Internet Information Server 6.0
•    ASP.NET

Q. What is Primary & Secondary WINS Server?

A. WINS servers can act as either a primary WINS server or a secondary WINS server to a client. The difference between primary and secondary WINS servers is simply the priority in which clients contact them. A primary WINS server is the first server a client contacts to perform its NetBIOS name service operations. A client contacts a secondary WINS server only when a primary WINS server is unable to fulfill the request, for example if it is unavailable when the client makes the request or unable to resolve a name for the client.

If a primary WINS server fails to fulfill a request, the client makes the same request of its secondary WINS server. If more than two WINS servers are configured for the client, the client tries the additional secondary WINS servers until the list is exhausted or one of the WINS servers successfully responds to the request. After a client uses a secondary WINS server, it periodically tries to switch back to its primary WINS server for future name service requests.

Q.  How does DNS relates with ADS?

A. Active Directory, which is an essential component of the Windows 2003 architecture, presents organizations with a directory service designed for distributed computing environments. Active Directory allows organizations to centrally manage and share information on network resources and users while acting as the central authority for network security. In addition to providing comprehensive directory services to a Windows environment, Active Directory is designed to be a consolidation point for isolating, migrating, centrally managing, and reducing the number of directories that companies require.

You must have DNS to run Active Directory but don't need Active Directory to run DNS in a Windows 2000/20003 environment. AD relies heavily on DNS.

Q. What is Host File?

A. The "Hosts" file in Windows and other operating systems is used to associate host names with IP addresses. Host names are the www.yahoo.com addresses that you see every day. IP addresses are numbers that mean the same thing as the www words - the computers use the numbers to actually find the sites, but we have words like www.yahoo.com so humans do not need to remember the long strings of numbers when they want to visit a site.

    We can put names and addresses into the Hosts file so your computer does not have to ask a DNS server to translate the domain name into an IP number. This speeds up access to the host site you want to see because your computer no longer has to query other systems on the Internet for the address translation

Q. What is LM Host File?

A. A text file in a windows network that provides name resolution of NetBIOS host names to IP addresses. The LMHOSTS files were the Windows counterpart to the HOSTS files in UNIX, but have long since given way to the WINS naming system. LM stands for "LAN Manager," the name of Microsoft's earlier network operating system (NOS).

Q. What is Firewall? What are the essential settings are used in Firewall?

A. A system designed to prevent unauthorized access to or from a private network. Firewalls can be implemented in both hardware and software, or a combination of both. Firewalls are frequently used to prevent unauthorized internet users from accessing private networks connected to the internet, especially intranets. All messages entering or leaving the intranet pass through the firewall, which examines each message and blocks those that do not meet the specified security criteria.

    There are several types of firewall techniques; the 3 basic are as given below:

• Packets filter: Looks at each packet entering or leaving the network and accepts or rejects it based on user-defined rules. Packet filtering is fairly effective and transparent to users, but it is difficult to configure. In addition, it is susceptible to IP spoofing.
• Application gateway: Applies security mechanisms to specific applications, such as FTP and Telnet servers. This is very effective, but can impose performance degradation.
• Circuit-level gateway: Applies security mechanisms when a TCP or UDP connection is established. Once the connection has been made, packets can flow between the hosts without further checking.
• Proxy server: Intercepts all messages entering and leaving the network. The proxy server effectively hides the true network addresses.

Q. What is Proxy server?

A. In an enterprise that uses the Internet, a proxy server is a server that acts as an intermediary between a workstation user and the Internet so that the enterprise can ensure security, administrative control, and caching service. A proxy server is associated with or part of a gateway server that separates the enterprise network from the outside network and a firewall server that protects the enterprise network from outside intrusion.

Q. What is VPN?

A.  VPN gives extremely secure connections between private networks linked through the Internet. It allows remote computers to act as though they were on the same secure, local network.

Q. What are the types of protocols used in VPN?
A.  There are two types of protocols used in VPN those are PPTP & L2TP.

PPTP: Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables the secure transfer of data from a remote client to a private enterprise server by creating a virtual private network (VPN) across TCP/IP-based data networks. PPTP supports on-demand, multi-protocol, virtual private networking over public networks, such as the Internet.

L2TP: Layer 2 Tunneling Protocol is an emerging Internet Engineering Task Force (IETF) standard that combines the features of two existing tunneling protocols: Cisco's Layer 2 Forwarding and Microsoft's Point-to-Point Tunneling Protocol. L2TP is an extension to the Point-to-Point Protocol (PPP).

Q. What is Terminal Services?

A. Terminal Services is a component of Microsoft Windows operating systems (both client and server versions) that allows a user to access applications or data stored on a remote computer over a network connection. Terminal Services is Microsoft's take on server centric computing, which allows individual users to access network resources easily.